commit 7d0a66e4bb9081d75c82ec4957c50034cb0ea449 Author: Linus Torvalds Date: Sun Nov 30 14:42:10 2025 -0800 Linux 6.18 commit e69c7c175115c51c7f95394fc55425a395b3af59 Merge: 6bda50f4333fa6 c7418164b46305 Author: Linus Torvalds Date: Sun Nov 30 08:47:10 2025 -0800 Merge tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Have timekeeping aux clocks sysfs interface setup function return an error code on failure instead of success * tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix error code in tk_aux_sysfs_init() commit 6bda50f4333fa61c07f04f790fdd4e2c9f4ca610 Merge: 19eef1d98eeda3 841ecc979b18d3 Author: Linus Torvalds Date: Sat Nov 29 15:15:14 2025 -0800 Merge tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Fix TLB unification for cores with more than 64 TLB entries" * tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 Author: Thomas Bogendoerfer Date: Fri Nov 28 16:53:46 2025 +0000 MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+ cores can have more than 64 TLB entries. Therefore allocate an array for uniquification instead of placing too an small array on the stack. Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") Co-developed-by: Maciej W. Rozycki Signed-off-by: Maciej W. Rozycki Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification Cc: stable@vger.kernel.org # v6.17+ Tested-by: Gregory CLEMENT Tested-by: Klara Modin Signed-off-by: Thomas Bogendoerfer commit 19eef1d98eeda3745df35839190b7d4a4adea656 Author: David Howells Date: Sat Nov 29 00:40:11 2025 +0000 afs: Fix uninit var in afs_alloc_anon_key() Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it to cell->anonymous_key. Without this change, the error check may return a false failure with a bad error number. Most of the time this is unlikely to happen because the first encounter with afs_alloc_anon_key() will usually be from (auto)mount, for which all subsequent operations must wait - apart from other (auto)mounts. Once the call->anonymous_key is allocated, all further calls to afs_request_key() will skip the call to afs_alloc_anon_key() for that cell. Fixes: d27c71257825 ("afs: Fix delayed allocation of a cell's anonymous key") Reported-by: Paulo Alcantra Signed-off-by: David Howells Reviewed-by: Paulo Alcantara cc: Marc Dionne cc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Linus Torvalds commit e6640487845061255af9614ec0a192e4fafa486e Merge: 82ebd4e32029f2 40ad64ac25bb73 Author: Linus Torvalds Date: Fri Nov 28 14:08:09 2025 -0800 Merge tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A disappointingly large set of device specific fixes that have built up since I've been a bit tardy with sending a pull requests as people kept sending me new new fixes. The bcm63xx and lpspi issues could lead to corruption so the fixes are fairly important for the affected parts, the other issues should all be relatively minor" * tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: nxp-fspi: Propagate fwnode in ACPI case as well spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors spi: spi-fsl-lpspi: fix watermark truncation caused by type cast spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm spi: bcm63xx: fix premature CS deassertion on RX-only transactions spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance commit 82ebd4e32029f299011a6ef68d96f5ddcea0723a Merge: 9917bf8e7f5a9e 8684229e19c418 Author: Linus Torvalds Date: Fri Nov 28 14:06:05 2025 -0800 Merge tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes for incorrect device descriptions in the rtq2208 driver" * tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: rtq2208: Correct LDO2 logic judgment bits regulator: rtq2208: Correct buck group2 phase mapping logic commit 9917bf8e7f5a9efbab844cf06cfd8da8eb7e13b6 Merge: f3b17337b94394 f6dc5a36195d3f Author: Linus Torvalds Date: Fri Nov 28 12:42:11 2025 -0800 Merge tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Ensure that vectored registered buffer imports ties the lifetime of those to the zero-copy send notification, not the parent request - Fix a bug introduced in this merge window, with the introduction of mixed sized CQE support * tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix mixed cqe overflow handling io_uring/net: ensure vectored buffer node import is tied to notification commit f3b17337b943949d0f3d12835d10d866210aeee8 Merge: 7fa0d7744c2826 d27c71257825dc Author: Linus Torvalds Date: Fri Nov 28 10:01:24 2025 -0800 Merge tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. The normal key lookup tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set, causing an oops - ovl: fail ovl_lock_rename_workdir() if either target is unhashed As well as checking that the parent hasn't changed after getting the lock, the code needs to check that the dentry hasn't been unhashed. Otherwise overlayfs might try to rename something that has been removed - namespace: fix a reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns, and so grab_requested_mnt_ns() doesn't need to take an extra reference * tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: afs: Fix delayed allocation of a cell's anonymous key ovl: fail ovl_lock_rename_workdir() if either target is unhashed fs/namespace: fix reference leak in grab_requested_mnt_ns commit 7fa0d7744c28267142287a75134de58790999e72 Merge: 6cf62f0174de64 3ecfcf34f0992d Author: Linus Torvalds Date: Fri Nov 28 09:57:31 2025 -0800 Merge tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "A few last minute fixes came in this week: - interrupt and gpio numbers in foud separate i.MX8 specific devicetree files were wrong - The vector length property in the C906 CPU description used the wrong unit - Two bugs with uninitialized stack variables in the tee subsystem - Alexander Stein now maintains additional devicetree files" * tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: dts: allwinner: d1: fix vlenb property MAINTAINERS: Add entry for TQ-Systems AM335 device trees tee: qcomtee: initialize result before use in release worker arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity tee: qcomtee: fix uninitialized pointers with free attribute ARM: dts: nxp: imx6ul: correct SAI3 interrupt line arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos arm64: dts: imx8dxl: Correct pcie-ep interrupt number commit 6cf62f0174de64e4161e301bb0ed52e198ce25dc Merge: dabf127d641e43 03bc4831ef064e Author: Linus Torvalds Date: Fri Nov 28 09:44:48 2025 -0800 Merge tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO fixes from Greg KH: "Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8. Fixes in here include: - lots of iio driver bugfixes for reported issues. - counter driver bugfix - slimbus driver bugfix - mei tiny bugfix - nvmem layout uevent bugfix All of these have been in linux-next for a while, but due to travel on my side, I haven't had a chance to get them to you" * tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits) nvmem: layouts: fix nvmem_layout_bus_uevent iio: accel: bmc150: Fix irq assumption regression most: usb: fix double free on late probe failure slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves firmware: stratix10-svc: fix bug in saving controller data mei: fix error flow in probe iio: st_lsm6dsx: Fixed calibrated timestamp calculation iio: humditiy: hdc3020: fix units for thresholds and hysteresis iio: humditiy: hdc3020: fix units for temperature and humidity measurement iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields iio: accel: fix ADXL355 startup race condition iio: adc: ad7124: fix temperature channel iio:common:ssp_sensors: Fix an error handling path ssp_probe() iio: adc: ad7280a: fix ad7280_store_balance_timer() iio: buffer-dmaengine: enable .get_dma_dev() iio: buffer-dma: support getting the DMA channel iio: buffer: support getting dma channel from the buffer iio: pressure: bmp280: correct meas_time_us calculation iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling iio: adc: ad7380: fix SPI offload trigger rate ... commit dabf127d641e43d5fbb72a1f48209818349db7ef Merge: 5d324e5159d9e6 2bf95a9bcb5000 Author: Linus Torvalds Date: Fri Nov 28 09:16:20 2025 -0800 Merge tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are two serial driver fixes for reported issues for 6.18-rc8. These are: - fix for a much reported symbol build loop that broke the build for some kernel configurations - amba-pl011 driver bugfix for a reported issue Both have been in linux next (the last for weeks, the first for a shorter amount of time), with no reported issues" * tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250: Fix 8250_rsa symbol loop serial: amba-pl011: prefer dma_mapping_error() over explicit address checking commit 5d324e5159d9e6a1e6678007ce3f24e569650db6 Merge: 24a84ea4eef6ec 74851fbb6d6473 Author: Linus Torvalds Date: Fri Nov 28 09:12:40 2025 -0800 Merge tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here are some last-minutes USB and Thunderbolt driver fixes and new device ids for 6.18-rc8. Included in here are: - usb storage quirk fixup - xhci driver fixes for reported issues - usb gadget driver fixes - dwc3 driver fixes - UAS driver fixup - thunderbolt new device ids - usb-serial driver new ids All of these have been in linux-next with no reported issues, many for many weeks" * tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits) usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors USB: storage: Remove subclass and protocol overrides from Novatek quirk usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths xhci: dbgtty: fix device unregister usb: storage: sddr55: Reject out-of-bound new_pba USB: serial: option: add support for Rolling RW101R-GL usb: typec: ucsi: psy: Set max current to zero when disconnected usb: gadget: f_eem: Fix memory leak in eem_unwrap usb: dwc3: pci: Sort out the Intel device IDs usb: dwc3: pci: add support for the Intel Nova Lake -S drivers/usb/dwc3: fix PCI parent check usb: storage: Fix memory leak in USB bulk transport xhci: sideband: Fix race condition in sideband unregister xhci: dbgtty: Fix data corruption when transmitting data form DbC to host xhci: fix stale flag preventig URBs after link state error is cleared USB: serial: ftdi_sio: add support for u-blox EVK-M101 usb: cdns3: Fix double resource release in cdns3_pci_probe usb: gadget: udc: fix use-after-free in usb_gadget_state_work usb: renesas_usbhs: Fix synchronous external abort on unbind ... commit 24a84ea4eef6ec6245e1efdc64764d60d17321bb Merge: 4331989728da4e e3cee98f2fcc22 Author: Linus Torvalds Date: Fri Nov 28 09:09:33 2025 -0800 Merge tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox fixes from Jassi Brar: - omap: check for pending msgs only when mbox is exclusive - mailbox-test: debugfs_create_dir error checking - mtk: - cmdq: fix DMA address handling - gpueb: Add missing 'static' to mailbox ops struct - pcc: don't zero error register - th1520: fix clock imbalance on probe failure * tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: th1520: fix clock imbalance on probe failure mailbox: pcc: don't zero error register mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct mailbox: mtk-cmdq: Refine DMA address handling for the command buffer mailbox: mailbox-test: Fix debugfs_create_dir error checking mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive commit 3ecfcf34f0992d11e5eb2458a2108b3320c61ba4 Merge: a6737fe620315d 9f393d8e757f79 Author: Arnd Bergmann Date: Fri Nov 28 17:37:13 2025 +0100 Merge tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner fixes for 6.18 Just one fix to correct the "thead,vlenb" property for the RISC-V based D1 SoC family. * tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: riscv: dts: allwinner: d1: fix vlenb property commit a6737fe620315db4a47d577703d516cdea960991 Merge: fe7cdcd1bacec3 517d066dc080fc Author: Arnd Bergmann Date: Fri Nov 21 22:14:04 2025 +0100 Merge tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes MAINTAINERS: Add entry for TQ-Systems AM335 device trees * tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: MAINTAINERS: Add entry for TQ-Systems AM335 device trees commit 4331989728da4e868fcda75bde872d032f5ce6ac Merge: f849f26f77205e 747528729c9b67 Author: Linus Torvalds Date: Fri Nov 28 08:20:14 2025 -0800 Merge tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: - sdhci-of-dwcmshc: Fix reset handling for some variants * tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level commit f849f26f77205e25f6ad0b9011b1b68a560d35ff Merge: e538109ac71d80 c98c99d5dbdf9f Author: Linus Torvalds Date: Fri Nov 28 08:08:02 2025 -0800 Merge tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - mediatek: Fix spinlock recursion in probe - tegra: Use GENPD_FLAG_NO_STAY_ON to restore old behaviour * tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag pmdomains: mtk-pm-domains: Fix spinlock recursion in probe commit e3cee98f2fcc2234be7813c0e55a7f7a5e77aaf2 Author: Johan Hovold Date: Fri Oct 17 07:54:14 2025 +0200 mailbox: th1520: fix clock imbalance on probe failure The purpose of the devm_add_action_or_reset() helper is to call the action function in case adding an action ever fails so drop the clock disable from the error path to avoid disabling the clocks twice. Fixes: 5d4d263e1c6b ("mailbox: Introduce support for T-head TH1520 Mailbox driver") Cc: Michal Wilczynski Signed-off-by: Johan Hovold Reviewed-by: Michal Wilczynski Signed-off-by: Jassi Brar commit ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0 Author: Jamie Iles Date: Wed Nov 5 14:42:29 2025 +0000 mailbox: pcc: don't zero error register The error status mask for a type 3/4 subspace is used for reading the error status, and the bitwise inverse is used for clearing the error with the intent being to preserve any of the non-error bits. However, we were previously applying the mask to extract the status and then applying the inverse to the result which ended up clearing all bits. Instead, store the inverse mask in the preserve mask and then use that on the original value read from the error status so that only the error is cleared. Fixes: c45ded7e1135 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)") Signed-off-by: Jamie Iles Signed-off-by: Punit Agrawal Signed-off-by: Jassi Brar commit 094b53ecaa3ef227f9c800f8de90a9b44f1c1bb4 Author: Nicolas Frattaroli Date: Mon Oct 13 10:09:01 2025 +0200 mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct mtk_gpueb_mbox_ops should be declared static. However, due to its const nature, this specifier was missed, as it compiled fine without it and with no warning by the compiler. arc-linux-gcc (GCC) 12.5.0 doesn't seem to like it however, so add the static to fix that. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510100629.3nGvrhEU-lkp@intel.com/ Fixes: dbca0eabb821 ("mailbox: add MediaTek GPUEB IPI mailbox") Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit a195c7ccfb7a21b8118139835e25936ec8722596 Author: Jason-JH Lin Date: Thu Oct 23 01:16:30 2025 +0800 mailbox: mtk-cmdq: Refine DMA address handling for the command buffer GCE can only fetch the command buffer address from a 32-bit register. Some SoCs support a 35-bit command buffer address for GCE, which requires a right shift of 3 bits before setting the address into the 32-bit register. A comment has been added to the header of cmdq_get_shift_pa() to explain this requirement. To prevent the GCE command buffer address from being DMA mapped beyond its supported bit range, the DMA bit mask for the device is set during initialization. Additionally, to ensure the correct shift is applied when setting or reading the register that stores the GCE command buffer address, new APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have been introduced for consistent operations on this register. The variable type for the command buffer address has been standardized to dma_addr_t to prevent handling issues caused by type mismatches. Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform") Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jassi Brar commit 3acf1028f5003731977f750a7070f3321a9cb740 Author: Haotian Zhang Date: Thu Nov 20 10:40:39 2025 +0800 mailbox: mailbox-test: Fix debugfs_create_dir error checking The debugfs_create_dir() function returns ERR_PTR() on error, not NULL. The current null-check fails to catch errors. Use IS_ERR() to correctly check for errors. Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers") Signed-off-by: Haotian Zhang Signed-off-by: Jassi Brar commit 060e4e835f9394816584942511f22d771f05100c Author: Beleswar Padhi Date: Tue Nov 4 01:41:11 2025 +0530 mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive On TI K3 devices, the mailbox resides in the Always-On power domain (LPSC_main_alwayson) and is shared among multiple processors. The mailbox is not solely exclusive to Linux. Currently, the suspend path checks all FIFO queues for pending messages and blocks suspend if any are present. This behavior is unnecessary for K3 devices, since some of the FIFOs are used for RTOS<->RTOS communication and are independent of Linux. For FIFOs used in Linux<->RTOS communication, any pending message would trigger an interrupt, which naturally prevents suspend from completing. Hence, there is no need for the mailbox driver to explicitly check for pending messages on K3 platforms. Introduce a device match flag to indicate whether the mailbox instance is exclusive to Linux, and skip the pending message check for non-exclusive instances (such as in K3). Fixes: a49f991e740f ("arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware") Closes: https://lore.kernel.org/all/sid7gtg5vay5qgicsl6smnzwg5mnneoa35cempt5ddwjvedaio@hzsgcx6oo74l/ Signed-off-by: Beleswar Padhi Tested-by: Hiago De Franco Reviewed-by: Andrew Davis Signed-off-by: Jassi Brar commit d27c71257825dced46104eefe42e4d9964bd032e Author: David Howells Date: Fri Nov 28 10:19:05 2025 +0000 afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with "afs@" as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead. Fixes: 330e2c514823 ("afs: Fix dynamic lookup to fail on cell lookup failure") Reported-by: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com Signed-off-by: David Howells Link: https://patch.msgid.link/800328.1764325145@warthog.procyon.org.uk cc: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit e9c70084a64e51b65bb68f810692a03dc8bedffa Author: NeilBrown Date: Fri Nov 28 12:22:35 2025 +1100 ovl: fail ovl_lock_rename_workdir() if either target is unhashed As well as checking that the parent hasn't changed after getting the lock we need to check that the dentry hasn't been unhashed. Otherwise we might try to rename something that has been removed. Reported-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.") Signed-off-by: NeilBrown Link: https://patch.msgid.link/176429295510.634289.1552337113663461690@noble.neil.brown.name Tested-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit e538109ac71d801d26776af5f3c54f548296c29c Merge: aa7243aaf1947a 6dbcb801e1eb1b Author: Linus Torvalds Date: Thu Nov 27 21:06:27 2025 -0800 Merge tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Last one for this round hopefully, mostly the usual suspects, xe/amdgpu, with some single fixes otherwise. There is one amdgpu HDMI blackscreen bug that came in late in the cycle, but it was bisected and the revert is in here. i915: - Reject async flips when PSR's selective fetch is enabled xe: - Fix resource leak in xe_guc_ct_init_noalloc()'s error path - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT - Fix overflow in conversion from clock tics to msec amdgpu: - Unified MES fix - HDMI fix - Cursor fix - Bightness fix - EDID reading improvement - UserQ fix - Cyan Skillfish IP discovery fix bridge: - sil902x: Fix HDMI detection imagination: - Update documentation sti: - Fix leaks in probe vga_switcheroo: - Avoid race condition during fbcon initialization" * tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel: drm/amdgpu: fix cyan_skillfish2 gpu info fw handling drm/amdgpu: attach tlb fence to the PTs update drm/amd/display: Increase EDID read retries drm/amd/display: Don't change brightness for disabled connectors drm/amd/display: Check NULL before accessing Revert "drm/amd/display: Move setup_stream_attribute" drm/xe: Fix conversion from clock ticks to milliseconds drm/xe/guc: Fix stack_depot usage drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc() drm/i915/psr: Reject async flips when selective fetch is enabled drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup drm/amd/amdgpu: reserve vm invalidation engine for uni_mes drm: sti: fix device leaks at component probe drm/imagination: Document pvr_device.power member drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR commit 6dbcb801e1eb1b1764fd0012918225b60dd7916c Merge: 26c7a181fdb873 7276878b069c57 Author: Dave Airlie Date: Fri Nov 28 12:10:19 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix resource leak in xe_guc_ct_init_noalloc()'s error path (Shuicheng Lin) - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT (Lucas) - Fix overflow in conversion from clock tics to msec (Harish Chegondi) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/7ejiqjgthpqybg5svmkind2pszk4fqadxuq7rngchaaw76iept@5pn6sngqj6lk commit 26c7a181fdb873297d3424794762e5c4f4ef7227 Merge: 4fc3ad63dd31e9 eb76d0f5553575 Author: Dave Airlie Date: Fri Nov 28 12:00:07 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bridge: - sil902x: Fix HDMI detection imagination: - Update documentation sti: - Fix leaks in probe vga_switcheroo: - Avoid race condition during fbcon initialization Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251127081007.GA13578@2a02-2454-fd5e-fd00-689d-32c0-780c-bb87.dyn6.pyur.net commit 4fc3ad63dd31e9ecd44211a4cd331acebb077551 Merge: b31e2e3bb744c8 7fa666ab07ba9e Author: Dave Airlie Date: Fri Nov 28 11:56:37 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-26: amdgpu: - Unified MES fix - HDMI fix - Cursor fix - Bightness fix - EDID reading improvement - UserQ fix - Cyan Skillfish IP discovery fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251126204925.3316684-1-alexander.deucher@amd.com commit aa7243aaf1947a0cb54c44337795d6759493fe02 Merge: 3fa77874b4a7ae d0d08f4bd7f667 Author: Linus Torvalds Date: Thu Nov 27 17:29:15 2025 -0800 Merge tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two last minute fixes for the recently modified DMA API infrastructure: - proper handling of DMA_ATTR_MMIO in dma_iova_unlink() function (me) - regression fix for the code refactoring related to P2PDMA (Pranjal Shrivastava)" * tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink() commit 3fa77874b4a7ae96d4ad40623d449cef6265ae4a Merge: e1afacb68573c3 fbf04215d9966d Author: Linus Torvalds Date: Thu Nov 27 17:25:46 2025 -0800 Merge tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "One more urgent ACPI support fix for 6.18 There is one more commit that needs to be reverted after reverting problematic commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration"), so revert it" * tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" commit b31e2e3bb744c8fa852ad2a70712db97147071c9 Merge: ac3fd01e4c1efc 7c373b3bd03c77 Author: Dave Airlie Date: Fri Nov 28 11:08:54 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Reject async flips when PSR's selective fetch is enabled (Ville) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aScgY8QMjmyJRBX2@intel.com commit fbf04215d9966da61feee3f4ec24dbf4544cfd0f Author: Rafael J. Wysocki Date: Thu Nov 27 20:52:55 2025 +0100 Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" Revert commit 8a1b5d412cb4 ("ACPI: processor: Update cpuidle driver check in __acpi_processor_start()") which depends on commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") that got reverted. Signed-off-by: Rafael J. Wysocki commit e1afacb68573c3cd0a3785c6b0508876cd3423bc Merge: 1f5e808aa63af6 7fce830ecd0a02 Author: Linus Torvalds Date: Thu Nov 27 11:11:03 2025 -0800 Merge tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A patch to make sparse read handling work in msgr2 secure mode from Slava and a couple of fixes from Ziming and myself to avoid operating on potentially invalid memory, all marked for stable" * tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd ceph: fix crash in process_v2_sparse_read() for encrypted directories libceph: drop started parameter of __ceph_open_session() libceph: fix potential use-after-free in have_mon_and_osd_map() commit 1f5e808aa63af61ec0d6a14909056d6668813e86 Merge: a76dce0e540915 f07f4ea53e2242 Author: Linus Torvalds Date: Thu Nov 27 09:18:40 2025 -0800 Merge tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth and CAN. No known outstanding regressions. Current release - regressions: - mptcp: initialize rcv_mss before calling tcp_send_active_reset() - eth: mlx5e: fix validation logic in rate limiting Previous releases - regressions: - xsk: avoid data corruption on cq descriptor number - bluetooth: - prevent race in socket write iter and sock bind - fix not generating mackey and ltk when repairing - can: - kvaser_usb: fix potential infinite loop in command parsers - rcar_canfd: fix CAN-FD mode as default - eth: - veth: reduce XDP no_direct return section to fix race - virtio-net: avoid unnecessary checksum calculation on guest RX Previous releases - always broken: - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - bluetooth: mediatek: fix kernel crash when releasing iso interface - vhost: rewind next_avail_head while discarding descriptors - eth: - r8169: fix RTL8127 hang on suspend/shutdown - aquantia: add missing descriptor cache invalidation on ATL2 - dsa: microchip: fix resource releases in error path" * tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). net: fec: do not register PPS event for PEROUT net: fec: do not allow enabling PPS and PEROUT simultaneously net: fec: do not update PEROUT if it is enabled net: fec: cancel perout_timer when PEROUT is disabled net: mctp: unconditionally set skb->dev on dst output net: atlantic: fix fragment overflow handling in RX path MAINTAINERS: separate VIRTIO NET DRIVER and add netdev virtio-net: avoid unnecessary checksum calculation on guest RX eth: fbnic: Fix counter roll-over issue mptcp: clear scheduled subflows on retransmit net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic s390/net: list Aswin Karuvally as maintainer net: wwan: mhi: Keep modem name match with Foxconn T99W640 vhost: rewind next_avail_head while discarding descriptors net/sched: em_canid: fix uninit-value in em_canid_match can: rcar_canfd: Fix CAN-FD mode as default xsk: avoid data corruption on cq descriptor number r8169: fix RTL8127 hang on suspend/shutdown net: sxgbe: fix potential NULL dereference in sxgbe_rx() ... commit a76dce0e54091556c0981375859d6cb60d2f7bfa Merge: 765e56e41a5af2 9b9c0adbc3f8a5 Author: Linus Torvalds Date: Thu Nov 27 08:51:36 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull platform driver fixes from Ilpo Järvinen: - arm64/thinkpad-t14s-ec: - Fix IRQ race condition - Sleep after EC access - intel/punit_ipc: Fix memory corruption * tag 'platform-drivers-x86-v6.18-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: intel: punit_ipc: fix memory corruption platform: arm64: thinkpad-t14s-ec: sleep after EC access platform: arm64: thinkpad-t14s-ec: fix IRQ race condition commit f07f4ea53e22429c84b20832fa098b5ecc0d4e35 Author: Kuniyuki Iwashima Date: Tue Nov 25 19:53:29 2025 +0000 mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 Fixes: ae155060247b ("mptcp: fix duplicate reset on fastclose") Reported-by: syzbot+3a92d359bc2ec6255a33@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69260882.a70a0220.d98e3.00b4.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Matthieu Baerts (NGI0) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251125195331.309558-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit 40ad64ac25bb736740f895d99a4aebbda9b80991 Author: Andy Shevchenko Date: Wed Nov 26 21:25:01 2025 +0100 spi: nxp-fspi: Propagate fwnode in ACPI case as well Propagate fwnode of the ACPI device to the SPI controller Linux device. Currently only OF case propagates fwnode to the controller. While at it, replace several calls to dev_fwnode() with a single one cached in a local variable, and unify checks for fwnode type by using is_*_node() APIs. Fixes: 55ab8487e01d ("spi: spi-nxp-fspi: Add ACPI support") Signed-off-by: Andy Shevchenko Reviewed-by: Haibo Chen Link: https://patch.msgid.link/20251126202501.2319679-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 8684229e19c4185d53d6fb7004d733907c865a91 Author: ChiYuan Huang Date: Thu Nov 27 10:25:51 2025 +0800 regulator: rtq2208: Correct LDO2 logic judgment bits The LDO2 judgement bit position should be 7, not 6. Cc: stable@vger.kernel.org Reported-by: Yoon Dong Min Fixes: b65439d90150 ("regulator: rtq2208: Fix the LDO DVS capability") Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/faadb009f84b88bfcabe39fc5009c7357b00bbe2.1764209258.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 45cc214152bc1f6b1cc135532cd7cdbe08716aaf Author: ChiYuan Huang Date: Thu Nov 27 10:25:50 2025 +0800 regulator: rtq2208: Correct buck group2 phase mapping logic Correct buck group2 H and F mapping logic. Cc: stable@vger.kernel.org Reported-by: Yoon Dong Min Fixes: 1742e7e978ba ("regulator: rtq2208: Fix incorrect buck converter phase mapping") Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/8527ae02a72b754d89b7580a5fe7474d6f80f5c3.1764209258.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 36d747866445a362d486028792e56dbe04fc16fb Merge: b3e528a5811bbc 9a060d0fac9e75 Author: Paolo Abeni Date: Thu Nov 27 11:57:47 2025 +0100 Merge branch 'net-fec-fix-some-ptp-related-issues' Wei Fang says: ==================== net: fec: fix some PTP related issues There are some issues which were introduced by the commit 350749b909bf ("net: fec: Add support for periodic output signal of PPS"). See each patch for more details. ==================== Link: https://patch.msgid.link/20251125085210.1094306-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 9a060d0fac9e75524f72864adec6d8cdb70a5bca Author: Wei Fang Date: Tue Nov 25 16:52:10 2025 +0800 net: fec: do not register PPS event for PEROUT There are currently two situations that can trigger the PTP interrupt, one is the PPS event, the other is the PEROUT event. However, the irq handler fec_pps_interrupt() does not check the irq event type and directly registers a PPS event into the system, but the event may be a PEROUT event. This is incorrect because PEROUT is an output signal, while PPS is the input of the kernel PPS system. Therefore, add a check for the event type, if pps_enable is true, it means that the current event is a PPS event, and then the PPS event is registered. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8 Author: Wei Fang Date: Tue Nov 25 16:52:09 2025 +0800 net: fec: do not allow enabling PPS and PEROUT simultaneously In the current driver, PPS and PEROUT use the same channel to generate the events, so they cannot be enabled at the same time. Otherwise, the later configuration will overwrite the earlier configuration. Therefore, when configuring PPS, the driver will check whether PEROUT is enabled. Similarly, when configuring PEROUT, the driver will check whether PPS is enabled. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit e97faa0c20ea8840f45569ba434e30538fff8fc9 Author: Wei Fang Date: Tue Nov 25 16:52:08 2025 +0800 net: fec: do not update PEROUT if it is enabled If the previously set PEROUT is already active, updating it will cause the new PEROUT to start immediately instead of at the specified time. This is because fep->reload_period is updated whithout check whether the PEROUT is enabled, and the old PEROUT is not disabled. Therefore, the pulse period will be updated immediately in the pulse interrupt handler fec_pps_interrupt(). Currently, the driver does not support directly updating PEROUT and it will make the logic be more complicated. To fix the current issue, add a check before enabling the PEROUT, the driver will return an error if PEROUT is enabled. If users wants to update a new PEROUT, they should disable the old PEROUT first. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 50caa744689e505414673c20359b04aa918439e3 Author: Wei Fang Date: Tue Nov 25 16:52:07 2025 +0800 net: fec: cancel perout_timer when PEROUT is disabled The PEROUT allows the user to set a specified future time to output the periodic signal. If the future time is far from the current time, the FEC driver will use hrtimer to configure PEROUT one second before the future time. However, the hrtimer will not be canceled if the PEROUT is disabled before the hrtimer expires. So the PEROUT will be configured when the hrtimer expires, which is not as expected. Therefore, cancel the hrtimer in fec_ptp_pps_disable() to fix this issue. Fixes: 350749b909bf ("net: fec: Add support for periodic output signal of PPS") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251125085210.1094306-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit b3e528a5811bbc8246dbdb962f0812dc9b721681 Author: Jeremy Kerr Date: Tue Nov 25 14:48:54 2025 +0800 net: mctp: unconditionally set skb->dev on dst output On transmit, we are currently relying on skb->dev being set by mctp_local_output() when we first set up the skb destination fields. However, forwarded skbs do not use the local_output path, so will retain their incoming netdev as their ->dev on tx. This does not work when we're forwarding between interfaces. Set skb->dev unconditionally in the transmit path, to allow for proper forwarding. We keep the skb->dev initialisation in mctp_local_output(), as we use it for fragmentation. Fixes: 269936db5eb3 ("net: mctp: separate routing database from routing operations") Suggested-by: Vince Chang Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20251125-dev-forward-v1-1-54ecffcd0616@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc Author: ziming zhang Date: Fri Nov 14 16:56:10 2025 +0800 libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets. [ idryomov: changelog ] Cc: stable@vger.kernel.org Signed-off-by: ziming zhang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit ec3797f043756a94ea2d0f106022e14ac4946c02 Author: ziming zhang Date: Mon Nov 17 18:07:41 2025 +0800 libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ] Cc: stable@vger.kernel.org Signed-off-by: ziming zhang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 43962db4a6f593903340c85591056a0cef812dfd Author: Viacheslav Dubeyko Date: Thu Nov 13 14:36:24 2025 -0800 ceph: fix crash in process_v2_sparse_read() for encrypted directories The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msgr2 protocol in secure mode. It can be reproduced by the steps: sudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure (1) mkdir /mnt/cephfs/fscrypt-test-3 (2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3 (3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3 (4) fscrypt lock /mnt/cephfs/fscrypt-test-3 (5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3 (6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar (7) Issue has been triggered [ 408.072247] ------------[ cut here ]------------ [ 408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865 ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072267] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+ [ 408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.072310] Workqueue: ceph-msgr ceph_con_workfn [ 408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0 [ 408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8 8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff <0f> 0b e9 06 fe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85 [ 408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246 [ 408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38 [ 408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8 [ 408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8 [ 408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000 [ 408.072329] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.072331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.072336] PKRU: 55555554 [ 408.072337] Call Trace: [ 408.072338] [ 408.072340] ? sched_clock_noinstr+0x9/0x10 [ 408.072344] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.072347] ? _raw_spin_unlock+0xe/0x40 [ 408.072349] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.072353] ? __kasan_check_write+0x14/0x30 [ 408.072357] ? mutex_lock+0x84/0xe0 [ 408.072359] ? __pfx_mutex_lock+0x10/0x10 [ 408.072361] ceph_con_workfn+0x27e/0x10e0 [ 408.072364] ? metric_delayed_work+0x311/0x2c50 [ 408.072367] process_one_work+0x611/0xe20 [ 408.072371] ? __kasan_check_write+0x14/0x30 [ 408.072373] worker_thread+0x7e3/0x1580 [ 408.072375] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.072378] ? __pfx_worker_thread+0x10/0x10 [ 408.072381] kthread+0x381/0x7a0 [ 408.072383] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.072385] ? __pfx_kthread+0x10/0x10 [ 408.072387] ? __kasan_check_write+0x14/0x30 [ 408.072389] ? recalc_sigpending+0x160/0x220 [ 408.072392] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.072394] ? calculate_sigpending+0x78/0xb0 [ 408.072395] ? __pfx_kthread+0x10/0x10 [ 408.072397] ret_from_fork+0x2b6/0x380 [ 408.072400] ? __pfx_kthread+0x10/0x10 [ 408.072402] ret_from_fork_asm+0x1a/0x30 [ 408.072406] [ 408.072407] ---[ end trace 0000000000000000 ]--- [ 408.072418] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 408.072984] KASAN: null-ptr-deref in range [0x0000000000000000- 0x0000000000000007] [ 408.073350] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Tainted: G W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 408.073886] Tainted: [W]=WARN [ 408.074042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 408.074468] Workqueue: ceph-msgr ceph_con_workfn [ 408.074694] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.074976] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.075884] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.076305] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.076909] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.077466] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.078034] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.078575] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.079159] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.079736] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.080039] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.080376] PKRU: 55555554 [ 408.080513] Call Trace: [ 408.080630] [ 408.080729] ceph_con_v2_try_read+0x49b9/0x72f0 [ 408.081115] ? __pfx_ceph_con_v2_try_read+0x10/0x10 [ 408.081348] ? _raw_spin_unlock+0xe/0x40 [ 408.081538] ? finish_task_switch.isra.0+0x15d/0x830 [ 408.081768] ? __kasan_check_write+0x14/0x30 [ 408.081986] ? mutex_lock+0x84/0xe0 [ 408.082160] ? __pfx_mutex_lock+0x10/0x10 [ 408.082343] ceph_con_workfn+0x27e/0x10e0 [ 408.082529] ? metric_delayed_work+0x311/0x2c50 [ 408.082737] process_one_work+0x611/0xe20 [ 408.082948] ? __kasan_check_write+0x14/0x30 [ 408.083156] worker_thread+0x7e3/0x1580 [ 408.083331] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 408.083557] ? __pfx_worker_thread+0x10/0x10 [ 408.083751] kthread+0x381/0x7a0 [ 408.083922] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 408.084139] ? __pfx_kthread+0x10/0x10 [ 408.084310] ? __kasan_check_write+0x14/0x30 [ 408.084510] ? recalc_sigpending+0x160/0x220 [ 408.084708] ? _raw_spin_unlock_irq+0xe/0x50 [ 408.084917] ? calculate_sigpending+0x78/0xb0 [ 408.085138] ? __pfx_kthread+0x10/0x10 [ 408.085335] ret_from_fork+0x2b6/0x380 [ 408.085525] ? __pfx_kthread+0x10/0x10 [ 408.085720] ret_from_fork_asm+0x1a/0x30 [ 408.085922] [ 408.086036] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery pmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass polyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse serio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg pata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore [ 408.087778] ---[ end trace 0000000000000000 ]--- [ 408.088007] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80 [ 408.088260] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 <0f> b6 14 16 84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03 [ 408.089118] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246 [ 408.089357] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000 [ 408.089678] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378 [ 408.090020] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8 [ 408.090360] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71 [ 408.090687] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378 [ 408.091035] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000) knlGS:0000000000000000 [ 408.091452] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 408.092015] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0 [ 408.092530] PKRU: 55555554 [ 417.112915] ================================================================== [ 417.113491] BUG: KASAN: slab-use-after-free in __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114014] Read of size 4 at addr ffff888124870034 by task kworker/2:0/4951 [ 417.114587] CPU: 2 UID: 0 PID: 4951 Comm: kworker/2:0 Tainted: G D W 6.17.0-rc7+ #1 PREEMPT(voluntary) [ 417.114592] Tainted: [D]=DIE, [W]=WARN [ 417.114593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 [ 417.114596] Workqueue: events handle_timeout [ 417.114601] Call Trace: [ 417.114602] [ 417.114604] dump_stack_lvl+0x5c/0x90 [ 417.114610] print_report+0x171/0x4dc [ 417.114613] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114617] ? kasan_complete_mode_report_info+0x80/0x220 [ 417.114621] kasan_report+0xbd/0x100 [ 417.114625] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114628] ? __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114630] __asan_report_load4_noabort+0x14/0x30 [ 417.114633] __mutex_lock.constprop.0+0x1522/0x1610 [ 417.114635] ? queue_con_delay+0x8d/0x200 [ 417.114638] ? __pfx___mutex_lock.constprop.0+0x10/0x10 [ 417.114641] ? __send_subscribe+0x529/0xb20 [ 417.114644] __mutex_lock_slowpath+0x13/0x20 [ 417.114646] mutex_lock+0xd4/0xe0 [ 417.114649] ? __pfx_mutex_lock+0x10/0x10 [ 417.114652] ? ceph_monc_renew_subs+0x2a/0x40 [ 417.114654] ceph_con_keepalive+0x22/0x110 [ 417.114656] handle_timeout+0x6b3/0x11d0 [ 417.114659] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114662] ? __pfx_handle_timeout+0x10/0x10 [ 417.114664] ? queue_delayed_work_on+0x8e/0xa0 [ 417.114669] process_one_work+0x611/0xe20 [ 417.114672] ? __kasan_check_write+0x14/0x30 [ 417.114676] worker_thread+0x7e3/0x1580 [ 417.114678] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 417.114682] ? __pfx_sched_setscheduler_nocheck+0x10/0x10 [ 417.114687] ? __pfx_worker_thread+0x10/0x10 [ 417.114689] kthread+0x381/0x7a0 [ 417.114692] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 417.114694] ? __pfx_kthread+0x10/0x10 [ 417.114697] ? __kasan_check_write+0x14/0x30 [ 417.114699] ? recalc_sigpending+0x160/0x220 [ 417.114703] ? _raw_spin_unlock_irq+0xe/0x50 [ 417.114705] ? calculate_sigpending+0x78/0xb0 [ 417.114707] ? __pfx_kthread+0x10/0x10 [ 417.114710] ret_from_fork+0x2b6/0x380 [ 417.114713] ? __pfx_kthread+0x10/0x10 [ 417.114715] ret_from_fork_asm+0x1a/0x30 [ 417.114720] [ 417.125171] Allocated by task 2: [ 417.125333] kasan_save_stack+0x26/0x60 [ 417.125522] kasan_save_track+0x14/0x40 [ 417.125742] kasan_save_alloc_info+0x39/0x60 [ 417.125945] __kasan_slab_alloc+0x8b/0xb0 [ 417.126133] kmem_cache_alloc_node_noprof+0x13b/0x460 [ 417.126381] copy_process+0x320/0x6250 [ 417.126595] kernel_clone+0xb7/0x840 [ 417.126792] kernel_thread+0xd6/0x120 [ 417.126995] kthreadd+0x85c/0xbe0 [ 417.127176] ret_from_fork+0x2b6/0x380 [ 417.127378] ret_from_fork_asm+0x1a/0x30 [ 417.127692] Freed by task 0: [ 417.127851] kasan_save_stack+0x26/0x60 [ 417.128057] kasan_save_track+0x14/0x40 [ 417.128267] kasan_save_free_info+0x3b/0x60 [ 417.128491] __kasan_slab_free+0x6c/0xa0 [ 417.128708] kmem_cache_free+0x182/0x550 [ 417.128906] free_task+0xeb/0x140 [ 417.129070] __put_task_struct+0x1d2/0x4f0 [ 417.129259] __put_task_struct_rcu_cb+0x15/0x20 [ 417.129480] rcu_do_batch+0x3d3/0xe70 [ 417.129681] rcu_core+0x549/0xb30 [ 417.129839] rcu_core_si+0xe/0x20 [ 417.130005] handle_softirqs+0x160/0x570 [ 417.130190] __irq_exit_rcu+0x189/0x1e0 [ 417.130369] irq_exit_rcu+0xe/0x20 [ 417.130531] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.130768] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 417.131082] Last potentially related work creation: [ 417.131305] kasan_save_stack+0x26/0x60 [ 417.131484] kasan_record_aux_stack+0xae/0xd0 [ 417.131695] __call_rcu_common+0xcd/0x14b0 [ 417.131909] call_rcu+0x31/0x50 [ 417.132071] delayed_put_task_struct+0x128/0x190 [ 417.132295] rcu_do_batch+0x3d3/0xe70 [ 417.132478] rcu_core+0x549/0xb30 [ 417.132658] rcu_core_si+0xe/0x20 [ 417.132808] handle_softirqs+0x160/0x570 [ 417.132993] __irq_exit_rcu+0x189/0x1e0 [ 417.133181] irq_exit_rcu+0xe/0x20 [ 417.133353] sysvec_apic_timer_interrupt+0x9f/0xd0 [ 417.133584] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 417.133921] Second to last potentially related work creation: [ 417.134183] kasan_save_stack+0x26/0x60 [ 417.134362] kasan_record_aux_stack+0xae/0xd0 [ 417.134566] __call_rcu_common+0xcd/0x14b0 [ 417.134782] call_rcu+0x31/0x50 [ 417.134929] put_task_struct_rcu_user+0x58/0xb0 [ 417.135143] finish_task_switch.isra.0+0x5d3/0x830 [ 417.135366] __schedule+0xd30/0x5100 [ 417.135534] schedule_idle+0x5a/0x90 [ 417.135712] do_idle+0x25f/0x410 [ 417.135871] cpu_startup_entry+0x53/0x70 [ 417.136053] start_secondary+0x216/0x2c0 [ 417.136233] common_startup_64+0x13e/0x141 [ 417.136894] The buggy address belongs to the object at ffff888124870000 which belongs to the cache task_struct of size 10504 [ 417.138122] The buggy address is located 52 bytes inside of freed 10504-byte region [ffff888124870000, ffff888124872908) [ 417.139465] The buggy address belongs to the physical page: [ 417.140016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x124870 [ 417.140789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 417.141519] memcg:ffff88811aa20e01 [ 417.141874] anon flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 417.142600] page_type: f5(slab) [ 417.142922] raw: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.143554] raw: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.143954] head: 0017ffffc0000040 ffff88810094f040 0000000000000000 dead000000000001 [ 417.144329] head: 0000000000000000 0000000000030003 00000000f5000000 ffff88811aa20e01 [ 417.144710] head: 0017ffffc0000003 ffffea0004921c01 00000000ffffffff 00000000ffffffff [ 417.145106] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 417.145485] page dumped because: kasan: bad access detected [ 417.145859] Memory state around the buggy address: [ 417.146094] ffff88812486ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146439] ffff88812486ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 417.146791] >ffff888124870000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147145] ^ [ 417.147387] ffff888124870080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.147751] ffff888124870100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 417.148123] ================================================================== First of all, we have warning in get_bvec_at() because cursor->total_resid contains zero value. And, finally, we have crash in ceph_msg_data_advance() because cursor->data is NULL. It means that get_bvec_at() receives not initialized ceph_msg_data_cursor structure because data is NULL and total_resid contains zero. Moreover, we don't have likewise issue for the case of Ceph msgr1 protocol because ceph_msg_data_cursor_init() has been called before reading sparse data. This patch adds calling of ceph_msg_data_cursor_init() in the beginning of process_v2_sparse_read() with the goal to guarantee that logic of reading sparse data works correctly for the case of Ceph msgr2 protocol. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/73152 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 765e56e41a5af2d456ddda6cbd617b9d3295ab4e Merge: 4941a17751c99e 3184b6a5a24ec9 Author: Linus Torvalds Date: Wed Nov 26 20:22:20 2025 -0800 Merge tag 'v6.18rc7-SMB-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: "smb client multiuser (with cifscreds) mount fix" * tag 'v6.18rc7-SMB-client-fix' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix memory leak in cifs_construct_tcon() commit 8ec205e8797046b79d02a6359ebd57091b594cd8 Merge: 5ffcb7b890f615 0c922106d7a58d Author: Jakub Kicinski Date: Wed Nov 26 19:56:00 2025 -0800 Merge tag 'linux-can-fixes-for-6.18-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-11-26 this is a pull request of 8 patches for net/main. Seungjin Bae provides a patch for the kvaser_usb driver to fix a potential infinite loop in the USB data stream command parser. Thomas Mühlbacher's patch for the sja1000 driver IRQ handler's max loop handling, that might lead to unhandled interrupts. 3 patches by me for the gs_usb driver fix handling of failed transmit URBs and add checking of the actual length of received URBs before accessing the data. The next patch is by me and is a port of Thomas Mühlbacher's patch (fix IRQ handler's max loop handling, that might lead to unhandled interrupts.) to the sun4i_can driver. Biju Das provides a patch for the rcar_canfd driver to fix the CAN-FD mode setting. The last patch is by Shaurya Rane for the em_canid filter to ensure that the complete CAN frame is present in the linear data buffer before accessing it. * tag 'linux-can-fixes-for-6.18-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: net/sched: em_canid: fix uninit-value in em_canid_match can: rcar_canfd: Fix CAN-FD mode as default can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs can: sja1000: fix max irq loop handling can: kvaser_usb: leaf: Fix potential infinite loop in command parsers ==================== Link: https://patch.msgid.link/20251126155713.217105-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 5ffcb7b890f61541201461580bb6622ace405aec Author: Jiefeng Zhang Date: Wed Nov 26 11:22:49 2025 +0800 net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS") Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. Signed-off-by: Jiefeng Zhang Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com Signed-off-by: Jakub Kicinski commit 384c1a4e2722b43f26b55cc041562ff8b229b536 Author: Jon Kohler Date: Tue Nov 25 18:57:48 2025 -0700 MAINTAINERS: separate VIRTIO NET DRIVER and add netdev Changes to virtio network stack should be cc'd to netdev DL, separate it into its own group to add netdev in addition to virtualization DL. Signed-off-by: Jon Kohler Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251126015750.2200267-1-jon@nutanix.com Signed-off-by: Jakub Kicinski commit 1cd1c472343b06d6d32038636ce51bfa2251e3cf Author: Jon Kohler Date: Tue Nov 25 15:27:53 2025 -0700 virtio-net: avoid unnecessary checksum calculation on guest RX Commit a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") inadvertently altered checksum offload behavior for guests not using UDP GSO tunneling. Before, tun_put_user called tun_vnet_hdr_from_skb, which passed has_data_valid = true to virtio_net_hdr_from_skb. After, tun_put_user began calling tun_vnet_hdr_tnl_from_skb instead, which passes has_data_valid = false into both call sites. This caused virtio hdr flags to not include VIRTIO_NET_HDR_F_DATA_VALID for SKBs where skb->ip_summed == CHECKSUM_UNNECESSARY. As a result, guests are forced to recalculate checksums unnecessarily. Restore the previous behavior by ensuring has_data_valid = true is passed in the !tnl_gso_type case, but only from tun side, as virtio_net_hdr_tnl_from_skb() is used also by the virtio_net driver, which in turn must not use VIRTIO_NET_HDR_F_DATA_VALID on tx. cc: stable@vger.kernel.org Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") Signed-off-by: Jon Kohler Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/20251125222754.1737443-1-jon@nutanix.com Signed-off-by: Jakub Kicinski commit 6d66e093e0740d39a36ef742c60eec247df26f41 Author: Mohsin Bashir Date: Tue Nov 25 13:17:04 2025 -0800 eth: fbnic: Fix counter roll-over issue Fix a potential counter roll-over issue in fbnic_mbx_alloc_rx_msgs() when calculating descriptor slots. The issue occurs when head - tail results in a large positive value (unsigned) and the compiler interprets head - tail - 1 as a signed value. Since FBNIC_IPC_MBX_DESC_LEN is a power of two, use a masking operation, which is a common way of avoiding this problem when dealing with these sort of ring space calculations. Fixes: da3cde08209e ("eth: fbnic: Add FW communication mechanism") Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20251125211704.3222413-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 27fd02860164bfa78cec2640dfad630d832e302c Author: Paolo Abeni Date: Tue Nov 25 17:59:11 2025 +0100 mptcp: clear scheduled subflows on retransmit When __mptcp_retrans() kicks-in, it schedules one or more subflows for retransmission, but such subflows could be actually left alone if there is no more data to retransmit and/or in case of concurrent fallback. Scheduled subflows could be processed much later in time, i.e. when new data will be transmitted, leading to bad subflow selection. Explicitly clear all scheduled subflows before leaving the retransmission function. Fixes: ee2708aedad0 ("mptcp: use get_retrans wrapper") Cc: stable@vger.kernel.org Reported-by: Filip Pokryvka Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251125-net-mptcp-clear-sched-rtx-v1-1-1cea4ad2165f@kernel.org Signed-off-by: Jakub Kicinski commit da62abaaa268357b1aa66b372ace562189a05df1 Author: Vladimir Oltean Date: Sat Nov 22 13:13:24 2025 +0200 net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic When using the SGMII PCS as a fixed-link chip-to-chip connection, it is easy to miss the fact that traffic passes only at 1G, since that's what any normal such connection would use. When using the SGMII PCS connected towards an on-board PHY or an SFP module, it is immediately noticeable that when the link resolves to a speed other than 1G, traffic from the MAC fails to pass: TX counters increase, but nothing gets decoded by the other end, and no local RX counters increase either. Artificially lowering a fixed-link rate to speed = <100> makes us able to see the same issue as in the case of having an SGMII PHY. Some debugging shows that the XPCS configuration is A-OK, but that the MAC Configuration Table entry for the port has the SPEED bits still set to 1000Mbps, due to a special condition in the driver. Deleting that condition, and letting the resolved link speed be programmed directly into the MAC speed field, results in a functional link at all 3 speeds. This piece of evidence, based on testing on both generations with SGMII support (SJA1105S and SJA1110A) directly contradicts the statement from the blamed commit that "the MAC is fixed at 1 Gbps and we need to configure the PCS only (if even that)". Worse, that statement is not backed by any documentation, and no one from NXP knows what it might refer to. I am unable to recall sufficient context regarding my testing from March 2020 to understand what led me to draw such a braindead and factually incorrect conclusion. Yet, there is nothing of value regarding forcing the MAC speed, either for SGMII or 2500Base-X (introduced at a later stage), so remove all such logic. Fixes: ffe10e679cec ("net: dsa: sja1105: Add support for the SGMII port") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251122111324.136761-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b9ba6338bc6e0e97dee30fa705f40950ed556729 Author: Alexandra Winter Date: Tue Nov 25 09:58:29 2025 +0100 s390/net: list Aswin Karuvally as maintainer Thank you Aswin for taking this responsibility. Signed-off-by: Alexandra Winter Acked-by: Aswin Karuvally Link: https://patch.msgid.link/20251125085829.3679506-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 4fcb8ab4a09b1855dbfd7062605dd13abd64c086 Author: Slark Xiao Date: Tue Nov 25 15:09:00 2025 +0800 net: wwan: mhi: Keep modem name match with Foxconn T99W640 Correct it since M.2 device T99W640 has updated from T99W515. We need to align it with MHI side otherwise this modem can't get the network. Fixes: ae5a34264354 ("bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640") Signed-off-by: Slark Xiao Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20251125070900.33324-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 779bcdd4b9ae6566f309043c53c946e8ac0015fd Author: Jason Wang Date: Thu Nov 20 10:29:50 2025 +0800 vhost: rewind next_avail_head while discarding descriptors When discarding descriptors with IN_ORDER, we should rewind next_avail_head otherwise it would run out of sync with last_avail_idx. This would cause driver to report "id X is not a head". Fixing this by returning the number of descriptors that is used for each buffer via vhost_get_vq_desc_n() so caller can use the value while discarding descriptors. Fixes: 67a873df0c41 ("vhost: basic in order support") Cc: stable@vger.kernel.org Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251120022950.10117-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 85f5491d9c6e9662653c8e6e7b70637b98537ecc Author: Ilya Dryomov Date: Mon Nov 3 21:34:01 2025 +0100 libceph: drop started parameter of __ceph_open_session() With the previous commit revamping the timeout handling, started isn't used anymore. It could be taken into account by adjusting the initial value of the timeout, but there is little point as both callers capture the timestamp shortly before calling __ceph_open_session() -- the only thing of note that happens in the interim is taking client->mount_mutex and that isn't expected to take multiple seconds. Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit 076381c261374c587700b3accf410bdd2dba334e Author: Ilya Dryomov Date: Mon Nov 3 21:34:01 2025 +0100 libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. Cc: stable@vger.kernel.org Reported-by: David Howells Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit 4941a17751c99e17422be743c02c923ad706f888 Merge: 9eb220edddb20a b042fdf18e89a3 Author: Linus Torvalds Date: Wed Nov 26 13:16:22 2025 -0800 Merge tag 'trace-ringbuffer-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer fix from Steven Rostedt: - Do not allow mmapped ring buffer to be split When the ring buffer VMA is split by a partial munmap or a MAP_FIXED, the kernel calls vm_ops->close() on each portion. This causes the ring_buffer_unmap() to be called multiple times. This causes subsequent calls to return -ENODEV and triggers a warning. There's no reason to allow user space to split up memory mapping of the ring buffer. Have it return -EINVAL when that happens. * tag 'trace-ringbuffer-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs commit d0d08f4bd7f667dc7a65cd7133c0a94a6f02aca3 Author: Pranjal Shrivastava Date: Wed Nov 26 11:41:12 2025 +0000 dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings Prior to commit a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers"), P2P segments were mapped using the pci_p2pdma_map_segment() helper. This helper was responsible for populating sg->dma_address, marking the bus address, and also setting sg_dma_len(sg). The refactor[1] removed this helper and moved the mapping logic directly into the callers. While iommu_dma_map_sg() was correctly updated to set the length in the new flow, it was missed in dma_direct_map_sg(). Thus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the dma_address and marks the segment, but immediately executes 'continue', which causes the loop to skip the standard assignment logic at the end: sg_dma_len(sg) = sg->length; As a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length field remains uninitialized (zero) for P2P bus address mappings. This breaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len() to determine the transfer size. Fix this by explicitly setting the DMA length in the PCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist entry. Fixes: a25e7962db0d7 ("PCI/P2PDMA: Refactor the p2pdma mapping helpers") Reported-by: Jacob Moroni Signed-off-by: Pranjal Shrivastava [1] https://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/ Reviewed-by: Logan Gunthorpe Reviewed-by: Leon Romanovsky Reviewed-by: Shivaji Kant Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251126114112.3694469-1-praan@google.com commit 9eb220edddb20a019d1630347555bc4ae1514e61 Merge: ad8cccc2488765 7c9580f44f90f7 Author: Linus Torvalds Date: Wed Nov 26 12:38:05 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-26-11-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "8 hotfixes. 4 are cc:stable, 7 are against mm/. All are singletons - please see the respective changelogs for details" * tag 'mm-hotfixes-stable-2025-11-26-11-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/filemap: fix logic around SIGBUS in filemap_map_pages() mm/huge_memory: fix NULL pointer deference when splitting folio MAINTAINERS: add test_kho to KHO's entry mailmap: add entry for Sam Protsenko selftests/mm: fix division-by-zero in uffd-unit-tests mm/mmap_lock: reset maple state on lock_vma_under_rcu() retry mm/memfd: fix information leak in hugetlb folios mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type() commit ad8cccc24887655ebf0a3f459d38d1fb683df46a Author: Linus Torvalds Date: Wed Nov 26 12:31:48 2025 -0800 Fix Intel Dollar Cove TI battery driver 32-bit build error The driver is doing a 64-bit divide, rather than using the proper helpers, causing link errors on i386 allyesconfig builds: x86_64-linux-ld: drivers/power/supply/intel_dc_ti_battery.o: in function `dc_ti_battery_get_voltage_and_current_now': intel_dc_ti_battery.c:(.text+0x5c): undefined reference to `__udivdi3' x86_64-linux-ld: intel_dc_ti_battery.c:(.text+0x96): undefined reference to `__udivdi3' and while fixing that, fix the double rounding: keep the timing difference in nanoseconds ('ktime'), and then just convert to usecs at the end. Not because the timing precision is likely to matter, but because doing it right also makes the code simpler. Reported-by: Guenter Roeck Cc: Hans de Goede Cc: Sebastian Reichel Signed-off-by: Linus Torvalds commit 32115734c0ed8b463d1020e8da47968735f882c0 Author: Linus Torvalds Date: Wed Nov 26 12:11:28 2025 -0800 Increase the default 32-bit build frame size warning limit to 1280 bytes That was already the limit with KASAN enabled, and the 32-bit x86 build ends up having a couple of drm cases that have stack frames _just_ over 1kB on my allmodconfig test. So the minimal fix for this build issue for now is to just bump the limit and make it independent of KASAN. [ Side note: XTENSA already used 1.5k and PARISC uses 2k, so 1280 is still relatively conservative ] Signed-off-by: Linus Torvalds commit 430c89fe3a523fe24faaad25ccc76cc9ff8034d6 Merge: a10d15a08f62bf d041e5e748f926 Author: Linus Torvalds Date: Wed Nov 26 10:33:32 2025 -0800 Merge tag 'sound-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are device-specific and trivial, mostly HD-audio and USB-audio quirks and fixups" * tag 'sound-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 ALSA: usb-audio: fix uac2 clock source at terminal parser ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 ALSA: au88x0: Fix incorrect error handling for PCI config reads commit a10d15a08f62bf97c707ef3c2a7493604c1bcc89 Merge: 30f09200cc4aef 43ff36c4a5a574 Author: Linus Torvalds Date: Wed Nov 26 10:17:10 2025 -0800 Merge tag 'acpi-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Revert a commit that attempted to make the code in the ACPI processor driver more straightforward, but it turned out to cause the kernel to crash on at least one system, along with some further cleanups on top of it" * tag 'acpi-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI: processor: idle: Optimize ACPI idle driver registration" Revert "ACPI: processor: Remove unused empty stubs of some functions" Revert "ACPI: processor: idle: Rearrange declarations in header file" Revert "ACPI: processor: idle: Redefine two functions as void" Revert "ACPI: processor: Do not expose global variable acpi_idle_driver" commit 7fa666ab07ba9e08f52f357cb8e1aad753e83ac6 Author: Alex Deucher Date: Wed Nov 26 09:40:31 2025 -0500 drm/amdgpu: fix cyan_skillfish2 gpu info fw handling If the board supports IP discovery, we don't need to parse the gpu info firmware. Backport to 6.18. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4721 Fixes: fa819e3a7c1e ("drm/amdgpu: add support for cyan skillfish gpu_info") Signed-off-by: Alex Deucher (cherry picked from commit 5427e32fa3a0ba9a016db83877851ed277b065fb) commit b4a7f4e7ad2b120a94f3111f92a11520052c762d Author: Prike Liang Date: Fri Oct 31 17:02:51 2025 +0800 drm/amdgpu: attach tlb fence to the PTs update Ensure the userq TLB flush is emitted only after the VM update finishes and the PT BOs have been annotated with bookkeeping fences. Suggested-by: Christian König Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit f3854e04b708d73276c4488231a8bd66d30b4671) Cc: stable@vger.kernel.org commit 8ea902361734c87b82122f9c17830f168ebfc65a Author: Mario Limonciello (AMD) Date: Wed Nov 5 23:04:54 2025 -0600 drm/amd/display: Increase EDID read retries [WHY] When monitor is still booting EDID read can fail while DPCD read is successful. In this case no EDID data will be returned, and this could happen for a while. [HOW] Increase number of attempts to read EDID in dm_helpers_read_local_edid() to 25. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit a76d6f2c76c3abac519ba753e2723e6ffe8e461c) Cc: stable@vger.kernel.org commit 81f4d4ba509522596143fd5d7dc2fc3495296b0a Author: Mario Limonciello (AMD) Date: Mon Nov 3 16:02:11 2025 -0600 drm/amd/display: Don't change brightness for disabled connectors [WHY] When a laptop lid is closed the connector is disabled but userspace can still try to change brightness. This doesn't work because the panel is turned off. It will eventually time out, but there is a lot of stutter along the way. [How] Iterate all connectors to check whether the matching one for the backlight index is enabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4675 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Ray Wu Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit f6eeab30323d1174a4cc022e769d248fe8241304) Cc: stable@vger.kernel.org commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 Author: Alex Hung Date: Fri Nov 7 15:35:58 2025 -0700 drm/amd/display: Check NULL before accessing [WHAT] IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic fails with NULL pointer dereference. This can be reproduced with both an eDP panel and a DP monitors connected. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted 6.16.0-99-custom #8 PREEMPT(voluntary) Hardware name: AMD ........ RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu] Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30 c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02 RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668 RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000 RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760 R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000 R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu] amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu] ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu] amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu] drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400 drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30 drm_crtc_get_last_vbltimestamp+0x55/0x90 drm_crtc_next_vblank_start+0x45/0xa0 drm_atomic_helper_wait_for_fences+0x81/0x1f0 ... Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c) Cc: stable@vger.kernel.org commit 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d Author: Alex Deucher Date: Tue Nov 25 09:08:45 2025 -0500 Revert "drm/amd/display: Move setup_stream_attribute" This reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414. This results in a blank screen on the HDMI port on some systems. Revert for now so as not to regress 6.18, can be addressed in 6.19 once the issue is root caused. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4652 Cc: Sunpeng.Li@amd.com Cc: ivan.lipski@amd.com Signed-off-by: Alex Deucher (cherry picked from commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb) commit 0c922106d7a58d106c6a5c52a741ae101cfaf088 Author: Shaurya Rane Date: Wed Nov 26 14:27:18 2025 +0530 net/sched: em_canid: fix uninit-value in em_canid_match Use pskb_may_pull() to ensure a complete CAN frame is present in the linear data buffer before reading the CAN ID. A simple skb->len check is insufficient because it only verifies the total data length but does not guarantee the data is present in skb->data (it could be in fragments). pskb_may_pull() both validates the length and pulls fragmented data into the linear buffer if necessary, making it safe to directly access skb->data. Reported-by: syzbot+5d8269a1e099279152bc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5d8269a1e099279152bc Fixes: f057bbb6f9ed ("net: em_canid: Ematch rule to match CAN frames according to their identifiers") Signed-off-by: Shaurya Rane Link: https://patch.msgid.link/20251126085718.50808-1-ssranevjti@gmail.com Signed-off-by: Marc Kleine-Budde commit 6d849ff573722afcf5508d2800017bdd40f27eb9 Author: Biju Das Date: Tue Nov 18 12:39:25 2025 +0000 can: rcar_canfd: Fix CAN-FD mode as default The commit 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting") has aligned with the flow mentioned in the hardware manual for all SoCs except R-Car Gen3 and RZ/G2L SoCs. On R-Car Gen4 and RZ/G3E SoCs, due to the wrong logic in the commit[1] sets the default mode to FD-Only mode instead of CAN-FD mode. This patch sets the CAN-FD mode as the default for all SoCs by dropping the rcar_canfd_set_mode() as some SoC requires mode setting in global reset mode, and the rest of the SoCs in channel reset mode and update the rcar_canfd_reset_controller() to take care of these constraints. Moreover, the RZ/G3E and R-Car Gen4 SoCs support 3 modes compared to 2 modes on the R-Car Gen3. Use inverted logic in rcar_canfd_reset_controller() to simplify the code later to support FD-only mode. [1] commit 45721c406dcf ("can: rcar_canfd: Add support for r8a779a0 SoC") Fixes: 5cff263606a1 ("can: rcar_canfd: Fix controller mode setting") Cc: stable@vger.kernel.org Signed-off-by: Biju Das Link: https://patch.msgid.link/20251118123926.193445-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 3dcf44ab56e1d3ca3532083c0d5390b758e45b45 Author: Francesco Lavra Date: Wed Nov 26 10:50:27 2025 +0100 spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA This driver runs also on Tegra SoCs without a Tegra20 APB DMA controller (e.g. Tegra234). Remove the Kconfig dependency on TEGRA20_APB_DMA; in addition, amend the help text to reflect the fact that this driver works on SoCs different from Tegra114. Fixes: bb9667d8187b ("arm64: tegra: Add SPI device tree nodes for Tegra234") Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20251126095027.4102004-1-flavra@baylibre.com Signed-off-by: Mark Brown commit 2bf95a9bcb50002ca9d47403d60aedaeb2e19abe Author: Ilpo Järvinen Date: Mon Nov 10 12:50:43 2025 +0200 serial: 8250: Fix 8250_rsa symbol loop Depmod fails for a kernel made with: make allnoconfig echo -e "CONFIG_MODULES=y\nCONFIG_SERIAL_8250=m\nCONFIG_SERIAL_8250_EXTENDED=y\nCONFIG_SERIAL_8250_RSA=y" >> .config make olddefconfig ...due to a dependency loop: depmod: ERROR: Cycle detected: 8250 -> 8250_base -> 8250 depmod: ERROR: Found 2 modules in dependency cycles! This is caused by the move of 8250 RSA code from 8250_port.c (in 8250_base.ko) into 8250_rsa.c (in 8250.ko) by the commit 5a128fb475fb ("serial: 8250: move RSA functions to 8250_rsa.c"). The commit b20d6576cdb3 ("serial: 8250: export RSA functions") tried to fix a missing symbol issue with EXPORTs but those then cause this dependency cycle. Break dependency loop by moving 8250_rsa.o from 8250.ko to 8250_base.ko and by passing univ8250_port_base_ops to univ8250_rsa_support() that can make a local copy of it. Reported-by: Stephen Rothwell Reported-by: Alex Davis Fixes: 5a128fb475fb ("serial: 8250: move RSA functions to 8250_rsa.c") Fixes: b20d6576cdb3 ("serial: 8250: export RSA functions") Cc: stable Link: https://lore.kernel.org/all/87frc3sd8d.fsf@posteo.net/ Link: https://lore.kernel.org/all/CADiockCvM6v+d+UoFZpJSMoLAdpy99_h-hJdzUsdfaWGn3W7-g@mail.gmail.com/ Reviewed-by: Andy Shevchenko Reviewed-by: Jiri Slaby Signed-off-by: Ilpo Järvinen Link: https://patch.msgid.link/20251110105043.4062-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d041e5e748f926398ad96436a86667dea8b591e0 Author: Ilyas Gasanov Date: Wed Nov 26 03:54:41 2025 +0400 ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 My laptop, HP ProBook 450 G8 (32M40EA), has Realtek ALC236 codec on its integrated sound card, and uses GPIO pins 0x2 and 0x1 for speaker mute and mic mute LEDs correspondingly, as found out by me through hda-verb invocations. This matches the GPIO masks used by the alc236_fixup_hp_gpio_led() function. PCI subsystem vendor and device IDs happen to be 0x103c and 0x8a75, which has not been covered in the ALC2xx driver code yet. Signed-off-by: Ilyas Gasanov Link: https://patch.msgid.link/20251125235441.53629-1-public@gsnoff.com Signed-off-by: Takashi Iwai commit 0ebc27a4c67d44e5ce88d21cdad8201862b78837 Author: Fernando Fernandez Mancera Date: Mon Nov 24 18:14:09 2025 +0100 xsk: avoid data corruption on cq descriptor number Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_submit_addr_locked() relies on it to put the umem addrs onto pool's completion queue. skb control block shouldn't be used for this purpose as after transmit xsk doesn't have control over it and other subsystems could use it. This leads to the following kernel panic due to a NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy) Debian 6.16.12-1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:xsk_destruct_skb+0xd0/0x180 [...] Call Trace: ? napi_complete_done+0x7a/0x1a0 ip_rcv_core+0x1bb/0x340 ip_rcv+0x30/0x1f0 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x87/0x130 __napi_poll+0x28/0x180 net_rx_action+0x339/0x420 handle_softirqs+0xdc/0x320 ? handle_edge_irq+0x90/0x1e0 do_softirq.part.0+0x3b/0x60 __local_bh_enable_ip+0x60/0x70 __dev_direct_xmit+0x14e/0x1f0 __xsk_generic_xmit+0x482/0xb70 ? __remove_hrtimer+0x41/0xa0 ? __xsk_generic_xmit+0x51/0xb70 ? _raw_spin_unlock_irqrestore+0xe/0x40 xsk_sendmsg+0xda/0x1c0 __sys_sendto+0x1ee/0x200 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x84/0x2f0 ? __pfx_pollwake+0x10/0x10 ? __rseq_handle_notify_resume+0xad/0x4c0 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 ? do_syscall_64+0x204/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Instead use the skb destructor_arg pointer along with pointer tagging. As pointers are always aligned to 8B, use the bottom bit to indicate whether this a single address or an allocated struct containing several addresses. Fixes: 30f241fcf52a ("xsk: Fix immature cq descriptor production") Closes: https://lore.kernel.org/netdev/0435b904-f44f-48f8-afb0-68868474bf1c@nop.hu/ Suggested-by: Jakub Kicinski Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Maciej Fijalkowski Reviewed-by: Jason Xing Link: https://patch.msgid.link/20251124171409.3845-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit ae1737e7339b513f8c2fc21b500a0fc215d155c3 Author: Heiner Kallweit Date: Sat Nov 22 15:23:02 2025 +0100 r8169: fix RTL8127 hang on suspend/shutdown There have been reports that RTL8127 hangs on suspend and shutdown, partially disappearing from lspci until power-cycling. According to Realtek disabling PLL's when switching to D3 should be avoided on that chip version. Fix this by aligning disabling PLL's with the vendor drivers, what in addition results in PLL's not being disabled when switching to D3hot on other chip versions. Fixes: f24f7b2f3af9 ("r8169: add support for RTL8127A") Tested-by: Fabio Baltieri Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/d7faae7e-66bc-404a-a432-3a496600575f@gmail.com Signed-off-by: Jakub Kicinski commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 Author: Alexey Kodanev Date: Fri Nov 21 12:38:34 2025 +0000 net: sxgbe: fix potential NULL dereference in sxgbe_rx() Currently, when skb is null, the driver prints an error and then dereferences skb on the next line. To fix this, let's add a 'break' after the error message to switch to sxgbe_rx_refill(), which is similar to the approach taken by the other drivers in this particular case, e.g. calxeda with xgmac_rx(). Found during a code review. Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver") Signed-off-by: Alexey Kodanev Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com Signed-off-by: Jakub Kicinski commit 0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef Author: Nikola Z. Ivanov Date: Sat Nov 22 02:20:27 2025 +0200 team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev This is done by adding a conditional before the call to dev_set_mtu to prevent it from assigning port_dev->mtu = dev->mtu and instead letting team_dev_type_check_change assign dev->mtu = port_dev->mtu. The conditional is needed because the patch moves the call to team_dev_type_check_change past dev_set_mtu. Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a2a3b519de727b0f7903 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Nikola Z. Ivanov Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251122002027.695151-1-zlatistiv@gmail.com Signed-off-by: Jakub Kicinski commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 Author: Danielle Costantino Date: Mon Nov 24 10:00:43 2025 -0800 net/mlx5e: Fix validation logic in rate limiting The rate limiting validation condition currently checks the output variable max_bw_value[i] instead of the input value maxrate->tc_maxrate[i]. This causes the validation to compare an uninitialized or stale value rather than the actual requested rate. The condition should check the input rate to properly validate against the upper limit: } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { This aligns with the pattern used in the first branch, which correctly checks maxrate->tc_maxrate[i] against upper_limit_mbps. The current implementation can lead to unreliable validation behavior: - For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0 from initialization, the GBPS path may be taken regardless of whether the actual rate is within bounds - When processing multiple TCs (i > 0), max_bw_value[i] contains the value computed for the previous TC, affecting the validation logic - The overflow check for rates exceeding 255 Gbps may not trigger consistently depending on previous array values This patch ensures the validation correctly examines the requested rate value for proper bounds checking. Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps") Signed-off-by: Danielle Costantino Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com Signed-off-by: Jakub Kicinski commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 Author: Paulo Alcantara Date: Mon Nov 24 17:00:36 2025 -0300 smb: client: fix memory leak in cifs_construct_tcon() When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so it needs to be freed before leaving cifs_construct_tcon(). This fixes the following memory leak reported by kmemleak: mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,... su - testuser cifscreds add -d ZELDA -u testuser ... ls /mnt/1 ... umount /mnt echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak unreferenced object 0xffff8881203c3f08 (size 8): comm "ls", pid 5060, jiffies 4307222943 hex dump (first 8 bytes): 5a 45 4c 44 41 00 cc cc ZELDA... backtrace (crc d109a8cf): __kmalloc_node_track_caller_noprof+0x572/0x710 kstrdup+0x3a/0x70 cifs_sb_tlink+0x1209/0x1770 [cifs] cifs_get_fattr+0xe1/0xf50 [cifs] cifs_get_inode_info+0xb5/0x240 [cifs] cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs] cifs_getattr+0x28e/0x450 [cifs] vfs_getattr_nosec+0x126/0x180 vfs_statx+0xf6/0x220 do_statx+0xab/0x110 __x64_sys_statx+0xd5/0x130 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: f2aee329a68f ("cifs: set domainName when a domain-key is used in multiuser") Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Jay Shin Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit b042fdf18e89a347177a49e795d8e5184778b5b6 Author: Deepanshu Kartikey Date: Wed Nov 19 12:10:19 2025 +0530 tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once. This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON. Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page. Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely. Cc: stable@vger.kernel.org Fixes: cf9f0f7c4c5bb ("tracing: Allow user-space mapping of the ring-buffer") Link: https://patch.msgid.link/20251119064019.25904-1-kartikey406@gmail.com Closes: https://syzkaller.appspot.com/bug?extid=a72c325b042aae6403c7 Tested-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com Reported-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Signed-off-by: Steven Rostedt (Google) commit 7276878b069c57d9a9cca5db01d2f7a427b73456 Author: Harish Chegondi Date: Mon Nov 17 11:48:43 2025 -0800 drm/xe: Fix conversion from clock ticks to milliseconds When tick counts are large and multiplication by MSEC_PER_SEC is larger than 64 bits, the conversion from clock ticks to milliseconds can go bad. Use mul_u64_u32_div() instead. Cc: Ashutosh Dixit Signed-off-by: Harish Chegondi Suggested-by: Umesh Nerlige Ramappa Fixes: 49cc215aad7f ("drm/xe: Add xe_gt_clock_interval_to_ms helper") Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/1562f1b62d5be3fbaee100f09107f3cc49e40dd1.1763408584.git.harish.chegondi@intel.com (cherry picked from commit 96b93ac214f9dd66294d975d86c5dee256faef91) Signed-off-by: Lucas De Marchi commit 0e234632e39bd21dd28ffc9ba3ae8eec4deb949c Author: Lucas De Marchi Date: Tue Nov 18 11:08:11 2025 -0800 drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is enabled to fix the following call stack: [] BUG: kernel NULL pointer dereference, address: 0000000000000000 [] Workqueue: drm_sched_run_job_work [gpu_sched] [] RIP: 0010:stack_depot_save_flags+0x172/0x870 [] Call Trace: [] [] fast_req_track+0x58/0xb0 [xe] Fixes: 16b7e65d299d ("drm/xe/guc: Track FAST_REQ H2Gs to report where errors came from") Tested-by: Sagar Ghuge Cc: stable@vger.kernel.org # v6.17+ Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20251118-fix-debug-guc-v1-1-9f780c6bedf8@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f) Signed-off-by: Lucas De Marchi commit 76555b1eb278da420b6e4d26714319a7a4460e7b Author: Shuicheng Lin Date: Mon Nov 10 18:45:23 2025 +0000 drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc() xe_guc_ct_init_noalloc() allocates the CT workqueue and other helpers before it tries to initialize ct->lock. If drmm_mutex_init() fails we currently bail out without releasing those resources because the guc_ct_fini() hasn’t been registered yet. Since destroy_workqueue() in guc_ct_fini() may flush the workqueue, which in turn can take the ct lock, the initialization sequence is restructured to first initialize the ct->lock, then set up all CT state, and finally register guc_ct_fini(). v2: guc_ct_fini() does take ct lock. (Matt) v3: move primelockdep() together with drmm_mutex_init(). (Lucas) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Lucas De Marchi Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251110184522.1581001-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 2e4ad5b0667244f496783c58de0995b9562d3344) Signed-off-by: Lucas De Marchi commit c7418164b463056bf4327b6a2abe638b78250f13 Author: Dan Carpenter Date: Tue Nov 25 16:55:19 2025 +0300 timekeeping: Fix error code in tk_aux_sysfs_init() If kobject_create_and_add() fails on the first iteration, then the error code is set to -ENOMEM which is correct. But if it fails in subsequent iterations then "ret" is zero, which means success, but it should be -ENOMEM. Set the error code to -ENOMEM correctly. Fixes: 7b5ab04f035f ("timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Malaya Kumar Rout Link: https://patch.msgid.link/aSW1R8q5zoY_DgQE@stanley.mountain commit 30f09200cc4aefbd8385b01e41bde2e4565a6f0e Merge: 5f8a6c70afc58d 165eb13e485c5c Author: Linus Torvalds Date: Tue Nov 25 08:36:03 2025 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "We've got a revert due to one of the recent CCA commits breaking ACPI firmware-based error reporting, a fix for a hard-lockup introduced by a prior fix affecting non-default (CONFIG_EXPERT) configurations and another ACPI fix for systems using MMIO-based timers. Other than that, we're looking pretty good. - Avoid hardlockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=n - Fix regression in APEI/GHES error handling - Fix MMIO timers when probed via ACPI" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY ACPI: GTDT: Correctly number platform devices for MMIO timers Revert "arm64: acpi: Enable ACPI CCEL support" commit 5f8a6c70afc58d4be849407658f27f47f006a3c7 Merge: 8a2bcda5e13906 b07bf253ef8e48 Author: Linus Torvalds Date: Tue Nov 25 08:31:28 2025 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Two build fixes, no functional change: - Fix a possible compiler error around counted_by() due to wrong initialization order - Fix a -Wflex-array-member-not-at-end" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning iommufd/driver: Fix counter initialization for counted_by annotation commit 43ff36c4a5a574ee83b4b0d3f3d74f09a3a8c2d3 Author: Rafael J. Wysocki Date: Tue Nov 25 15:06:12 2025 +0100 Revert "ACPI: processor: idle: Optimize ACPI idle driver registration" Revert commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") because it is reported to introduce a cpuidle regression leading to a kernel crash on a platform using the ACPI idle driver. Signed-off-by: Rafael J. Wysocki Reported-by: Borislav Petkov Tested-by: Borislav Petkov (AMD) Closes: https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/ commit d26e9f669cc0a6a85cf17180c09a6686db9f4002 Author: René Rebe Date: Tue Nov 25 15:41:49 2025 +0100 ALSA: usb-audio: fix uac2 clock source at terminal parser Since 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values") usb-audio is using UAC3_CLOCK_SOURCE instead of bDescriptorSubtype, later refactored with e0ccdef9265 ("ALSA: usb-audio: Clean up check_input_term()") into parse_term_uac2_clock_source(). This breaks the clock source selection for at least my 1397:0003 BEHRINGER International GmbH FCA610 Pro. Fix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source(). Fixes: 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values") Signed-off-by: René Rebe Link: https://patch.msgid.link/20251125.154149.1121389544970412061.rene@exactco.de Signed-off-by: Takashi Iwai commit 9780f535f8e0f20b4632b5a173ead71aa8f095d2 Author: Horatiu Vultur Date: Fri Nov 21 07:14:11 2025 +0100 net: lan966x: Fix the initialization of taprio To initialize the taprio block in lan966x, it is required to configure the register REVISIT_DLY. The purpose of this register is to set the delay before revisit the next gate and the value of this register depends on the system clock. The problem is that the we calculated wrong the value of the system clock period in picoseconds. The actual system clock is ~165.617754MHZ and this correspond to a period of 6038 pico seconds and not 15125 as currently set. Fixes: e462b2717380b4 ("net: lan966x: Add offload support for taprio") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251121061411.810571-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 1a8b3501821b608383f7c7aa0f24e2006681e2b5 Author: Rafael J. Wysocki Date: Tue Nov 25 15:05:01 2025 +0100 Revert "ACPI: processor: Remove unused empty stubs of some functions" Revert commit 5020d05b3476 ("ACPI: processor: Remove unused empty stubs of some functions") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit f6dc5a36195d3f5be769f60d6987150192dfb099 Author: Pavel Begunkov Date: Tue Nov 25 12:33:06 2025 +0000 io_uring: fix mixed cqe overflow handling I started to see zcrx data corruptions. That turned out to be due to CQ tail pointing to a stale entry which happened to be from a zcrx request. I.e. the tail is incremented without the CQE memory being changed. The culprit is __io_cqring_overflow_flush() passing "cqe32=true" to io_get_cqe_overflow() for non-mixed CQE32 setups, which only expects it to be set for mixed 32B CQEs and not for SETUP_CQE32. The fix is slightly hacky, long term it's better to unify mixed and CQE32 handling. Fixes: e26dca67fde19 ("io_uring: add support for IORING_SETUP_CQE_MIXED") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e6889323c2184c700428dd4b90a1c2c06b8ae51f Author: Rafael J. Wysocki Date: Tue Nov 25 15:03:24 2025 +0100 Revert "ACPI: processor: idle: Rearrange declarations in header file" Revert commit bdf780fbcef5 ("ACPI: processor: idle: Rearrange declarations in header file") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 66e600a26ee7d845d9434c3d60cef4bbf7dd3eb4 Author: Rafael J. Wysocki Date: Tue Nov 25 14:53:33 2025 +0100 Revert "ACPI: processor: idle: Redefine two functions as void" Revert commit fbd401e95e56 ("ACPI: processor: idle: Redefine two functions as void") because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 34fa09c698d626b09f7824fe2c520a0a21a072b9 Author: Rafael J. Wysocki Date: Tue Nov 25 14:50:25 2025 +0100 Revert "ACPI: processor: Do not expose global variable acpi_idle_driver" Revert commit 559f2eacc8a2 ACPI: processor: Do not expose global variable acpi_idle_driver" because it depends on a problematic one. Signed-off-by: Rafael J. Wysocki commit 7c373b3bd03c77fe8f6ea206ed49375eb4d43d13 Author: Ville Syrjälä Date: Wed Nov 5 19:10:15 2025 +0200 drm/i915/psr: Reject async flips when selective fetch is enabled The selective fetch code doesn't handle asycn flips correctly. There is a nonsense check for async flips in intel_psr2_sel_fetch_config_valid() but that only gets called for modesets/fastsets and thus does nothing for async flips. Currently intel_async_flip_check_hw() is very unhappy as the selective fetch code pulls in planes that are not even async flips capable. Reject async flips when selective fetch is enabled, until someone fixes this properly (ie. disable selective fetch while async flips are being issued). Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251105171015.22234-1-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander (cherry picked from commit a5f0cc8e0cd4007370af6985cb152001310cf20c) Signed-off-by: Rodrigo Vivi commit 747528729c9b6733839f9c95f300d5bef95ee52c Author: Jisheng Zhang Date: Mon Nov 17 08:01:32 2025 +0800 mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level Commit 27e8fe0da3b7 ("mmc: sdhci-of-dwcmshc: Prevent stale command interrupt handling") clears pending interrupts when resetting host->pending_reset to ensure no pending stale interrupts after sdhci_threaded_irq restores interrupts. But this fix is only added for th1520 platforms, in fact per my test, this issue exists on all dwcmshc users, such as cv1800b, sg2002, and synaptics platforms. So promote the above reset handling from th1520 to ip level. And keep reset handling on rk, sg2042 and bf3 as is, until it's confirmed that the same issue exists on these platforms too. Fixes: 017199c2849c ("mmc: sdhci-of-dwcmshc: Add support for Sophgo CV1800B and SG2002") Signed-off-by: Jisheng Zhang Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 081156ce13f8fa4e97b5148dc54d8c0ddf02117b Author: Daniel Golle Date: Thu Nov 20 15:02:19 2025 +0000 net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs gpy_update_interface() returns early in case the PHY is internal or connected via USXGMII. In this case the gigabit master/slave property as well as MDI/MDI-X status also won't be read which seems wrong. Always read those properties by moving the logic to retrieve them to gpy_read_status(). Fixes: fd8825cd8c6fc ("net: phy: mxl-gpy: Add PHY Auto/MDI/MDI-X set driver for GPY211 chips") Fixes: 311abcdddc00a ("net: phy: add support to get Master-Slave configuration") Suggested-by: "Russell King (Oracle)" Signed-off-by: Daniel Golle Link: https://patch.msgid.link/71fccf3f56742116eb18cc070d2a9810479ea7f9.1763650701.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 82fca3d8a4a34667f01ec2351a607135249c9cff Author: Gui-Dong Han Date: Thu Nov 20 20:06:57 2025 +0800 atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race. The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos(). In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock. This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs. Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com Signed-off-by: Paolo Abeni commit f98e3ca2e4306a0c9deba1769248b25859db8a3d Merge: 7526183cfdbe35 d0b8fec8ae5052 Author: Paolo Abeni Date: Tue Nov 25 12:32:42 2025 +0100 Merge branch 'net-dsa-microchip-fix-resource-releases-in-error-path' Bastien Curutchet says: ==================== net: dsa: microchip: Fix resource releases in error path I worked on adding PTP support for the KSZ8463. While doing so, I ran into a few bugs in the resource release process that occur when things go wrong arount IRQ initialization. This small series fixes those bugs. The next series, which will add the PTP support, depend on this one. Signed-off-by: Bastien Curutchet (Schneider Electric) --- Bastien Curutchet (Schneider Electric) (5): net: dsa: microchip: common: Fix checks on irq_find_mapping() net: dsa: microchip: ptp: Fix checks on irq_find_mapping() net: dsa: microchip: Don't free uninitialized ksz_irq net: dsa: microchip: Free previously initialized ports on init failures net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() drivers/net/dsa/microchip/ksz_common.c | 31 +++++++++++++++---------------- drivers/net/dsa/microchip/ksz_ptp.c | 22 +++++++++------------- 2 files changed, 24 insertions(+), 29 deletions(-) --- base-commit: 09652e543e809c2369dca142fee5d9b05be9bdc7 change-id: 20251031-ksz-fix-db345df7635f Best regards, ==================== Link: https://patch.msgid.link/20251120-ksz-fix-v6-0-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit d0b8fec8ae50525b57139393d0bb1f446e82ff7e Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:04 2025 +0100 net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() The IRQ numbers created through irq_create_mapping() are only assigned to ptpmsg_irq[n].num at the end of the IRQ setup. So if an error occurs between their creation and their assignment (for instance during the request_threaded_irq() step), we enter the error path and fail to release the newly created virtual IRQs because they aren't yet assigned to ptpmsg_irq[n].num. Move the mapping creation to ksz_ptp_msg_irq_setup() to ensure symetry with what's released by ksz_ptp_msg_irq_free(). In the error path, move the irq_dispose_mapping to the out_ptp_msg label so it will be called only on created IRQs. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-5-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 0f80e21bf6229637e193248fbd284c0ec44bc0fd Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:03 2025 +0100 net: dsa: microchip: Free previously initialized ports on init failures If a port interrupt setup fails after at least one port has already been successfully initialized, the gotos miss some resource releasing: - the already initialized PTP IRQs aren't released - the already initialized port IRQs aren't released if the failure occurs in ksz_pirq_setup(). Merge 'out_girq' and 'out_ptpirq' into a single 'port_release' label. Behind this label, use the reverse loop to release all IRQ resources for all initialized ports. Jump in the middle of the reverse loop if an error occurs in ksz_ptp_irq_setup() to only release the port IRQ of the current iteration. Cc: stable@vger.kernel.org Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link") Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-4-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 25b62cc5b22c45face094ae3e8717258e46d1d19 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:02 2025 +0100 net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It leads to freeing uninitialized IRQ numbers and/or domains. Use dsa_switch_for_each_user_port_continue_reverse() in the error path to iterate only over the fully initialized ports. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-3-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 9e059305be41a5bd27e03458d8333cf30d70be34 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:01 2025 +0100 net: dsa: microchip: ptp: Fix checks on irq_find_mapping() irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, during the PTP IRQ setup, we verify that its returned value isn't negative. Fix the irq_find_mapping() check to enter the error path when 0 is returned. Return -EINVAL in such case. Cc: stable@vger.kernel.org Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-2-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 7b3c09e1667977edee11de94a85e2593a7c15e87 Author: Bastien Curutchet (Schneider Electric) Date: Thu Nov 20 10:12:00 2025 +0100 net: dsa: microchip: common: Fix checks on irq_find_mapping() irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found but it never returns a negative value. However, on each irq_find_mapping() call, we verify that the returned value isn't negative. Fix the irq_find_mapping() checks to enter error paths when 0 is returned. Return -EINVAL in such cases. CC: stable@vger.kernel.org Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link") Reviewed-by: Andrew Lunn Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20251120-ksz-fix-v6-1-891f80ae7f8f@bootlin.com Signed-off-by: Paolo Abeni commit 7526183cfdbe352c51c285762f0e15b7c428ea06 Author: Kai-Heng Feng Date: Thu Nov 20 12:15:33 2025 +0800 net: aquantia: Add missing descriptor cache invalidation on ATL2 ATL2 hardware was missing descriptor cache invalidation in hw_stop(), causing SMMU translation faults during device shutdown and module removal: [ 70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received: [ 70.361893] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0002060000000010 [ 70.367948] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000020000000000 [ 70.374002] arm-smmu-v3 arm-smmu-v3.5.auto: 0x00000000ff9bc000 [ 70.380055] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000000000000000 [ 70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0 [ 70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0 Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning hw cache it should be toggled") fixed cache invalidation for ATL B0, but ATL2 was left with only interrupt disabling. This allowed hardware to write to cached descriptors after DMA memory was unmapped, triggering SMMU faults. Once cache invalidation is applied to ATL2, the translation fault can't be observed anymore. Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both ATL B0 and ATL2 hw_stop() implementations for consistent behavior. Fixes: e54dcf4bba3e ("net: atlantic: basic A2 init/deinit hw_ops") Tested-by: Carol Soto Signed-off-by: Kai-Heng Feng Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251120041537.62184-1-kaihengf@nvidia.com Signed-off-by: Paolo Abeni commit 7b6dcd9bfd869eee7693e45b1817dac8c56e5f86 Author: Andrei Vagin Date: Sat Nov 22 07:19:53 2025 +0000 fs/namespace: fix reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns. grab_requested_mnt_ns() doesn't need to take an extra reference. Fixes: 78f0e33cd6c93 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns") Signed-off-by: Andrei Vagin Link: https://patch.msgid.link/20251122071953.3053755-1-avagin@google.com Signed-off-by: Christian Brauner commit eb76d0f5553575599561010f24c277cc5b31d003 Author: Thomas Zimmermann Date: Wed Nov 5 17:14:49 2025 +0100 drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs. VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array. Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly. Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer(). Serializes the helper with VGA switcheroo's call to fbcon_remap_all(). Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing. Signed-off-by: Thomas Zimmermann Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1] Fixes: 6a9ee8af344e ("vga_switcheroo: initial implementation (v15)") Acked-by: Javier Martinez Canillas Acked-by: Alex Deucher Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Cc: # v2.6.34+ Link: https://patch.msgid.link/20251105161549.98836-1-tzimmermann@suse.de commit 4fe5a00ec70717a7f1002d8913ec6143582b3c8e Author: Eric Dumazet Date: Fri Nov 21 15:41:00 2025 +0000 net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() syzbot reported that tcf_get_base_ptr() can be called while transport header is not set [1]. Instead of returning a dangling pointer, return NULL. Fix tcf_get_base_ptr() callers to handle this NULL value. [1] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 skb_transport_header include/linux/skbuff.h:3071 [inline] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 tcf_get_base_ptr include/net/pkt_cls.h:539 [inline] WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 em_nbyte_match+0x2d8/0x3f0 net/sched/em_nbyte.c:43 Modules linked in: CPU: 1 UID: 0 PID: 6019 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Call Trace: tcf_em_match net/sched/ematch.c:494 [inline] __tcf_em_tree_match+0x1ac/0x770 net/sched/ematch.c:520 tcf_em_tree_match include/net/pkt_cls.h:512 [inline] basic_classify+0x115/0x2d0 net/sched/cls_basic.c:50 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x4cf/0x1140 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xfd/0x4c0 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x4e/0x260 net/core/dev.c:4118 __dev_xmit_skb net/core/dev.c:4214 [inline] __dev_queue_xmit+0xe83/0x3b50 net/core/dev.c:4729 packet_snd net/packet/af_packet.c:3076 [inline] packet_sendmsg+0x3e33/0x5080 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x830 net/socket.c:2630 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+f3a497f02c389d86ef16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6920855a.a70a0220.2ea503.0058.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251121154100.1616228-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7c9580f44f90f7a4c11fc7831efe323ebe446091 Author: Kiryl Shutsemau Date: Thu Nov 20 16:14:11 2025 +0000 mm/filemap: fix logic around SIGBUS in filemap_map_pages() Chris noticed that filemap_map_pages() calculates can_map_large only once for the first page in the fault around range. The value is not valid for the following pages in the range and must be recalculated. Instead of recalculating can_map_large on each iteration, pass down file_end to filemap_map_folio_range() and let it make the decision on what can be mapped. Link: https://lkml.kernel.org/r/20251120161411.859078-1-kirill@shutemov.name Fixes: 74207de2ba10 ("mm/memory: do not populate page table entries beyond i_size")h Signed-off-by: Kiryl Shutsemau Reported-by: Chris Mason Reviewed-by: Matthew Wilcox (Oracle) Cc: Al Viro Cc: Baolin Wang Cc: Chris Mason Cc: Christian Brauner Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cff47b9e39a6abf03dde5f4f156f841b0c54bba0 Author: Wei Yang Date: Wed Nov 19 23:53:02 2025 +0000 mm/huge_memory: fix NULL pointer deference when splitting folio Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via mapping->flags before proceeding with the split work. This check introduced a bug: for shmem folios in the swap cache and truncated folios, the mapping pointer can be NULL. Accessing mapping->flags in this state leads directly to a NULL pointer dereference. This commit fixes the issue by moving the check for mapping != NULL before any attempt to access mapping->flags. Link: https://lkml.kernel.org/r/20251119235302.24773-1-richard.weiyang@gmail.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Wei Yang Reviewed-by: Zi Yan Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Baolin Wang Cc: Signed-off-by: Andrew Morton commit 6c96c6bd2c71fc7ee08580388a3a4a459019c320 Author: Pratyush Yadav Date: Tue Nov 18 19:24:15 2025 +0100 MAINTAINERS: add test_kho to KHO's entry Commit b753522bed0b7 ("kho: add test for kexec handover") introduced the KHO test but missed adding it to KHO's MAINTAINERS entry. Add it so the KHO maintainers can get patches for its test. Link: https://lkml.kernel.org/r/20251118182416.70660-1-pratyush@kernel.org Fixes: b753522bed0b7 ("kho: add test for kexec handover") Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Mike Rapoport Signed-off-by: Andrew Morton commit 52ac3f5829eea40cbcb74994e075ad4d7db7c88f Author: Sam Protsenko Date: Mon Nov 17 21:31:11 2025 -0600 mailmap: add entry for Sam Protsenko Use 'Sam Protsenko' as my name consistently in git-shortlog. Also map my old GlobalLogic email address to my current email to stay reachable. Link: https://lkml.kernel.org/r/20251118033111.23382-1-semen.protsenko@linaro.org Signed-off-by: Sam Protsenko Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit f0bb6dba3df32ecb4a7038ca549b21e9812aec5e Author: Carlos Llamas Date: Thu Nov 13 03:46:22 2025 +0000 selftests/mm: fix division-by-zero in uffd-unit-tests Commit 4dfd4bba8578 ("selftests/mm/uffd: refactor non-composite global vars into struct") moved some of the operations previously implemented in uffd_setup_environment() earlier in the main test loop. The calculation of nr_pages, which involves a division by page_size, now occurs before checking that default_huge_page_size() returns a non-zero This leads to a division-by-zero error on systems with !CONFIG_HUGETLB. Fix this by relocating the non-zero page_size check before the nr_pages calculation, as it was originally implemented. Link: https://lkml.kernel.org/r/20251113034623.3127012-1-cmllamas@google.com Fixes: 4dfd4bba8578 ("selftests/mm/uffd: refactor non-composite global vars into struct") Signed-off-by: Carlos Llamas Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Ujwal Kundur Cc: Brendan Jackman Cc: Liam Howlett Cc: Michal Hocko Cc: Peter Xu Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 270065f514c5da7b3deb4f6a96cf93e96551cf35 Author: Liam R. Howlett Date: Tue Nov 11 16:56:05 2025 -0500 mm/mmap_lock: reset maple state on lock_vma_under_rcu() retry The retry in lock_vma_under_rcu() drops the rcu read lock before reacquiring the lock and trying again. This may cause a use-after-free if the maple node the maple state was using was freed. The maple state is protected by the rcu read lock. When the lock is dropped, the state cannot be reused as it tracks pointers to objects that may be freed during the time where the lock was not held. Any time the rcu read lock is dropped, the maple state must be invalidated. Resetting the address and state to MA_START is the safest course of action, which will result in the next operation starting from the top of the tree. Prior to commit 0b16f8bed19c ("mm: change vma_start_read() to drop RCU lock on failure"), vma_start_read() would drop rcu read lock and return NULL, so the retry would not have happened. However, now that vma_start_read() drops rcu read lock on failure followed by a retry, we may end up using a freed maple tree node cached in the maple state. [surenb@google.com: changelog alteration] Link: https://lkml.kernel.org/r/CAJuCfpEWMD-Z1j=nPYHcQW4F7E2Wka09KTXzGv7VE7oW1S8hcw@mail.gmail.com Link: https://lkml.kernel.org/r/20251111215605.1721380-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Fixes: 0b16f8bed19c ("mm: change vma_start_read() to drop RCU lock on failure") Reported-by: syzbot+131f9eb2b5807573275c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=131f9eb2b5807573275c Acked-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Shakeel Butt Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit de8798965fd0d9a6c47fc2ac57767ec32de12b49 Author: Deepanshu Kartikey Date: Wed Nov 12 20:20:34 2025 +0530 mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosure to userspace 2. Folios are not marked uptodate before adding to page cache 3. hugetlb_fault_mutex is not taken before hugetlb_add_to_page_cache() The memfd allocation path bypasses the normal page fault handler (hugetlb_no_page) which would handle all of these initialization steps. This is problematic especially for udmabuf use cases where folios are pinned and directly accessed by userspace via DMA. Fix by matching the initialization pattern used in hugetlb_no_page(): - Zero the folio using folio_zero_user() which is optimized for huge pages - Mark it uptodate with folio_mark_uptodate() - Take hugetlb_fault_mutex before adding to page cache to prevent races The folio_zero_user() change also fixes a potential security issue where uninitialized kernel memory could be disclosed to userspace through read() or mmap() operations on the memfd. Link: https://lkml.kernel.org/r/20251112145034.2320452-1-kartikey406@gmail.com Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20251112031631.2315651-1-kartikey406@gmail.com/ [v1] Closes: https://syzkaller.appspot.com/bug?extid=f64019ba229e3a5c411b Suggested-by: Oscar Salvador Suggested-by: David Hildenbrand Tested-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Red Hat) Acked-by: Hugh Dickins Cc: Vivek Kasireddy Cc: Jason Gunthorpe Cc: Jason Gunthorpe (v2) Cc: Christoph Hellwig (v6) Cc: Dave Airlie Cc: Gerd Hoffmann Cc: Signed-off-by: Andrew Morton commit f5e31a196edcd1f1bb44f26b6f9299b9a5b9b3c4 Author: Youngjun Park Date: Sun Nov 2 17:24:56 2025 +0900 mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type() After commit 4f78252da887, nr_swap_pages is decremented in swap_range_alloc(). Since cluster_alloc_swap_entry() calls swap_range_alloc() internally, the decrement in get_swap_page_of_type() causes double-decrementing. As a representative userspace-visible runtime example of the impact, /proc/meminfo reports increasingly inaccurate SwapFree values. The discrepancy grows with each swap allocation, and during hibernation when large amounts of memory are written to swap, the reported value can deviate significantly from actual available swap space, misleading users and monitoring tools. Remove the duplicate decrement. Link: https://lkml.kernel.org/r/20251102082456.79807-1-youngjun.park@lge.com Fixes: 4f78252da887 ("mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc()") Signed-off-by: Youngjun Park Acked-by: Chris Li Reviewed-by: Barry Song Reviewed-by: Kairui Song Acked-by: Nhat Pham Cc: Baoquan He Cc: Kemeng Shi Cc: [6.17+] Signed-off-by: Andrew Morton commit 1a96f3a22fd88b8ea217233d359e0334981b0384 Author: Marek Szyprowski Date: Mon Nov 24 18:09:55 2025 +0100 iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink() Commit c288d657dd51 added support for DMA_ATTR_MMIO attribute in the dma_iova_link() code path, but missed that the CPU cache is being also touched in the dma_iova_unlink() path. Fix this. Fixes: c288d657dd51 ("iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link().") Signed-off-by: Marek Szyprowski Reviewed-by: Jason Gunthorpe Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20251124170955.3884351-1-m.szyprowski@samsung.com commit 971fb57429df5aa4e6efc796f7841e0d10b1e83c Author: Michael Chen Date: Thu Nov 13 12:56:43 2025 -0500 drm/amd/amdgpu: reserve vm invalidation engine for uni_mes Reserve vm invalidation engine 6 when uni_mes enabled. It is used in processing tlb flush request from host. Signed-off-by: Michael Chen Acked-by: Alex Deucher Reviewed-by: Shaoyun liu Signed-off-by: Alex Deucher (cherry picked from commit 873373739b9b150720ea2c5390b4e904a4d21505) Cc: stable@vger.kernel.org commit f6041803a831266a2a5a5b5af66f7de0845bcbf3 Author: Jens Axboe Date: Mon Nov 24 10:59:02 2025 -0700 io_uring/net: ensure vectored buffer node import is tied to notification When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification io_kiocb, sr->notif. For non-vectored imports, sr->notif is correctly used. This is important as the lifetime of the two may be different. Use the correct io_kiocb for the vectored buffer import. Cc: stable@vger.kernel.org Fixes: 23371eac7d9a ("io_uring/net: implement vectored reg bufs for zctx") Reported-by: Google Big Sleep Signed-off-by: Jens Axboe commit 8a2bcda5e139064b255531eb5889ff826a8b6995 Merge: ac3fd01e4c1efc fe680d8c747f4e Author: Linus Torvalds Date: Mon Nov 24 09:46:41 2025 -0800 Merge tag 'for-6.18/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - dm-pcache fixes - fix a regression with empty flush bios - dm-verity: fix unreliable memory allocation with GFP_NOWAIT * tag 'for-6.18/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-verity: fix unreliable memory allocation dm: fix failure when empty flush's bi_sector points beyond the device end dm-pcache: zero cache_info before default init dm-pcache: reuse meta_addr in pcache_meta_find_latest dm-pcache: allow built-in build and rename flush helper commit 03bc4831ef064e114328dea906101cff7c6fb8b3 Author: Wentao Guan Date: Fri Nov 14 11:05:39 2025 +0000 nvmem: layouts: fix nvmem_layout_bus_uevent correctly check the ENODEV return value. Fixes: 810b790033cc ("nvmem: layouts: fix automatic module loading") CC: stable@vger.kernel.org Co-developed-by: WangYuli Signed-off-by: WangYuli Signed-off-by: Wentao Guan Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110539.143154-1-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 74851fbb6d647304f8a7dc491434d3a335ef4b8d Author: Haotian Zhang Date: Mon Nov 24 10:22:15 2025 +0800 usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing pm_runtime_resume_and_get() to operate on uninitialized runtime PM state. Check the return value of devm_pm_runtime_enable() and return on failure. Fixes: 3e6e14ffdea4 ("usb: gadget: udc: add Renesas RZ/N1 USBF controller support") Signed-off-by: Haotian Zhang Acked-by: Herve Codina Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251124022215.1619-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 165eb13e485c5c25c7cb276ac85f788a2bd200cb Author: Jonathan Marek Date: Mon Nov 17 00:12:08 2025 -0500 arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY The "drop print" commit removed the whole branch and not just the print. For some ARM64 cpus, this leads to hard lockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not enabled. Fixes: 62e72463ca71 ("arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY") Signed-off-by: Jonathan Marek Signed-off-by: Will Deacon commit 7c16c02e86081355a54c50c045b0caa172e72028 Author: Marc Zyngier Date: Thu Oct 30 11:01:15 2025 +0000 ACPI: GTDT: Correctly number platform devices for MMIO timers Use the actual timer counter instead of the watchdog counter. Fixes: 5669d92f3efa ("ACPI: GTDT: Generate platform devices for MMIO timers") Reported-by: Pavan Kondeti Signed-off-by: Marc Zyngier Cc: Hanjun Guo Cc: Sudeep Holla Cc: Rafael J. Wysocki Cc: Daniel Lezcano Cc: Thomas Gleixner Cc: Mark Rutland Acked-by: Hanjun Guo Signed-off-by: Will Deacon commit 9238fa35a3c04835a77988a14e1397763cf0eabe Author: Will Deacon Date: Mon Nov 24 13:08:43 2025 +0000 Revert "arm64: acpi: Enable ACPI CCEL support" This reverts commit d02c2e45b1e7767b177f6854026e4ad0d70b4a4d. Mauro reports that this breaks APEI notifications on his QEMU setup because the "reserved for firmware" region still needs to be writable by Linux in order to signal _back_ to the firmware after processing the reported error: | {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1 | ... | [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error | Unable to handle kernel write to read-only memory at virtual address ffff800080035018 | Mem abort info: | ESR = 0x000000009600004f | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x0f: level 3 permission fault | Data abort info: | ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000505d7000 | pgd=10000000510bc003, p4d=1000000100229403, pud=100000010022a403, pmd=100000010022b403, pte=0060000139b90483 | Internal error: Oops: 000000009600004f [#1] SMP For now, revert the offending commit. We can presumably switch back to PAGE_KERNEL when bringing this back in the future. Link: https://lore.kernel.org/r/20251121224611.07efa95a@foz.lan Reported-by: Mauro Carvalho Chehab Signed-off-by: Will Deacon commit 9b9c0adbc3f8a524d291baccc9d0c04097fb4869 Author: Dan Carpenter Date: Fri Nov 21 20:51:28 2025 +0300 platform/x86: intel: punit_ipc: fix memory corruption This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersand). This means that the: complete(&ipcdev->cmd_complete); in intel_punit_ioc() will write to a wrong memory address corrupting it. Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 620a8f131154250f6a64a07d049a4f235d6451a5 Author: Johan Hovold Date: Mon Sep 22 14:20:12 2025 +0200 drm: sti: fix device leaks at component probe Make sure to drop the references taken to the vtg devices by of_find_device_by_node() when looking up their driver data during component probe. Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns. Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure") Cc: stable@vger.kernel.org # 4.16 Cc: Benjamin Gaignard Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org Signed-off-by: Raphael Gallais-Pou commit a90903c2a3c38bce475f46ea3f93dbf6a9971553 Author: Haotian Zhang Date: Mon Nov 24 09:58:52 2025 +0800 spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value, potentially causing runtime PM operations to fail silently after autosuspend configuration. Check the return value of devm_pm_runtime_enable() and return on failure. Fixes: 909fac05b926 ("spi: add support for Amlogic A1 SPI Flash Controller") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251124015852.937-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit c98c99d5dbdf9fb0063650594edfd7d49b5f4e29 Author: Jon Hunter Date: Fri Nov 21 14:10:03 2025 +0000 pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag Commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") kept power-domains on longer during boot which is causing some GPU related tests to fail on Tegra234. While this is being investigated, add the flag GENPD_FLAG_NO_STAY_ON for Tegra devices to restore the previous behaviour to fix this. Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Signed-off-by: Jon Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c1bac49fe91f7c10fec95e6ef8304062202d5263 Author: AngeloGioacchino Del Regno Date: Fri Nov 21 13:52:12 2025 +0100 pmdomains: mtk-pm-domains: Fix spinlock recursion in probe For some reason, of_find_node_with_property() is creating a spinlock recursion issue along with fwnode_count_parents(), and this issue is making all MediaTek boards unbootable. As of kernel v6.18-rc6, there are only three users of this function, one of which is this driver. Migrate away from of_find_node_with_property() by adding a local scpsys_get_legacy_regmap_node() function, which acts similarly to of_find_node_with_property(), and calling the former in place of the latter. This resolves the following spinlock recursion issue: [ 1.773979] BUG: spinlock recursion on CPU#2, kworker/u24:1/60 [ 1.790485] lock: devtree_lock+0x0/0x40, .magic: dead4ead, .owner: kworker/u24:1/60, .owner_cpu: 2 [ 1.791644] CPU: 2 UID: 0 PID: 60 Comm: kworker/u24:1 Tainted: G W 6.18.0-rc6 #3 PREEMPT [ 1.791649] Tainted: [W]=WARN [ 1.791650] Hardware name: MediaTek Genio-510 EVK (DT) [ 1.791653] Workqueue: events_unbound deferred_probe_work_func [ 1.791658] Call trace: [ 1.791659] show_stack+0x18/0x30 (C) [ 1.791664] dump_stack_lvl+0x68/0x94 [ 1.791668] dump_stack+0x18/0x24 [ 1.791672] spin_dump+0x78/0x88 [ 1.791678] do_raw_spin_lock+0x110/0x140 [ 1.791684] _raw_spin_lock_irqsave+0x58/0x6c [ 1.791690] of_get_parent+0x28/0x74 [ 1.791694] of_fwnode_get_parent+0x38/0x7c [ 1.791700] fwnode_count_parents+0x34/0xf0 [ 1.791705] fwnode_full_name_string+0x28/0x120 [ 1.791710] device_node_string+0x3e4/0x50c [ 1.791715] pointer+0x294/0x430 [ 1.791718] vsnprintf+0x21c/0x5bc [ 1.791722] vprintk_store+0x108/0x47c [ 1.791728] vprintk_emit+0xc4/0x350 [ 1.791732] vprintk_default+0x34/0x40 [ 1.791736] vprintk+0x24/0x30 [ 1.791740] _printk+0x60/0x8c [ 1.791744] of_node_release+0x154/0x194 [ 1.791749] kobject_put+0xa0/0x120 [ 1.791753] of_node_put+0x18/0x28 [ 1.791756] of_find_node_with_property+0x74/0x100 [ 1.791761] scpsys_probe+0x338/0x5e0 [ 1.791765] platform_probe+0x5c/0xa4 [ 1.791770] really_probe+0xbc/0x2ac [ 1.791774] __driver_probe_device+0x78/0x118 [ 1.791779] driver_probe_device+0x3c/0x170 [ 1.791783] __device_attach_driver+0xb8/0x150 [ 1.791788] bus_for_each_drv+0x88/0xe8 [ 1.791792] __device_attach+0x9c/0x1a0 [ 1.791796] device_initial_probe+0x14/0x20 [ 1.791801] bus_probe_device+0xa0/0xa4 [ 1.791805] deferred_probe_work_func+0x88/0xd0 [ 1.791809] process_one_work+0x1e8/0x448 [ 1.791813] worker_thread+0x1ac/0x340 [ 1.791816] kthread+0x138/0x220 [ 1.791821] ret_from_fork+0x10/0x20 Fixes: c29345fa5f66 ("pmdomain: mediatek: Refactor bus protection regmaps retrieval") Signed-off-by: AngeloGioacchino Del Regno Tested-by: Louis-Alexis Eyraud Tested-by: Macpaul Lin Reviewed-by: Macpaul Lin Signed-off-by: Ulf Hansson commit ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d Author: Linus Torvalds Date: Sun Nov 23 14:53:16 2025 -0800 Linux 6.18-rc7 commit d0e88704d96ca0df77717320fec4ebabe42c8a94 Merge: 1af5c1d3a90246 3c493b524ffdb3 Author: Linus Torvalds Date: Sun Nov 23 12:03:28 2025 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Fixes for the Allwinner A523 clk driver: - Lower the minimum rate for the A523 audio PLL to support frequencies required by audio devices - Mark a couple clks critical on A523 so that Linux doesn't turn them off when they're used by other code like TF-A" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical commit 1af5c1d3a90246a15225fc7de0ed7e5f9b2f3f98 Merge: e624f7377599d1 20739af07383e6 Author: Linus Torvalds Date: Sun Nov 23 08:23:30 2025 -0800 Merge tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix a race in timer->function clearing in timer_shutdown_sync() - Fix a timekeeper sysfs-setup resource leak in error paths - Fix the NOHZ report_idle_softirq() syslog rate-limiting logic to have no side effects on the return value * tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers: Fix NULL function pointer race in timer_shutdown_sync() timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths tick/sched: Fix bogus condition in report_idle_softirq() commit e624f7377599d1f82190b17bdf7d8e735c0576ee Merge: d13f3ac64efb86 f1f96511b1c4c3 Author: Linus Torvalds Date: Sun Nov 23 08:20:15 2025 -0800 Merge tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Fix perf CPU-clock counters, and address a static checker warning" * tag 'perf-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix 0 count issue of cpu-clock perf/x86/intel/uncore: Remove superfluous check commit 20739af07383e6eb1ec59dcd70b72ebfa9ac362c Author: Yipeng Zou Date: Sat Nov 22 09:39:42 2025 +0000 timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running. Fixes: 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions") Signed-off-by: Yipeng Zou Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com commit d13f3ac64efb868d09cb2726b1e84929afe90235 Merge: 0629dcf772e66f 14b46ba92bf547 Author: Linus Torvalds Date: Sat Nov 22 12:55:18 2025 -0800 Merge tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fix CPU type in DT for econet - Fix for Malta PCI MMIO breakage for SOC-it - Fix TLB shutdown caused by iniital uniquification - Fix random seg faults due to missed vdso storage requirement * tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: kernel: Fix random segmentation faults MIPS: mm: Prevent a TLB shutdown on initial uniquification mips: dts: econet: fix EN751221 core type MIPS: Malta: Fix !EVA SOC-it PCI MMIO commit 0629dcf772e66ff9b81822af0e29ae2c7d03068f Merge: 89edd36fd801ef 141fbbecec0e71 Author: Linus Torvalds Date: Sat Nov 22 11:53:53 2025 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix another KMSAN warning that made it in while KMSAN wasn't working reliably" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x() commit 89edd36fd801efdb3d2f38bbf7791a293c24bb45 Merge: 7e29f077609413 678e1cc2f482e0 Author: Linus Torvalds Date: Sat Nov 22 10:23:34 2025 -0800 Merge tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Carlos Maiolino: "A single out-of-bounds fix, nothing special" * tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix out of bounds memory read error in symlink repair commit 7e29f077609413f94f70d4da4d7602a59abad991 Merge: ebd975458deada 90449f2d1e1f02 Author: Linus Torvalds Date: Sat Nov 22 10:16:21 2025 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "One target driver fix and one scsi-generic one. The latter is 10 lines because the problem lock has to be dropped and re-taken around the call causing the sleep in atomic" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sg: Do not sleep in atomic context scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() commit ebd975458deada5eadcc9f4e0f63fc4ce6aa90ea Merge: a6ff0d85ebf0d4 ae8966b7b5bd69 Author: Linus Torvalds Date: Sat Nov 22 09:58:41 2025 -0800 Merge tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of devices it is supposed to be set for - a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver - Goodix driver no longer tries to set reset pin as "input" as it causes issues when there is no pull up resistor installed on the board - fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to deal with potential out-of-bounds access and memory corruption issues * tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD Input: cros_ec_keyb - fix an invalid memory access Input: imx_sc_key - fix memory corruption on unload Input: pegasus-notetaker - fix potential out-of-bounds access Input: goodix - remove setting of RST pin to input Input: goodix - add support for ACPI ID GDIX1003 commit a6ff0d85ebf0d4033c9850bf7f77fdaf472191a1 Merge: 5703357ede59ce e2cb69263e797c Author: Linus Torvalds Date: Sat Nov 22 09:44:50 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Correct the MIPS RISC-V/JEDEC vendor ID - Fix the system shutdown behavior in the legacy case where CONFIG_RISCV_SBI_V01 is set, but the firmware implementation doesn't support the older v0.1 system shutdown method - Align some tools/ macro definitions with the corresponding kernel headers * tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: tools: riscv: Fixed misalignment of CSR related definitions riscv: sbi: Prefer SRST shutdown over legacy riscv: Update MIPS vendor id to 0x127 commit 5703357ede59ce8b0af11e02c374a3db73c55ee8 Merge: 2eba5e05d9bcf4 3ded250b97c3ae Author: Linus Torvalds Date: Sat Nov 22 09:24:36 2025 -0800 Merge tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: "Three SELinux patches for v6.18 to fix issues around accessing the per-task decision cache that we introduced in v6.16 to help reduce SELinux overhead on path walks. The problem was that despite the cache being located in the SELinux "task_security_struct", the parent struct wasn't actually tied to the task, it was tied to a cred. Historically SELinux did locate the task_security_struct in the task_struct's security blob, but it was later relocated to the cred struct when the cred work happened, as it made the most sense at the time. Unfortunately we never did the task_security_struct to cred_security_struct rename work (avoid code churn maybe? who knows) because it didn't really matter at the time. However, it suddenly became a problem when we added a per-task cache to a per-cred object and didn't notice because of the old, no-longer-correct struct naming. Thanks to KCSAN for flagging this, as the silly humans running things forgot that the task_security_struct was a big lie. This contains three patches, only one of which actually fixes the problem described above and moves the SELinux decision cache from the per-cred struct to a newly (re)created per-task struct. The other two patches, which form the bulk of the diffstat, take care of the associated renaming tasks so we can hopefully avoid making the same stupid mistake in the future. For the record, I did contemplate sending just a fix for the cache, leaving the renaming patches for the upcoming merge window, but the type/variable naming ended up being pretty awful and would have made v6.18 an outlier stuck between the "old" names and the "new" names in v6.19. The renaming patches are also fairly mechanical/trivial and shouldn't pose much risk despite their size. TLDR; naming things may be hard, but if you mess it up bad things happen" * tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: rename the cred_security_struct variables to "crsec" selinux: move avdcache to per-task security struct selinux: rename task_security_struct to cred_security_struct commit df5fde297e617041449f603ed5f646861c80000b Author: Alan Stern Date: Fri Nov 21 16:29:34 2025 -0500 USB: storage: Remove subclass and protocol overrides from Novatek quirk A report from Oleg Smirnov indicates that the unusual_devs quirks entry for the Novatek camera does not need to override the subclass and protocol parameters: [3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd [3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00 [3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [3266355.333043] usb 1-3: Product: YICARCAM [3266355.333045] usb 1-3: Manufacturer: XIAO-YI [3266355.333047] usb 1-3: SerialNumber: 966110000000100 [3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected [3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000 [3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1) Please send a copy of this message to and The overrides are harmless but they do provoke the driver into logging this annoying message. Update the entry to remove the unneeded entries. Reported-by: stealth Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/ Fixes: 6ca8af3c8fb5 ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera") Signed-off-by: Alan Stern Cc: stable Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 8a4dfa8fa6b5ed35659ffeed6bcc10dd98ad36e9 Merge: ec3803b5917b6f 545d7827b2cd5d Author: Jakub Kicinski Date: Fri Nov 21 18:18:47 2025 -0800 Merge tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sock: Prevent race in socket write iter and sock bind - hci_core: Fix triggering cmd_timer for HCI_OP_NOP - hci_core: lookup hci_conn on RX path on protocol side - SMP: Fix not generating mackey and ltk when repairing - btusb: mediatek: Fix kernel crash when releasing mtk iso interface - btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref * tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: SMP: Fix not generating mackey and ltk when repairing Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref Bluetooth: hci_core: lookup hci_conn on RX path on protocol side Bluetooth: hci_sock: Prevent race in socket write iter and sock bind Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface ==================== Link: https://patch.msgid.link/20251121145332.177015-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit ec3803b5917b6ff2f86ea965d0985c95d8a85119 Author: Daniel Golle Date: Thu Nov 20 14:17:13 2025 +0000 net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY As the interface mode doesn't need to be updated on PHYs connected with USXGMII and integrated PHYs, gpy_update_interface() should just return 0 in these cases rather than -EINVAL which has wrongly been introduced by commit 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type"), as this breaks support for those PHYs. Fixes: 7a495dde27ebc ("net: phy: mxl-gpy: Change gpy_update_interface() function return type") Signed-off-by: Daniel Golle Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/f744f721a1fcc5e2e936428c62ff2c7d94d2a293.1763648168.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 9f393d8e757f79060baf4b2e703bd6b2d0d8d323 Author: Sergey Matyukevich Date: Wed Nov 19 23:35:06 2025 +0300 riscv: dts: allwinner: d1: fix vlenb property According to [1], the C906 vector registers are 128 bits wide. The 'thead,vlenb' property specifies the vector register length in bytes, so its value must be set to 16. [1] https://dl.linux-sunxi.org/D1/Xuantie_C906_R1S0_User_Manual.pdf Fixes: ce1daeeba600 ("riscv: dts: allwinner: Add xtheadvector to the D1/D1s devicetree") Signed-off-by: Sergey Matyukevich Link: https://patch.msgid.link/20251119203508.1032716-1-geomatsi@gmail.com Signed-off-by: Chen-Yu Tsai commit fe7cdcd1bacec3a54ec94131292b5c883cec50cf Merge: 65c4ba832d0952 e19d7f7e92e061 Author: Arnd Bergmann Date: Fri Nov 21 21:27:20 2025 +0100 Merge tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes QCOMTEE fixes2 for v6.18 - initialize result before use in in error path - fix uninitialized pointers with free attribute * tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: qcomtee: initialize result before use in release worker tee: qcomtee: fix uninitialized pointers with free attribute Signed-off-by: Arnd Bergmann commit 65c4ba832d09529eebafde527d18092b69ab1938 Merge: 2eba5e05d9bcf4 e89ee35567d3d4 Author: Arnd Bergmann Date: Fri Nov 21 21:26:38 2025 +0100 Merge tag 'imx-fixes-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.18, 2nd round: - Correct i.MX8DXL's pcie-ep interrupt number (Frank Li) - Swap interrupt numbers of eqos for imx8dxl-ss-conn (Frank Li) - Correct SAI3 interrupt line for i.MX6UL (Maarten Zanders) - Correct mux-controller select/enable-gpios polarity for imx8qm-mek board (Xu Yang) * tag 'imx-fixes-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity ARM: dts: nxp: imx6ul: correct SAI3 interrupt line arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos arm64: dts: imx8dxl: Correct pcie-ep interrupt number Signed-off-by: Arnd Bergmann commit b07bf253ef8e48e7ff0b378f441a180a8ad37124 Author: Gustavo A. R. Silva Date: Mon Nov 10 20:35:31 2025 +0900 iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that struct iommufd_vevent is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: drivers/iommu/iommufd/iommufd_private.h:621:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Link: https://patch.msgid.link/r/aRHOAwpATIE0oajj@kspp Signed-off-by: "Gustavo A. R. Silva" Fixes: e36ba5ab808e ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC") Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit ac84ff453305d12bc799074a9f9af30ff97fff70 Author: Gustavo A. R. Silva Date: Tue Nov 11 18:01:24 2025 +0900 iommufd/driver: Fix counter initialization for counted_by annotation One of the requirements for counted_by annotations is that the counter member must be initialized before the first reference to the flexible-array member. Move the vevent->data_len = data_len; initialization to before the first access to flexible array vevent->event_data. Link: https://patch.msgid.link/r/aRL7ZFFqM5bRTd2D@kspp Cc: stable@vger.kernel.org Fixes: e8e1ef9b77a7 ("iommufd/viommu: Add iommufd_viommu_report_event helper") Signed-off-by: "Gustavo A. R. Silva" Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 2eba5e05d9bcf4cdea995ed51b0f07ba0275794a Merge: e3fe48f9bdf47e 677e6123e3d24a Author: Linus Torvalds Date: Fri Nov 21 11:16:14 2025 -0800 Merge tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Use UAPI types in ptrace UAPI header to fix nolibc ptrace. Fix CPU name display, NUMA node parsing, kexec/kdump, PCI init and BPF trampoline" * tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: BPF: Disable trampoline for kernel module function trace LoongArch: Don't panic if no valid cache info for PCI LoongArch: Mask all interrupts during kexec/kdump LoongArch: Fix NUMA node parsing with numa_memblks LoongArch: Consolidate CPU names in /proc/cpuinfo LoongArch: Use UAPI types in ptrace UAPI header commit e3fe48f9bdf47e0de91ffb7ba10d94a6a7598e8f Merge: a07a003ce6d475 d5227c88174c38 Author: Linus Torvalds Date: Fri Nov 21 11:14:21 2025 -0800 Merge tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix potential memory leak in mount - Add some missing read tracepoints - Fix locking issue with directory leases * tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Add the smb3_read_* tracepoints to SMB1 cifs: fix memory leak in smb3_fs_context_parse_param error path smb: client: introduce close_cached_dir_locked() commit a07a003ce6d475014e71e1c4f52f4ed7146dd35e Merge: a4165ffc835fcf 46447367a52965 Author: Linus Torvalds Date: Fri Nov 21 11:09:57 2025 -0800 Merge tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a mixup of arguments for the skb_queue_splice() call, in the io_uring timestamp retrieval code" * tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cmd_net: fix wrong argument types for skb_queue_splice() commit a4165ffc835fcf738c2ff41ce8305b04454c07d0 Merge: 317c4d8a2a320a 49c2d5941c8906 Author: Linus Torvalds Date: Fri Nov 21 10:59:35 2025 -0800 Merge tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: "NVMe pull request via Keith: - Admin queue use-after-free fix (Keith) - Target authentication fix (Alistar) - Multipath lockdeup fix (Shin'ichiro) - FC transport teardown fixes (Ewan)" * tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() nvme-multipath: fix lockdep WARN due to partition scan work nvmet-auth: update sc_c in target host hash calculation nvme: fix admin request_queue lifetime commit 317c4d8a2a320a58997f30a5b2a8eca57e0990fc Merge: 68d804c64a595d 91842ed844a068 Author: Linus Torvalds Date: Fri Nov 21 10:53:23 2025 -0800 Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Niklas Cassel: - Add a missing refcount decrement in ata_scsi_dev_rescan() when the device or its queue is not running. In the case where the device is running, the recount is already decremented properly (Yihang Li) - Generate the proper sense code for a Security locked device. There was a regression caused by a recent change of how sense data is generated for commands that did not provide any sense data. This broke system suspend for Security locked devices. Generate the sense data that the SCSI disk driver expects for a Security locked device so that system suspend works again (me) - Set capacity to zero for a Security locked device. All I/O commands will be aborted by a Security locked device. Thus, the block layer disk partition scanning will result in a bunch of, for the user, confusing I/O errors in dmesg during boot. Since a Security locked device is unusable anyway, set the capacity to zero, to avoid the disk partition scanning during boot. We still create the block device in /dev such that the user may unlock the device using e.g. hdparm (me) * tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Set capacity to zero for a security locked drive ata: libata-scsi: Fix system suspend for a security locked drive ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() commit 68d804c64a595dd7f885759f3c3bd51ca893deb4 Merge: 2c26574cc4ea41 79afd3c5edac93 Author: Linus Torvalds Date: Fri Nov 21 10:47:24 2025 -0800 Merge tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fix register naming in the Mediatek mt8189 driver - Select REGMAP_MMIO for the Realtek RTD driver - Fix the number of items in groups in the Toshiba Visconti driver - Fix a memory leak in the Cirrus CS42L43 driver - Fix a deadlock (!) in Qualcomm pinmux configuration - Fix use of uninitialized memory and list initialization in the S32CC pin controller * tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc pinctrl: qcom: msm: Fix deadlock in pinmux configuration pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups pinctrl: realtek: Select REGMAP_MMIO for RTD driver pinctrl: mediatek: mt8189: align register base names to dt-bindings ones pinctrl: mediatek: mt8196: align register base names to dt-bindings ones commit 2c26574cc4ea41266d9a09441d0e05a9f09192de Merge: c6d732c3bd4137 2b6d546ba83e83 Author: Linus Torvalds Date: Fri Nov 21 10:43:58 2025 -0800 Merge tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a use-after-free bug in GPIO character device code - update MAINTAINERS * tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: update my email address gpio: cdev: make sure the cdev fd is still active before emitting events commit 141fbbecec0e71fa6b35d08c7d3dba2f9853a4ee Author: Eric Biggers Date: Thu Nov 20 19:34:31 2025 -0800 lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x() Fully initialize *ctx, including the buf field which sha256_init() doesn't initialize, to avoid a KMSAN warning when comparing *ctx to orig_ctx. This KMSAN warning slipped in while KMSAN was not working reliably due to a stackdepot bug, which has now been fixed. Fixes: 6733968be7cb ("lib/crypto: tests: Add tests and benchmark for sha256_finup_2x()") Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251121033431.34406-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c6d732c3bd41375d176447b043274396268aa6ab Merge: a48f8229089823 40b53db87c998b Author: Linus Torvalds Date: Fri Nov 21 09:55:55 2025 -0800 Merge tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "A range of small fixes across the board, the i915 display disambiguation is probably the biggest otherwise amdgpu and xe as usual with tegra, nouveau, radeon and a core atomic fix. Looks mostly normal. atomic: - Return error codes on failed blob creation for planes nouveau: - Fix memory leak tegra: - Fix device ref counting - Fix pid ref counting - Revert booting on Pixel C xe: - Fix out-of-bounds access with BIT() - Fix kunit test checking wrong condition - Drop duplicate kconfig select - Fix guc2host irq handler with MSI-X i915: - Wildcat Lake and Panther Lake detangled for display fixes amdgpu: - DTBCLK gating fix - EDID fetching retry improvements - HDMI HPD debounce filtering - DCN 2.0 cursor fix - DP MST PBN fix - VPE fix - GC 11 fix - PRT fix - MMIO remap page fix - SR-IOV fix radeon: - Fence deadlock fix" * tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) drm/amdgpu: Add sriov vf check for VCN per queue reset support. drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled drm/amd: Skip power ungate during suspend for VPE drm/plane: Fix create_in_format_blob() return value drm/xe/irq: Handle msix vector0 interrupt drm/xe: Remove duplicate DRM_EXEC selection from Kconfig drm/xe/kunit: Fix forcewake assertion in mocs test drm/xe: Prevent BIT() overflow when handling invalid prefetch region drm/radeon: delete radeon_fence_process in is_signaled, no deadlock drm/amd/display: Fix pbn to kbps Conversion drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 drm/amd/display: Add an HPD filter for HDMI drm/amd/display: Increase DPCD read retries drm/amd/display: Move sleep into each retry for retrieve_link_cap() drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A drm/i915/display: Add definition for wcl as subplatform drm/pcids: Split PTL pciids group to make wcl subplatform ... commit a48f822908982353c3256e35a089e9e7d0d61580 Author: Linus Torvalds Date: Fri Nov 21 09:29:02 2025 -0800 samples: work around glibc redefining some of our defines wrong Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in . Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things. Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid. Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values. It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does #define AT_RENAME_NOREPLACE 0x0001 while glibc does # define RENAME_NOREPLACE (1 << 0) # define AT_RENAME_NOREPLACE RENAME_NOREPLACE instead. Same value in the end, but very different macro definition. For absolutely no reason. This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions. Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes. Signed-off-by: Linus Torvalds commit 83c53f1a2d6c4c8c19354b926367d0e82dcd6386 Author: Matt Coster Date: Fri Nov 21 15:20:31 2025 +0000 drm/imagination: Document pvr_device.power member Automated testing caught this missing doc comment; add something suitable (and useful). Fixes: 330e76d31697 ("drm/imagination: Add power domain control") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20251106152448.453b53ad@canb.auug.org.au/ Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20251121-device-power-doc-fix-v2-1-3417779f36c7@imgtec.com Signed-off-by: Matt Coster commit 752630cb8c62abca0407f96cc7baa2e13335cd15 Author: Sebastian Reichel Date: Wed Nov 19 01:41:41 2025 +0100 platform: arm64: thinkpad-t14s-ec: sleep after EC access The ACPI ECRD and ECWR functions have a 10ms sleep at the end. It turns out, that this is sometimes needed to avoid I2C transmission failures, especially for functions doing regmap_update_bits (and thus read + write shortly after each other). This fixes problems like the following appearing in the kernel log: leds platform::micmute: Setting an LED's brightness failed (-6) leds platform::kbd_backlight: Setting an LED's brightness failed (-6) The ACPI QEVT function used to read the interrupt status register also has a 10ms sleep at the end. Without that there are problems with reading multiple events following directly after each other resulting in the following error message being logged: thinkpad-t14s-ec 4-0028: Failed to read event Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-2-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 29be646f75c4406bdd8322572a6054ebd22bf63b Author: Sebastian Reichel Date: Wed Nov 19 01:41:40 2025 +0100 platform: arm64: thinkpad-t14s-ec: fix IRQ race condition Fix a race condition, that an input key related interrupt might be triggered before the input handler has been registered, which results in a NULL pointer dereference. This can happen if the user enables the keyboard backlight shortly before the driver is being probed. This fixes the following backtrace visible in dmesg: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e0 ... Call trace: sparse_keymap_report_event+0x2c/0x978 [sparse_keymap] (P) t14s_ec_irq_handler+0x190/0x3e8 [lenovo_thinkpad_t14s] irq_thread_fn+0x30/0xb8 irq_thread+0x18c/0x3b0 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Fixes: 60b7ab6ce030 ("platform: arm64: thinkpad-t14s-ec: new driver") Signed-off-by: Sebastian Reichel Reviewed-by: Bryan O'Donoghue Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-1-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d6732ef4ab252e5753be7acad87b0a91cfd06953 Author: Devarsh Thakkar Date: Thu Oct 30 20:46:35 2025 +0530 drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR The sii902x driver was caching HDMI detection state in a sink_is_hdmi field and checking it in mode_set() to determine whether to set HDMI or DVI output mode. This approach had two problems: 1. With DRM_BRIDGE_ATTACH_NO_CONNECTOR (used by modern display drivers like TIDSS), the bridge's get_modes() is never called. Instead, the drm_bridge_connector helper calls the bridge's edid_read() and updates the connector itself. This meant sink_is_hdmi was never populated, causing the driver to default to DVI mode and breaking HDMI audio. 2. The mode_set() callback doesn't receive atomic state or connector pointer, making it impossible to check connector->display_info.is_hdmi directly at that point. Fix this by moving the HDMI vs DVI decision from mode_set() to atomic_enable(), where we can access the connector via drm_atomic_get_new_connector_for_encoder(). This works for both connector models: - With DRM_BRIDGE_ATTACH_NO_CONNECTOR: Returns the drm_bridge_connector created by the display driver, which has already been updated by the helper's call to drm_edid_connector_update() - Without DRM_BRIDGE_ATTACH_NO_CONNECTOR (legacy): Returns the connector embedded in sii902x struct, which gets updated by the bridge's own get_modes() Fixes: 3de47e1309c2 ("drm/bridge: sii902x: use display info is_hdmi") Signed-off-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251030151635.3019864-1-devarsht@ti.com commit 9f0c21bac5a8089e74b21d007e26fb4594b10d73 Author: Carlos Song Date: Mon Nov 17 11:03:55 2025 +0800 spi: spi-fsl-lpspi: fix watermark truncation caused by type cast 't->len' is an unsigned integer, while 'watermark' and 'txfifosize' are u8. Using min_t with typeof(watermark) forces both values to be cast to u8, which truncates len when it exceeds 255. For example, len = 4096 becomes 0 after casting, resulting in an incorrect watermark value. Use a wider type in min_t to avoid truncation and ensure the correct minimum value is applied. Fixes: a750050349ea ("spi: spi-fsl-lpspi: use min_t() to improve code") Signed-off-by: Carlos Song Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20251117030355.1359081-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 26d56a9fcb2014b99e654127960aa0a48a391e3c Author: Owen Gu Date: Thu Nov 20 20:33:36 2025 +0800 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory address during URB callback handling. Specifically, this happens when the dma_direct_unmap_sg() function is called within the usb_hcd_unmap_urb_for_dma() interface, but the sg->dma_address field is 0 and the sg data structure has already been freed. The SCSI driver sends transfer commands by invoking uas_queuecommand_lck() in uas.c, using the uas_submit_urbs() function to submit requests to USB. Within the uas_submit_urbs() implementation, three URBs (sense_urb, data_urb, and cmd_urb) are sequentially submitted. Device removal may occur at any point during uas_submit_urbs execution, which may result in URB submission failure. However, some URBs might have been successfully submitted before the failure, and uas_submit_urbs will return the -ENODEV error code in this case. The current error handling directly calls scsi_done(). In the SCSI driver, this eventually triggers scsi_complete() to invoke scsi_end_request() for releasing the sgtable. The successfully submitted URBs, when being unlinked to giveback, call usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg unmapping operations since the sg data structure has already been freed. This patch modifies the error condition check in the uas_submit_urbs() function. When a UAS device is removed but one or more URBs have already been successfully submitted to USB, it avoids immediately invoking scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully submitted URBs is completed before devinfo->resetting being set, then the scsi_done() function will be called within uas_try_complete() after all pending URB operations are finalized. Otherwise, the scsi_done() function will be called within uas_zap_pending(), which is executed after usb_kill_anchored_urbs(). The error handling only takes effect when uas_queuecommand_lck() calls uas_submit_urbs() and returns the error value -ENODEV . In this case, the device is disconnected, and the flow proceeds to uas_disconnect(), where uas_zap_pending() is invoked to call uas_try_complete(). Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub") Cc: stable Signed-off-by: Yu Chen Signed-off-by: Owen Gu Acked-by: Oliver Neukum Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com Signed-off-by: Greg Kroah-Hartman commit e4037689a366743c4233966f0e74bc455820d316 Author: Manish Nagar Date: Thu Nov 20 13:14:35 2025 +0530 usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests()`, leading to premature freeing of USB requests and subsequent crashes. Three distinct execution paths interact with `dwc3_remove_requests()`: Path 1: Triggered via `dwc3_gadget_reset_interrupt()` during USB reset handling. The call stack includes: - `dwc3_ep0_reset_state()` - `dwc3_ep0_stall_and_restart()` - `dwc3_ep0_out_start()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 2: Also initiated from `dwc3_gadget_reset_interrupt()`, but through `dwc3_stop_active_transfers()`. The call stack includes: - `dwc3_stop_active_transfers()` - `dwc3_remove_requests()` - `dwc3_gadget_del_and_unmap_request()` Path 3: Occurs independently during `adb root` execution, which triggers USB function unbind and bind operations. The sequence includes: - `gserial_disconnect()` - `usb_ep_disable()` - `dwc3_gadget_ep_disable()` - `dwc3_remove_requests()` with `-ESHUTDOWN` status Path 3 operates asynchronously and lacks synchronization with Paths 1 and 2. When Path 3 completes, it disables endpoints and frees 'out' requests. If Paths 1 or 2 are still processing these requests, accessing freed memory leads to a crash due to use-after-free conditions. To fix this added check for request completion and skip processing if already completed and added the request status for ep0 while queue. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable Suggested-by: Thinh Nguyen Acked-by: Thinh Nguyen Signed-off-by: Manish Nagar Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1f73b8b56cf35de29a433aee7bfff26cea98be3f Author: Łukasz Bartosik Date: Wed Nov 19 21:29:09 2025 +0000 xhci: dbgtty: fix device unregister When DbC is disconnected then xhci_dbc_tty_unregister_device() is called. However if there is any user space process blocked on write to DbC terminal device then it will never be signalled and thus stay blocked indifinitely. This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device(). The tty_vhangup() wakes up any blocked writers and causes subsequent write attempts to DbC terminal device to fail. Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Łukasz Bartosik Link: https://patch.msgid.link/20251119212910.1245694-1-ukaszb@google.com Signed-off-by: Greg Kroah-Hartman commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 Author: Tianchu Chen Date: Sun Nov 16 12:46:18 2025 +0800 usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries. Signed-off-by: Tianchu Chen Cc: stable Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com Signed-off-by: Greg Kroah-Hartman commit 14b46ba92bf547508b4a49370c99aba76cb53b53 Author: Thomas Bogendoerfer Date: Thu Nov 20 13:10:29 2025 +0100 MIPS: kernel: Fix random segmentation faults Commit 69896119dc9d ("MIPS: vdso: Switch to generic storage implementation") switches to a generic vdso storage, which increases the number of data pages from 1 to 4. But there is only one page reserved, which causes segementation faults depending where the VDSO area is randomized to. To fix this use the same size of reservation and allocation of the VDSO data pages. Fixes: 69896119dc9d ("MIPS: vdso: Switch to generic storage implementation") Reviewed-by: Thomas Weißschuh Reviewed-by: Huacai Chen Reviewed-by: Thomas Gleixner Signed-off-by: Thomas Bogendoerfer commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 Author: Maciej W. Rozycki Date: Thu Nov 13 05:21:10 2025 +0000 MIPS: mm: Prevent a TLB shutdown on initial uniquification Depending on the particular CPU implementation a TLB shutdown may occur if multiple matching entries are detected upon the execution of a TLBP or the TLBWI/TLBWR instructions. Given that we don't know what entries we have been handed we need to be very careful with the initial TLB setup and avoid all these instructions. Therefore read all the TLB entries one by one with the TLBR instruction, bypassing the content addressing logic, and truncate any large pages in place so as to avoid a case in the second step where an incoming entry for a large page at a lower address overlaps with a replacement entry chosen at another index. Then preinitialize the TLB using addresses outside our usual unique range and avoiding clashes with any entries received, before making the usual call to local_flush_tlb_all(). This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual address). Signed-off-by: Maciej W. Rozycki Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init") Cc: stable@vger.kernel.org Reviewed-by: Jiaxun Yang Tested-by: Jiaxun Yang # Boston I6400, M5150 sim Signed-off-by: Thomas Bogendoerfer commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 Author: Mikulas Patocka Date: Mon Nov 17 21:42:02 2025 +0100 dm-verity: fix unreliable memory allocation GFP_NOWAIT allocation may fail anytime. It needs to be changed to GFP_NOIO. There's no need to handle an error because mempool_alloc with GFP_NOIO can't fail. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Reviewed-by: Eric Biggers commit be4c9abdf04b86bb33f4a2ce59fd7cb64a739c51 Author: Jacob Zhong Date: Fri Nov 21 09:57:12 2025 +0800 ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 The laptop uses ALC287 chip (as shown in /proc/asound/card1/codec#0). It seems that every HP pavilion laptop in the table uses the same quirk, so I just copied them. I have verified that the mute LED on my laptop works with this patch. For reference, here's the alsa-info of my laptop: https://alsa-project.org/db/?f=2d5f297087708610bc01816ab12052abdd4a17c0 Signed-off-by: Jacob Zhong Link: https://patch.msgid.link/tencent_E2DFA33EFDF39E0517A94FA8FF06C05C0709@qq.com Signed-off-by: Takashi Iwai commit 40b53db87c998b36649292a3b0daff4fa65cf481 Merge: 4e9fd472d1b951 5b38c22687d928 Author: Dave Airlie Date: Fri Nov 21 18:33:01 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix out-of-bounds access with BIT() (Shuicheng Lin) - Fix kunit test checking wrong condition (Matt Roper) - Drop duplicate kconfig select (Shuicheng Lin) - Fix guc2host irq handler with MSI-X (Venkata Ramana Nayana) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/uadbrmftcud3wg32c6tje7mmfcr7wgmpnkzxwubk6fletahje2@coek2ciunkvz commit 4e9fd472d1b951abda236cd4099088f8a97a05ac Merge: 201a32e61b5171 c156c7f27ecdb7 Author: Dave Airlie Date: Fri Nov 21 18:19:33 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-20: amdgpu: - DTBCLK gating fix - EDID fetching retry improvements - HDMI HPD debounce filtering - DCN 2.0 cursor fix - DP MST PBN fix - VPE fix - GC 11 fix - PRT fix - MMIO remap page fix - SR-IOV fix radeon: - Fence deadlock fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251120164110.1077973-1-alexander.deucher@amd.com commit 201a32e61b5171e41e6e2839e5053e3ed0192b34 Merge: 9b571b32313f01 cead55e24cf9e0 Author: Dave Airlie Date: Fri Nov 21 17:51:14 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: atomic: - Return error codes on failed blob creation for planes nouveau: - Fix memory leak tegra: - Fix device ref counting - Fix pid ref counting - Revert booting on Pixel C Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251120151308.GA589436@linux.fritz.box commit 9b571b32313f01dd7017562a79df59ef2cdb4ba6 Merge: 6a23ae0a96a600 5474560381775b Author: Dave Airlie Date: Fri Nov 21 17:10:00 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Wildcat Lake and Panther Lake detangled for display fixes (Dnyaneshwar) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aR8jByCwjIThpnpk@intel.com commit a14602fcae17a3f1cb8a8521bedf31728f9e7e39 Author: Jesper Dangaard Brouer Date: Wed Nov 19 17:28:36 2025 +0100 veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance. The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested. Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context. Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct(). Fixes: 401cb7dae8130 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/176356963888.337072.4805242001928705046.stgit@firesoul Signed-off-by: Jakub Kicinski commit 4b4749b7b4b3badabd0fa26f454782842db6ae53 Author: Sayooj K Karun Date: Wed Nov 19 14:27:47 2025 +0530 net: atm: fix incorrect cleanup function call in error path In atm_init(), if atmsvc_init() fails, the code jumps to out_atmpvc_exit label which incorrectly calls atmsvc_exit() instead of atmpvc_exit(). This results in calling the wrong cleanup function and failing to properly clean up atmpvc_init(). Fix this by calling atmpvc_exit() in the out_atmpvc_exit error path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Sayooj K Karun Link: https://patch.msgid.link/20251119085747.67139-1-sayooj@aerlync.com Signed-off-by: Jakub Kicinski commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 Author: Luiz Augusto von Dentz Date: Mon Nov 17 13:45:13 2025 -0500 Bluetooth: SMP: Fix not generating mackey and ltk when repairing The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used") introduced a goto that bypasses the creation of temporary mackey and ltk which are later used by the likes of DHKey Check step. Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for Just Works (LE SC)") which means confirm_hint is always set in case JUST_WORKS so the branch checking for an existing LTK becomes pointless as confirm_hint will always be set, so this just merge both cases of malicious or legitimate devices to be confirmed before continuing with the pairing procedure. Link: https://github.com/bluez/bluez/issues/1622 Fixes: eed467b517e8 ("Bluetooth: fix passkey uninitialized when used") Signed-off-by: Luiz Augusto von Dentz commit c884a0b27b4586e607431d86a1aa0bb4fb39169c Author: Douglas Anderson Date: Thu Nov 20 08:12:28 2025 -0800 Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to: usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM) That function can return NULL in some cases. Even when it returns NULL, though, we still go on to call btusb_mtk_claim_iso_intf(). As of commit e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()"), calling btusb_mtk_claim_iso_intf() when `btmtk_data->isopkt_intf` is NULL will cause a crash because we'll end up passing a bad pointer to device_lock(). Prior to that commit we'd pass the NULL pointer directly to usb_driver_claim_interface() which would detect it and return an error, which was handled. Resolve the crash in btusb_mtk_claim_iso_intf() by adding a NULL check at the start of the function. This makes the code handle a NULL `btmtk_data->isopkt_intf` the same way it did before the problematic commit (just with a slight change to the error message printed). Reported-by: IncogCyberpunk Closes: http://lore.kernel.org/r/a380d061-479e-4713-bddd-1d6571ca7e86@leemhuis.info Fixes: e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()") Cc: stable@vger.kernel.org Tested-by: IncogCyberpunk Signed-off-by: Douglas Anderson Signed-off-by: Luiz Augusto von Dentz commit 79a2d4678ba90bdba577dc3af88cc900d6dcd5ee Author: Pauli Virtanen Date: Sat Nov 15 18:43:55 2025 +0200 Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b ("Bluetooth: convert conn hash to RCU") and not clear if it had purpose since then. Currently, there are code paths that delete hci_conn* from elsewhere than the ordered hdev->workqueue where the RX work runs in. E.g. commit 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync") introduced some of these, and there probably were a few others before it. It's better to do the locking so that even if these run concurrently no UAF is possible. Move the lookup of hci_conn and associated socket-specific conn to protocol recv handlers, and do them within a single critical section to cover hci_conn* usage and lookup. syzkaller has reported a crash that appears to be this issue: [Task hdev->workqueue] [Task 2] hci_disconnect_all_sync l2cap_recv_acldata(hcon) hci_conn_get(hcon) hci_abort_conn_sync(hcon) hci_dev_lock hci_dev_lock hci_conn_del(hcon) v-------------------------------- hci_dev_unlock hci_conn_put(hcon) conn = hcon->l2cap_data (UAF) Fixes: 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync") Reported-by: syzbot+d32d77220b92eddd89ad@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d32d77220b92eddd89ad Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 89bb613511cc21ed5ba6bddc1c9b9ae9c0dad392 Author: Edward Adam Davis Date: Sun Nov 16 17:04:43 2025 +0800 Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314 Fixes: 6fe26f694c82 ("Bluetooth: MGMT: Protect mgmt_pending list with its own lock") Reported-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9aa47cd4633a3cf92a80 Tested-by: syzbot+9aa47cd4633a3cf92a80@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Luiz Augusto von Dentz commit 275ddfeb3fdc274050c2173ffd985b1e80a9aa37 Author: Luiz Augusto von Dentz Date: Thu Nov 13 09:49:27 2025 -0500 Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP HCI_OP_NOP means no command was actually sent so there is no point in triggering cmd_timer which may cause a hdev->reset in the process since it is assumed that the controller is stuck processing a command. Fixes: e2d471b7806b ("Bluetooth: ISO: Fix not using SID from adv report") Signed-off-by: Luiz Augusto von Dentz commit 4015b979767125cf8a2233a145a3b3af78bfd8fb Author: Chris Lu Date: Wed Nov 12 15:53:34 2025 +0800 Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface When performing reset tests and encountering abnormal card drop issues that lead to a kernel crash, it is necessary to perform a null check before releasing resources to avoid attempting to release a null pointer. <4>[ 29.158070] Hardware name: Google Quigon sku196612/196613 board (DT) <4>[ 29.158076] Workqueue: hci0 hci_cmd_sync_work [bluetooth] <4>[ 29.158154] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) <4>[ 29.158162] pc : klist_remove+0x90/0x158 <4>[ 29.158174] lr : klist_remove+0x88/0x158 <4>[ 29.158180] sp : ffffffc0846b3c00 <4>[ 29.158185] pmr_save: 000000e0 <4>[ 29.158188] x29: ffffffc0846b3c30 x28: ffffff80cd31f880 x27: ffffff80c1bdc058 <4>[ 29.158199] x26: dead000000000100 x25: ffffffdbdc624ea3 x24: ffffff80c1bdc4c0 <4>[ 29.158209] x23: ffffffdbdc62a3e6 x22: ffffff80c6c07000 x21: ffffffdbdc829290 <4>[ 29.158219] x20: 0000000000000000 x19: ffffff80cd3e0648 x18: 000000031ec97781 <4>[ 29.158229] x17: ffffff80c1bdc4a8 x16: ffffffdc10576548 x15: ffffff80c1180428 <4>[ 29.158238] x14: 0000000000000000 x13: 000000000000e380 x12: 0000000000000018 <4>[ 29.158248] x11: ffffff80c2a7fd10 x10: 0000000000000000 x9 : 0000000100000000 <4>[ 29.158257] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 : 2d7223ff6364626d <4>[ 29.158266] x5 : 0000008000000000 x4 : 0000000000000020 x3 : 2e7325006465636e <4>[ 29.158275] x2 : ffffffdc11afeff8 x1 : 0000000000000000 x0 : ffffffdc11be4d0c <4>[ 29.158285] Call trace: <4>[ 29.158290] klist_remove+0x90/0x158 <4>[ 29.158298] device_release_driver_internal+0x20c/0x268 <4>[ 29.158308] device_release_driver+0x1c/0x30 <4>[ 29.158316] usb_driver_release_interface+0x70/0x88 <4>[ 29.158325] btusb_mtk_release_iso_intf+0x68/0xd8 [btusb (HASH:e8b6 5)] <4>[ 29.158347] btusb_mtk_reset+0x5c/0x480 [btusb (HASH:e8b6 5)] <4>[ 29.158361] hci_cmd_sync_work+0x10c/0x188 [bluetooth (HASH:a4fa 6)] <4>[ 29.158430] process_scheduled_works+0x258/0x4e8 <4>[ 29.158441] worker_thread+0x300/0x428 <4>[ 29.158448] kthread+0x108/0x1d0 <4>[ 29.158455] ret_from_fork+0x10/0x20 <0>[ 29.158467] Code: 91343000 940139d1 f9400268 927ff914 (f9401297) <4>[ 29.158474] ---[ end trace 0000000000000000 ]--- <0>[ 29.167129] Kernel panic - not syncing: Oops: Fatal exception <2>[ 29.167144] SMP: stopping secondary CPUs <4>[ 29.167158] ------------[ cut here ]------------ Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 3ded250b97c3ae94a642bc2e710a95700e72dfb0 Author: Paul Moore Date: Tue Nov 18 17:27:58 2025 -0500 selinux: rename the cred_security_struct variables to "crsec" Along with the renaming from task_security_struct to cred_security_struct, rename the local variables to "crsec" from "tsec". This both fits with existing conventions and helps distinguish between task and cred related variables. No functional changes. Acked-by: Stephen Smalley Signed-off-by: Paul Moore commit dde3a5d0f4dce1d1a6095e6b8eeb59b75d28fb3b Author: Stephen Smalley Date: Thu Nov 13 15:23:14 2025 -0500 selinux: move avdcache to per-task security struct The avdcache is meant to be per-task; move it to a new task_security_struct that is duplicated per-task. Cc: stable@vger.kernel.org Fixes: 5d7ddc59b3d89b724a5aa8f30d0db94ff8d2d93f ("selinux: reduce path walk overhead") Signed-off-by: Stephen Smalley [PM: line length fixes] Signed-off-by: Paul Moore commit 75f72fe289a7f76204a728668edcf20e4a2a6097 Author: Stephen Smalley Date: Thu Nov 13 15:23:13 2025 -0500 selinux: rename task_security_struct to cred_security_struct Before Linux had cred structures, the SELinux task_security_struct was per-task and although the structure was switched to being per-cred long ago, the name was never updated. This change renames it to cred_security_struct to avoid confusion and pave the way for the introduction of an actual per-task security structure for SELinux. No functional change. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit fd95357fd8c6778ac7dea6c57a19b8b182b6e91f Merge: c966813ea1206a 7b6216baae7513 Author: Linus Torvalds Date: Thu Nov 20 11:04:37 2025 -0800 Merge tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fix from Tejun Heo: "One low risk and obvious fix: scx_enable() was dereferencing an error pointer on helper kthread creation failure. Fixed" * tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix scx_enable() crash on helper kthread creation failure commit a612d24e850b28c16384cf071636034935447e43 Author: Mikulas Patocka Date: Thu Nov 20 12:08:47 2025 +0100 dm: fix failure when empty flush's bi_sector points beyond the device end An empty flush bio can have arbitrary bi_sector. The commit 2b1c6d7a890a introduced a regression that device mapper would fail an empty flush bio with -EIO if the sector pointed beyond the end of the device. The commit introduced an optimization, that optimization would pass flushes to __split_and_process_bio and __split_and_process_bio is not prepared to handle empty bios. Fix this bug by passing only non-empty flushes to __split_and_process_bio - non-empty flushes must have valid bi_sector. Empty bios will go through __send_empty_flush, as they did before the optimization. This problem can be reproduced by running the lvm2 test: make check_local T=lvconvert-thin.sh LVM_TEST_PREFER_BRD=0 Signed-off-by: Mikulas Patocka Fixes: 2b1c6d7a890a ("dm: optimize REQ_PREFLUSH with data when using the linear target") Reported-by: Zdenek Kabelac Reviewed-by: Bart Van Assche commit c966813ea1206abc50a4447cb05cd7419e506806 Merge: 07e09c32330c5a ec33b59542d968 Author: Linus Torvalds Date: Thu Nov 20 10:49:12 2025 -0800 Merge tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix mempool poisoning order>0 pages with CONFIG_HIGHMEM (Vlastimil Babka) * tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/mempool: fix poisoning order>0 pages with HIGHMEM commit 7b6216baae751369195fa3c83d434d23bcda406a Author: Saket Kumar Bhaskar Date: Wed Nov 19 16:07:22 2025 +0530 sched_ext: Fix scx_enable() crash on helper kthread creation failure A crash was observed when the sched_ext selftests runner was terminated with Ctrl+\ while test 15 was running: NIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0 LR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0 Call Trace: scx_enable.constprop.0+0x32c/0x12b0 (unreliable) bpf_struct_ops_link_create+0x18c/0x22c __sys_bpf+0x23f8/0x3044 sys_bpf+0x2c/0x6c system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec kthread_run_worker() returns an ERR_PTR() on failure rather than NULL, but the current code in scx_alloc_and_add_sched() only checks for a NULL helper. Incase of failure on SIGQUIT, the error is not handled in scx_alloc_and_add_sched() and scx_enable() ends up dereferencing an error pointer. Error handling is fixed in scx_alloc_and_add_sched() to propagate PTR_ERR() into ret, so that scx_enable() jumps to the existing error path, avoiding random dereference on failure. Fixes: bff3b5aec1b7 ("sched_ext: Move disable machinery into scx_sched") Cc: stable@vger.kernel.org # v6.16+ Reported-and-tested-by: Samir Mulani Signed-off-by: Saket Kumar Bhaskar Reviewed-by: Emil Tsalapatis Reviewed-by: Andrea Righi Reviewed-by: Vishal Chourasia Signed-off-by: Tejun Heo commit 46447367a52965e9d35f112f5b26fc8ff8ec443d Author: Jens Axboe Date: Thu Nov 20 11:40:15 2025 -0700 io_uring/cmd_net: fix wrong argument types for skb_queue_splice() If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the socket queue. However, the arguments for the splice helper are transposed, causing exactly the wrong direction of splicing into the on-stack list. Fix that up. Cc: stable@vger.kernel.org Reported-by: Google Big Sleep Fixes: 9e4ed359b8ef ("io_uring/netcmd: add tx timestamping cmd support") Signed-off-by: Jens Axboe commit 07e09c32330c5ad2864b2d52ce6a33e1963ebfcb Merge: 1753d40dce2023 f384497a76ed95 Author: Linus Torvalds Date: Thu Nov 20 09:46:52 2025 -0800 Merge tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a regression introduced during the 6.16 development cycle that may cause runtime PM to be enabled by mistake for devices that do not support it (which may lead to some serious trouble) if there is a system wakeup event during the "late suspend" phase of system suspend" * tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: core: Fix runtime PM enabling in device_resume_early() commit 1753d40dce2023405cafd9e3bec169674ed99e2d Merge: 6ba3bb334835ee d2932a59c2d4fb Author: Linus Torvalds Date: Thu Nov 20 09:44:27 2025 -0800 Merge tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "This fixes EINJV2 support introduced during the 6.17 cycle by unbreaking the initialization broken by a previous attempted fix, adding sanity checks for data coming from the platform firmware, and updating the code to handle injecting legacy error types on an EINJV2 capable systems properly (Tony Luck)" * tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: APEI: EINJ: Fix EINJV2 initialization and injection commit 6ba3bb334835eeca7e2bd2db4c9dbb0343ebff4f Merge: 8e621c9a337555 db30233361f94e Author: Linus Torvalds Date: Thu Nov 20 09:39:34 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "This one has lots of new HW entries which adds to the size in diffstat but the individual changes are simple. Fixes - acer-wmi: Ignore backlight event - alienware-wmi-wmax: Fix quirk match table order & drop redundant entries - amd/pmc: - Add Xbox Ally to spurious 8042 quirk list - Quirk list Lenovo Legion Go 2 NVMe resume - msi-wmi-platform: - Correct GUID to uppercase - GUID is uncleverly copy-pasted from an example so add a DMI whitelist - intel/speed_select_if: PCIBIOS_* return code conversion - intel-uncore-freq & ISST: Fix kernel doc warnings New HW support - alienware-wmi-wmax: - Alienware 16 Aurora support - Alienware M support - Alienware X support - Dell G support - amd/pmc: - ROG Xbox Ally (non-X) support - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys - hp-wmi: - Omen 16-wf1xxx fan support - Omen MAX 16-ah0xx fan + thermal profile support - Victus 16-r0 and 16-s0 fan + thermal profile support - intel/hid: Intel Nova Lake support - intel-uncore-freq: - Intel Panther Lake support - Intel Wildcat Lake support - Intel Nova Lake support" * tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits) platform/x86: intel-uncore-freq: fix all header kernel-doc warnings platform/x86: acer-wmi: Ignore backlight event platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos platform/x86/intel/hid: Add Nova Lake support platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile platform/x86: msi-wmi-platform: Fix typo in WMI GUID platform/x86: msi-wmi-platform: Only load on MSI devices platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally platform/x86/amd/pmc: Add support for Van Gogh SoC platform/x86: alienware-wmi-wmax: Add support for the whole "G" family platform/x86: alienware-wmi-wmax: Add support for the whole "X" family platform/x86: alienware-wmi-wmax: Add support for the whole "M" family platform/x86: alienware-wmi-wmax: Drop redundant DMI entries platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order platform/x86: ISST: isst_if.h: fix all kernel-doc warnings platform/x86: intel-uncore-freq: Add additional client processors platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support platform/x86: huawei-wmi: add keys for HONOR models ... commit 8e621c9a337555c914cf1664605edfaa6f839774 Merge: 23cb64fb762573 002541ef650b74 Author: Linus Torvalds Date: Thu Nov 20 08:52:07 2025 -0800 Merge tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from IPsec and wireless. Previous releases - regressions: - prevent NULL deref in generic_hwtstamp_ioctl_lower(), newer APIs don't populate all the pointers in the request - phylink: add missing supported link modes for the fixed-link - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr Previous releases - always broken: - openvswitch: remove never-working support for setting NSH fields - xfrm: number of fixes for error paths of xfrm_state creation/ modification/deletion - xfrm: fixes for offload - fix the determination of the protocol of the inner packet - don't push locally generated packets directly to L2 tunnel mode offloading, they still need processing from the standard xfrm path - mptcp: fix a couple of corner cases in fallback and fastclose handling - wifi: rtw89: hw_scan: prevent connections from getting stuck, work around apparent bug in FW by tweaking messages we send - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait - veth: more robust handing of race to avoid txq getting stuck - eth: ps3_gelic_net: handle skb allocation failures" * tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) vsock: Ignore signal/timeout on connect() if already established be2net: pass wrb_params in case of OS2BMC l2tp: reset skb control buffer on xmit net: dsa: microchip: lan937x: Fix RGMII delay tuning selftests: mptcp: add a check for 'add_addr_accepted' mptcp: fix address removal logic in mptcp_pm_nl_rm_addr selftests: mptcp: join: userspace: longer timeout selftests: mptcp: join: endpoints: longer timeout selftests: mptcp: join: fastclose: remove flaky marks mptcp: fix duplicate reset on fastclose mptcp: decouple mptcp fastclose from tcp close mptcp: do not fallback when OoO is present mptcp: fix premature close in case of fallback mptcp: avoid unneeded subflow-level drops mptcp: fix ack generation for fallback msk wifi: rtw89: hw_scan: Don't let the operating channel be last net: phylink: add missing supported link modes for the fixed-link selftest: af_unix: Add test for SO_PEEK_OFF. af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). net/mlx5: Clean up only new IRQ glue on request_irq() failure ... commit 7b5ab04f035f829ed6008e4685501ec00b3e73c9 Author: Malaya Kumar Rout Date: Thu Nov 20 20:32:13 2025 +0530 timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths tk_aux_sysfs_init() returns immediately on error during the auxiliary clock initialization loop without cleaning up previously allocated kobjects and sysfs groups. If kobject_create_and_add() or sysfs_create_group() fails during loop iteration, the parent kobjects (tko and auxo) and any previously created child kobjects are leaked. Fix this by adding proper error handling with goto labels to ensure all allocated resources are cleaned up on failure. kobject_put() on the parent kobjects will handle cleanup of their children. Fixes: 7b95663a3d96 ("timekeeping: Provide interface to control auxiliary clocks") Signed-off-by: Malaya Kumar Rout Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251120150213.246777-1-mrout@redhat.com commit 002541ef650b742a198e4be363881439bb9d86b4 Author: Michal Luczaj Date: Wed Nov 19 15:02:59 2025 +0100 vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg(). [1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/ Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251119-vsock-interrupted-connect-v2-1-70734cf1233f@rbox.co Signed-off-by: Jakub Kicinski commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 Author: Andrey Vatoropin Date: Wed Nov 19 10:51:12 2025 +0000 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states. The correct way would be to pass the wrb_params from be_xmit(). Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru Signed-off-by: Jakub Kicinski commit 49c2d5941c89060342c65997de91859e5830dee5 Merge: 8f05967b022d25 0a2c5495b6d1ec Author: Jens Axboe Date: Thu Nov 20 08:39:17 2025 -0700 Merge tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.18 - Admin queue use-after-free fix (Keith) - Target authentication fix (Alistar) - Multipath lockdeup fix (Shin'ichiro) - FC transport teardown fixes (Ewan)" * tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() nvme-multipath: fix lockdep WARN due to partition scan work nvmet-auth: update sc_c in target host hash calculation nvme: fix admin request_queue lifetime commit 91842ed844a068a41a38f97a1ac5535b909279cd Author: Niklas Cassel Date: Wed Nov 19 15:13:15 2025 +0100 ata: libata-core: Set capacity to zero for a security locked drive For Security locked drives (drives that have Security enabled, and have not been Security unlocked by boot firmware), the automatic partition scanning will result in the user being spammed with errors such as: ata5.00: failed command: READ DMA ata5.00: cmd c8/00:08:00:00:00/00:00:00:00:00/e0 tag 7 dma 4096 in res 51/04:08:00:00:00/00:00:00:00:00/e0 Emask 0x1 (device error) ata5.00: status: { DRDY ERR } ata5.00: error: { ABRT } sd 4:0:0:0: [sda] tag#7 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 4:0:0:0: [sda] tag#7 Sense Key : Aborted Command [current] sd 4:0:0:0: [sda] tag#7 Add. Sense: No additional sense information during boot, because most commands except for IDENTIFY will be aborted by a Security locked drive. For a Security locked drive, set capacity to zero, so that no automatic partition scanning will happen. If the user later unlocks the drive using e.g. hdparm, the close() by the user space application should trigger a revalidation of the drive. Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit b11890683380a36b8488229f818d5e76e8204587 Author: Niklas Cassel Date: Wed Nov 19 15:13:14 2025 +0100 ata: libata-scsi: Fix system suspend for a security locked drive Commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") fixed ata_to_sense_error() to properly generate sense key ABORTED COMMAND (without any additional sense code), instead of the previous bogus sense key ILLEGAL REQUEST with the additional sense code UNALIGNED WRITE COMMAND, for a failed command. However, this broke suspend for Security locked drives (drives that have Security enabled, and have not been Security unlocked by boot firmware). The reason for this is that the SCSI disk driver, for the Synchronize Cache command only, treats any sense data with sense key ILLEGAL REQUEST as a successful command (regardless of ASC / ASCQ). After commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") the code that treats any sense data with sense key ILLEGAL REQUEST as a successful command is no longer applicable, so the command fails, which causes the system suspend to be aborted: sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5 sd 1:0:0:0: PM: failed to suspend async: error -5 PM: Some devices failed to suspend, or early wake event detected To make suspend work once again, for a Security locked device only, return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense data which a real SCSI device would have returned if locked. The SCSI disk driver treats this sense data as a successful command. Cc: stable@vger.kernel.org Reported-by: Ilia Baryshnikov Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704 Fixes: cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling") Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit b32cc17d607e8ae7af037303fe101368cb4dc44c Author: Yihang Li Date: Thu Nov 20 11:50:23 2025 +0800 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its queue are not running. Fixes: 0c76106cb975 ("scsi: sd: Fix TCG OPAL unlock on system resume") Cc: stable@vger.kernel.org Signed-off-by: Yihang Li Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit dc9e7e652f8d9220aaae35ecf2f71931d9e0fdc9 Merge: d70b592551ff23 0ff8eeafba5c57 Author: Paolo Abeni Date: Thu Nov 20 13:02:00 2025 +0100 Merge tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== wireless-2025-11-20 A single fix for scanning on some rtw89 devices. * tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: rtw89: hw_scan: Don't let the operating channel be last ==================== Link: https://patch.msgid.link/20251120085433.8601-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit d70b592551ff23747e26e74081205babf8dba9b6 Author: David Bauer Date: Tue Nov 18 01:16:18 2025 +0100 l2tp: reset skb control buffer on xmit The L2TP stack did not reset the skb control buffer before sending the encapsulated package. In a setup with an ath10k radio and batman-adv over an L2TP tunnel massive fragmentations happen sporadically if the L2TP tunnel is established over IPv4. L2TP might reset some of the fields in the IP control buffer, but L2TP assumes the type of the control buffer to be of an IPv4 packet. In case the L2TP interface is used as a batadv hardif or the packet is an IPv6 packet, this assumption breaks. Clear the entire control buffer to avoid such mishaps altogether. Fixes: f77ae9390438 ("[PPPOL2TP]: Reset meta-data in xmit function") Signed-off-by: David Bauer Link: https://patch.msgid.link/20251118001619.242107-1-mail@david-bauer.net Signed-off-by: Paolo Abeni commit 3ceb6ac2116ecda1c5d779bb73271479e70fccb4 Author: Oleksij Rempel Date: Fri Nov 14 10:09:51 2025 +0100 net: dsa: microchip: lan937x: Fix RGMII delay tuning Correct RGMII delay application logic in lan937x_set_tune_adj(). The function was missing `data16 &= ~PORT_TUNE_ADJ` before setting the new delay value. This caused the new value to be bitwise-OR'd with the existing PORT_TUNE_ADJ field instead of replacing it. For example, when setting the RGMII 2 TX delay on port 4, the intended TUNE_ADJUST value of 0 (RGMII_2_TX_DELAY_2NS) was incorrectly OR'd with the default 0x1B (from register value 0xDA3), leaving the delay at the wrong setting. This patch adds the missing mask to clear the field, ensuring the correct delay value is written. Physical measurements on the RGMII TX lines confirm the fix, showing the delay changing from ~1ns (before change) to ~2ns. While testing on i.MX 8MP showed this was within the platform's timing tolerance, it did not match the intended hardware-characterized value. Fixes: b19ac41faa3f ("net: dsa: microchip: apply rgmii tx and rx delay in phylink mac config") Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20251114090951.4057261-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 678e1cc2f482e0985a0613ab4a5bf89c497e5acc Author: Darrick J. Wong Date: Wed Nov 12 08:35:18 2025 -0800 xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110 Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpy_orig+0x54/0x110 xrep_symlink_salvage_inline+0xb3/0xf0 [xfs] xrep_symlink_salvage+0x100/0x110 [xfs] xrep_symlink+0x2e/0x80 [xfs] xrep_attempt+0x61/0x1f0 [xfs] xfs_scrub_metadata+0x34f/0x5c0 [xfs] xfs_ioc_scrubv_metadata+0x387/0x560 [xfs] xfs_file_ioctl+0xe23/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128 allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfs_init_local_fork+0x79/0xe0 [xfs] xfs_iformat_local+0xa4/0x170 [xfs] xfs_iformat_data_fork+0x148/0x180 [xfs] xfs_inode_from_disk+0x2cd/0x480 [xfs] xfs_iget+0x450/0xd60 [xfs] xfs_bulkstat_one_int+0x6b/0x510 [xfs] xfs_bulkstat_iwalk+0x1e/0x30 [xfs] xfs_iwalk_ag_recs+0xdf/0x150 [xfs] xfs_iwalk_run_callbacks+0xb9/0x190 [xfs] xfs_iwalk_ag+0x1dc/0x2f0 [xfs] xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs] xfs_iwalk+0xa4/0xd0 [xfs] xfs_bulkstat+0xfa/0x170 [xfs] xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs] xfs_file_ioctl+0xbf2/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ================================================================== On further analysis, I realized that the second parameter to min() is not correct. xfs_ifork::if_bytes is the size of the xfs_ifork::if_data buffer. if_bytes can be smaller than the data fork size because: (a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, if_bytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8. Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long. In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that. Cc: stable@vger.kernel.org # v6.10 Fixes: 2651923d8d8db0 ("xfs: online repair of symbolic links") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit f1f96511b1c4c33e53f05909dd267878e0643a9a Author: Dapeng Mi Date: Wed Nov 12 16:05:26 2025 +0800 perf: Fix 0 count issue of cpu-clock Currently cpu-clock event always returns 0 count, e.g., perf stat -e cpu-clock -- sleep 1 Performance counter stats for 'sleep 1': 0 cpu-clock # 0.000 CPUs utilized 1.002308394 seconds time elapsed The root cause is the commit 'bc4394e5e79c ("perf: Fix the throttle error of some clock events")' adds PERF_EF_UPDATE flag check before calling cpu_clock_event_update() to update the count, however the PERF_EF_UPDATE flag is never set when the cpu-clock event is stopped in counting mode (pmu->dev() -> cpu_clock_event_del() -> cpu_clock_event_stop()). This leads to the cpu-clock event count is never updated. To fix this issue, force to set PERF_EF_UPDATE flag for cpu-clock event just like what task-clock does. Fixes: bc4394e5e79c ("perf: Fix the throttle error of some clock events") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Link: https://patch.msgid.link/20251112080526.3971392-1-dapeng1.mi@linux.intel.com commit d5227c88174c384d83d9176bd4315ef13dce306c Author: David Howells Date: Fri Oct 24 16:33:43 2025 +0100 cifs: Add the smb3_read_* tracepoints to SMB1 Add the smb3_read_* tracepoints to SMB1's cifs_async_readv() and cifs_readv_callback(). Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 7e4d9120cfa413dd34f4f434befc5dbe6c38b2e5 Author: Shaurya Rane Date: Tue Nov 18 20:32:57 2025 +0530 cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents(). Pointers are also set to NULL after freeing to prevent potential double-free issues. This change fixes a memory leak originally detected by syzbot. The leak occurred when processing Opt_source mount options if an error happened after ctx->source and fc->source were successfully allocated but before the function completed. The specific leak sequence was: 1. ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory 2. fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory 3. A subsequent error jumps to cifs_parse_mount_err 4. The old error handler freed passwords but not the source strings, causing the memory to leak. This issue was not addressed by commit e8c73eb7db0a ("cifs: client: fix memory leak in smb3_fs_context_parse_param"), which only fixed leaks from repeated fsconfig() calls but not this error path. Patch updated with minor change suggested by kernel test robot Reported-by: syzbot+87be6809ed9bf6d718e3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=87be6809ed9bf6d718e3 Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") Reviewed-by: David Howells Signed-off-by: Shaurya Rane Signed-off-by: Steve French commit a9d1f38df7ecd0e21233447c9cc6fa1799eddaf3 Author: Henrique Carvalho Date: Thu Nov 13 15:09:13 2025 -0300 smb: client: introduce close_cached_dir_locked() Replace close_cached_dir() calls under cfid_list_lock with a new close_cached_dir_locked() variant that uses kref_put() instead of kref_put_lock() to avoid recursive locking when dropping references. While the existing code works if the refcount >= 2 invariant holds, this area has proven error-prone. Make deadlocks impossible and WARN on invariant violations. Cc: stable@vger.kernel.org Reviewed-by: David Howells Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 0ff8eeafba5c5742effb9e2cfdb52daa17b1b7d7 Merge: d0309c054362a2 e837b9091b277a Author: Johannes Berg Date: Thu Nov 20 09:43:24 2025 +0100 Merge tag 'rtw-2025-11-20' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw patches for v6.18-rc7 Fix firmware goes wrong and causes device unusable after scanning. This issue presents under certain regulatory domain reported from end users. ================== Link: https://patch.msgid.link/8217bee0-96c4-44c1-9593-2e9ca12eccc5@RTKEXHMBS03.realtek.com.tw Signed-off-by: Johannes Berg commit 677e6123e3d24adaa252697dc89740f2ac07664e Author: Vincent Li Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: BPF: Disable trampoline for kernel module function trace The current LoongArch BPF trampoline implementation is incompatible with tracing functions in kernel modules. This causes several severe and user-visible problems: * The `bpf_selftests/module_attach` test fails consistently. * Kernel lockup when a BPF program is attached to a module function [1]. * Critical kernel modules like WireGuard experience traffic disruption when their functions are traced with fentry [2]. Given the severity and the potential for other unknown side-effects, it is safest to disable the feature entirely for now. This patch prevents the BPF subsystem from allowing trampoline attachments to kernel module functions on LoongArch. This is a temporary mitigation until the core issues in the trampoline code for kernel module handling can be identified and fixed. [root@fedora bpf]# ./test_progs -a module_attach -v bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_module_attach:PASS:skel_open 0 nsec test_module_attach:PASS:set_attach_target 0 nsec test_module_attach:PASS:set_attach_target_explicit 0 nsec test_module_attach:PASS:skel_load 0 nsec libbpf: prog 'handle_fentry': failed to attach: -ENOTSUPP libbpf: prog 'handle_fentry': failed to auto-attach: -ENOTSUPP test_module_attach:FAIL:skel_attach skeleton attach failed: -524 Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED Successfully unloaded bpf_testmod.ko. [1]: https://lore.kernel.org/loongarch/CAK3+h2wDmpC-hP4u4pJY8T-yfKyk4yRzpu2LMO+C13FMT58oqQ@mail.gmail.com/ [2]: https://lore.kernel.org/loongarch/CAK3+h2wYcpc+OwdLDUBvg2rF9rvvyc5amfHT-KcFaK93uoELPg@mail.gmail.com/ Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Acked-by: Hengqi Chen Signed-off-by: Vincent Li Signed-off-by: Huacai Chen commit a6b533adfc05ba15360631e019d3e18275080275 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Don't panic if no valid cache info for PCI If there is no valid cache info detected (may happen in virtual machine) for pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI core it will be evaluated to (L1_CACHE_BYTES >> 2). Cc: Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Mask all interrupts during kexec/kdump If the default state of the interrupt controllers in the first kernel don't mask any interrupts, it may cause the second kernel to potentially receive interrupts (which were previously allocated by the first kernel) immediately after a CPU becomes online during its boot process. These interrupts cannot be properly routed, leading to bad IRQ issues. This patch calls machine_kexec_mask_interrupts() to mask all interrupts during the kexec/kdump process. Signed-off-by: Tianyang Zhang Signed-off-by: Huacai Chen commit acf5de1b23b0275eb69f235c8e9f2cef19fa39a1 Author: Bibo Mao Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Fix NUMA node parsing with numa_memblks On physical machine, NUMA node id comes from high bit 44:48 of physical address. However it is not true on virt machine. With general method, it comes from ACPI SRAT table. Here the common function numa_memblks_init() is used to parse NUMA node information with numa_memblks. Cc: Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1c004609fdefb48888ef98bc6e3b8fe78ae4e088 Author: Huacai Chen Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Consolidate CPU names in /proc/cpuinfo Some processors have no IOCSR.VENDOR and IOCSR.CPUNAME, some processors have these registers but there is no valid information. Consolidate CPU names in /proc/cpuinfo: 1. Add "PRID" to display the PRID & Core-Name; 2. Let "Model Name" display "Unknown" if no valid name. Signed-off-by: Huacai Chen commit 20d7338f2d3bcb570068dd6d39b16f1a909fe976 Author: Thomas Weißschuh Date: Thu Nov 20 14:42:05 2025 +0800 LoongArch: Use UAPI types in ptrace UAPI header The kernel UAPI headers already contain fixed-width integer types, there is no need to rely on the libc types. There may not be a libc available or the libc may not provides the , like for example on nolibc. This also aligns the header with the rest of the LoongArch UAPI headers. Fixes: 803b0fc5c3f2 ("LoongArch: Add process management") Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit f170b1dc26535d64442416babf380c17d967a5b2 Merge: 4026310a042c6e 23a5b9b12de9dc Author: Jakub Kicinski Date: Wed Nov 19 20:10:53 2025 -0800 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-11-18 (idpf, ice) This series contains updates to idpf and ice drivers. Emil adds a check for NULL vport_config during removal to avoid NULL pointer dereference in idpf. Grzegorz fixes PTP teardown paths to account for some missed cleanups for ice driver. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: fix PTP cleanup on driver removal in error path idpf: fix possible vport_config NULL pointer deref in remove ==================== Link: https://patch.msgid.link/20251118235207.2165495-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4026310a042c6ea501db745b7f0f676687967045 Merge: e31a11be41cd13 0eee0fdf9b7b0b Author: Jakub Kicinski Date: Wed Nov 19 20:07:18 2025 -0800 Merge branch 'mptcp-misc-fixes-for-v6-18-rc7' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.18-rc7 Here are various unrelated fixes: - Patch 1: Fix window space computation for fallback connections which can affect ACK generation. A fix for v5.11. - Patch 2: Avoid unneeded subflow-level drops due to unsynced received window. A fix for v5.11. - Patch 3: Avoid premature close for fallback connections with PREEMPT kernels. A fix for v5.12. - Patch 4: Reset instead of fallback in case of data in the MPTCP out-of-order queue. A fix for v5.7. - Patches 5-7: Avoid also sending "plain" TCP reset when closing with an MP_FASTCLOSE. A fix for v6.1. - Patches 8-9: Longer timeout for background connections in MPTCP Join selftests. An additional fix for recent patches for v5.13/v6.1. - Patches 10-11: Fix typo in a check introduce in a recent refactoring. A fix for v6.15. ==================== Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-0-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 0eee0fdf9b7b0baf698f9b426384aa9714d76a51 Author: Gang Yan Date: Tue Nov 18 08:20:29 2025 +0100 selftests: mptcp: add a check for 'add_addr_accepted' The previous patch fixed an issue with the 'add_addr_accepted' counter. This was not spot by the test suite. Check this counter and 'add_addr_signal' in MPTCP Join 'delete re-add signal' test. This should help spotting similar regressions later on. These counters are crucial for ensuring the MPTCP path manager correctly handles the subflow creation via 'ADD_ADDR'. Signed-off-by: Gang Yan Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-11-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 92e239e36d600002559074994a545fcfac9afd2d Author: Gang Yan Date: Tue Nov 18 08:20:28 2025 +0100 mptcp: fix address removal logic in mptcp_pm_nl_rm_addr Fix inverted WARN_ON_ONCE condition that prevented normal address removal counter updates. The current code only executes decrement logic when the counter is already 0 (abnormal state), while normal removals (counter > 0) are ignored. Signed-off-by: Gang Yan Fixes: 636113918508 ("mptcp: pm: remove '_nl' from mptcp_pm_nl_rm_addr_received") Cc: stable@vger.kernel.org Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-10-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 0e4ec14dc1ee4b1ec347729c225c3ca950f2bcf6 Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:27 2025 +0100 selftests: mptcp: join: userspace: longer timeout In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications. To play it safe, all userspace tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes. The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments. Fixes: 290493078b96 ("selftests: mptcp: join: userspace: longer transfer") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Geliang Tang Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-9-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit fb13c6bb810ca871964e062cf91882d1c83db509 Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:26 2025 +0100 selftests: mptcp: join: endpoints: longer timeout In rare cases, when the test environment is very slow, some endpoints tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to have a longer timeout, and even go over the default one. This connection will be killed at the end, after the verifications: increasing the timeout doesn't change anything, apart from avoiding it to end before the end of the verifications. To play it safe, all endpoints tests not waiting for the end of the transfer are now having a longer timeout: 2 minutes. The Fixes commit was making the connection longer, but still, the default timeout would have stopped it after 1 minute, which might not be enough in very slow environments. Fixes: 6457595db987 ("selftests: mptcp: join: endpoints: longer transfer") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Geliang Tang Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-8-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit efff6cd53ac52827948298043270bb81ff17fdff Author: Matthieu Baerts (NGI0) Date: Tue Nov 18 08:20:25 2025 +0100 selftests: mptcp: join: fastclose: remove flaky marks After recent fixes like the parent commit, and "selftests: mptcp: connect: trunc: read all recv data", the two fastclose subtests no longer look flaky any more. It then feels fine to remove these flaky marks, to no longer ignore these subtests in case of errors. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-7-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit ae155060247be8dcae3802a95bd1bdf93ab3215d Author: Paolo Abeni Date: Tue Nov 18 08:20:24 2025 +0100 mptcp: fix duplicate reset on fastclose The CI reports sporadic failures of the fastclose self-tests. The root cause is a duplicate reset, not carrying the relevant MPTCP option. In the failing scenario the bad reset is received by the peer before the fastclose one, preventing the reception of the latter. Indeed there is window of opportunity at fastclose time for the following race: mptcp_do_fastclose __mptcp_close_ssk __tcp_close() tcp_set_state() [1] tcp_send_active_reset() [2] After [1] the stack will send reset to in-flight data reaching the now closed port. Such reset may race with [2]. Address the issue explicitly sending a single reset on fastclose before explicitly moving the subflow to close status. Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/596 Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-6-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit fff0c87996672816a84c3386797a5e69751c5888 Author: Paolo Abeni Date: Tue Nov 18 08:20:23 2025 +0100 mptcp: decouple mptcp fastclose from tcp close With the current fastclose implementation, the mptcp_do_fastclose() helper is in charge of two distinct actions: send the fastclose reset and cleanup the subflows. Formally decouple the two steps, ensuring that mptcp explicitly closes all the subflows after the mentioned helper. This will make the upcoming fix simpler, and allows dropping the 2nd argument from mptcp_destroy_common(). The Fixes tag is then the same as in the next commit to help with the backports. Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-5-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 Author: Paolo Abeni Date: Tue Nov 18 08:20:22 2025 +0100 mptcp: do not fallback when OoO is present In case of DSS corruption, the MPTCP protocol tries to avoid the subflow reset if fallback is possible. Such corruptions happen in the receive path; to ensure fallback is possible the stack additionally needs to check for OoO data, otherwise the fallback will break the data stream. Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 Author: Paolo Abeni Date: Tue Nov 18 08:20:21 2025 +0100 mptcp: fix premature close in case of fallback I'm observing very frequent self-tests failures in case of fallback when running on a CONFIG_PREEMPT kernel. The root cause is that subflow_sched_work_if_closed() closes any subflow as soon as it is half-closed and has no incoming data pending. That works well for regular subflows - MPTCP needs bi-directional connectivity to operate on a given subflow - but for fallback socket is race prone. When TCP peer closes the connection before the MPTCP one, subflow_sched_work_if_closed() will schedule the MPTCP worker to gracefully close the subflow, and shortly after will do another schedule to inject and process a dummy incoming DATA_FIN. On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the fallback subflow before subflow_sched_work_if_closed() is able to create the dummy DATA_FIN, unexpectedly interrupting the transfer. Address the issue explicitly avoiding closing fallback subflows on when the peer is only half-closed. Note that, when the subflow is able to create the DATA_FIN before the worker invocation, the worker will change the msk state before trying to close the subflow and will skip the latter operation as the msk will not match anymore the precondition in __mptcp_close_subflow(). Fixes: f09b0ad55a11 ("mptcp: close subflow when receiving TCP+FIN") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-3-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 Author: Paolo Abeni Date: Tue Nov 18 08:20:20 2025 +0100 mptcp: avoid unneeded subflow-level drops The rcv window is shared among all the subflows. Currently, MPTCP sync the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time. The above means that incoming data may sporadically observe outdated TCP-level rcv window and being wrongly dropped by TCP. Address the issue checking for the edge condition before queuing the data at TCP level, and eventually syncing the rcv window as needed. Note that the issue is actually present from the very first MPTCP implementation, but backports older than the blamed commit below will range from impossible to useless. Before: $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 14 0.0 After: $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow TcpExtBeyondWindow 0 0.0 Fixes: fa3fe2b15031 ("mptcp: track window announced to peer") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-2-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b Author: Paolo Abeni Date: Tue Nov 18 08:20:19 2025 +0100 mptcp: fix ack generation for fallback msk mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level rcv_wnd sent, and such information is tracked into the msk->old_wspace field, updated at ack transmission time by mptcp_write_options(). Fallback socket do not add any mptcp options, such helper is never invoked, and msk->old_wspace value remain stale. That in turn makes ack generation at recvmsg() time quite random. Address the issue ensuring mptcp_write_options() is invoked even for fallback sockets, and just update the needed info in such a case. The issue went unnoticed for a long time, as mptcp currently overshots the fallback socket receive buffer autotune significantly. It is going to change in the near future. Fixes: e3859603ba13 ("mptcp: better msk receive window updates") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/594 Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-1-806d3781c95f@kernel.org Signed-off-by: Jakub Kicinski commit 90449f2d1e1f020835cba5417234636937dd657e Author: Bart Van Assche Date: Thu Nov 13 10:16:43 2025 -0800 scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disabled. Reported-by: syzbot+c01f8e6e73f20459912e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google.com/ Cc: Hannes Reinecke Cc: stable@vger.kernel.org Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit e837b9091b277ae6f309d7e9fc93cb0308cf461f Author: Bitterblue Smith Date: Fri Nov 14 00:54:48 2025 +0200 wifi: rtw89: hw_scan: Don't let the operating channel be last Scanning can be offloaded to the firmware. To that end, the driver prepares a list of channels to scan, including periodic visits back to the operating channel, and sends the list to the firmware. When the channel list is too long to fit in a single H2C message, the driver splits the list, sends the first part, and tells the firmware to scan. When the scan is complete, the driver sends the next part of the list and tells the firmware to scan. When the last channel that fit in the H2C message is the operating channel something seems to go wrong in the firmware. It will acknowledge receiving the list of channels but apparently it will not do anything more. The AP can't be pinged anymore. The driver still receives beacons, though. One way to avoid this is to split the list of channels before the operating channel. Affected devices: * RTL8851BU with firmware 0.29.41.3 * RTL8832BU with firmware 0.29.29.8 * RTL8852BE with firmware 0.29.29.8 The commit 57a5fbe39a18 ("wifi: rtw89: refactor flow that hw scan handles channel list") is found by git blame, but it is actually to refine the scan flow, but not a culprit, so skip Fixes tag. Reported-by: Bitterblue Smith Closes: https://lore.kernel.org/linux-wireless/0abbda91-c5c2-4007-84c8-215679e652e1@gmail.com/ Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c1e61744-8db4-4646-867f-241b47d30386@gmail.com commit 295fe8406a357bc0abb901a21d1a554fd4dd1d05 Author: Siddharth Vadapalli Date: Wed Nov 19 20:53:53 2025 +0530 spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm Commit f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") relocated code but missed updating the error handling path associated with it. Prior to the relocation, runtime pm was enabled after the code-block associated with 'cqspi_request_mmap_dma()', due to which, the error handling for the same didn't require invoking 'pm_runtime_disable()'. Post refactoring, runtime pm has been enabled before the code-block and when an error is encountered, jumping to 'probe_dma_failed' doesn't invoke 'pm_runtime_disable()'. This leads to a race condition wherein 'cqspi_runtime_suspend()' is invoked while the error handling path executes in parallel. The resulting error is the following: clk:103:0 already disabled WARNING: drivers/clk/clk.c:1188 at clk_core_disable+0x80/0xa0, CPU#1: kworker/u8:0/12 [TRIMMED] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : clk_core_disable+0x80/0xa0 lr : clk_core_disable+0x80/0xa0 [TRIMMED] Call trace: clk_core_disable+0x80/0xa0 (P) clk_core_disable_lock+0x88/0x10c clk_disable+0x24/0x30 cqspi_probe+0xa3c/0xae8 [TRIMMED] The error is due to the second invocation of 'clk_disable_unprepare()' on 'cqspi->clk' in the error handling within 'cqspi_probe()', with the first invocation being within 'cqspi_runtime_suspend()'. Fix this by correcting the error handling. Fixes: f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance") Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251119152545.2591651-1-s-vadapalli@ti.com Signed-off-by: Mark Brown commit c156c7f27ecdb7b89dbbeaaa1f40d9fadc3c1680 Author: Shikang Fan Date: Wed Nov 19 18:05:10 2025 +0800 drm/amdgpu: Add sriov vf check for VCN per queue reset support. Add SRIOV check when setting VCN ring's supported reset mask. Signed-off-by: Shikang Fan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit ee9b603ad43f9870eb75184f9fb0a84f8c3cc852) Cc: stable@vger.kernel.org commit 21f46f54769c45ac8ca0dbaa977bc1b436ffdee2 Author: Srinivasan Shanmugam Date: Tue Nov 18 14:28:33 2025 +0530 drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags The MMIO_REMAP BO is a special 4K IO page that does not have a ttm_tt behind it. However, amdgpu_ttm_tt_pde_flags() was treating it like normal TT/doorbell/preempt memory and unconditionally accessed ttm->caching. For the MMIO_REMAP BO, ttm is NULL, so this leads to a NULL pointer dereference when computing PDE flags. Fix this by checking that ttm is non-NULL before reading ttm->caching. This prevents the crash for MMIO_REMAP and also makes the code more defensive if other BOs ever come through without a ttm_tt. Fixes: fb5a52dbe9fe ("drm/amdgpu: Implement TTM handling for MMIO_REMAP placement") Suggested-by: Jesse Zhang Suggested-by: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Jesse Zhang Tested-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 0db94da5a0a1cacda080b9ec8425fcbe4babc141) commit a44592339397bc6715917997c6869bdedd1a7256 Author: Timur Kristóf Date: Wed Nov 19 10:25:42 2025 +0100 drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag This fixes sparse mappings (aka. partially resident textures). Check the correct flags. Since a recent refactor, the code works with uAPI flags (for mapping buffer objects), and not PTE (page table entry) flags. Fixes: 6716a823d18d ("drm/amdgpu: rework how PTE flags are generated v3") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8feeab26c80635b802f72b3ed986c693ff8f3212) commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 Author: Yifan Zha Date: Fri Nov 14 17:48:58 2025 +0800 drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled [Why] Accoreding to CP updated to RS64 on gfx11, WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW. That packet is used for MCBP on F32 based system. So it would lead to incorrect GRBM write and FW is not handling that extra case correctly. [How] With gfx11 rs64 enabled, skip emit de meta data. Signed-off-by: Yifan Zha Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 8366cd442d226463e673bed5d199df916f4ecbcf) Cc: stable@vger.kernel.org commit 31ab31433c9bd2f255c48dc6cb9a99845c58b1e4 Author: Mario Limonciello Date: Tue Nov 18 07:18:10 2025 -0600 drm/amd: Skip power ungate during suspend for VPE During the suspend sequence VPE is already going to be power gated as part of vpe_suspend(). It's unnecessary to call during calls to amdgpu_device_set_pg_state(). It actually can expose a race condition with the firmware if s0i3 sequence starts as well. Drop these calls. Cc: Peyton.Lee@amd.com Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 2a6c826cfeedd7714611ac115371a959ead55bda) Cc: stable@vger.kernel.org commit 807e0d187da4c0b22036b5e34000f7a8c52f6e50 Author: Wen Yang Date: Thu Nov 20 01:45:25 2025 +0800 tick/sched: Fix bogus condition in report_idle_softirq() In commit 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") the new function report_idle_softirq() was created by breaking code out of the existing can_stop_idle_tick() for kernels v5.18 and newer. In doing so, the code essentially went from this form: if (A) { static int ratelimit; if (ratelimit < 10 && !C && A&D) { pr_warn("NOHZ tick-stop error: ..."); ratelimit++; } return false; } to a new function: static bool report_idle_softirq(void) { static int ratelimit; if (likely(!A)) return false; if (ratelimit < 10) return false; ... pr_warn("NOHZ tick-stop error: local softirq work is pending, handler #%02x!!!\n", pending); ratelimit++; return true; } commit a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition") realized ratelimit was essentially set to zero instead of ten, and hence *no* softirq pending messages would ever be issued, but "fixed" it as: - if (ratelimit < 10) + if (ratelimit >= 10) return false; However, this fix introduced another issue: When ratelimit is greater than or equal 10, even if A is true, it will directly return false. While ratelimit in the original code was only used to control printing and will not affect the return value. Restore the original logic and restrict ratelimit to control the printk and not the return value. Fixes: 0345691b24c0 ("tick/rcu: Stop allowing RCU_SOFTIRQ in idle") Fixes: a7e282c77785 ("tick/rcu: Fix bogus ratelimit condition") Signed-off-by: Wen Yang Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251119174525.29470-1-wen.yang@linux.dev commit 3c493b524ffdb3fae7f0d9dc6b887359ce13cd34 Merge: 3a8660878839fa 2050280a4bb660 Author: Stephen Boyd Date: Wed Nov 19 10:59:21 2025 -0700 Merge tag 'sunxi-clk-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clk driver fixes from Chen-Yu Tsai: Just a couple fixes for the A523 family. A couple clocks are marked as critical, and the lower bound of the audio PLL was lowered to match the datasheet. * tag 'sunxi-clk-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical commit cead55e24cf9e092890cf51c0548eccd7569defa Author: Ville Syrjälä Date: Thu Nov 13 01:30:28 2025 +0200 drm/plane: Fix create_in_format_blob() return value create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when it is not an error, and thus will oops if NULL returned. Return proper error values in the failure cases. Cc: stable@vger.kernel.org Cc: Arun R Murthy Fixes: 0d6dcd741c26 ("drm/plane: modify create_in_formats to acommodate async") Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251112233030.24117-2-ville.syrjala@linux.intel.com Reviewed-by: Arun R Murthy commit 23cb64fb76257309e396ea4cec8396d4a1dbae68 Merge: fdeee1cc7f3568 7a601324ac9828 Author: Linus Torvalds Date: Wed Nov 19 09:36:04 2025 -0800 Merge tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are mainly devicetree fixes for the arm platforms from Rockchips NXP, ASpeed and Broadcom, addressing issues with accidental overclocking, pinctrl, network and dtc warnings. There are additional fixes for regressions with the i.MX reset and memory controller drivers as well as the Tegra memory controller driver. Minor updates to the MAINTAINERS file, tee documentation and defconfigs bring those up to date with recent changes elsewhere" * tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (29 commits) MAINTAINERS: sync omap devicetree maintainers with omap platform MAINTAINERS: Update Krzysztof Kozlowski's email arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 arm64: dts: rockchip: disable HS400 on RK3588 Tiger arm64: dts: rockchip: drop reset from rk3576 i2c9 node tee: Date: Wed Nov 19 09:26:09 2025 -0800 Merge tag 'pwm/for-6.18-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fix from Uwe Kleine-König: "Correct mismatched pwm chip info for adp5585. Luke Wang found a problem in the pwm-adp5585 driver about how register information is mapped to the different device variants. This effectively made the driver non-functional. That didn't pop up before because the driver change was developed as part of a bigger mfd series and the original author didn't retest PWM functionality after it was tested in an earlier revision but then reworked" * tag 'pwm/for-6.18-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: adp5585: Correct mismatched pwm chip info commit 0678f5630429a5049d7663703b897e1bf8d13cd1 Merge: 2df79e4d729cc6 a78eb69d60ce89 Author: Linus Torvalds Date: Wed Nov 19 08:54:58 2025 -0800 Merge tag 'hid-for-linus-2025111901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - memory leak fixes in hid-uclogic, hid-ntrig and hid-playstation drivers (Abdun Nihaal, Masami Ichikawa) - regression fix for playback handling in hid-pidff (Tomasz Pakuła) - initialization fix for some amd_sfh platforms (Mario Limonciello) - a few assorted device-specific ID additions and quirks * tag 'hid-for-linus-2025111901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: uclogic: Fix potential memory leak in error path HID: playstation: Fix memory leak in dualshock4_get_calibration_data() HID: pidff: Fix needs_playback check HID: corsair-void: Use %pe for printing PTR_ERR HID: elecom: Add support for ELECOM M-XT3URBK (018F) HID: hid-input: Extend Elan ignore battery quirk to USB HID: hid-ntrig: Prevent memory leak in ntrig_report_version() HID: amd_sfh: Stop sensor before starting HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 commit e31a11be41cd134f245c01d1329e7bc89aba78fb Author: Wei Fang Date: Mon Nov 17 18:29:43 2025 +0800 net: phylink: add missing supported link modes for the fixed-link Pause, Asym_Pause and Autoneg bits are not set when pl->supported is initialized, so these link modes will not work for the fixed-link. This leads to a TCP performance degradation issue observed on the i.MX943 platform. The switch CPU port of i.MX943 is connected to an ENETC MAC, this link is a fixed link and the link speed is 2.5Gbps. And one of the switch user ports is the RGMII interface, and its link speed is 1Gbps. If the flow-control of the fixed link is not enabled, we can easily observe the iperf performance of TCP packets is very low. Because the inbound rate on the CPU port is greater than the outbound rate on the user port, the switch is prone to congestion, leading to the loss of some TCP packets and requiring multiple retransmissions. Solving this problem should be as simple as setting the Asym_Pause and Pause bits. The reason why the Autoneg bit needs to be set, Russell has gave a very good explanation in the thread [1], see below. "As the advertising and lp_advertising bitmasks have to be non-empty, and the swphy reports aneg capable, aneg complete, and AN enabled, then for consistency with that state, Autoneg should be set. This is how it was prior to the blamed commit." Fixes: de7d3f87be3c ("net: phylink: Use phy_caps_lookup for fixed-link configuration") Link: https://lore.kernel.org/aRjqLN8eQDIQfBjS@shell.armlinux.org.uk # [1] Signed-off-by: Wei Fang Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251117102943.1862680-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 2df79e4d729cc67395db2fd6965148fea0851898 Merge: 8b690556d8fe07 c42af83c59b65d Author: Linus Torvalds Date: Wed Nov 19 08:27:05 2025 -0800 Merge tag 'fixes-2025-11-19' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "Fix memblock_estimated_nr_free_pages() for soft-reserved memory The "soft-reserved" memory regions (EFI_MEMORY_SP) are added to the memblock.reserved, but not to the memblock.memory. It causes memblock_estimated_nr_free_pages() to return a value smaller value than expected, or if it underflows, an extremely large value. Calculate the number of estimated free pages using memblock_reserved_kern_size() instead of memblock_reserved_size() to fix the issue" * tag 'fixes-2025-11-19' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: fix memblock_estimated_nr_free_pages() for soft-reserved memory commit d4f14fa5c6c4d39b5187e1f410d59e38d76f283f Merge: 949f1fd2225bae 6a23ae0a96a600 Author: Thomas Zimmermann Date: Wed Nov 19 15:26:25 2025 +0100 Merge drm/drm-fixes into drm-misc-fixes Backmerging to get fixes from v6.18-rc6. Signed-off-by: Thomas Zimmermann commit 79afd3c5edac93b684393ec84185b2776d0630ef Author: Rob Herring (Arm) Date: Tue Nov 18 15:34:27 2025 -0600 dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes Add the missing unevaluatedProperties to disallow extra properties on the '^conf' nodes. Signed-off-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit d2932a59c2d4fb364396f21df58431c44918dd47 Author: Tony Luck Date: Tue Nov 18 17:27:12 2025 -0800 ACPI: APEI: EINJ: Fix EINJV2 initialization and injection ACPI 6.6 specification for EINJV2 appends an extra structure to the end of the existing struct set_error_type_with_address. Several issues showed up in testing. 1) Initialization was broken by an earlier fix [1] since is_v2 is only set while performing an injection, not during initialization. 2) A buggy BIOS provided invalid "revision" and "length" for the extension structure. Add several sanity checks. 3) When injecting legacy error types on an EINJV2 capable system, don't copy the component arrays. Fixes: 6c7058514991 ("ACPI: APEI: EINJ: Check if user asked for EINJV2 injection") # [1] Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Signed-off-by: Tony Luck [ rjw: Changelog edits ] Cc: 6.17+ # 6.17+ Link: https://patch.msgid.link/20251119012712.178715-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit 2b6d546ba83e8332870741eca469aed662d819ff Author: Bartosz Golaszewski Date: Tue Nov 18 13:18:16 2025 +0100 MAINTAINERS: update my email address Due to an upcoming change in my professional situation, I will need to start using my kernel.org address. Update all my MAINTAINERS entries. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20251118121816.23018-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit d4cd0902c156b2ca60fdda8cd8b5bcb4b0e9ed64 Author: Bartosz Golaszewski Date: Mon Nov 17 16:08:42 2025 +0100 gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor is still zero and it must not be used. It's possible that a GPIO change, we want to notify the user-space about, happens AFTER the reference count on the file descriptor associated with the character device went down to zero but BEFORE the .release() callback was called from the workqueue and so BEFORE we unregistered from the notifier. Using the regular get_file() routine in this situation triggers the following warning: struct file::f_count incremented from zero; use-after-free condition present! So use the get_file_active() variant that will return NULL on file descriptors that have been or are being released. Fixes: 40b7c49950bd ("gpio: cdev: put emitting the line state events on a workqueue") Reported-by: Alexander Sverdlin Closes: https://lore.kernel.org/all/5d605f7fc99456804911403102a4fe999a14cc85.camel@siemens.com/ Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20251117-gpio-cdev-get-file-v1-1-28a16b5985b8@linaro.org Signed-off-by: Bartosz Golaszewski commit a24074ca8840cf28fa50c40e957fdc50f29971b3 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:15:38 2025 +0100 perf/x86/intel/uncore: Remove superfluous check The 'pmu' pointer cannot be NULL, as it is taken as a pointer to an array. Remove the superfluous NULL check. Found by Coverity: CID#1497507. Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Ingo Molnar Cc: Liang Kan Cc: Peter Zijlstra Link: https://patch.msgid.link/20251119091538.825307-1-jirislaby@kernel.org commit 106a67494c53c56f55a2bd0757be0edb6eaa5407 Merge: d47515af6cccd7 e1bb28bf13f41a Author: Jakub Kicinski Date: Tue Nov 18 19:19:28 2025 -0800 Merge branch 'af_unix-fix-so_peek_off-bug-in-unix_stream_read_generic' Kuniyuki Iwashima says: ==================== af_unix: Fix SO_PEEK_OFF bug in unix_stream_read_generic(). Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket. Patch 1 fixes the bug and Patch 2 adds a new selftest to cover the case. ==================== Link: https://patch.msgid.link/20251117174740.3684604-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e1bb28bf13f41af5d7cc48359d1755cbcda4d502 Author: Kuniyuki Iwashima Date: Mon Nov 17 17:47:11 2025 +0000 selftest: af_unix: Add test for SO_PEEK_OFF. The test covers various cases to verify SO_PEEK_OFF behaviour for all AF_UNIX socket types. two_chunks_blocking and two_chunks_overlap_blocking reproduce the issue mentioned in the previous patch. Without the patch, the two tests fail: # RUN so_peek_off.stream.two_chunks_blocking ... # so_peek_off.c:121:two_chunks_blocking:Expected 'bbbb' == 'aaaabbbb'. # two_chunks_blocking: Test terminated by assertion # FAIL so_peek_off.stream.two_chunks_blocking not ok 3 so_peek_off.stream.two_chunks_blocking # RUN so_peek_off.stream.two_chunks_overlap_blocking ... # so_peek_off.c:159:two_chunks_overlap_blocking:Expected 'bbbb' == 'aaaabbbb'. # two_chunks_overlap_blocking: Test terminated by assertion # FAIL so_peek_off.stream.two_chunks_overlap_blocking not ok 5 so_peek_off.stream.two_chunks_overlap_blocking With the patch, all tests pass: # PASSED: 15 / 15 tests passed. # Totals: pass:15 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251117174740.3684604-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7bf3a476ce43833c49fceddbe94ff3472e04e9bc Author: Kuniyuki Iwashima Date: Mon Nov 17 17:47:10 2025 +0000 af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). Miao Wang reported a bug of SO_PEEK_OFF on AF_UNIX SOCK_STREAM socket. The unexpected behaviour is triggered when the peek offset is larger than the recv queue and the thread is unblocked by new data. Let's assume a socket which has "aaaa" in the recv queue and the peek offset is 4. First, unix_stream_read_generic() reads the offset 4 and skips the skb(s) of "aaaa" with the code below: skip = max(sk_peek_offset(sk, flags), 0); /* @skip is 4. */ do { ... while (skip >= unix_skb_len(skb)) { skip -= unix_skb_len(skb); ... skb = skb_peek_next(skb, &sk->sk_receive_queue); if (!skb) goto again; /* @skip is 0. */ } The thread jumps to the 'again' label and goes to sleep since new data has not arrived yet. Later, new data "bbbb" unblocks the thread, and the thread jumps to the 'redo:' label to restart the entire process from the first skb in the recv queue. do { ... redo: ... last = skb = skb_peek(&sk->sk_receive_queue); ... again: if (skb == NULL) { ... timeo = unix_stream_data_wait(sk, timeo, last, last_len, freezable); ... goto redo; /* @skip is 0 !! */ However, the peek offset is not reset in the path. If the buffer size is 8, recv() will return "aaaabbbb" without skipping any data, and the final offset will be 12 (the original offset 4 + peeked skbs' length 8). After sleeping in unix_stream_read_generic(), we have to fetch the peek offset again. Let's move the redo label before mutex_lock(&u->iolock). Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") Reported-by: Miao Wang Closes: https://lore.kernel.org/netdev/3B969F90-F51F-4B9D-AB1A-994D9A54D460@gmail.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251117174740.3684604-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d47515af6cccd7484d8b0870376858c9848a18ec Author: Pradyumn Rahar Date: Mon Nov 17 14:16:08 2025 +0200 net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to access this, when request_irq() fails due to exhausted IRQ vectors. This commit modifies the cleanup to remove only the specific IRQ mapping that was just added. This prevents removal of other valid mappings and ensures precise cleanup of the failed IRQ allocation's associated glue object. Note: This error is observed when both fwctl and rds configs are enabled. [1] mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:06:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 general protection fault, probably for non-canonical address 0xe277a58fde16f291: 0000 [#1] SMP NOPTI RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Call Trace: ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] ? __die_body.cold+0x8/0xa ? die_addr+0x39/0x53 ? exc_general_protection+0x1c4/0x3e9 ? dev_vprintk_emit+0x5f/0x90 ? asm_exc_general_protection+0x22/0x27 ? free_irq_cpu_rmap+0x23/0x7d mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] irq_pool_request_vector+0x7d/0x90 [mlx5_core] mlx5_irq_request+0x2e/0xe0 [mlx5_core] mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] comp_irq_request_pci+0x64/0xf0 [mlx5_core] create_comp_eq+0x71/0x385 [mlx5_core] ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] ? xas_load+0x8/0x91 mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] mlx5e_open_channels+0xad/0x250 [mlx5_core] mlx5e_open_locked+0x3e/0x110 [mlx5_core] mlx5e_open+0x23/0x70 [mlx5_core] __dev_open+0xf1/0x1a5 __dev_change_flags+0x1e1/0x249 dev_change_flags+0x21/0x5c do_setlink+0x28b/0xcc4 ? __nla_parse+0x22/0x3d ? inet6_validate_link_af+0x6b/0x108 ? cpumask_next+0x1f/0x35 ? __snmp6_fill_stats64.constprop.0+0x66/0x107 ? __nla_validate_parse+0x48/0x1e6 __rtnl_newlink+0x5ff/0xa57 ? kmem_cache_alloc_trace+0x164/0x2ce rtnl_newlink+0x44/0x6e rtnetlink_rcv_msg+0x2bb/0x362 ? __netlink_sendskb+0x4c/0x6c ? netlink_unicast+0x28f/0x2ce ? rtnl_calcit.isra.0+0x150/0x146 netlink_rcv_skb+0x5f/0x112 netlink_unicast+0x213/0x2ce netlink_sendmsg+0x24f/0x4d9 __sock_sendmsg+0x65/0x6a ____sys_sendmsg+0x28f/0x2c9 ? import_iovec+0x17/0x2b ___sys_sendmsg+0x97/0xe0 __sys_sendmsg+0x81/0xd8 do_syscall_64+0x35/0x87 entry_SYSCALL_64_after_hwframe+0x6e/0x0 RIP: 0033:0x7fc328603727 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48 RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727 RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffe8eb3f3c8 R15: 00007ffe8eb3f3bc ---[ end trace f43ce73c3c2b13a2 ]--- RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Code: 0f 1f 80 00 00 00 00 48 85 ff 74 6b 55 48 89 fd 53 66 83 7f 06 00 74 24 31 db 48 8b 55 08 0f b7 c3 48 8b 04 c2 48 85 c0 74 09 <8b> 38 31 f6 e8 c4 0a b8 ff 83 c3 01 66 3b 5d 06 72 de b8 ff ff ff RSP: 0018:ff384881640eaca0 EFLAGS: 00010282 RAX: e277a58fde16f291 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ff2335e2e20b3600 RSI: 0000000000000000 RDI: ff2335e2e20b3400 RBP: ff2335e2e20b3400 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 00000000ffffffe4 R12: ff384881640ead88 R13: ff2335c3760751e0 R14: ff2335e2e1672200 R15: ff2335c3760751f8 FS: 00007fc32ac22480(0000) GS:ff2335e2d6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f651ab54000 CR3: 00000029f1206003 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x1dc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) kvm-guest: disable async PF for cpu 0 Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") Signed-off-by: Mohith Kumar Thummaluru Tested-by: Mohith Kumar Thummaluru Reviewed-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Pradyumn Rahar Reviewed-by: Jacob Keller Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763381768-1234998-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 426358d9be7ce3518966422f87b96f1bad27295f Author: Eric Dumazet Date: Mon Nov 17 10:07:44 2025 +0000 mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events mptcp_worker Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631 mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362 mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174 tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361 tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441 tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931 tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6079 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6192 process_backlog+0x31e/0x900 net/core/dev.c:6544 __napi_poll+0xb6/0x540 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xda0 net/core/dev.c:7784 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline] mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1 mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 44: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385 mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline] __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529 mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 6630: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2523 [inline] slab_free mm/slub.c:6611 [inline] kfree+0x197/0x950 mm/slub.c:6818 mptcp_remove_anno_list_by_saddr+0x2d/0x40 net/mptcp/pm.c:158 mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1209 [inline] mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1240 [inline] mptcp_pm_nl_flush_addrs_doit+0x593/0xbb0 net/mptcp/pm_kernel.c:1281 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x508/0x820 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: stable@vger.kernel.org Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout") Reported-by: syzbot+2a6fbf0f0530375968df@syzkaller.appspotmail.com Closes: https://lore.kernel.org/691ad3c3.a70a0220.f6df1.0004.GAE@google.com Signed-off-by: Eric Dumazet Cc: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251117100745.1913963-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c3995fc1a89cc716bfe914c829b84da879c11db4 Merge: f94c1a114ac209 a55ef3bff84f11 Author: Jakub Kicinski Date: Tue Nov 18 17:58:44 2025 -0800 Merge tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2025-11-18 1) Misc fixes for xfrm_state creation/modification/deletion. Patchset from Sabrina Dubroca. 2) Fix inner packet family determination for xfrm offloads. From Jianbo Liu. 3) Don't push locally generated packets directly to L2 tunnel mode offloading, they still need processing from the standard xfrm path. From Jianbo Liu. 4) Fix memory leaks in xfrm_add_acquire for policy offloads and policy security contexts. From Zilin Guan. * tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: fix memory leak in xfrm_add_acquire() xfrm: Prevent locally generated packets from direct output in tunnel mode xfrm: Determine inner GSO type from packet inner protocol xfrm: Check inner packet family directly from skb_dst xfrm: check all hash buckets for leftover states during netns deletion xfrm: set err and extack on failure to create pcpu SA xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state xfrm: make state as DEAD before final put when migrate fails xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added xfrm: drop SA reference in xfrm_state_update if dir doesn't match ==================== Link: https://patch.msgid.link/20251118085344.2199815-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit f94c1a114ac209977bdf5ca841b98424295ab1f0 Author: Shay Drory Date: Mon Nov 17 14:05:49 2025 +0200 devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: d75559845078 ("devlink: Allow setting parent node of rate objects") Signed-off-by: Shay Drory Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763381149-1234377-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6010d4d8b55b5d3ae1efb5502c54312e15c14f21 Author: Jared Kangas Date: Tue Nov 11 13:54:12 2025 -0800 pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() s32_pmx_gpio_request_enable() does not initialize the newly-allocated gpio_pin_config::list before adding it to s32_pinctrl::gpio_configs. This could result in a linked list corruption. Initialize the new list_head with INIT_LIST_HEAD() to fix this. Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support") Signed-off-by: Jared Kangas Signed-off-by: Linus Walleij commit 97ea34defbb57bfaf71ce487b1b0865ffd186e81 Author: Jared Kangas Date: Tue Nov 11 13:54:11 2025 -0800 pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its fields are initialized. Notably, num_custom_params is used in pinconf_generic_parse_dt_config(), resulting in intermittent allocation errors, such as the following splat when probing i2c-imx: WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300 [...] Hardware name: NXP S32G3 Reference Design Board 3 (S32G-VNP-RDB3) (DT) [...] Call trace: __alloc_pages_noprof+0x290/0x300 (P) ___kmalloc_large_node+0x84/0x168 __kmalloc_large_node_noprof+0x34/0x120 __kmalloc_noprof+0x2ac/0x378 pinconf_generic_parse_dt_config+0x68/0x1a0 s32_dt_node_to_map+0x104/0x248 dt_to_map_one_config+0x154/0x1d8 pinctrl_dt_to_map+0x12c/0x280 create_pinctrl+0x6c/0x270 pinctrl_get+0xc0/0x170 devm_pinctrl_get+0x50/0xa0 pinctrl_bind_pins+0x60/0x2a0 really_probe+0x60/0x3a0 [...] __platform_driver_register+0x2c/0x40 i2c_adap_imx_init+0x28/0xff8 [i2c_imx] [...] This results in later parse failures that can cause issues in dependent drivers: s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c0-pins/i2c0-grp0: could not parse node property [...] pca953x 0-0022: failed writing register: -6 i2c i2c-0: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c2-pins/i2c2-grp0: could not parse node property i2c i2c-1: IMX I2C adapter registered s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property s32g-siul2-pinctrl 4009c240.pinctrl: /soc@0/pinctrl@4009c240/i2c4-pins/i2c4-grp0: could not parse node property i2c i2c-2: IMX I2C adapter registered Fix this by initializing s32_pinctrl_desc with devm_kzalloc() instead of devm_kmalloc() in s32_pinctrl_probe(), which sets the previously uninitialized fields to zero. Fixes: fd84aaa8173d ("pinctrl: add NXP S32 SoC family support") Signed-off-by: Jared Kangas Tested-by: Jan Petrous (OSS) Signed-off-by: Linus Walleij commit 23a5b9b12de9dcd15ebae4f1abc8814ec1c51ab0 Author: Grzegorz Nitka Date: Mon Oct 20 12:02:16 2025 +0200 ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initialization or on PTP restart (errors in reset handling, NVM update etc). In both cases, calls to PF PTP cleanup (ice_ptp_cleanup_pf function) and 'ps_lock' mutex deinitialization were missed. Additionally, ptp clock was not unregistered in the latter case. Keep PTP state as 'uninitialized' on init to distinguish between error scenarios and to avoid resource release duplication at driver removal. The consequence of missing ice_ptp_cleanup_pf call is the following call trace dumped when ice_adapter object is freed (port list is not empty, as it is required at this stage): [ T93022] ------------[ cut here ]------------ [ T93022] WARNING: CPU: 10 PID: 93022 at ice/ice_adapter.c:67 ice_adapter_put+0xef/0x100 [ice] ... [ T93022] RIP: 0010:ice_adapter_put+0xef/0x100 [ice] ... [ T93022] Call Trace: [ T93022] [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? __warn.cold+0xb0/0x10e [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] ? report_bug+0xd8/0x150 [ T93022] ? handle_bug+0xe9/0x110 [ T93022] ? exc_invalid_op+0x17/0x70 [ T93022] ? asm_exc_invalid_op+0x1a/0x20 [ T93022] ? ice_adapter_put+0xef/0x100 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] [ T93022] pci_device_remove+0x42/0xb0 [ T93022] device_release_driver_internal+0x19f/0x200 [ T93022] driver_detach+0x48/0x90 [ T93022] bus_remove_driver+0x70/0xf0 [ T93022] pci_unregister_driver+0x42/0xb0 [ T93022] ice_module_exit+0x10/0xdb0 [ice 33d2647ad4f6d866d41eefff1806df37c68aef0c] ... [ T93022] ---[ end trace 0000000000000000 ]--- [ T93022] ice: module unloaded Fixes: e800654e85b5 ("ice: Use ice_adapter for PTP shared data instead of auxdev") Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7a601324ac9828468291151d220edb47a6a82449 Author: Andreas Kemnade Date: Tue Nov 18 11:26:52 2025 -0800 MAINTAINERS: sync omap devicetree maintainers with omap platform Both used to go through Tony's branches, so lets keep things together. This was missed at the time when Co-Maintainers were added. Signed-off-by: Andreas Kemnade Acked-by: Aaro Koskinen Acked-by: Tony Lindgren Reviewed-by: Roger Quadros Acked-by: Kevin Hilman Link: https://patch.msgid.link/20240915195321.1071967-1-andreas@kemnade.info Signed-off-by: Kevin Hilman Link: https://lore.kernel.org/r/20251118192652.316198-1-khilman@baylibre.com Signed-off-by: Arnd Bergmann commit c10519c8c88629e3e0e7f822c67e5286eb97c836 Merge: 124c98b10001a3 b5414520793e68 Author: Arnd Bergmann Date: Tue Nov 18 22:45:25 2025 +0100 Merge tag 'v6.18-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Regulator/supply fixes for a number of boards, removed too fast cpu OPPs from rk3576 (not supported in newer vendor TF-A and never supported in upstream TF-A). As well as some DTS validation fixes and one pinctrl fix for the odroid-m1. * tag 'v6.18-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 arm64: dts: rockchip: disable HS400 on RK3588 Tiger arm64: dts: rockchip: drop reset from rk3576 i2c9 node arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2 arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic arm64: dts: rockchip: Drop 'rockchip,grf' prop from tsadc on rk3328 arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576 arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2 arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 Signed-off-by: Arnd Bergmann commit 118082368c2b6ddefe6cb607efc312285148f044 Author: Emil Tantilov Date: Mon Oct 13 08:08:24 2025 -0700 idpf: fix possible vport_config NULL pointer deref in remove Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an instance where the driver failed during an attempt to create a VF: [ 1661.543624] idpf 0000:84:00.7: Device HW Reset initiated [ 1722.923726] idpf 0000:84:00.7: Transaction timed-out (op:1 cookie:2900 vc_op:1 salt:29 timeout:60000ms) [ 1723.353263] BUG: kernel NULL pointer dereference, address: 0000000000000028 ... [ 1723.358472] RIP: 0010:idpf_remove+0x11c/0x200 [idpf] ... [ 1723.364973] Call Trace: [ 1723.365475] [ 1723.365972] pci_device_remove+0x42/0xb0 [ 1723.366481] device_release_driver_internal+0x1a9/0x210 [ 1723.366987] pci_stop_bus_device+0x6d/0x90 [ 1723.367488] pci_stop_and_remove_bus_device+0x12/0x20 [ 1723.367971] pci_iov_remove_virtfn+0xbd/0x120 [ 1723.368309] sriov_disable+0x34/0xe0 [ 1723.368643] idpf_sriov_configure+0x58/0x140 [idpf] [ 1723.368982] sriov_numvfs_store+0xda/0x1c0 Avoid the NULL pointer dereference by adding NULL pointer check for vport_config[i], before freeing user_config.q_coalesce. Fixes: e1e3fec3e34b ("idpf: preserve coalescing settings across resets") Signed-off-by: Emil Tantilov Reviewed-by: Chittim Madhu Reviewed-by: Simon Horman Tested-by: Samuel Salin Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 5b38c22687d9287d85dd3bef2fa708bf62cf3895 Author: Venkata Ramana Nayana Date: Fri Nov 7 14:01:41 2025 +0530 drm/xe/irq: Handle msix vector0 interrupt Current gu2host handler registered as MSI-X vector 0 and as per bspec for a msix vector 0 interrupt, the driver must check the legacy registers 190008(TILE_INT_REG), 190060h (GT INTR Identity Reg 0) and other registers mentioned in "Interrupt Service Routine Pseudocode" otherwise it will block the next interrupts. To overcome this issue replacing guc2host handler with legacy xe_irq_handler. Fixes: da889070be7b2 ("drm/xe/irq: Separate MSI and MSI-X flows") Bspec: 62357 Signed-off-by: Venkata Ramana Nayana Reviewed-by: Balasubramani Vivekanandan Link: https://patch.msgid.link/20251107083141.2080189-1-venkata.ramana.nayana@intel.com Signed-off-by: Matt Roper (cherry picked from commit c34a14bce7090862ebe5a64abe8d85df75e62737) Signed-off-by: Lucas De Marchi commit 27c0a54e48c658eb12fa3bcbb2892a3fa17b72af Author: Shuicheng Lin Date: Mon Nov 10 23:26:58 2025 +0000 drm/xe: Remove duplicate DRM_EXEC selection from Kconfig There are 2 identical "select DRM_EXEC" lines for DRM_XE. Remove one to clean up the configuration. Fixes: d490ecf57790 ("drm/xe: Rework xe_exec and the VM rebind worker to use the drm_exec helper") Cc: Thomas Hellström Cc: Lucas De Marchi Signed-off-by: Shuicheng Lin Reviewed-by: Nitin Gote Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251110232657.1807998-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit b1aa02acd03bfef3ed39c511d33c4a4303d2f9b1) Signed-off-by: Lucas De Marchi commit 905a3468ec679293949438393de7e61310432662 Author: Matt Roper Date: Thu Nov 13 15:40:39 2025 -0800 drm/xe/kunit: Fix forcewake assertion in mocs test The MOCS kunit test calls KUNIT_ASSERT_TRUE_MSG() with a condition of 'true;' this prevents the assertion from ever failing. Replace KUNIT_ASSERT_TRUE_MSG with KUNIT_FAIL_AND_ABORT to get the intended failure behavior in cases where forcewake was not acquired successfully. Fixes: 51c0ee84e4dc ("drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs") Cc: Tejas Upadhyay Cc: Gustavo Sousa Reviewed-by: Lucas De Marchi Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20251113234038.2256106-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 9be4f0f687048ba77428ceca11994676736507b7) Signed-off-by: Lucas De Marchi commit d52dea485cd3c98cfeeb474cf66cf95df2ab142f Author: Shuicheng Lin Date: Wed Nov 12 18:10:06 2025 +0000 drm/xe: Prevent BIT() overflow when handling invalid prefetch region If user provides a large value (such as 0x80) for parameter prefetch_mem_region_instance in vm_bind ioctl, it will cause BIT(prefetch_region) overflow as below: " ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/gpu/drm/xe/xe_vm.c:3414:7 shift exponent 128 is too large for 64-bit type 'long unsigned int' CPU: 8 UID: 0 PID: 53120 Comm: xe_exec_system_ Tainted: G W 6.18.0-rc1-lgci-xe-kernel+ #200 PREEMPT(voluntary) Tainted: [W]=WARN Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 Call Trace: dump_stack_lvl+0xa0/0xc0 dump_stack+0x10/0x20 ubsan_epilogue+0x9/0x40 __ubsan_handle_shift_out_of_bounds+0x10e/0x170 ? mutex_unlock+0x12/0x20 xe_vm_bind_ioctl.cold+0x20/0x3c [xe] ... " Fix it by validating prefetch_region before the BIT() usage. v2: Add Closes and Cc stable kernels. (Matt) Reported-by: Koen Koning Reported-by: Peter Senna Tschudin Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6478 Cc: # v6.8+ Reviewed-by: Matthew Auld Signed-off-by: Shuicheng Lin Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20251112181005.2120521-2-shuicheng.lin@intel.com (cherry picked from commit 8f565bdd14eec5611cc041dba4650e42ccdf71d9) Signed-off-by: Lucas De Marchi commit 8b690556d8fe074b4f9835075050fba3fb180e93 Merge: 5bebe8de192649 3fa05f96fc08df Author: Linus Torvalds Date: Tue Nov 18 10:02:22 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Arm: - Only adjust the ID registers when no irqchip has been created once per VM run, instead of doing it once per vcpu, as this otherwise triggers a pretty bad conbsistency check failure in the sysreg code - Make sure the per-vcpu Fine Grain Traps are computed before we load the system registers on the HW, as we otherwise start running without anything set until the first preemption of the vcpu x86: - Fix selftests failure on AMD, checking for an optimization that was not happening anymore" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Fix redundant updates of LBR MSR intercepts KVM: arm64: VHE: Compute fgt traps before activating them KVM: arm64: Finalize ID registers only once per VM commit a6ee8422b4f2a591de010f4e60471060b13d4170 Author: Li Chen Date: Tue Nov 11 20:13:36 2025 +0800 dm-pcache: zero cache_info before default init pcache_meta_find_latest() leaves whatever it last copied into the caller’s buffer even when it returns NULL. For cache_info_init(), that meant cache->cache_info could still contain CRC-bad garbage when no valid metadata exists, leading later initialization paths to read bogus flags. Explicitly memset cache->cache_info in cache_info_init_default() so new-cache paths start from a clean slate. The default sequence number assignment becomes redundant with this reset, so it drops out. Signed-off-by: Li Chen Reviewed-by: Zheng Gu Signed-off-by: Mikulas Patocka commit 840b80af74fda9672f111023ca17ad7875427f13 Author: Li Chen Date: Tue Nov 11 20:13:35 2025 +0800 dm-pcache: reuse meta_addr in pcache_meta_find_latest pcache_meta_find_latest() already computes the metadata address as meta_addr. Reuse that instead of recomputing. Signed-off-by: Li Chen Signed-off-by: Mikulas Patocka commit 341d14bd69d05b1c30bd83c5056730ba6d78b83d Author: Li Chen Date: Tue Nov 11 20:13:34 2025 +0800 dm-pcache: allow built-in build and rename flush helper CONFIG_BCACHE is tristate, so dm-pcache can also be built-in. Switch the Makefile to use obj-$(CONFIG_DM_PCACHE) so the target can be linked into vmlinux instead of always being a loadable module. Also rename cache_flush() to pcache_cache_flush() to avoid a global symbol clash with sunrpc/cache.c's cache_flush(). Signed-off-by: Li Chen Signed-off-by: Mikulas Patocka commit 9eb00b5f5697bd56baa3222c7a1426fa15bacfb5 Author: Robert McClinton Date: Sun Nov 16 12:33:21 2025 -0500 drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because incorrectly returning false from signaled() is perfectly acceptable. Link: https://github.com/brave/brave-browser/issues/49182 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4641 Cc: Alex Deucher Signed-off-by: Robert McClinton Signed-off-by: Alex Deucher (cherry picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db) Cc: stable@vger.kernel.org commit 1788ef30725da53face7e311cdf62ad65fababcd Author: Fangzhi Zuo Date: Fri Nov 7 15:01:30 2025 -0500 drm/amd/display: Fix pbn to kbps Conversion [Why] Existing routine has two conversion sequence, pbn_to_kbps and kbps_to_pbn with margin. Non of those has without-margin calculation. kbps_to_pbn with margin conversion includes fec overhead which has already been included in pbn_div calculation with 0.994 factor considered. It is a double counted fec overhead factor that causes potential bw loss. [How] Add without-margin calculation. Fix fec overhead double counted issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3735 Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit e0dec00f3d05e8c0eceaaebfdca217f8d10d380c) Cc: stable@vger.kernel.org commit a78eb69d60ce893de48dd75f725ba21309131fc2 Author: Abdun Nihaal Date: Mon Nov 10 22:59:41 2025 +0530 HID: uclogic: Fix potential memory leak in error path In uclogic_params_ugee_v2_init_event_hooks(), the memory allocated for event_hook is not freed in the next error path. Fix that by freeing it. Fixes: a251d6576d2a ("HID: uclogic: Handle wireless device reconnection") Signed-off-by: Abdun Nihaal Signed-off-by: Jiri Kosina commit 5bab4c89390f32b2f491f49a151948cd226dd909 Author: Ivan Lipski Date: Wed Nov 5 15:27:42 2025 -0500 drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 [Why] On DCN20 & DCN30, the 6th DPP's & HUBP's are powered on permanently and cannot be power gated. Thus, when dpp_reset() is invoked for the DPP5, while it's still powered on, the cached cursor_state (dpp_base->pos.cur0_ctl.bits.cur0_enable) and the actual state (CUR0_ENABLE) bit are unsycned. This can cause a double cursor in full screen with non-native scaling. [How] Force disable cursor on DPP5 on plane powerdown for ASICs w/ 6 DPPs/HUBPs. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4673 Reviewed-by: Aric Cyr Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 79b3c037f972dcb13e325a8eabfb8da835764e15) Cc: stable@vger.kernel.org commit 8513c154f8ad7097653dd9bf43d6155e5aad4ab3 Author: Abdun Nihaal Date: Mon Nov 10 22:45:50 2025 +0530 HID: playstation: Fix memory leak in dualshock4_get_calibration_data() The memory allocated for buf is not freed in the error paths when ps_get_report() fails. Free buf before jumping to transfer_failed label Fixes: 947992c7fa9e ("HID: playstation: DS4: Fix calibration workaround for clone devices") Signed-off-by: Abdun Nihaal Reviewed-by: Silvan Jegen Signed-off-by: Jiri Kosina commit c97da4785b3bbc60c24cfd1ffea1d7c8b90ed743 Author: Ivan Lipski Date: Thu Oct 30 11:25:33 2025 -0400 drm/amd/display: Add an HPD filter for HDMI [Why] Some monitors perform rapid “autoscan” HPD re‑assertions right after a disconnect or powersaving mode enablement. These appear as a quick disconnect→reconnect with an identical EDID. Since Linux has no HDMI hotplug detection (HPD) filter, these quick reconnects are seen as hotplug events, which can unintentionally wake a system with DPMS off. An example: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Such 'fake reconnects' are considered when the interval between a disconnect and a connect is within 1500ms (experimentally chosen using several monitors), and the two connections have the same EDID. [How] Implement a time-based debounce mechanism: 1. On HDMI disconnect detection, instead of immediately processing the HPD event, save the current sink and schedule delayed work (default 1500ms) 2. If another HDMI disconnect HPD event arrives during the debounce period, it reschedules the pending work, ensuring only the final state is processed. 3. When the debounce timer expires, re-detect the display and compare the new sink with the cached one using EDID comparison. 4. If sinks match (same EDID), this was a spontaneous HPD toggle: - Update connector state internally - Skip hotplug event to prevent desktop rearrangement If sinks differ, this was a real display change: - Process normally with the hotplug event The debounce delay is configurable via module parameter 'hdmi_hpd_debounce_delay_ms'. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Reviewed-by: Sun peng (Leo) Li Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit c918e75e1ed95be76f8e3156a411188f650fe03f) commit 8612badc331bcab2068baefa69e1458085ed89e3 Author: Mario Limonciello (AMD) Date: Mon Nov 3 12:11:31 2025 -0600 drm/amd/display: Increase DPCD read retries [Why] Empirical measurement of some monitors that fail to read EDID while booting shows that the number of retries with a 30ms delay between tries is as high as 16. [How] Increase number of retries to 20. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit ad1c59ad7cf74ec06e32fe2c330ac1e957222288) Cc: stable@vger.kernel.org commit 9d7b89a1028230315a8999cfea7795fbe84f62cc Author: Tomasz Pakuła Date: Mon Nov 3 21:02:43 2025 +0100 HID: pidff: Fix needs_playback check A small bug made it's way here when rewriting code to Linux quality. Currently, if an effect is not infinite and a program requests it's playback with the same number of loops, the play command won't be fired and if an effect is infinite, the spam will continue. We want every playback update for non-infinite effects and only some for infinite (detecting when a program requests stop with 0 which will be different than previous value which is usually 1 or 255). Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 4e127a74786fa9573a32c8aa4bbf69ef78c3232a Author: Stuart Hayhurst Date: Mon Nov 3 14:21:13 2025 +0000 HID: corsair-void: Use %pe for printing PTR_ERR Use %pe to print a PTR_ERR to silence a cocci warning Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510300342.WtPn2jF3-lkp@intel.com/ Signed-off-by: Stuart Hayhurst Signed-off-by: Jiri Kosina commit 71ad9054c1f241be63f9d11df8cbd0aa0352fe16 Author: Mario Limonciello (AMD) Date: Mon Nov 3 11:17:44 2025 -0600 drm/amd/display: Move sleep into each retry for retrieve_link_cap() [Why] When a monitor is booting it's possible that it isn't ready to retrieve link caps and this can lead to an EDID read failure: ``` [drm:retrieve_link_cap [amdgpu]] *ERROR* retrieve_link_cap: Read receiver caps dpcd data failed. amdgpu 0000:c5:00.0: [drm] *ERROR* No EDID read. ``` [How] Rather than msleep once and try a few times, msleep each time. Should be no changes for existing working monitors, but should correct reading caps on a monitor that is slow to boot. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 669dca37b3348a447db04bbdcbb3def94d5997cc) Cc: stable@vger.kernel.org commit cdcbb8e8d10f656642380ee13516290437b52b36 Author: Naoki Ueki Date: Mon Nov 3 21:16:45 2025 +0900 HID: elecom: Add support for ELECOM M-XT3URBK (018F) The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which shares the same report descriptor as the existing device (0x00FB). However, the driver does not currently recognize this new ID, resulting in only five buttons being functional. This patch adds the new device ID so that all six buttons work properly. Signed-off-by: Naoki Ueki Signed-off-by: Jiri Kosina commit 3fa05f96fc08dff5e846c2cc283a249c1bf029a1 Author: Yosry Ahmed Date: Wed Nov 12 01:30:17 2025 +0000 KVM: SVM: Fix redundant updates of LBR MSR intercepts Don't update the LBR MSR intercept bitmaps if they're already up-to-date, as unconditionally updating the intercepts forces KVM to recalculate the MSR bitmaps for vmcb02 on every nested VMRUN. The redundant updates are functionally okay; however, they neuter an optimization in Hyper-V nested virtualization enlightenments and this manifests as a self-test failure. In particular, Hyper-V lets L1 mark "nested enlightenments" as clean, i.e. tell KVM that no changes were made to the MSR bitmap since the last VMRUN. The hyperv_svm_test KVM selftest intentionally changes the MSR bitmap "without telling KVM about it" to verify that KVM honors the clean hint, correctly fails because KVM notices the changed bitmap anyway: ==== Test Assertion Failure ==== x86/hyperv_svm_test.c:120: vmcb->control.exit_code == 0x081 pid=193558 tid=193558 errno=4 - Interrupted system call 1 0x0000000000411361: assert_on_unhandled_exception at processor.c:659 2 0x0000000000406186: _vcpu_run at kvm_util.c:1699 3 (inlined by) vcpu_run at kvm_util.c:1710 4 0x0000000000401f2a: main at hyperv_svm_test.c:175 5 0x000000000041d0d3: __libc_start_call_main at libc-start.o:? 6 0x000000000041f27c: __libc_start_main_impl at ??:? 7 0x00000000004021a0: _start at ??:? vmcb->control.exit_code == SVM_EXIT_VMMCALL Do *not* fix this by skipping svm_hv_vmcb_dirty_nested_enlightenments() when svm_set_intercept_for_msr() performs a no-op change. changes to the L0 MSR interception bitmap are only triggered by full CPUID updates and MSR filter updates, both of which should be rare. Changing svm_set_intercept_for_msr() risks hiding unintended pessimizations like this one, and is actually more complex than this change. Fixes: fbe5e5f030c2 ("KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv()") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251112013017.1836863-1-yosry.ahmed@linux.dev [Rewritten commit message based on mailing list discussion. - Paolo] Reviewed-by: Sean Christopherson Tested-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit cfa0904a35fd0231f4d05da0190f0a22ed881cce Author: Fangzhi Zuo Date: Thu Sep 18 16:25:45 2025 -0400 drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched [why] 1. With allow_0_dtb_clk enabled, the time required to latch DTBCLK to 600 MHz depends on the SMU. If DTBCLK is not latched to 600 MHz before set_mode completes, gating DTBCLK causes the DP2 sink to lose its clock source. 2. The existing DTBCLK gating sequence ungates DTBCLK based on both pix_clk and ref_dtbclk, but gates DTBCLK when either pix_clk or ref_dtbclk is zero. pix_clk can be zero outside the set_mode sequence before DTBCLK is properly latched, which can lead to DTBCLK being gated by mistake. [how] Consider both pixel_clk and ref_dtbclk when determining when it is safe to gate DTBCLK; this is more accurate. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4701 Fixes: 5949e7c4890c ("drm/amd/display: Enable Dynamic DTBCLK Switch") Reviewed-by: Charlene Liu Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d04eb0c402780ca037b62a6aecf23b863545ebca) Cc: stable@vger.kernel.org commit b82ebaf298643cad497ef8daf263c0652d486eec Merge: 6a23ae0a96a600 85592114ffda56 Author: Paolo Bonzini Date: Tue Nov 18 17:38:01 2025 +0100 Merge tag 'kvmarm-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.18, take #3 - Only adjust the ID registers when no irqchip has been created once per VM run, instead of doing it once per vcpu, as this otherwise triggers a pretty bad conbsistency check failure in the sysreg code. - Make sure the per-vcpu Fine Grain Traps are computed before we load the system registers on the HW, as we otherwise start running without anything set until the first preemption of the vcpu. commit 5bebe8de19264946d398ead4e6c20c229454a552 Author: Linus Torvalds Date: Tue Nov 18 08:21:27 2025 -0800 mm/huge_memory: Fix initialization of huge zero folio The recent fix to properly initialize the tags of the huge zero folio had an unfortunate not-so-subtle side effect: it caused the actual *contents* of the huge zero folio to not be initialized at all when the hardware didn't support the memory tagging. The reason was the unfortunate semantics of tag_clear_highpage(): on hardware that didn't do the tagging, it would silently just not do anything at all. And since this is done only on arm64 with MTE support, that basically meant most hardware. It wasn't necessarily immediately obvious since the huge zero page isn't necessarily very heavily used - or because it might already be zero because all-zeroes is the most common pattern. But it ends up causing random odd user space failures when you do hit it. The unfortunate semantics have been around for a while, but became a real bug only when we started actively using __GFP_ZEROTAGS in the generic get_huge_zero_folio() function - before that, it had only ever been used in code that checked that the hardware supported it. Fix this by simply changing the semantics of tag_clear_highpage() to return whether it actually successfully did something or not. While at it, also make it initialize multiple pages in one go, since that's actually what the only caller wants it to do and it simplifies the whole logic. Fixes: adfb6609c680 ("mm/huge_memory: initialise the tags of the huge zero folio") Link: https://lore.kernel.org/all/20251117082023.90176-1-00107082@163.com/ Reviewed-by: David Hildenbrand (Red Hat) Reported-and-tested-by: David Wang <00107082@163.com> Reported-and-tested-by: Carlos Llamas Signed-off-by: Linus Torvalds commit f384497a76ed9539f70f6e8fe81a193441c943d2 Author: Rafael J. Wysocki Date: Tue Nov 18 15:16:04 2025 +0100 PM: sleep: core: Fix runtime PM enabling in device_resume_early() Runtime PM should only be enabled in device_resume_early() if it has been disabled for the given device by device_suspend_late(). Otherwise, it may cause runtime PM callbacks to run prematurely in some cases which leads to further functional issues. Make two changes to address this problem. First, reorder device_suspend_late() to only disable runtime PM for a device when it is going to look for the device's callback or if the device is a "syscore" one. In all of the other cases, disabling runtime PM for the device is not in fact necessary. However, if the device's callback returns an error and the power.is_late_suspended flag is not going to be set, enable runtime PM so it only remains disabled when power.is_late_suspended is set. Second, make device_resume_early() only enable runtime PM for the devices with the power.is_late_suspended flag set. Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous") Reported-by: Rose Wu Closes: https://lore.kernel.org/linux-pm/70b25dca6f8c2756d78f076f4a7dee7edaaffc33.camel@mediatek.com/ Cc: 6.16+ # 6.16+ Reviewed-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12784270.O9o76ZdvQC@rafael.j.wysocki commit 5474560381775bc70cc90ed2acefad48ffd6ee07 Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:17 2025 +0530 drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A On PTL, no combo PHY is connected to PORT B. However, PORT B can still be used for Type-C and will utilize the C20 PHY for eDP over Type-C. In such configurations, VBTs also enumerate PORT B. This leads to issues where PORT B is incorrectly identified as using the C10 PHY, due to the assumption that returning true for PORT B in intel_encoder_is_c10phy() would not cause problems. From PTL's perspective, only PORT A/PHY A uses the C10 PHY. Update the helper intel_encoder_is_c10phy() to return true only for PORT A/PHY on PTL. v2: Change the condition code style for ptl/wcl Bspec: 72571,73944 Fixes: 9d10de78a37f ("drm/i915/wcl: C10 phy connected to port A and B") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-4-dnyaneshwar.bhadane@intel.com (cherry picked from commit 8147f7a1c083fd565fb958824f7c552de3b2dc46) Signed-off-by: Rodrigo Vivi commit 913253ed47b9925454cbb17faa3e350015b3d67a Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:16 2025 +0530 drm/i915/display: Add definition for wcl as subplatform We will need to differentiate between WCL and PTL in intel_encoder_is_c10phy(). Since WCL and PTL use the same display architecture, let's define WCL as a subplatform of PTL to allow the differentiation. v2: Update commit message and reorder wcl define (Gustavo) Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-3-dnyaneshwar.bhadane@intel.com (cherry picked from commit 4dfaae643e59cf3ab71b88689dce1b874f036f00) Signed-off-by: Rodrigo Vivi [Rodrigo added Fixes tag when porting it to fixes] commit 6eb2e056b0e418718fc5a3cfe79bdb41d9a2851d Author: Dnyaneshwar Bhadane Date: Mon Sep 22 20:33:15 2025 +0530 drm/pcids: Split PTL pciids group to make wcl subplatform To form the WCL platform as a subplatform of PTL in definition, WCL pci ids are splited into saparate group from PTL. So update the pciidlist struct to cover all the pci ids. v2: - Squash wcl description in single patch for display and xe.(jani,gustavo) Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250922150317.2334680-2-dnyaneshwar.bhadane@intel.com (cherry picked from commit 32620e176443bf23ec81bfe8f177c6721a904864) Signed-off-by: Rodrigo Vivi [Rodrigo added the Fixes tag when porting it to fixes] commit 0f08f0b0fb5e674b48f30e86c103760204a1d3f3 Author: Florian Fuchs Date: Thu Nov 13 19:10:00 2025 +0100 net: ps3_gelic_net: handle skb allocation failures Handle skb allocation failures in RX path, to avoid NULL pointer dereference and RX stalls under memory pressure. If the refill fails with -ENOMEM, complete napi polling and wake up later to retry via timer. Also explicitly re-enable RX DMA after oom, so the dmac doesn't remain stopped in this situation. Previously, memory pressure could lead to skb allocation failures and subsequent Oops like: Oops: Kernel access of bad area, sig: 11 [#2] Hardware name: SonyPS3 Cell Broadband Engine 0x701000 PS3 NIP [c0003d0000065900] gelic_net_poll+0x6c/0x2d0 [ps3_gelic] (unreliable) LR [c0003d00000659c4] gelic_net_poll+0x130/0x2d0 [ps3_gelic] Call Trace: gelic_net_poll+0x130/0x2d0 [ps3_gelic] (unreliable) __napi_poll+0x44/0x168 net_rx_action+0x178/0x290 Steps to reproduce the issue: 1. Start a continuous network traffic, like scp of a 20GB file 2. Inject failslab errors using the kernel fault injection: echo -1 > /sys/kernel/debug/failslab/times echo 30 > /sys/kernel/debug/failslab/interval echo 100 > /sys/kernel/debug/failslab/probability 3. After some time, traces start to appear, kernel Oopses and the system stops Step 2 is not always necessary, as it is usually already triggered by the transfer of a big enough file. Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") Signed-off-by: Florian Fuchs Link: https://patch.msgid.link/20251113181000.3914980-1-fuchsfl@gmail.com Signed-off-by: Paolo Abeni commit 896f1a2493b59beb2b5ccdf990503dbb16cb2256 Author: Pavel Zhigulin Date: Thu Nov 13 14:27:56 2025 +0300 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 55482edc25f0 ("qede: Add slowpath/fastpath support and enable hardware GRO") Signed-off-by: Pavel Zhigulin Link: https://patch.msgid.link/20251113112757.4166625-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Paolo Abeni commit db30233361f94e1a84450c607989bdb671100fb6 Author: Randy Dunlap Date: Mon Nov 10 22:09:34 2025 -0800 platform/x86: intel-uncore-freq: fix all header kernel-doc warnings In file uncore-frequency/uncore-frequency-common.h, correct all kernel-doc warnings by adding missing leading " *" to some lines, adding a missing kernel-doc entry, and fixing a name typo. Warning: uncore-frequency-common.h:50 bad line: Storage for kobject attribute elc_low_threshold_percent Warning: uncore-frequency-common.h:52 bad line: Storage for kobject attribute elc_high_threshold_percent Warning: uncore-frequency-common.h:54 bad line: Storage for kobject attribute elc_high_threshold_enable Warning: uncore-frequency-common.h:92 struct member 'min_freq_khz_kobj_attr' not described in 'uncore_data' Warning: uncore-frequency-common.h:92 struct member 'die_id_kobj_attr' not described in 'uncore_data' Fixes: 24b6616355f7 ("platform/x86/intel-uncore-freq: Add efficiency latency control to sysfs interface") Fixes: 416de0246f35 ("platform/x86: intel-uncore-freq: Fix types in sysfs callbacks") Fixes: 247b43fcd872 ("platform/x86/intel-uncore-freq: Add attributes to show die_id") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251111060938.1998542-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba Author: Armin Wolf Date: Mon Nov 17 16:59:38 2025 +0100 platform/x86: acer-wmi: Ignore backlight event On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events. Reported-by: Bugaddr Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues Tested-by: Bugaddr Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d8bb447efc5622577994287dc77c684fa8840b30 Author: Haotian Zhang Date: Mon Nov 17 11:33:54 2025 +0800 platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos isst_if_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The return code is returned from the probe function as is but probe functions should return normal errnos. A proper implementation can be found in drivers/leds/leds-ss4200.c. Convert PCIBIOS_* return codes using pcibios_err_to_errno() into normal errno before returning. Fixes: d3a23584294c ("platform/x86: ISST: Add Intel Speed Select mmio interface") Signed-off-by: Haotian Zhang Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251117033354.132-1-vulab@iscas.ac.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ddf5ffff3a5fe95bed178f5554596b93c52afbc9 Author: Srinivas Pandruvada Date: Mon Nov 10 15:50:41 2025 -0800 platform/x86/intel/hid: Add Nova Lake support Add ACPI ID for Nova Lake. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251110235041.123685-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6f91ad24c6639220f2edb0ad8edb199b43cc3b22 Author: Anthony Wong Date: Mon Nov 17 02:53:11 2025 +0800 platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora Add AWCC support to Alienware 16 Aurora Cc: stable@vger.kernel.org Signed-off-by: Anthony Wong Reviewed-by: Kurt Borja Link: https://patch.msgid.link/20251116185311.18074-1-anthony.wong@canonical.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ae8966b7b5bd69b86209cc34bcca1ba9f18b68e6 Author: Peter Hutterer Date: Thu Nov 6 21:45:34 2025 +1000 Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD And expand it to encompass all pressure pads. Definition: "pressure pad" as used here as includes all touchpads that use physical pressure to convert to click, without physical hinges. Also called haptic touchpads in general parlance, Synaptics calls them ForcePads. Most (all?) pressure pads are currently advertised as INPUT_PROP_BUTTONPAD. The suggestion to identify them as pressure pads by defining the resolution on ABS_MT_PRESSURE has been in the docs since commit 20ccc8dd38a3 ("Documentation: input: define ABS_PRESSURE/ABS_MT_PRESSURE resolution as grams") but few devices provide this information. In userspace it's thus impossible to determine whether a device is a true pressure pad (pressure equals pressure) or a normal clickpad with (pressure equals finger size). Commit 7075ae4ac9db ("Input: add INPUT_PROP_HAPTIC_TOUCHPAD") introduces INPUT_PROP_HAPTIC_TOUCHPAD but restricted it to those touchpads that have support for userspace-controlled effects. Let's expand and rename that definition to include all pressure pad touchpads since those that do support FF effects can be identified by the presence of the FF_HAPTIC bit. This means: - clickpad: INPUT_PROP_BUTTONPAD - pressurepad: INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD - pressurepad with configurable haptics: INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD + FF_HAPTIC Signed-off-by: Peter Hutterer Acked-by: Benjamin Tissoires Link: https://patch.msgid.link/20251106114534.GA405512@tassie Signed-off-by: Dmitry Torokhov commit f39b6c468c52745dbca9a842d91c8373fda208ab Merge: e08969c4d65ac3 6a23ae0a96a600 Author: Dmitry Torokhov Date: Mon Nov 17 23:16:55 2025 -0800 Merge tag 'v6.18-rc6' into for-linus Sync up with the mainline to bring in definition of INPUT_PROP_HAPTIC_TOUCHPAD. commit 5719a189c9345977c16f10874fd5102f70094d8f Author: René Rebe Date: Mon Nov 17 18:23:51 2025 +0100 ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection Turns out the Apple MacPro 6,1 trashcan also needs the inverted jack detection like Mac mini patched, too. Signed-off-by: René Rebe Cc: Link: https://patch.msgid.link/20251117.182351.1595411649664739497.rene@exactco.de Signed-off-by: Takashi Iwai commit 8e0a754b0836d996802713bbebc87bc1cc17925c Author: Lorenzo Bianconi Date: Thu Nov 13 18:19:38 2025 +0100 net: airoha: Do not loopback traffic to GDM2 if it is available on the device Airoha_eth driver forwards offloaded uplink traffic (packets received on GDM1 and forwarded to GDM{3,4}) to GDM2 in order to apply hw QoS. This is correct if the device does not support a dedicated GDM2 port. In this case, in order to enable hw offloading for uplink traffic, the packets should be sent to GDM{3,4} directly. Fixes: 9cd451d414f6 ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251113-airoha-hw-offload-gdm2-fix-v1-1-7e4ca300872f@kernel.org Signed-off-by: Jakub Kicinski commit bed22c7b90af732978715a1789bca1c3cfa245a6 Author: Ido Schimmel Date: Sun Nov 16 10:10:29 2025 +0200 selftests: net: lib: Do not overwrite error messages ret_set_ksft_status() calls ksft_status_merge() with the current return status and the last one. It treats a non-zero return code from ksft_status_merge() as an indication that the return status was overwritten by the last one and therefore overwrites the return message with the last one. Currently, ksft_status_merge() returns a non-zero return code even if the current return status and the last one are equal. This results in return messages being overwritten which is counter-productive since we are more interested in the first failure message and not the last one. Fix by changing ksft_status_merge() to only return a non-zero return code if the current return status was actually changed. Add a test case which checks that the first error message is not overwritten. Before: # ./lib_sh_test.sh [...] TEST: RET tfail2 tfail -> fail [FAIL] retmsg=tfail expected tfail2 [...] # echo $? 1 After: # ./lib_sh_test.sh [...] TEST: RET tfail2 tfail -> fail [ OK ] [...] # echo $? 0 Fixes: 596c8819cb78 ("selftests: forwarding: Have RET track kselftest framework constants") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20251116081029.69112-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit da02a1824884d6c84c5e5b5ac373b0c9e3288ec2 Author: Aleksei Nikiforov Date: Wed Nov 12 19:27:24 2025 +0100 s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer. Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak") Reviewed-by: Aswin Karuvally Signed-off-by: Aleksei Nikiforov Signed-off-by: Aswin Karuvally Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251112182724.1109474-1-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski commit 949f1fd2225baefbea2995afa807dba5cbdb6bd3 Author: Nam Cao Date: Mon Nov 17 08:42:31 2025 +0000 nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a kmemleak warning. Make sure this data is deallocated. Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251117084231.2910561-1-namcao@linutronix.de commit fa766e759ff7b128ab77323d9d9c232434621bb6 Author: Dnyaneshwar Bhadane Date: Thu Oct 16 18:45:17 2025 +0530 drm/i915/xe3lpd: Load DMC for Xe3_LPD version 30.02 Load the DMC for Xe3_LPD version 30.02. Fixes: 3c0f211bc8fc ("drm/xe: Add Wildcat Lake device IDs to PTL list") Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Reviewed-by: Chaitanya Kumar Borah Link: https://lore.kernel.org/r/20251016131517.2032684-1-dnyaneshwar.bhadane@intel.com Signed-off-by: Gustavo Sousa (cherry picked from commit a63db39a578b543f5e5719b9f14dd82d3b8648d1) Signed-off-by: Rodrigo Vivi [Rodrigo added the Fixes tag while cherry-picking to fixes] commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 Author: Hang Zhou <929513338@qq.com> Date: Mon Nov 17 01:08:35 2025 +1100 spi: bcm63xx: fix premature CS deassertion on RX-only transactions On BCM6358 (and also observed on BCM6368) the controller appears to only generate as many SPI clocks as bytes that have been written into the TX FIFO. For RX-only transfers the driver programs the transfer length in SPI_MSG_CTL but does not write anything into the FIFO, so chip select is deasserted early and the RX transfer segment is never fully clocked in. A concrete failing case is a three-transfer MAC address read from SPI-NOR: - TX 0x03 (read command) - TX 3-byte address - RX 6 bytes (MAC) In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works because the driver uses prepend_len and writes dummy bytes into the TX FIFO for the RX part. Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only segments so that the number of bytes written to the FIFO matches the total message length seen by the controller. Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up") Signed-off-by: Hang Zhou <929513338@qq.com> Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com Signed-off-by: Mark Brown commit e7c375b181600caf135cfd03eadbc45eb530f2cb Merge: 418592a04021ba e9d50b78fdfe67 Author: Linus Torvalds Date: Mon Nov 17 09:11:27 2025 -0800 Merge tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix unitialized variable in statmount_string() - Fix hostfs mounting when passing host root during boot - Fix dynamic lookup to fail on cell lookup failure - Fix missing file type when reading bfs inodes from disk - Enforce checking of sb_min_blocksize() calls and update all callers accordingly - Restore write access before closing files opened by open_exec() in binfmt_misc - Always freeze efivarfs during suspend/hibernate cycles - Fix statmount()'s and listmount()'s grab_requested_mnt_ns() helper to actually allow mount namespace file descriptor in addition to mount namespace ids - Fix tmpfs remount when noswap is specified - Switch Landlock to iput_not_last() to remove false-positives from might_sleep() annotations in iput() - Remove dead node_to_mnt_ns() code - Ensure that per-queue kobjects are successfully created * tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: landlock: fix splats from iput() after it started calling might_sleep() fs: add iput_not_last() shmem: fix tmpfs reconfiguration (remount) when noswap is set fs/namespace: correctly handle errors returned by grab_requested_mnt_ns power: always freeze efivarfs binfmt_misc: restore write access before closing files opened by open_exec() block: add __must_check attribute to sb_min_blocksize() virtio-fs: fix incorrect check for fsvq->kobj xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super isofs: check the return value of sb_min_blocksize() in isofs_fill_super exfat: check return value of sb_min_blocksize in exfat_read_boot_sector vfat: fix missing sb_min_blocksize() return value checks mnt: Remove dead code which might prevent from building bfs: Reconstruct file type when loading from disk afs: Fix dynamic lookup to fail on cell lookup failure hostfs: Fix only passing host root in boot stage with new mount fs: Fix uninitialized 'offp' in statmount_string() commit 418592a04021baf5fcfbd0b7b7c5330bb135d10f Merge: e97c61885bfe39 36c6f3c03d104f Author: Linus Torvalds Date: Mon Nov 17 09:01:22 2025 -0800 Merge tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: "Five fixes addressing PREEMPT_RT compatibility and locking issues. Three commits fix potential deadlocks and sleeps in atomic contexts on RT kernels by converting locks to raw spinlocks and ensuring IRQ work runs in hard-irq context. The remaining two fix unsafe locking in the debug dump path and a variable dereference typo" * tag 'sched_ext-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work sched_ext: Fix possible deadlock in the deferred_irq_workfn() sched/ext: convert scx_tasks_lock to raw spinlock sched_ext: Fix unsafe locking in the scx_dump_state() sched_ext: Fix use of uninitialized variable in scx_bpf_cpuperf_set() commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 Author: Ewan D. Milne Date: Mon Nov 10 16:20:01 2025 -0500 nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915] Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context") Cc: stable@vger.kernel.org Tested-by: Marco Patalano Reviewed-by: Justin Tee Signed-off-by: Ewan D. Milne Signed-off-by: Keith Busch commit ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 Author: Ewan D. Milne Date: Mon Nov 10 16:20:00 2025 -0500 nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() Now target is removed from nvme_fc_ctrl_free() which is the ctrl->ref release handler. And even admin queue is unquiesced there, this way is definitely wrong because the ctr->ref is grabbed when submitting command. And Marco observed that nvme_fc_ctrl_free() can be called from request completion code path, and trigger kernel warning since request completes from softirq context. Fix the issue by moveing target removal into nvme_fc_delete_ctrl(), which is also aligned with nvme-tcp and nvme-rdma. Patch originally proposed by Ming Lei, then modified to move the tagset removal down to after nvme_fc_delete_association() after further testing. Cc: Marco Patalano Cc: Ewan Milne Cc: James Smart Cc: Sagi Grimberg Signed-off-by: Ming Lei Cc: stable@vger.kernel.org Tested-by: Marco Patalano Reviewed-by: Justin Tee Signed-off-by: Ewan D. Milne Signed-off-by: Keith Busch commit e97c61885bfe3919ed1f7d56bf05d3ffef392ccb Merge: 6a23ae0a96a600 97315e7c901a1d Author: Linus Torvalds Date: Mon Nov 17 08:57:21 2025 -0800 Merge tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "Mostly small misc fixes, here they are sorted by sub-subsystem: ECC fixes: - Realtek Kconfig fix SPI NAND fixes: - Remove nonexistent QE bit on FMSH FM25S01A Raw NAND fixes: - Prevent DMA device NULL pointer dereference in Cadence driver MTD device fixes: - Possible integer overflow in read/write ioctls - Fix the IRQ handler pointer in the onenand driver, even if in practice it is never dereferenced. * tag 'mtd/fixes-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: onenand: Pass correct pointer to IRQ handler mtd: spinand: fmsh: remove QE bit for FM25S01A flash mtd: rawnand: cadence: fix DMA device NULL pointer dereference mtd: rawnand: realtek: Make rtl_ecc_engine_ops const mtd: nand: MTD_NAND_ECC_REALTEK should depend on HAS_DMA mtd: nand: realtek-ecc: Fix a IS_ERR() vs NULL bug in probe mtdchar: fix integer overflow in read/write ioctls commit 517d066dc080fc297f1ab5e8c6fda7c59d48ef8d Author: Alexander Stein Date: Tue Aug 26 16:08:50 2025 +0200 MAINTAINERS: Add entry for TQ-Systems AM335 device trees This includes the TQMa335x series and the corresponding mainboard MBa335x. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250826140853.2570528-5-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit c83fc13960643c4429cd9dfef1321e6430a81b47 Author: Ivan Zhaldak Date: Mon Nov 17 15:58:35 2025 +0300 ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 Integrated amplifier LEAK Stereo 230 by IAG Limited has built-in ESS9038Q2M DAC served by XMOS controller. It supports both DSD Native and DSD-over-PCM (DoP) operational modes. But it doesn't work properly by default and tries DSD-to-PCM conversion. USB quirks below allow it to operate as designed. Add DSD_RAW quirk flag for IAG Limited devices (vendor ID 0x2622) Add DSD format quirk for LEAK Stereo 230 (USB ID 0x2622:0x0061) Signed-off-by: Ivan Zhaldak Cc: Link: https://patch.msgid.link/20251117125848.30769-1-i.v.zhaldak@gmail.com Signed-off-by: Takashi Iwai commit d4371c266ba3d708cd760d5dbfec960c399d3552 Author: Haotian Zhang Date: Mon Nov 17 14:55:59 2025 +0800 ALSA: au88x0: Fix incorrect error handling for PCI config reads __snd_vortex_probe() uses pci_read_config_word() that returns PCIBIOS_* codes (positive values on error). However, the function checks 'err < 0' which can never be true for PCIBIOS_* codes, causing errors to be silently ignored. Check for non-zero return value and convert PCIBIOS_* codes using pcibios_err_to_errno() into normal errno before returning them. Signed-off-by: Haotian Zhang Reviewed-by: Philipp Stanner Link: https://patch.msgid.link/20251117065559.1138-1-vulab@iscas.ac.cn Signed-off-by: Takashi Iwai commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 Author: Marc Kleine-Budde Date: Sun Nov 16 16:55:26 2025 +0100 can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits to be reset. If we ever reach the condition of handling more than `SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body. This may, among other issues, cause us to never `netif_wake_queue()` again after a transmission interrupt. Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module") Cc: stable@vger.kernel.org Co-developed-by: Thomas Mühlbacher Signed-off-by: Thomas Mühlbacher Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 6d5479953270f60ac064d154a76cb7ba64fb81f8 Merge: 30db4451c7f6aa 395d988f938611 Author: Marc Kleine-Budde Date: Mon Nov 17 17:22:04 2025 +0100 Merge patch series "can: gs_usb: fix USB bulk in and out callbacks" Marc Kleine-Budde says: The bulk-out callback gs_usb_xmit_callback() does not take care of the cleanup of failed transfers of URBs. The 1st patch adds the missing cleanup. The bulk-in callback gs_usb_receive_bulk_callback() accesses the buffer of the URB without checking how much data has actually been received. The last 2 patches fix this problem. Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-0-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 395d988f93861101ec89d0dd9e3b876ae9392a5b Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:03 2025 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the data after the header depends on the gs_host_frame hf::flags and the active device features (e.g. time stamping). Introduce a new function gs_usb_get_minimum_length() and check that we have at least received the required amount of data before accessing it. Only copy the data to that skb that has actually been received. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de [mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()] Signed-off-by: Marc Kleine-Budde commit 6d87cd5335784351280f82c47cc8a657271929c3 Author: Shin'ichiro Kawasaki Date: Mon Nov 17 11:23:39 2025 +0900 nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion. To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work not by kblockd workqueue but by nvme_wq. Reported-by: Yi Zhang Closes: https://lore.kernel.org/linux-block/CAHj4cs8mJ+R_GmQm9R8ebResKAWUE8kF5+_WVg0v8zndmqd6BQ@mail.gmail.com/ Link: https://lore.kernel.org/linux-block/oeyzci6ffshpukpfqgztsdeke5ost5hzsuz4rrsjfmvpqcevax@5nhnwbkzbrpa/ Fixes: 1f021341eef4 ("nvme-multipath: defer partition scanning") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 159de7a825aea4242d3f8d32de5853d269dbe72f Author: Alistair Francis Date: Fri Nov 7 09:17:11 2025 +1000 nvmet-auth: update sc_c in target host hash calculation Commit 7e091add9c43 "nvme-auth: update sc_c in host response" added the sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response. This breaks secure concat connections with a Linux target as the target code wasn't updated at the same time. This patch fixes this by adding a new sc_c variable to the host hash calculations. Fixes: 7e091add9c43 ("nvme-auth: update sc_c in host response") Tested-by: Shin'ichiro Kawasaki Tested-by: Yi Zhang Reviewed-by: Martin George Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Alistair Francis Signed-off-by: Keith Busch commit 36c6f3c03d104faf1aa90922f2310549c175420f Author: Zqiang Date: Mon Nov 17 20:53:10 2025 +0800 sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work For PREEMPT_RT kernels, the kick_cpus_irq_workfn() be invoked in the per-cpu irq_work/* task context and there is no rcu-read critical section to protect. this commit therefore use IRQ_WORK_INIT_HARD() to initialize the per-cpu rq->scx.kick_cpus_irq_work in the init_sched_ext_class(). Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit e19d7f7e92e061707252eab2b71d2c3be09b2e96 Author: Amirreza Zarrabi Date: Thu Nov 13 19:38:42 2025 -0800 tee: qcomtee: initialize result before use in release worker Initialize result to 0 so the error path doesn't read it uninitialized when the invoke fails. Fixes a Smatch warning. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/op-tee/7c1e0de2-7d42-4c6b-92fe-0e4fe5d650b5@oss.qualcomm.com/ Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Signed-off-by: Amirreza Zarrabi Reviewed-by: Sumit Garg Reviewed-by: Konrad Dybcio Signed-off-by: Jens Wiklander commit 6a23ae0a96a600d1d12557add110e0bb6e32730c Author: Linus Torvalds Date: Sun Nov 16 14:25:38 2025 -0800 Linux 6.18-rc6 commit 998ccc327b14c03861247540ff6f8135a5283621 Merge: 7ba45f15049b44 b72b8132d8fd2d Author: Linus Torvalds Date: Sun Nov 16 13:45:03 2025 -0800 Merge tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix writing bpf_prog (infos|btfs)_cnt to data file, to not generate invalid perf.data files in some corner cases. - Fix 'perf top' segfault by ensuring libbfd is initialized. This is an opt-in feature due to license incompatibilities. - Fix segfault in 'perf lock' due to missing kernel map. - Fix 'perf lock contention' test. - Don't fail fast path detection if binutils-devel isn't available. - Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason. * tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf libbfd: Ensure libbfd is initialized prior to use perf test: Fix lock contention test perf lock: Fix segfault due to missing kernel map tools headers UAPI: Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason perf build: Don't fail fast path feature detection when binutils-devel is not available perf header: Write bpf_prog (infos|btfs)_cnt to data file commit 7ba45f15049b4442c932ca2499aec739bb6bdbcf Merge: 7254a2b5227909 1c2a936edd71e1 Author: Linus Torvalds Date: Sun Nov 16 13:31:14 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "7 hotfixes. 5 are cc:stable, 4 are against mm/ All are singletons - please see the respective changelogs for details" * tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm, swap: fix potential UAF issue for VMA readahead selftests/user_events: fix type cast for write_index packed member in perf_test lib/test_kho: check if KHO is enabled mm/huge_memory: fix folio split check for anon folios in swapcache MAINTAINERS: update David Hildenbrand's email address crash: fix crashkernel resource shrink mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb commit e2cb69263e797c0aa6676bcef23e9e27e44c83b0 Author: Chen Pei Date: Fri Nov 14 15:12:15 2025 +0800 tools: riscv: Fixed misalignment of CSR related definitions The file tools/arch/riscv/include/asm/csr.h borrows from arch/riscv/include/asm/csr.h, and subsequent modifications related to CSR should maintain consistency. Signed-off-by: Chen Pei Link: https://patch.msgid.link/20251114071215.816-1-cp0613@linux.alibaba.com [pjw@kernel.org: dropped Fixes: lines for patches that weren't broken; removed superfluous blank line] Signed-off-by: Paul Walmsley commit 7b090e7b910cafd245f23e56f3257a151ca0a289 Author: Mayuresh Chitale Date: Fri Nov 14 06:58:06 2025 +0000 riscv: sbi: Prefer SRST shutdown over legacy Currently, the sbi_init() always attempts to register the legacy shutdown function as the sys-off handler which is fine when RISCV_SBI_V01 is not enabled. However, if RISCV_SBI_V01 is enabled in the kernel and the SBI v0.1 is not supported by the underlying SBI implementation then the legacy shutdown fails. Fix this by not registering the legacy shutdown when SRST shutdown is available. Fixes: 70ddf86d76c1 ("riscv: sbi: Switch to new sys-off handler API") Signed-off-by: Mayuresh Chitale Reviewed-by: Anup Patel Link: https://patch.msgid.link/20251114065808.304430-1-mchitale@ventanamicro.com Signed-off-by: Paul Walmsley commit 6fe9f3279f7d2518439a7962c5870c6e9ecbadcf Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:02 2025 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_group to describe the header of the struct gs_host_frame and check that we have at least received the header before accessing any members of it. To resubmit the URB, do not dereference the pointer chain "dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since "urb->context" contains "parent", it is always defined, while "dev" is not defined if the URB it too short. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-2-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 516a0cd1c03fa266bb67dd87940a209fd4e53ce7 Author: Marc Kleine-Budde Date: Sat Nov 8 10:01:01 2025 +0100 can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs The driver lacks the cleanup of failed transfers of URBs. This reduces the number of available URBs per error by 1. This leads to reduced performance and ultimately to a complete stop of the transmission. If the sending of a bulk URB fails do proper cleanup: - increase netdev stats - mark the echo_sbk as free - free the driver's context and do accounting - wake the send queue Closes: https://github.com/candle-usb/candleLight_fw/issues/187 Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-1-a29b42eacada@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 30db4451c7f6aabcada029b15859a76962ec0cf8 Author: Thomas Mühlbacher Date: Sat Nov 15 15:34:56 2025 +0000 can: sja1000: fix max irq loop handling Reading the interrupt register `SJA1000_IR` causes all of its bits to be reset. If we ever reach the condition of handling more than `SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its bits but without actually handling the interrupt inside of the loop body. This may, among other issues, cause us to never `netif_wake_queue()` again after a transmission interrupt. Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller") Cc: stable@vger.kernel.org Signed-off-by: Thomas Mühlbacher Acked-by: Oliver Hartkopp Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net Signed-off-by: Marc Kleine-Budde commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec Author: Seungjin Bae Date: Thu Oct 23 12:27:09 2025 -0400 can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands. These commands are used to align data to the USB endpoint's wMaxPacketSize boundary. The driver attempts to skip these placeholders by aligning the buffer position `pos` to the next packet boundary using `round_up()` function. However, if zero-length command is found exactly on a packet boundary (i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up` function will return the unchanged value of `pos`. This prevents `pos` to be increased, causing an infinite loop in the parsing logic. This patch fixes this in the function by using `pos + 1` instead. This ensures that even if `pos` is on a boundary, the calculation is based on `pos + 1`, forcing `round_up()` to always return the next aligned boundary. Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") Signed-off-by: Seungjin Bae Reviewed-by: Jimmy Assarsson Tested-by: Jimmy Assarsson Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com Signed-off-by: Marc Kleine-Budde commit 7254a2b52279091683e0228095118ee69ce9742f Merge: 87751e715e23ed 1107aac1ad7f44 Author: Linus Torvalds Date: Sun Nov 16 07:08:28 2025 -0800 Merge tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "This includes some fixes for the topology map, newly introduced in v6.18 kernel" * tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix to update generation field in topology map firewire: core: Initialize topology_map.lock commit 87751e715e23ede7386fb57a1a8593aa9830b21f Merge: f824272b6e3fe2 281326be67252a Author: Linus Torvalds Date: Sun Nov 16 07:05:24 2025 -0800 Merge tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: - In Versalnet, handle the reporting of non-standard hw errors whose information can come in more than one remote processor message. - Explicitly reenable ECC checking after a warm reset in Altera OCRAM as those registers are reset to default otherwise - Fix single-bit error injection in Altera EDAC to not inject errors directly in ECC RAM and thus lead to false double-bit errors due to same ECC RAM being in concurrent use * tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection EDAC/altera: Handle OCRAM ECC enable after warm reset EDAC/versalnet: Handle split messages for non-standard errors commit e89ee35567d3d465ef0715953170be72f5ef1d4c Author: Xu Yang Date: Thu Nov 13 19:14:44 2025 +0800 arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity According to the board design, set SEL to high means flipped connection (TX2/RX2). And the TCPM will output logical 1 if it needs flipped connection. So switch to active high for select-gpios. The EN pin on mux chip is low active, so switch to active low for enable-gpios too. Fixes: b237975b2cd5 ("arm64: dts: imx8qm-mek: add usb 3.0 and related type C nodes") Cc: stable@vger.kernel.org Reviewed-by: Jun Li Signed-off-by: Xu Yang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 1107aac1ad7f445a83604b14af7be47f1a795c66 Author: Takashi Sakamoto Date: Fri Nov 14 23:44:21 2025 +0900 firewire: core: fix to update generation field in topology map The generation field of topology map is updated after initialized by zero. The updated value of generation field is always zero, and is against specification. This commit fixes the bug. Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map") Link: https://lore.kernel.org/r/20251114144421.415278-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 91f815b7073d8f1abb5f3a3a7bf6b9466a6e5e8f Author: Chao-ying Fu Date: Thu Nov 13 17:10:32 2025 +0100 riscv: Update MIPS vendor id to 0x127 [1] defines MIPS vendor id as 0x127. All previous MIPS RISC-V patches were tested on QEMU, also modified to use 0x722 as MIPS_VENDOR_ID. This new value should reflect real hardware. [1] https://mips.com/wp-content/uploads/2025/06/P8700_Programmers_Reference_Manual_Rev1.84_5-31-2025.pdf Fixes: a8fed1bc03ac ("riscv: Add xmipsexectl as a vendor extension") Signed-off-by: Chao-ying Fu Signed-off-by: Aleksa Paunovic Link: https://patch.msgid.link/20251113-mips-vendorid-v2-1-3279489b7f84@htecgroup.com Cc: Signed-off-by: Paul WAlmsley commit 1c2a936edd71e133f2806e68324ec81a4eb07588 Author: Kairui Song Date: Tue Nov 11 21:36:08 2025 +0800 mm, swap: fix potential UAF issue for VMA readahead Since commit 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning"), the common helper for allocating and preparing a folio in the swap cache layer no longer tries to get a swap device reference internally, because all callers of __read_swap_cache_async are already holding a swap entry reference. The repeated swap device pinning isn't needed on the same swap device. Caller of VMA readahead is also holding a reference to the target entry's swap device, but VMA readahead walks the page table, so it might encounter swap entries from other devices, and call __read_swap_cache_async on another device without holding a reference to it. So it is possible to cause a UAF when swapoff of device A raced with swapin on device B, and VMA readahead tries to read swap entries from device A. It's not easy to trigger, but in theory, it could cause real issues. Make VMA readahead try to get the device reference first if the swap device is a different one from the target entry. Link: https://lkml.kernel.org/r/20251111-swap-fix-vma-uaf-v1-1-41c660e58562@tencent.com Fixes: 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning") Suggested-by: Huang Ying Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baoquan He Cc: Barry Song Cc: Kemeng Shi Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton commit 216158f063fe24fb003bd7da0cd92cd6e2c4d48b Author: Ankit Khushwaha Date: Thu Nov 6 15:25:32 2025 +0530 selftests/user_events: fix type cast for write_index packed member in perf_test Accessing 'reg.write_index' directly triggers a -Waddress-of-packed-member warning due to potential unaligned pointer access: perf_test.c:239:38: warning: taking address of packed member 'write_index' of class or structure 'user_reg' may result in an unaligned pointer value [-Waddress-of-packed-member] 239 | ASSERT_NE(-1, write(self->data_fd, ®.write_index, | ^~~~~~~~~~~~~~~ Since write(2) works with any alignment. Casting '®.write_index' explicitly to 'void *' to suppress this warning. Link: https://lkml.kernel.org/r/20251106095532.15185-1-ankitkhushwaha.linux@gmail.com Fixes: 42187bdc3ca4 ("selftests/user_events: Add perf self-test for empty arguments events") Signed-off-by: Ankit Khushwaha Cc: Beau Belgrave Cc: "Masami Hiramatsu (Google)" Cc: Steven Rostedt Cc: sunliming Cc: Wei Yang Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit a26ec8f3d4e56d4a7ffa301e8032dca9df0bbc05 Author: Pasha Tatashin Date: Thu Nov 6 17:06:35 2025 -0500 lib/test_kho: check if KHO is enabled We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized. Link: https://lkml.kernel.org/r/20251106220635.2608494-1-pasha.tatashin@soleen.com Fixes: b753522bed0b ("kho: add test for kexec handover") Signed-off-by: Pasha Tatashin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511061629.e242724-lkp@intel.com Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Signed-off-by: Andrew Morton commit f1d47cafe513b5552a5b20a7af0936d9070a8a78 Author: Zi Yan Date: Wed Nov 5 11:29:10 2025 -0500 mm/huge_memory: fix folio split check for anon folios in swapcache Both uniform and non uniform split check missed the check to prevent splitting anon folios in swapcache to non-zero order. Splitting anon folios in swapcache to non-zero order can cause data corruption since swapcache only support PMD order and order-0 entries. This can happen when one use split_huge_pages under debugfs to split anon folios in swapcache. In-tree callers do not perform such an illegal operation. Only debugfs interface could trigger it. I will put adding a test case on my TODO list. Fix the check. Link: https://lkml.kernel.org/r/20251105162910.752266-1-ziy@nvidia.com Fixes: 58729c04cf10 ("mm/huge_memory: add buddy allocator like (non-uniform) folio_split()") Signed-off-by: Zi Yan Reported-by: "David Hildenbrand (Red Hat)" Closes: https://lore.kernel.org/all/dc0ecc2c-4089-484f-917f-920fdca4c898@kernel.org/ Acked-by: David Hildenbrand (Red Hat) Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Cc: Wei Yang Cc: Signed-off-by: Andrew Morton commit 3470715e5c22578c6ea4098b256d5a904e12eef2 Author: David Hildenbrand (Red Hat) Date: Mon Nov 3 11:36:59 2025 +0100 MAINTAINERS: update David Hildenbrand's email address Switch to kernel.org email address as I will be leaving Red Hat. The old address will remain active until end of January 2026, so performing the change now should make sure that most mails will reach me. Link: https://lkml.kernel.org/r/20251103103659.379335-1-david@kernel.org Signed-off-by: David Hildenbrand Signed-off-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 00fbff75c5acb4755f06f08bd1071879c63940c5 Author: Sourabh Jain Date: Sun Nov 2 01:07:41 2025 +0530 crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Call Trace: ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40 __crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0 This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated. Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory. Link: https://lkml.kernel.org/r/20251101193741.289252-1-sourabhjain@linux.ibm.com Fixes: 16c6006af4d4 ("kexec: enable kexec_crash_size to support two crash kernel regions") Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Zhen Lei Cc: Signed-off-by: Andrew Morton commit 39231e8d6ba7f794b566fd91ebd88c0834a23b98 Author: David Hildenbrand (Red Hat) Date: Fri Nov 14 22:49:20 2025 +0100 mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb In the past, CONFIG_ARCH_HAS_GIGANTIC_PAGE indicated that we support runtime allocation of gigantic hugetlb folios. In the meantime it evolved into a generic way for the architecture to state that it supports gigantic hugetlb folios. In commit fae7d834c43c ("mm: add __dump_folio()") we started using CONFIG_ARCH_HAS_GIGANTIC_PAGE to decide MAX_FOLIO_ORDER: whether we could have folios larger than what the buddy can handle. In the context of that commit, we started using MAX_FOLIO_ORDER to detect page corruptions when dumping tail pages of folios. Before that commit, we assumed that we cannot have folios larger than the highest buddy order, which was obviously wrong. In commit 7b4f21f5e038 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate"), we used MAX_FOLIO_ORDER to detect inconsistencies, and in fact, we found some now. Powerpc allows for configs that can allocate gigantic folio during boot (not at runtime), that do not set CONFIG_ARCH_HAS_GIGANTIC_PAGE and can exceed PUD_ORDER. To fix it, let's make powerpc select CONFIG_ARCH_HAS_GIGANTIC_PAGE with hugetlb on powerpc, and increase the maximum folio size with hugetlb to 16 GiB on 64bit (possible on arm64 and powerpc) and 1 GiB on 32 bit (powerpc). Note that on some powerpc configurations, whether we actually have gigantic pages depends on the setting of CONFIG_ARCH_FORCE_MAX_ORDER, but there is nothing really problematic about setting it unconditionally: we just try to keep the value small so we can better detect problems in __dump_folio() and inconsistencies around the expected largest folio in the system. Ideally, we'd have a better way to obtain the maximum hugetlb folio size and detect ourselves whether we really end up with gigantic folios. Let's defer bigger changes and fix the warnings first. While at it, handle gigantic DAX folios more clearly: DAX can only end up creating gigantic folios with HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD. Add a new Kconfig option HAVE_GIGANTIC_FOLIOS to make both cases clearer. In particular, worry about ARCH_HAS_GIGANTIC_PAGE only with HUGETLB_PAGE. Note: with enabling CONFIG_ARCH_HAS_GIGANTIC_PAGE on powerpc, we will now also allow for runtime allocations of folios in some more powerpc configs. I don't think this is a problem, but if it is we could handle it through __HAVE_ARCH_GIGANTIC_PAGE_RUNTIME_SUPPORTED. While __dump_page()/__dump_folio was also problematic (not handling dumping of tail pages of such gigantic folios correctly), it doesn't seem critical enough to mark it as a fix. Link: https://lkml.kernel.org/r/20251114214920.2550676-1-david@kernel.org Fixes: 7b4f21f5e038 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate") Reported-by: Christophe Leroy Closes: https://lore.kernel.org/r/3e043453-3f27-48ad-b987-cc39f523060a@csgroup.eu/ Reported-by: Sourabh Jain Closes: https://lore.kernel.org/r/94377f5c-d4f0-4c0f-b0f6-5bf1cd7305b1@linux.ibm.com/ Signed-off-by: David Hildenbrand (Red Hat) Cc: Ritesh Harjani (IBM) Cc: Madhavan Srinivasan Cc: Donet Tom Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit f824272b6e3fe24950abc527136e8140f67b0b23 Merge: b8a2c32b22de69 31475b88110c47 Author: Linus Torvalds Date: Sat Nov 15 09:01:00 2025 -0800 Merge tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fix from Heiko Carstens: - Fix a bug in the __ptep_rdp() inline assembly which may lead to missing TLB flushes * tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/mm: Fix __ptep_rdp() inline assembly commit b8a2c32b22de691cceb835f1de306f2a8c1dd0c8 Merge: bb1a6ddcfaa54b dd14022a7ce969 Author: Linus Torvalds Date: Sat Nov 15 08:55:29 2025 -0800 Merge tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Update the list of AMD microcode minimum Entrysign revisions - Add additional fixed AMD RDSEED microcode revisions - Update the language transliteration for Kiryl Shutsemau's name in the MAINTAINERS entry * tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev x86/CPU/AMD: Add additional fixed RDSEED microcode revisions MAINTAINERS: Update name spelling commit bb1a6ddcfaa54b156e6e2ac61a986c4f5f8cb841 Merge: fa3ade5e8e247e e0fd4d42e27f76 Author: Linus Torvalds Date: Sat Nov 15 08:51:43 2025 -0800 Merge tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a memory leak in the posix timer creation logic" * tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-timers: Plug potential memory leak in do_timer_create() commit fa3ade5e8e247e39bd192c92f9d1c1d08e0e61a4 Merge: e256f7b4e57d9f 14473a1f88596f Author: Linus Torvalds Date: Sat Nov 15 08:48:51 2025 -0800 Merge tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix an irqchip driver release bug in the riscv-intc irqchip driver" * tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops commit e256f7b4e57d9f1149efd0e7745f77d8e615177b Merge: 7a0892d2836e12 ebd4469e7af610 Author: Linus Torvalds Date: Sat Nov 15 08:46:18 2025 -0800 Merge tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fix from Ingo Molnar: "Fix a broken #ifndef in the header. It hasn't caused problems upstream yet because no arch overrides arch_xfer_to_guest_mode_handle_work() at this moment" * tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub commit 5442a9da69789741bfda39f34ee7f69552bf0c56 Author: Jesper Dangaard Brouer Date: Wed Nov 12 14:13:52 2025 +0100 veth: more robust handing of race to avoid txq getting stuck Commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") introduced a race condition that can lead to a permanently stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra Max). The race occurs in veth_xmit(). The producer observes a full ptr_ring and stops the queue (netif_tx_stop_queue()). The subsequent conditional logic, intended to re-wake the queue if the consumer had just emptied it (if (__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a "lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and traffic halts. This failure is caused by an incorrect use of the __ptr_ring_empty() API from the producer side. As noted in kernel comments, this check is not guaranteed to be correct if a consumer is operating on another CPU. The empty test is based on ptr_ring->consumer_head, making it reliable only for the consumer. Using this check from the producer side is fundamentally racy. This patch fixes the race by adopting the more robust logic from an earlier version V4 of the patchset, which always flushed the peer: (1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier are removed. Instead, after stopping the queue, we unconditionally call __veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled, making it solely responsible for re-waking the TXQ. This handles the race where veth_poll() consumes all packets and completes NAPI *before* veth_xmit() on the producer side has called netif_tx_stop_queue. The __veth_xdp_flush(rq) will observe rx_notify_masked is false and schedule NAPI. (2) On the consumer side, the logic for waking the peer TXQ is moved out of veth_xdp_rcv() and placed at the end of the veth_poll() function. This placement is part of fixing the race, as the netif_tx_queue_stopped() check must occur after rx_notify_masked is potentially set to false during NAPI completion. This handles the race where veth_poll() consumes all packets, but haven't finished (rx_notify_masked is still true). The producer veth_xmit() stops the TXQ and __veth_xdp_flush(rq) will observe rx_notify_masked is true, meaning not starting NAPI. Then veth_poll() change rx_notify_masked to false and stops NAPI. Before exiting veth_poll() will observe TXQ is stopped and wake it up. Fixes: dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") Reviewed-by: Toshiaki Makita Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/176295323282.307447.14790015927673763094.stgit@firesoul Signed-off-by: Jakub Kicinski commit dfe28c4167a9259fc0c372d9f9473e1ac95cff67 Author: Ilya Maximets Date: Wed Nov 12 12:14:03 2025 +0100 net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible. There is also confusion in the code between the 'masked' flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation code. Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang Signed-off-by: Ilya Maximets Acked-by: Eelco Chaudron Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20251112112246.95064-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 035bca3f017ee9dea3a5a756e77a6f7138cc6eea Author: Eric Dumazet Date: Thu Nov 13 10:39:24 2025 +0000 mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Cc: stable@vger.kernel.org Fixes: 3b1d6210a957 ("mptcp: implement and use MPTCP-level retransmission") Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b0c959fec18f4595a6a6317ffc30615cfa37bf69 Author: Pavel Zhigulin Date: Thu Nov 13 19:19:21 2025 +0300 net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() The call to devlink_info_version_fixed_put() in mlxsw_linecard_devlink_info_get() did not check for errors, although it is checked everywhere in the code. Add missed 'err' check to the mlxsw_linecard_devlink_info_get() Fixes: 3fc0c51905fb ("mlxsw: core_linecards: Expose device PSID over device info") Signed-off-by: Pavel Zhigulin Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251113161922.813828-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit e6751b0b19a6baab219a62e1e302b8aa6b5a55b2 Author: Pavel Zhigulin Date: Thu Nov 13 16:57:44 2025 +0300 net: dsa: hellcreek: fix missing error handling in LED registration The LED setup routine registered both led_sync_good and led_is_gm devices without checking the return values of led_classdev_register(). If either registration failed, the function continued silently, leaving the driver in a partially-initialized state and leaking a registered LED classdev. Add proper error handling Fixes: 7d9ee2e8ff15 ("net: dsa: hellcreek: Add PTP status LEDs") Signed-off-by: Pavel Zhigulin Reviewed-by: Andrew Lunn Acked-by: Kurt Kanzenbach Link: https://patch.msgid.link/20251113135745.92375-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit 7a0892d2836e12cc61b6823f888629a3eb64e268 Merge: cbba5d1b53fb82 921b3f59b7b00c Author: Linus Torvalds Date: Fri Nov 14 15:45:31 2025 -0800 Merge tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Cache the ASPM L0s/L1 Supported bits early so quirks can override them if necessary (Bjorn Helgaas) - Add quirks for PA Semi and Freescale Root Ports and a HiSilicon Wi-Fi device that are reported to have broken L0s and L1 (Shawn Lin, Bjorn Helgaas) * tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports PCI/ASPM: Convert quirks to override advertised link states PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden commit cbba5d1b53fb82209feacb459edecb1ef8427119 Merge: a752782a284332 6c762611fed736 Author: Linus Torvalds Date: Fri Nov 14 15:39:39 2025 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix interaction between livepatch and BPF fexit programs (Song Liu) With Steven and Masami acks. - Fix stack ORC unwind from BPF kprobe_multi (Jiri Olsa) With Steven and Masami acks. - Fix out of bounds access in widen_imprecise_scalars() in the verifier (Eduard Zingerman) - Fix conflicts between MPTCP and BPF sockmap (Jiayuan Chen) - Fix net_sched storage collision with BPF data_meta/data_end (Eric Dumazet) - Add _impl suffix to BPF kfuncs with implicit args to avoid breaking them in bpf-next when KF_IMPLICIT_ARGS is added (Mykyta Yatsenko) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Test widen_imprecise_scalars() with different stack depth bpf: account for current allocated stack depth in widen_imprecise_scalars() bpf: Add bpf_prog_run_data_pointers() selftests/bpf: Add mptcp test with sockmap mptcp: Fix proto fallback detection with BPF mptcp: Disallow MPTCP subflows from sockmap selftests/bpf: Add stacktrace ips test for raw_tp selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" bpf: add _impl suffix for bpf_stream_vprintk() kfunc bpf:add _impl suffix for bpf_task_work_schedule* kfuncs selftests/bpf: Add tests for livepatch + bpf trampoline ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() ftrace: Fix BPF fexit with livepatch commit a752782a2843323d2c04ee6ab79531d027072e88 Merge: 1cc41c88ef00de fdf302e6bea182 Author: Linus Torvalds Date: Fri Nov 14 15:36:15 2025 -0800 Merge tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fix from Miguel Ojeda: - Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing DWARF debug information anymore by teaching gendwarfksyms to skip object files without exports * tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: gendwarfksyms: Skip files with no exports commit 1cc41c88ef00de0f3216c5f4b9cfab47de1c49d3 Merge: d5c1b4b43249bf b623390045a81f Author: Linus Torvalds Date: Fri Nov 14 13:44:23 2025 -0800 Merge tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Various fixes when using NFS with TLS - Localio direct-IO fixes - Fix error handling in nfs_atomic_open_v23() - Fix sysfs memory leak when nfs_client kobject add fails - Fix an incorrect parameter when calling nfs4_call_sync() - Fix a failing LTP test when using delegated timestamps * tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Fix LTP test failures when timestamps are delegated NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() NFS: sysfs: fix leak when nfs_client kobject add fails NFSv2/v3: Fix error handling in nfs_atomic_open_v23() nfs/localio: do not issue misaligned DIO out-of-order nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion nfs/localio: backfill missing partial read support for misaligned DIO nfs/localio: add refcounting for each iocb IO associated with NFS pgio header nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support NFS: Check the TLS certificate fields in nfs_match_client() pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect() commit d5c1b4b43249bfa038df2f63e2d506bbf6e07df9 Merge: ccc0011804d406 362a7d4fd5c473 Author: Linus Torvalds Date: Fri Nov 14 13:39:15 2025 -0800 Merge tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, amdgpu and vmwgfx making up the most of it, along with panthor and i915/xe. Seems about right for this time of development, nothing major outstanding. client: - Fix description of module parameter panthor: - Flush writes before mapping buffers vmwgfx: - Improve command validation - Improve ref counting - Fix cursor-plane support amdgpu: - Disallow P2P DMA for GC 12 DCC surfaces - ctx error handling fix - UserQ fixes - VRR fix - ISP fix - JPEG 5.0.1 fix amdkfd: - Save area check fix - Fix GPU mappings for APU after prefetch i915: - Fix PSR's pipe to vblank conversion - Disable Panel Replay on MST links xe: - New HW workarounds affecting PTL and WCL platforms * tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel: drm/client: fix MODULE_PARM_DESC string for "active" drm/i915/dp_mst: Disable Panel Replay drm/amdkfd: Fix GPU mappings for APU after prefetch drm/amdkfd: relax checks for over allocation of save area drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO drm/amd/display: Allow VRR params change if unsynced with the stream drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process drm/amdgpu: jump to the correct label on failure drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg drm/xe/xe3: Extend wa_14023061436 drm/xe/xe3: Add WA_14024681466 for Xe3_LPG drm/i915/psr: fix pipe to vblank conversion drm/panthor: Flush shmem writes before mapping buffers CPU-uncached drm/vmwgfx: Restore Guest-Backed only cursor plane support drm/vmwgfx: Use kref in vmw_bo_dirty drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE commit ccc0011804d406493da6d97f913c43de842f1abb Merge: 241e99dbdcdfa7 739f04f4a46237 Author: Linus Torvalds Date: Fri Nov 14 13:34:36 2025 -0800 Merge tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - dw_mmc-rockchip: Fix internal phase calculation - pxamci: Simplify and fix ->probe() error handling - sdhci-of-dwcmshc: Fix strbin signal delay - wmt-sdmmc: Fix compile test default * tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: dw_mmc-rockchip: Fix wrong internal phase calculate mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 mmc: wmt-sdmmc: fix compile test default commit 241e99dbdcdfa715989555fa1d83025a8ce95775 Merge: 6014e75e87562a bbde14682eba21 Author: Linus Torvalds Date: Fri Nov 14 13:29:15 2025 -0800 Merge tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Fix reference count leak in ->remove() - samsung: Rework legacy splash-screen handover workaround - samsung: Fix potential memleak during ->probe() - arm: Fix genpd leak on provider registration failure for scmi * tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: samsung: Rework legacy splash-screen handover workaround pmdomain: arm: scmi: Fix genpd leak on provider registration failure pmdomain: samsung: plug potential memleak during probe commit 6014e75e87562abd3c55a7b6d361bbe66beb0b07 Merge: de90cc610eb613 214291cbaaceeb Author: Linus Torvalds Date: Fri Nov 14 13:25:00 2025 -0800 Merge tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Dave Jiang: - Fix incorrect device handle check for Generic Initiator - Fix offset calculation for extended linear cache poison injection - Fix lockdep warning for hmem_register_resource() * tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: acpi/hmat: Fix lockdep warning for hmem_register_resource() cxl: Adjust offset calculation for poison injection acpi,srat: Fix incorrect device handle check for Generic Initiator commit 124c98b10001a35928a379593c7aacb3cbef6659 Merge: 4e08ec0054a968 aaf46c6a6df605 Author: Arnd Bergmann Date: Fri Nov 14 22:21:45 2025 +0100 Merge tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE kernel-doc fixes for v6.18 * tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: commit 4e08ec0054a96875f74dd32631575e5778bede03 Merge: c3216f1d62e17c 5e44c5a2cc84be Author: Arnd Bergmann Date: Fri Nov 14 22:20:06 2025 +0100 Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 6.18, please pull the following: - Andrea assigns clocks rates for the Ethernet controller for the Raspberry Pi 5 systems - Laurent adds an ethernet0 alias to allow client programs consuming that alias to populate the correct Ethernet address for the Raspberry Pi 5 systems * tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias arm64: dts: broadcom: Assign clock rates in eth node for RPi5 Signed-off-by: Arnd Bergmann commit c3216f1d62e17c60d323aaa39e57ce9e5226def7 Merge: 7b52117eea0c58 997c06330fd5c2 Author: Arnd Bergmann Date: Fri Nov 14 22:18:11 2025 +0100 Merge tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v6.18 * Fix incorrect EARC reset masks in the reset-imx8mp-audiomix driver, introduced in commit a83bc87cd30a. * tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux: reset: imx8mp-audiomix: Fix bad mask values Signed-off-by: Arnd Bergmann commit 7b52117eea0c58e53d973429b25414985d70fb1b Merge: 020e792ca39b51 3d1c795bdef433 Author: Arnd Bergmann Date: Fri Nov 14 22:14:49 2025 +0100 Merge tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree files updates for 6.18, please pull the following: - Rafal fixes the Ethernet PHY address on the Luxul XAP-1440 * tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux: ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY Signed-off-by: Arnd Bergmann commit 020e792ca39b516ab1cbec757641491735d7d696 Merge: f4f012b0ee1d40 9c16e4d216d810 Author: Arnd Bergmann Date: Fri Nov 14 22:13:21 2025 +0100 Merge tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64 defconfig updates for 6.18, please pull the following: - Stefan ensures that the clk-raspberrypi driver which is now the clock provider is built into the kernel image to satisfy root over NFS * tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: defconfig: Fix V3D deferred probe timeout Signed-off-by: Arnd Bergmann commit f4f012b0ee1d401adfc85cbd5dacd6adf35004c4 Merge: ec0ca4be116ad7 6504297872c7a5 Author: Arnd Bergmann Date: Fri Nov 14 22:10:14 2025 +0100 Merge tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.18: - Enable ext4 support explicitly in imx_v6_v7_defconfig to fix a regression caused by commit d6ace46c82fd ("ext4: remove obsolete EXT3 config options") - Correct report-rate-hz setting for imx6ull-engicam-microgea-rmm board - Fix MSI mapping for i.MX95 PCIe endpoint device nodes - Fix USB OTG role switching for imx8mp-kontron board - Fix a dt-schema warning caused by audmux node for imx51-zii-rdu1 board - Avoid gpio0_mipi_csi GPIOs being deferred for i.MX8 img subsystem * tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mp-kontron: Fix USB OTG role switching arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred arm: imx_v6_v7_defconfig: enable ext4 directly ARM: dts: imx51-zii-rdu1: Fix audmux node names ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value Signed-off-by: Arnd Bergmann commit ec0ca4be116ad7efb08cd23acc1ff29b04d9cf52 Author: Krzysztof Kozlowski Date: Fri Oct 31 14:50:39 2025 +0100 MAINTAINERS: Update Krzysztof Kozlowski's email Update Krzysztof Kozlowski's email address in mailmap to stay reachable. Link: https://patch.msgid.link/20251021095426.86549-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251031135041.78789-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 64bdb49f2dc928d20b48b19380354d885bbc9de7 Merge: dc00a9fea282d3 6f37469a933030 Author: Arnd Bergmann Date: Fri Nov 14 22:05:41 2025 +0100 Merge tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v6.18 Correct incorrect ID used for the memory controller client IDs in Tegra210 Memory Controller driver, introduced in v6.18-rc1. * tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra210: Fix incorrect client ids Signed-off-by: Arnd Bergmann commit de90cc610eb61341662fc23919dd823573ef9a41 Merge: 809bd274521537 66e9feb03e7cf8 Author: Linus Torvalds Date: Fri Nov 14 13:04:35 2025 -0800 Merge tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few standard fixes here, plus one more interesting one from Hans which addresses an issue where a move in when we requested GPIOs on ACPI systems caused us to stop doing pinmuxing and leave things floating that we'd really rather not have floating" * tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: Add TODO comment about ACPI GPIO setup spi: xilinx: increase number of retries before declaring stall spi: imx: keep dma request disabled before dma transfer setup spi: Try to get ACPI GPIO IRQ earlier commit dc00a9fea282d325edb58977062f043c94e23c7d Merge: 3e40c919816d56 85893094535cce Author: Arnd Bergmann Date: Fri Nov 14 22:03:52 2025 +0100 Merge tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes First batch of ASPEED fixes for 6.18 This time it's just the one fix addressing a PHY configuration regression in the Fuji (Meta) platform's mac3 devicetree node. * tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: fuji-data64: Enable mac3 controller Signed-off-by: Arnd Bergmann commit 3e40c919816d56ec877c90f61522d6bc2d34c398 Merge: e9a6fb0bcdd760 ce121914f38aaa Author: Arnd Bergmann Date: Fri Nov 14 22:01:00 2025 +0100 Merge tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes arm64: tegra: Fixes for v6.18 This contains a simple fix to mark the Ethernet PHY on Jetson Xavier NX as a wakeup source so the device can support WoL. * tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Mark Jetson Xavier NX's PHY as a wakeup source Signed-off-by: Arnd Bergmann commit 809bd274521537a550306f96b06c0585fd723bbf Merge: 27f518609e585d 636f4618b1cd96 Author: Linus Torvalds Date: Fri Nov 14 13:01:23 2025 -0800 Merge tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One simple fix for a GPIO descriptor leak in the probe error handling for the fixed regulator" * tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fixed: fix GPIO descriptor leak on register failure commit 27f518609e585d28a82119ce77f6c7085b61da50 Merge: d4f8cccc6230bd 21a9ab5b90b371 Author: Linus Torvalds Date: Fri Nov 14 12:50:08 2025 -0800 Merge tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are device-specific, and nothing stands out. - A regression fix for HD-audio HDMI probe - USB-audio hardening patches for issues spotted by fuzzers - ASoC fixes for TAS278x, SoundWire and Cirrus - Usual HD-audio and USB-audio quirks" * tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe() ALSA: hda/tas2781: Correct the wrong project ID ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list ALSA: usb-audio: Fix potential overflow of PCM transfer buffer ALSA: hda/tas2781: Add new quirk for HP new projects ASoC: tas2781: fix getting the wrong device number ASoC: codecs: va-macro: fix resource leak in probe error path ASoC: tas2783A: Fix issues in firmware parsing ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() ASoC: cs4271: Fix regulator leak on probe failure ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver ASoC: da7213: Use component driver suspend/resume ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis ASoC: doc: cs35l56: Update firmware filename description for B0 silicon commit d4f8cccc6230bd2f3aa28348a4c71f0dc3e89788 Merge: ac9f4f306d943c 8f05967b022d25 Author: Linus Torvalds Date: Fri Nov 14 10:18:45 2025 -0800 Merge tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixlet from Jens Axboe: "Been sitting on this one for a week or two, planning on sending it out when there were other block changes for 6.18. But as that hasn't materialized in the second week of sitting on it, let's flush it out. A previous commit updated my git tree locations, but one was missed as it was already set to the git.kernel.org one. But the git location swap also renamed the actual tree from linux-block to just linux, let's get that last one updated too" * tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: correct git location for block layer tree commit ac9f4f306d943c1c551280977ae5321167835088 Merge: b86caedd0b2c6e 2d0e88f3fd1dcb Author: Linus Torvalds Date: Fri Nov 14 09:57:30 2025 -0800 Merge tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Use the actual segments in a request when for bvec based buffers - Fix an odd case where the iovec might get leaked for a read/write request, if it was newly allocated, overflowed the alloc cache, and hit an early error - Minor tweak to the query API added in this release, returning the number of available entries * tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs io_uring/query: return number of available queries io_uring/rw: ensure allocated iovec gets cleared for early failure commit 6c762611fed7365790000925f3d14f20037d0061 Author: Eduard Zingerman Date: Thu Nov 13 18:57:30 2025 -0800 selftests/bpf: Test widen_imprecise_scalars() with different stack depth A test case for a situation when widen_imprecise_scalars() is called with old->allocated_stack > cur->allocated_stack. Test structure: def widening_stack_size_bug(): r1 = 0 for r6 in 0..1: iterator_with_diff_stack_depth(r1) r1 = 42 def iterator_with_diff_stack_depth(r1): if r1 != 42: use 128 bytes of stack iterator based loop iterator_with_diff_stack_depth() is verified with r1 == 0 first and r1 == 42 next. Causing stack usage of 128 bytes on a first visit and 8 bytes on a second. Such arrangement triggered a KASAN error in widen_imprecise_scalars(). Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114025730.772723-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b0c8e6d3d866b6a7f73877f71968dbffd27b7785 Author: Eduard Zingerman Date: Thu Nov 13 18:57:29 2025 -0800 bpf: account for current allocated stack depth in widen_imprecise_scalars() The usage pattern for widen_imprecise_scalars() looks as follows: prev_st = find_prev_entry(env, ...); queued_st = push_stack(...); widen_imprecise_scalars(env, prev_st, queued_st); Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case: def main(): for i in 1..2: foo(i) // same callsite, differnt param def foo(i): if i == 1: use 128 bytes of stack iterator based loop Here, for a second 'foo' call prev_st->allocated_stack is 128, while queued_st->allocated_stack is much smaller. widen_imprecise_scalars() needs to take this into account and avoid accessing bpf_verifier_state->frame[*]->stack out of bounds. Fixes: 2793a8b015f7 ("bpf: exact states comparison for iterator convergence checks") Reported-by: Emil Tsalapatis Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114025730.772723-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 660b299bed2a2a55a1f9102d029549d0235f881c Author: Diogo Ivo Date: Mon Nov 3 14:14:15 2025 +0000 Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" Commit b6bcbce33596 ("soc/tegra: pmc: Ensure power-domains are in a known state") was introduced so that all power domains get initialized to a known working state when booting and it does this by shutting them down (including asserting resets and disabling clocks) before registering each power domain with the genpd framework, leaving it to each driver to later on power its needed domains. This caused the Google Pixel C to hang when booting due to a workaround in the DSI driver introduced in commit b22fd0b9639e ("drm/tegra: dsi: Clear enable register if powered by bootloader") meant to handle the case where the bootloader enabled the DSI hardware module. The workaround relies on reading a hardware register to determine the current status and after b6bcbce33596 that now happens in a powered down state thus leading to the boot hang. Fix this by reverting b22fd0b9639e since currently we are guaranteed that the hardware will be fully reset by the time we start enabling the DSI module. Fixes: b6bcbce33596 ("soc/tegra: pmc: Ensure power-domains are in a known state") Cc: stable@vger.kernel.org Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20251103-diogo-smaug_ec_typec-v1-1-be656ccda391@tecnico.ulisboa.pt commit 6cbab9f0da72b4dc3c3f9161197aa3b9daa1fa3a Author: Prateek Agarwal Date: Fri Sep 19 13:25:40 2025 +0900 drm/tegra: Add call to put_pid() Add a call to put_pid() corresponding to get_task_pid(). host1x_memory_context_alloc() does not take ownership of the PID so we need to free it here to avoid leaking. Signed-off-by: Prateek Agarwal Fixes: e09db97889ec ("drm/tegra: Support context isolation") [mperttunen@nvidia.com: reword commit message] Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250919-host1x-put-pid-v1-1-19c2163dfa87@nvidia.com commit 4c5376b4b143c4834ebd392aef2215847752b16a Author: Ma Ke Date: Wed Oct 22 19:47:20 2025 +0800 drm/tegra: dc: Fix reference leak in tegra_dc_couple() driver_find_device() calls get_device() to increment the reference count once a matching device is found, but there is no put_device() to balance the reference count. To avoid reference count leakage, add put_device() to decrease the reference count. Found by code review. Cc: stable@vger.kernel.org Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers") Signed-off-by: Ma Ke Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn commit 4ef92743625818932b9c320152b58274c05e5053 Author: Eric Dumazet Date: Wed Nov 12 12:55:16 2025 +0000 bpf: Add bpf_prog_run_data_pointers() syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop(). WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214 struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf"). drop_reason was added later. Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end. Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") Reported-by: syzbot Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/ Signed-off-by: Eric Dumazet Signed-off-by: Martin KaFai Lau Reviewed-by: Victor Nogueira Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com commit ec33b59542d96830e3c89845ff833cf7b25ef172 Author: Vlastimil Babka Date: Thu Nov 13 19:54:35 2025 +0100 mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283) Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed. We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com Analyzed-by: Christoph Hellwig Fixes: bdfedb76f4f5 ("mm, mempool: poison elements backed by slab allocator") Cc: stable@vger.kernel.org Tested-by: kernel test robot Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz Signed-off-by: Vlastimil Babka commit b86caedd0b2c6e86c3fbaf5a04e5f9161b5688fd Merge: 95baf63fe81e5f 59b0afd01b2ce3 Author: Linus Torvalds Date: Fri Nov 14 08:32:58 2025 -0800 Merge tag 'v6.18-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix device reference leak in hisilicon * tag 'v6.18-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value commit 95baf63fe81e5fc91d194019f5aec8ecd9c50bb6 Merge: 6da43bbeb69181 d93a89684dce94 Author: Linus Torvalds Date: Fri Nov 14 08:30:48 2025 -0800 Merge tag 'v6.18-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Multichannel reconnect channel selection fix - Fix for smbdirect (RDMA) disconnect bug - Fix for incorrect username length check - Fix memory leak in mount parm processing * tag 'v6.18-rc5-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: let smbd_disconnect_rdma_connection() turn CREATED into DISCONNECTED smb: fix invalid username check in smb3_fs_context_parse_param() cifs: client: fix memory leak in smb3_fs_context_parse_param smb: client: fix cifs_pick_channel when channel needs reconnect commit e0fd4d42e27f761e9cc82801b3f183e658dc749d Author: Eslam Khafagy Date: Fri Nov 14 14:27:39 2025 +0200 posix-timers: Plug potential memory leak in do_timer_create() When posix timer creation is set to allocate a given timer ID and the access to the user space value faults, the function terminates without freeing the already allocated posix timer structure. Move the allocation after the user space access to cure that. [ tglx: Massaged change log ] Fixes: ec2d0c04624b3 ("posix-timers: Provide a mechanism to allocate a given timer ID") Reported-by: syzbot+9c47ad18f978d4394986@syzkaller.appspotmail.com Suggested-by: Cyrill Gorcunov Signed-off-by: Eslam Khafagy Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251114122739.994326-1-eslam.medhat1993@gmail.com Closes: https://lore.kernel.org/all/69155df4.a70a0220.3124cb.0017.GAE@google.com/T/ commit 14473a1f88596fd729e892782efc267c0097dd1d Author: Nick Hu Date: Fri Nov 14 15:28:44 2025 +0800 irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops The irq_domain_free_irqs() helper requires that the irq_domain_ops->free callback is implemented. Otherwise, the kernel reports the warning message "NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to release the per-HART local interrupts. Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that. Fixes: 832f15f42646 ("RISC-V: Treat IPIs as normal Linux IRQs") Signed-off-by: Nick Hu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251114-rv-intc-fix-v1-1-a3edd1c1a868@sifive.com commit 31475b88110c4725b4f9a79c3a0d9bbf97e69e1c Author: Heiko Carstens Date: Thu Nov 13 13:21:47 2025 +0100 s390/mm: Fix __ptep_rdp() inline assembly When a zero ASCE is passed to the __ptep_rdp() inline assembly, the generated instruction should have the R3 field of the instruction set to zero. However the inline assembly is written incorrectly: for such cases a zero is loaded into a register allocated by the compiler and this register is then used by the instruction. This means that selected TLB entries may not be flushed since the specified ASCE does not match the one which was used when the selected TLB entries were created. Fix this by removing the asce and opt parameters of __ptep_rdp(), since all callers always pass zero, and use a hard-coded register zero for the R3 field. Fixes: 0807b856521f ("s390/mm: add support for RDP (Reset DAT-Protection)") Cc: stable@vger.kernel.org Reviewed-by: Gerald Schaefer Signed-off-by: Heiko Carstens commit 37339122a7801660dce11abd817af82cc4bef163 Author: Ville Syrjälä Date: Fri Nov 14 23:18:50 2025 +0900 firewire: core: Initialize topology_map.lock Lockdep barfs on the new uninitialized spinlock. Initialize it. protip: enable lockdep (CONFIG_PROVE_LOCKING=y) when doing locking changes firewire_ohci 0000:02:01.1: added OHCI v1.10 device as card 0, 4 IR + 4 IT contexts, quirks 0x11 INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 UID: 0 PID: 1042 Comm: irq/17-firewire Not tainted 6.17.0-rc2-cl-bisect2-00026-g7d138cb269db #136 PREEMPT Hardware name: Dell Inc. Latitude E5400 /0D695C, BIOS A19 06/13/2013 Call Trace: dump_stack_lvl+0x6d/0xa0 register_lock_class+0x783/0x790 ? find_held_lock+0x2b/0x80 ? __mod_timer+0x110/0x320 ? __mod_timer+0x110/0x320 __lock_acquire+0x405/0x2600 lock_acquire+0xca/0x2e0 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core] ? fw_core_handle_bus_reset+0x878/0xca0 [firewire_core] _raw_spin_lock+0x2e/0x40 ? fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] fw_core_handle_bus_reset+0x888/0xca0 [firewire_core] handle_selfid_complete_event+0x35c/0x7a0 [firewire_ohci] ? irq_thread+0x8d/0x280 irq_thread_fn+0x18/0x50 irq_thread+0x15a/0x280 ? irq_check_status_bit+0x100/0x100 ? lockdep_hardirqs_on+0x78/0x100 ? irq_finalize_oneshot.part.0+0xc0/0xc0 ? irq_forced_thread_fn+0x60/0x60 kthread+0x114/0x200 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x158/0x1e0 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 Reported-by: Erhard Furtner Fixes: 7d138cb269db ("firewire: core: use spin lock specific to topology map") Signed-off-by: Ville Syrjälä Signed-off-by: Takashi Sakamoto commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 Author: Lushih Hsieh Date: Fri Nov 14 13:20:53 2025 +0800 ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series The PureAudio APA DAC and Lotus DAC5 series are USB Audio 2.0 Class devices that support native Direct Stream Digital (DSD) playback via specific vendor protocols. Without these quirks, the devices may only function in standard PCM mode, or fail to correctly report their DSD format capabilities to the ALSA framework, preventing native DSD playback under Linux. This commit adds new quirk entries for the mentioned DAC models based on their respective Vendor/Product IDs (VID:PID), for example: 0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc. The quirk ensures correct DSD format handling by setting the required SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA DSD API to correctly address the device for high-bitrate DSD streams, bypassing the need for DoP (DSD over PCM). Test on APA DAC and Lotus DAC5 SE under Arch Linux. Tested-by: Lushih Hsieh Signed-off-by: Lushih Hsieh Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw Signed-off-by: Takashi Iwai commit dd14022a7ce96963aa923e35cf4bcc8c32f95840 Author: Borislav Petkov (AMD) Date: Fri Nov 14 14:01:14 2025 +0100 x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev Add the minimum Entrysign revision for that model+stepping to the list of minimum revisions. Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Reported-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/e94dd76b-4911-482f-8500-5c848a3df026@citrix.com commit e1a97a627cd01d73fac5dd054d8f3de601ef2781 Author: Mario Limonciello Date: Thu Nov 13 16:35:50 2025 -0600 x86/CPU/AMD: Add additional fixed RDSEED microcode revisions Microcode that resolves the RDSEED failure (SB-7055 [1]) has been released for additional Zen5 models to linux-firmware [2]. Update the zen5_rdseed_microcode array to cover these new models. Fixes: 607b9fb2ce24 ("x86/CPU/AMD: Add RDSEED fix for Zen5") Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7055.html [1] Link: https://gitlab.com/kernel-firmware/linux-firmware/-/commit/6167e5566900cf236f7a69704e8f4c441bc7212a [2] Link: https://patch.msgid.link/20251113223608.1495655-1-mario.limonciello@amd.com commit f84fd5bec502447df145f31734793714690ce27f Author: Luke Wang Date: Fri Nov 14 14:53:08 2025 +0800 pwm: adp5585: Correct mismatched pwm chip info The register addresses of ADP5585 and ADP5589 are swapped. Fixes: 75024f97e82e ("pwm: adp5585: add support for adp5589") Signed-off-by: Luke Wang Acked-by: Nuno Sá Tested-by: Liu Ying # ADP5585 PWM Link: https://patch.msgid.link/20251114065308.2074893-1-ziniu.wang_1@nxp.com Signed-off-by: Uwe Kleine-König commit a55ef3bff84f11ee8c84a1ae29b071ffd4ccbbd9 Author: Zilin Guan Date: Mon Nov 10 06:41:25 2025 +0000 xfrm: fix memory leak in xfrm_add_acquire() The xfrm_add_acquire() function constructs an xfrm policy by calling xfrm_policy_construct(). This allocates the policy structure and potentially associates a security context and a device policy with it. However, at the end of the function, the policy object is freed using only kfree() . This skips the necessary cleanup for the security context and device policy, leading to a memory leak. To fix this, invoke the proper cleanup functions xfrm_dev_policy_delete(), xfrm_dev_policy_free(), and security_xfrm_policy_free() before freeing the policy object. This approach mirrors the error handling path in xfrm_add_policy(), ensuring that all associated resources are correctly released. Fixes: 980ebd25794f ("[IPSEC]: Sync series - acquire insert") Signed-off-by: Zilin Guan Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit fa3c727e05996811a2a57c5114e88200c05b6161 Merge: f6fdd77b3e0d51 360b3730f8eab6 Author: Takashi Iwai Date: Fri Nov 14 09:47:28 2025 +0100 Merge tag 'asoc-fix-v6.18-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A small collection of fixes, all driver specific and none especially remarkable unless you have the hardware (many not even then). commit 362a7d4fd5c473d43c498e68e13ff7acf8ca4ccf Merge: 538e0110fedc6d 240372edaf854c Author: Dave Airlie Date: Fri Nov 14 17:51:09 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - New HW workarounds affecting PTL and WCL platforms (Nitin Gote, Tangudu Tilak Tirumalesh) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/ay2qztgonodwson6tuzcv5napjmqbgwzv27so4ybfola34guux@xgufrrmbzyws commit 538e0110fedc6d7321fbd79594395469bf2749e3 Merge: 15ebea1bdff2f9 f2687d3cc9f905 Author: Dave Airlie Date: Fri Nov 14 17:50:36 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix PSR's pipe to vblank conversion (Jani) - Disable Panel Replay on MST links (Imre) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aRXdQnitzyFcokhF@intel.com commit ac5ae0a5ce22640f73677d40730a37f43df442d1 Author: Ally Heev Date: Tue Nov 11 13:26:42 2025 +0530 tee: qcomtee: fix uninitialized pointers with free attribute Uninitialized pointers with `__free` attribute can cause undefined behavior as the memory assigned randomly to the pointer is freed automatically when the pointer goes out of scope. qcomtee doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attribute in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 15ebea1bdff2f9740fc6f0af1c08454916bd5d2f Merge: 63444b4ca4bbe0 0a4a18e888ae8c Author: Dave Airlie Date: Fri Nov 14 17:24:51 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: client: - Fix description of module parameter panthor: - Flush writes before mapping buffers vmwgfx: - Improve command validation - Improve ref counting - Fix cursor-plane support Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251113132317.GA451885@linux.fritz.box commit 63444b4ca4bbe0df7e870ca8893496b80c9bb73b Merge: e9a6fb0bcdd760 eac32ff42393ef Author: Dave Airlie Date: Fri Nov 14 17:09:50 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-12: amdgpu: - Disallow P2P DMA for GC 12 DCC surfaces - ctx error handling fix - UserQ fixes - VRR fix - ISP fix - JPEG 5.0.1 fix amdkfd: - Save area check fix - Fix GPU mappings for APU after prefetch Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251112200930.8788-1-alexander.deucher@amd.com commit 407a06507c2358554958e8164dc97176feddcafc Author: Zilin Guan Date: Wed Nov 12 05:21:14 2025 +0000 mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() The function mlxsw_sp_flower_stats() calls mlxsw_sp_acl_ruleset_get() to obtain a ruleset reference. If the subsequent call to mlxsw_sp_acl_rule_lookup() fails to find a rule, the function returns an error without releasing the ruleset reference, causing a memory leak. Fix this by using a goto to the existing error handling label, which calls mlxsw_sp_acl_ruleset_put() to properly release the reference. Fixes: 7c1b8eb175b69 ("mlxsw: spectrum: Add support for TC flower offload statistics") Signed-off-by: Zilin Guan Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251112052114.1591695-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit f796a8dec9beafcc0f6f0d3478ed685a15c5e062 Author: Jiaming Zhang Date: Wed Nov 12 01:36:52 2025 +0800 net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_get_hwtstamp_phylib() -> vlan_hwtstamp_get() -> generic_hwtstamp_get_lower() -> generic_hwtstamp_ioctl_lower() results in generic_hwtstamp_ioctl_lower() being called with kernel_cfg->ifr as NULL. The generic_hwtstamp_ioctl_lower() function does not expect a NULL ifr and dereferences it, leading to a system crash. Fix this by adding a NULL check for kernel_cfg->ifr in generic_hwtstamp_ioctl_lower(). If ifr is NULL, return -EINVAL. Fixes: 6e9e2eed4f39 ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Closes: https://lore.kernel.org/cd6a7056-fa6d-43f8-b78a-f5e811247ba8@linux.dev Signed-off-by: Jiaming Zhang Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20251111173652.749159-2-r772577952@gmail.com Signed-off-by: Jakub Kicinski commit 6da43bbeb6918164f7287269881a5f861ae09d7e Merge: 01814e11e5e987 d323ad73966676 Author: Linus Torvalds Date: Thu Nov 13 17:00:40 2025 -0800 Merge tag 'vfio-v6.18-rc6' of https://github.com/awilliam/linux-vfio Pull VFIO seftest fixes from Alex Williamson: - Fix vfio selftests to remove the expectation that the IOMMU supports a 64-bit IOVA space. These manifest both in the original set of tests introduced this development cycle in identity mapping the IOVA to buffer virtual address space, as well as the more recent boundary testing. Implement facilities for collecting the valid IOVA ranges from the backend, implement a simple IOVA allocator, and use the information for determining extents (Alex Mastro) * tag 'vfio-v6.18-rc6' of https://github.com/awilliam/linux-vfio: vfio: selftests: replace iova=vaddr with allocated iovas vfio: selftests: add iova allocator vfio: selftests: fix map limit tests to use last available iova vfio: selftests: add iova range query helpers commit 01814e11e5e9878f26cfeb4ad4be791525757e30 Merge: aecba2e013ab79 c55a8e24cd129b Author: Linus Torvalds Date: Thu Nov 13 16:54:36 2025 -0800 Merge tag 'hwmon-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - gpd-fan: Fix compilation error for non-ACPI builds, and initialize EC when loading the driver * tag 'hwmon-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (gpd-fan) initialize EC on driver load for Win 4 hwmon: (gpd-fan) Fix compilation error in non-ACPI builds commit aecba2e013ab79dde441dfc81a32792ced229539 Merge: 6a3cc1b749c080 161284b26fb170 Author: Linus Torvalds Date: Thu Nov 13 16:31:07 2025 -0800 Merge tag 'pm-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix issues related to the handling of compressed hibernation images and a recent intel_pstate driver regression: - Fix issues related to using inadequate data types and incorrect use of atomic variables in the compressed hibernation images handling code that were introduced during the 6.9 development cycle (Mario Limonciello) - Move a X86_FEATURE_IDA check from turbo_is_disabled() to the places where a new value for MSR_IA32_PERF_CTL is computed in intel_pstate to address a regression preventing users from enabling turbo frequencies post-boot (Srinivas Pandruvada)" * tag 'pm-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes PM: hibernate: Fix style issues in save_compressed_image() PM: hibernate: Use atomic64_t for compressed_size variable PM: hibernate: Emit an error when image writing fails commit 7410c86fc05b1423466c1a579bcc994f87822566 Author: Baruch Siach Date: Wed Nov 12 13:17:03 2025 +0200 MAINTAINERS: Remove eth bridge website Ethernet bridge website URL shows "This page isn’t available". Signed-off-by: Baruch Siach Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/0a32aaf7fa4473e7574f7327480e8fbc4fef2741.1762946223.git.baruch@tkos.co.il Signed-off-by: Jakub Kicinski commit 6a3cc1b749c0808011424c80a0ba5497fdcd5f9c Merge: 9b9e43704d2b05 7564f3543cf19b Author: Linus Torvalds Date: Thu Nov 13 16:22:36 2025 -0800 Merge tag 'acpi-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix issues in the ACPI CPPC library and in the recently added parser for the ACPI MRRM table: - Limit some checks in the ACPI CPPC library to online CPUs to avoid accessing uninitialized per-CPU variables when some CPUs are offline to start with, like during boot with 'nosmt=force' (Gautham Shenoy) - Rework add_boot_memory_ranges() in the ACPI MRRM table parser to fix memory leaks and improve error handling (Kaushlendra Kumar)" * tag 'acpi-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: MRRM: Fix memory leaks and improve error handling ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs ACPI: CPPC: Perform fast check switch only for online CPUs ACPI: CPPC: Check _CPC validity for only the online CPUs ACPI: CPPC: Detect preferred core availability on online CPUs commit b5414520793e68d266fdd97a84989d9831156aad Author: Mykola Kvach Date: Mon Nov 3 12:27:40 2025 +0200 arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 The vcc3v3_pcie20 fixed regulator powers the PCIe device-side 3.3V rail for pcie2x1l2 via vpcie3v3-supply. The DTS mistakenly set its regulator-min/max-microvolt to 1800000 (1.8 V). Correct both to 3300000 (3.3 V) to match the rail name, the PCIe/M.2 power requirement, and the actual hardware wiring on Orange Pi 5. Fixes: b6bc755d806e ("arm64: dts: rockchip: Add Orange Pi 5") Cc: stable@vger.kernel.org Signed-off-by: Mykola Kvach Reviewed-by: Michael Riesch Link: https://patch.msgid.link/cf6e08dfdfbf1c540685d12388baab1326f95d2c.1762165324.git.xakep.amatop@gmail.com Signed-off-by: Heiko Stuebner commit baa18d577cd445145039e731d3de0fa49ca57204 Author: Quentin Schulz Date: Wed Nov 12 16:01:53 2025 +0100 arm64: dts: rockchip: disable HS400 on RK3588 Tiger We've had reports from the field that some RK3588 Tiger have random issues with eMMC errors. Applying commit a28352cf2d2f ("mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4") didn't help and seemed to have made things worse for our board. Our HW department checked the eMMC lines and reported that they are too long and don't look great so signal integrity is probably not the best. Note that not all Tigers with the same eMMC chip have errors, so the suspicion is that we're really on the edge in terms of signal integrity and only a handful devices are failing. Additionally, we have RK3588 Jaguars with the same eMMC chip but the layout is different and we also haven't received reports about those so far. Lowering the max-frequency to 150MHz from 200MHz instead of simply disabling HS400 was briefly tested and seem to work as well. We've disabled HS400 downstream and haven't received reports since so we'll go with that instead of lowering the max-frequency. Signed-off-by: Quentin Schulz Fixes: 6173ef24b35b ("arm64: dts: rockchip: add RK3588-Q7 (Tiger) SoM") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251112-tiger-hs200-v1-1-b50adac107c0@cherry.de [added Fixes tag and stable-cc from 2nd mail] Signed-off-by: Heiko Stuebner commit 264152a97edf9f1b7ed5372e4033e46108e41422 Author: Chukun Pan Date: Sat Nov 1 22:01:01 2025 +0800 arm64: dts: rockchip: drop reset from rk3576 i2c9 node The reset property is not part of the binding, so drop it. It is also not used by the driver, so it was likely copied from some vendor-kernel node. Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101140101.302229-1-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit d6b9ce75e87c5f4bfbc0f7bba4f4f7cbf942f98a Merge: 8d422b8beb76bf d0fcf70c680e4d Author: Greg Kroah-Hartman Date: Thu Nov 13 17:36:35 2025 -0500 Merge tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus Dinh writes: firmware: stratix10-svc: fix saving contoller data for v6.18 - Fix the incorrect use of platform_set_drvdata and dev_set_drvdata * tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: (237 commits) firmware: stratix10-svc: fix bug in saving controller data Linux 6.18-rc4 objtool: Fix skip_alt_group() for non-alternative STAC/CLAC kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols PCI: Do not size non-existing prefetchable window Revert "PCI: qcom: Remove custom ASPM enablement code" bpf/arm64: Fix BPF_ST into arena memory bpf: Make migrate_disable always inline to avoid partial inlining null_blk: set dma alignment to logical block size xfs: document another racy GC case in xfs_zoned_map_extent xfs: prevent gc from picking the same zone twice drm/ast: Clear preserved bits from register output value s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP drm/imx: parallel-display: add the bridge before attaching it drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API blk-crypto: use BLK_STS_INVAL for alignment errors regulator: bd718x7: Fix voltages scaled by resistor divider x86/cpu: Add/fix core comments for {Panther,Nova} Lake ... commit 8d422b8beb76bfc57f0fe4b03082f3823eccd150 Merge: baadf2a5c26e80 3aa385a9c75c09 Author: Greg Kroah-Hartman Date: Thu Nov 13 17:34:22 2025 -0500 Merge tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: Fixes for 6.18 (set 1) The usual mixed back of brand new and ancient bugs. dmaengine buffer / core - Add new callback to allow fetching the providing device for a DMA channel. Use this to get the right device for the dmaengine buffer implementation. adi,ad4030 - Fix incorrect _scale value for common-mode channels. adi,ad7124 - Fix gain and offset for temperature channel. adi,ad7280a - Fix a factor of 10 error when setting the balance timer. adi,ad7380 - Fix sampling frequency to account for need to trigger twice per scan for some supported chips. adi,adxl355 - Ensure a long enough wait after SW reset. bosch,bmc150 - Fix wrong assumption that interrupts are always available. bosch,bmp280 - Fix the measurement time calculation. richtek,rtq6056 - Fix wrong sign bit when sign extending. samsung,ssp - Fix cleanup of registered mfd devices on error. st,lsm6dsx - Fix wrong sized array for register information. - Fix a wrong time stamp calculation for some devices. st,stm32-dfsdm - Update handling of st,adc-alt-channel to reflect binding change as part of moving to iio-backend framework. ti,hdc3020 - Fix wrong units for temperature and humidity. Also the thresholds and hysteresis. * tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: accel: bmc150: Fix irq assumption regression iio: st_lsm6dsx: Fixed calibrated timestamp calculation iio: humditiy: hdc3020: fix units for thresholds and hysteresis iio: humditiy: hdc3020: fix units for temperature and humidity measurement iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields iio: accel: fix ADXL355 startup race condition iio: adc: ad7124: fix temperature channel iio:common:ssp_sensors: Fix an error handling path ssp_probe() iio: adc: ad7280a: fix ad7280_store_balance_timer() iio: buffer-dmaengine: enable .get_dma_dev() iio: buffer-dma: support getting the DMA channel iio: buffer: support getting dma channel from the buffer iio: pressure: bmp280: correct meas_time_us calculation iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling iio: adc: ad7380: fix SPI offload trigger rate iio: adc: rtq6056: Correct the sign bit index iio: adc: ad4030: Fix _scale value for common-mode channels commit 91a78ce994e710f2e983071ccf6d0e60fc9c1ac5 Merge: e427054ae7bc8b cb730e4ac1b4dc Author: Martin KaFai Lau Date: Thu Nov 13 09:15:42 2025 -0800 Merge branch 'mptcp-fix-conflicts-between-mptcp-and-sockmap' Jiayuan Chen says: ==================== mptcp: Fix conflicts between MPTCP and sockmap Overall, we encountered a warning [1] that can be triggered by running the selftest I provided. sockmap works by replacing sk_data_ready, recvmsg, sendmsg operations and implementing fast socket-level forwarding logic: 1. Users can obtain file descriptors through userspace socket()/accept() interfaces, then call BPF syscall to perform these replacements. 2. Users can also use the bpf_sock_hash_update helper (in sockops programs) to replace handlers when TCP connections enter ESTABLISHED state (BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB/BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) However, when combined with MPTCP, an issue arises: MPTCP creates subflow sk's and performs TCP handshakes, so the BPF program obtains subflow sk's and may incorrectly replace their sk_prot. We need to reject such operations. In patch 1, we set psock_update_sk_prot to NULL in the subflow's custom sk_prot. Additionally, if the server's listening socket has MPTCP enabled and the client's TCP also uses MPTCP, we should allow the combination of subflow and sockmap. This is because the latest Golang programs have enabled MPTCP for listening sockets by default [2]. For programs already using sockmap, upgrading Golang should not cause sockmap functionality to fail. Patch 2 prevents the WARNING from occurring. Despite these patches fixing stream corruption, users of sockmap must set GODEBUG=multipathtcp=0 to disable MPTCP until sockmap fully supports it. [1] truncated warning: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 388 at net/mptcp/protocol.c:68 mptcp_stream_accept+0x34c/0x380 Modules linked in: RIP: 0010:mptcp_stream_accept+0x34c/0x380 RSP: 0018:ffffc90000cf3cf8 EFLAGS: 00010202 PKRU: 55555554 Call Trace: do_accept+0xeb/0x190 ? __x64_sys_pselect6+0x61/0x80 ? _raw_spin_unlock+0x12/0x30 ? alloc_fd+0x11e/0x190 __sys_accept4+0x8c/0x100 __x64_sys_accept+0x1f/0x30 x64_sys_call+0x202f/0x20f0 do_syscall_64+0x72/0x9a0 ? switch_fpu_return+0x60/0xf0 ? irqentry_exit_to_user_mode+0xdb/0x1e0 ? irqentry_exit+0x3f/0x50 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- [2]: https://go-review.googlesource.com/c/go/+/607715 ==================== Link: https://patch.msgid.link/20251111060307.194196-1-jiayuan.chen@linux.dev Signed-off-by: Martin KaFai Lau commit cb730e4ac1b4dca09d364fd83464ebd29547a4ef Author: Jiayuan Chen Date: Tue Nov 11 14:02:52 2025 +0800 selftests/bpf: Add mptcp test with sockmap Add test cases to verify that when MPTCP falls back to plain TCP sockets, they can properly work with sockmap. Additionally, add test cases to ensure that sockmap correctly rejects MPTCP sockets as expected. Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Acked-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251111060307.194196-4-jiayuan.chen@linux.dev commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f Author: Jiayuan Chen Date: Tue Nov 11 14:02:51 2025 +0800 mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() syn_recv_sock()/subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. ''' subflow_syn_recv_sock() subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() ''' Then, this subflow can be normally used by sockmap, which replaces the native sk_prot with sockmap's custom sk_prot. The issue occurs when the user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops(). Here, it uses sk->sk_prot to compare with the native sk_prot, but this is incorrect when sockmap is used, as we may incorrectly set sk->sk_socket->ops. This fix uses the more generic sk_family for the comparison instead. Additionally, this also prevents a WARNING from occurring: result from ./scripts/decode_stacktrace.sh: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \ (net/mptcp/protocol.c:4005) Modules linked in: ... PKRU: 55555554 Call Trace: do_accept (net/socket.c:1989) __sys_accept4 (net/socket.c:2028 net/socket.c:2057) __x64_sys_accept (net/socket.c:2067) x64_sys_call (arch/x86/entry/syscall_64.c:41) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f87ac92b83d ---[ end trace 0000000000000000 ]--- Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash") Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Sitnicki Reviewed-by: Matthieu Baerts (NGI0) Cc: Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev commit b72b8132d8fd2d6bf5b420a03d4fc553980c3a92 Author: Ian Rogers Date: Tue Nov 11 23:43:11 2025 -0800 perf libbfd: Ensure libbfd is initialized prior to use Multiple threads may be creating and destroying BFD objects in situations like `perf top`. Without appropriate initialization crashes may occur during libbfd's cache management. BFD's locks require recursive mutexes, add support for these. Committer testing: This happens only when building with 'make BUILD_NONDISTRO=1' and having the binutils-devel package (or equivalent) installed, i.e. linking with binutils devel files, an opt-in perf build. Before: root@x1:~# perf top perf: Segmentation fault -------- backtrace -------- root@x1:~# After this patch it works as before. Closes: https://lore.kernel.org/lkml/aQt66zhfxSA80xwt@gentoo.org/ Fixes: 95931d9a594dd0b5 ("perf libbfd: Move libbfd functionality to its own file") Reported-by: Guilherme Amadio Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 3c723f449723db2dc2b75b7efe03c2a76e4c09f0 Author: Ravi Bangoria Date: Thu Nov 13 16:01:24 2025 +0000 perf test: Fix lock contention test Couple of independent fixes: 1. Wire in SIGSEGV handler that terminates the test with a failure code. 2. Use "--lock-cgroup" instead of "-g"; "-g" was proposed but never merged. See commit 4d1792d0a2564caf ("perf lock contention: Add --lock-cgroup option") 3. Call cleanup() on every normal exit so trap_cleanup() doesn't mistake it for an unexpected signal and emit a false-negative "Unexpected signal in main" message. Before patch: # ./perf test -vv "lock contention" 85: kernel lock contention analysis test: --- start --- test child forked, pid 610711 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --lock-cgroup Unexpected signal in test_aggr_cgroup ---- end(0) ---- 85: kernel lock contention analysis test : Ok After patch: # ./perf test -vv "lock contention" 85: kernel lock contention analysis test: --- start --- test child forked, pid 602637 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --lock-cgroup Testing perf lock contention --type-filter (w/ spinlock) Testing perf lock contention --lock-filter (w/ tasklist_lock) Testing perf lock contention --callstack-filter (w/ unix_stream) [Skip] Could not find 'unix_stream' Testing perf lock contention --callstack-filter with task aggregation [Skip] Could not find 'unix_stream' Testing perf lock contention --cgroup-filter Testing perf lock contention CSV output ---- end(0) ---- 85: kernel lock contention analysis test : Ok Reviewed-by: Ian Rogers Signed-off-by: Ravi Bangoria Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Cc: Tycho Andersen Signed-off-by: Arnaldo Carvalho de Melo commit d0206db94b36c998c11458cfdae2f45ba20bc4fb Author: Ravi Bangoria Date: Thu Nov 13 16:01:23 2025 +0000 perf lock: Fix segfault due to missing kernel map Kernel maps are encoded in PERF_RECORD_MMAP2 samples but "perf lock report" and "perf lock contention" do not process MMAP2 samples. Because of that, machine->vmlinux_map stays NULL and any later access triggers a segmentation fault. Fix it by adding ->mmap2() callbacks. Fixes: 53b00ff358dc75b1 ("perf record: Make --buildid-mmap the default") Reported-by: Tycho Andersen (AMD) Reviewed-by: Ian Rogers Signed-off-by: Ravi Bangoria Tested-by: Tycho Andersen (AMD) Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sandipan Das Cc: Santosh Shukla Signed-off-by: Arnaldo Carvalho de Melo commit 84003ab3d0ca3717e4b36071c3c5f8b3c70e317c Author: Arnaldo Carvalho de Melo Date: Thu Nov 13 15:03:07 2025 -0300 tools headers UAPI: Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason To pick the changes in: 9d7dfb95da2cb5c1 ("KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL") The 'perf kvm-stat' tool uses the exit reasons that are included in the VMX_EXIT_REASONS define, this new SEAMCALL isn't included there (TDCALL is), so shouldn't be causing any change in behaviour, this patch ends up being just addressess the following perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit a09e5967ad6819379fd31894634d7aed29c18409 Author: Arnaldo Carvalho de Melo Date: Wed Nov 12 21:57:08 2025 -0300 perf build: Don't fail fast path feature detection when binutils-devel is not available This is one more remnant of the BUILD_NONDISTRO series to make building with binutils-devel opt-in due to license incompatibility. In this case just the references at link time were still in place, which make building the test-all.bin file fail, which wasn't detected before probably because the last test was done with binutils-devel available, doh. Now: $ rpm -q binutils-devel package binutils-devel is not installed $ file /tmp/build/perf-tools/feature/test-all.bin /tmp/build/perf-tools/feature/test-all.bin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=4b5388a346b51f1b993f0b0dbd49f4570769b03c, for GNU/Linux 3.2.0, not stripped $ Fixes: 970ae86307718c34 ("perf build: The bfd features are opt-in, stop testing for them by default") Reviewed-by: Ian Rogers Cc: Adrian Hunter Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 85c894a80ac46aa177df04e0a33bcad409b7d64f Author: Thomas Falcon Date: Fri Nov 7 11:31:50 2025 -0600 perf header: Write bpf_prog (infos|btfs)_cnt to data file With commit f0d0f978f3f5830a ("perf header: Don't write empty BPF/BTF info"), the write_bpf_( prog_info() | btf() ) functions exit without writing anything if env->bpf_prog.(infos| btfs)_cnt is zero. process_bpf_( prog_info() | btf() ), however, still expect a "count" value to exist in the data file. If btf information is empty, for example, process_bpf_btf will read garbage or some other data as the number of btf nodes in the data file. As a result, the data file will not be processed correctly. Instead, write the count to the data file and exit if it is zero. Fixes: f0d0f978f3f5830a ("perf header: Don't write empty BPF/BTF info") Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 161284b26fb17093bad3c7b25d76459e11d3142f Merge: 4b747cc628d8f5 0b6c10cb8479d0 Author: Rafael J. Wysocki Date: Thu Nov 13 21:05:46 2025 +0100 Merge branch 'pm-sleep' Merge fixes for issues related to the handling of compressed hibernation images that were introduced during the 6.9 development cycle. * pm-sleep: PM: hibernate: Fix style issues in save_compressed_image() PM: hibernate: Use atomic64_t for compressed_size variable PM: hibernate: Emit an error when image writing fails commit 9b9e43704d2b05514aeeaea36311addba2c72408 Merge: 8b4a014e2865a9 cbcff934fa7deb Author: Linus Torvalds Date: Thu Nov 13 11:42:44 2025 -0800 Merge tag 'slab-for-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix memory leak of objects from remote NUMA node when bulk freeing to a cache with sheaves (Harry Yoo) * tag 'slab-for-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: fix memory leak in free_to_pcs_bulk() commit 7564f3543cf19b1232553ab10399c9fbf514b5f3 Merge: e9a6fb0bcdd760 0fce75870666b4 4b93d211bbffd3 Author: Rafael J. Wysocki Date: Thu Nov 13 20:40:51 2025 +0100 Merge branches 'acpi-cppc' and 'acpi-tables' Merge ACPI CPPC library fixes and an ACPI MRRM table parser fix for 6.18-rc6. * acpi-cppc: ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs ACPI: CPPC: Perform fast check switch only for online CPUs ACPI: CPPC: Check _CPC validity for only the online CPUs ACPI: CPPC: Detect preferred core availability on online CPUs * acpi-tables: ACPI: MRRM: Fix memory leaks and improve error handling commit 8b4a014e2865a970c18c1e9bba2b5c5a7322045f Merge: d0309c054362a2 dd4adb986a8672 Author: Linus Torvalds Date: Thu Nov 13 11:37:40 2025 -0800 Merge tag 'linux_kselftest-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "Fixes event-filter-function.tc tracing test failure caused when a first run to sample events triggers kmem_cache_free which interferes with the rest of the test. Fix this by calling sample_events twice to eliminate the kmem_cache_free related noise from the sampling" * tag 'linux_kselftest-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Run sample events to clear page cache events commit d0309c054362a235077327b46f727bc48878a3bc Merge: 2ccec5944606ee 94909c53e44247 Author: Linus Torvalds Date: Thu Nov 13 11:20:25 2025 -0800 Merge tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth and Wireless. No known outstanding regressions. Current release - regressions: - eth: - bonding: fix mii_status when slave is down - mlx5e: fix missing error assignment in mlx5e_xfrm_add_state() Previous releases - regressions: - sched: limit try_bulk_dequeue_skb() batches - ipv4: route: prevent rt_bind_exception() from rebinding stale fnhe - af_unix: initialise scc_index in unix_add_edge() - netpoll: fix incorrect refcount handling causing incorrect cleanup - bluetooth: don't hold spin lock over sleeping functions - hsr: Fix supervision frame sending on HSRv0 - sctp: prevent possible shift out-of-bounds - tipc: fix use-after-free in tipc_mon_reinit_self(). - dsa: tag_brcm: do not mark link local traffic as offloaded - eth: virtio-net: fix incorrect flags recording in big mode Previous releases - always broken: - sched: initialize struct tc_ife to fix kernel-infoleak - wifi: - mac80211: reject address change while connecting - iwlwifi: avoid toggling links due to wrong element use - bluetooth: cancel mesh send timer when hdev removed - strparser: fix signed/unsigned mismatch bug - handshake: fix memory leak in tls_handshake_accept() Misc: - selftests: mptcp: fix some flaky tests" * tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits) hsr: Follow standard for HSRv0 supervision frames hsr: Fix supervision frame sending on HSRv0 virtio-net: fix incorrect flags recording in big mode ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe wifi: iwlwifi: mld: always take beacon ies in link grading wifi: iwlwifi: mvm: fix beacon template/fixed rate wifi: iwlwifi: fix aux ROC time event iterator usage net_sched: limit try_bulk_dequeue_skb() batches selftests: mptcp: join: properly kill background tasks selftests: mptcp: connect: trunc: read all recv data selftests: mptcp: join: userspace: longer transfer selftests: mptcp: join: endpoints: longer transfer selftests: mptcp: join: rm: set backup flag selftests: mptcp: connect: fix fallback note due to OoO ethtool: fix incorrect kernel-doc style comment in ethtool.h mlx5: Fix default values in create CQ Bluetooth: btrtl: Avoid loading the config file on security chips net/mlx5e: Fix potentially misleading debug message net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net/mlx5e: Fix maxrate wraparound in threshold between units ... commit cbcff934fa7deb670d9545a3aad4d07e8f1e4f3c Author: Harry Yoo Date: Tue Nov 11 21:53:31 2025 +0900 mm/slub: fix memory leak in free_to_pcs_bulk() The commit 989b09b73978 ("slab: skip percpu sheaves for remote object freeing") introduced the remote_objects array in free_to_pcs_bulk() to skip sheaves when objects from a remote node are freed. However, the array is flushed only when: 1) the array becomes full (++remote_nr >= PCS_BATCH_MAX), or 2) slab_free_hook() returns false and size becomes zero. When neither of the conditions is met, objects in the array are leaked. This resulted in a memory leak [1], where 82 GiB of memory was allocated for the maple_node cache. Flush the array after successfully freeing objects to sheaves in the do_free: path. In the meantime, move the snippet if (!size) goto flush_remote; outside the while loop for readability. Let's say all objects in the array are from a remote node: then we acquire s->cpu_sheaves->lock and try to free an object even when size is zero. This doesn't appear to be harmful, but isn't really readable. Reported-by: Tytus Rogalewski Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220765 [1] Closes: https://lore.kernel.org/linux-mm/20251107094809.12e9d705b7bf4815783eb184@linux-foundation.org Closes: https://lore.kernel.org/all/aRGDTwbt2EIz2CYn@hyeyoo Fixes: 989b09b73978 ("slab: skip percpu sheaves for remote object freeing") Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20251111125331.12246-1-harry.yoo@oracle.com Acked-by: Liam R. Howlett Tested-by: Darrick J. Wong Tested-by: Tytus Rogalewski Signed-off-by: Vlastimil Babka commit 10eaa4c4a257944e9b30d13fda7d09164a70866d Author: Anurag Dutta Date: Wed Nov 5 21:41:46 2025 +0530 spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call Fix runtime PM usage count underflow caused by calling pm_runtime_put_autosuspend() twice with only one corresponding pm_runtime_get_noresume() call. This triggers the warning: "Runtime PM usage count underflow!" Remove the duplicate put call to balance the runtime PM reference counting. Fixes: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") Signed-off-by: Anurag Dutta Link: https://patch.msgid.link/20251105161146.2019090-3-a-dutta@ti.com Signed-off-by: Mark Brown commit f1eb4e792bb1ee3dcdffa66f8a83a4867cda2dd3 Author: Anurag Dutta Date: Wed Nov 5 21:41:45 2025 +0530 spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance The "probe_setup_failed" label calls pm_runtime_disable(), but pm_runtime_enable() was placed after a possible jump to this label. When cqspi_setup_flash() fails, control jumps to the label without pm_runtime_enable() being called, leading to unbalanced PM runtime reference counting. Move pm_runtime_enable() and associated calls above the first possible branch to "probe_setup_failed" to ensure balanced enable/disable calls across all error paths. Fixes: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") Signed-off-by: Anurag Dutta Link: https://patch.msgid.link/20251105161146.2019090-2-a-dutta@ti.com Signed-off-by: Mark Brown commit a257e974210320ede524f340ffe16bf4bf0dda1e Author: Zqiang Date: Thu Nov 13 19:43:55 2025 +0800 sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the following scenarios may occur: lock(&rq->__lock); lock(&rq->__lock); This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn() is always invoked in hard-irq context. Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit fbade4bd08ba52cbc74a71c4e86e736f059f99f7 Author: Jiayuan Chen Date: Tue Nov 11 14:02:50 2025 +0800 mptcp: Disallow MPTCP subflows from sockmap The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing with sockmap's custom read/write interfaces. ''' tcp_rcv_state_process() subflow_syn_recv_sock() tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB) bpf_skops_established <== sockops bpf_sock_map_update(sk) <== call bpf helper tcp_bpf_update_proto() <== update sk_prot ''' Consider two scenarios: 1. When the server has MPTCP enabled and the client also requests MPTCP, the sk passed to the BPF program is a subflow sk. Since subflows only handle partial data, replacing their sk_prot is meaningless and will cause traffic disruption. 2. When the server has MPTCP enabled but the client sends a TCP SYN without MPTCP, subflow_syn_recv_sock() performs a fallback on the subflow, replacing the subflow sk's sk_prot with the native sk_prot. ''' subflow_ulp_fallback() subflow_drop_ctx() mptcp_subflow_ops_undo_override() ''' Subsequently, accept::mptcp_stream_accept::mptcp_fallback_tcp_ops() converts the subflow to plain TCP. For the first case, we should prevent it from being combined with sockmap by setting sk_prot->psock_update_sk_prot to NULL, which will be blocked by sockmap's own flow. For the second case, since subflow_syn_recv_sock() has already restored sk_prot to native tcp_prot/tcpv6_prot, no further action is needed. Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections") Signed-off-by: Jiayuan Chen Signed-off-by: Martin KaFai Lau Reviewed-by: Matthieu Baerts (NGI0) Cc: Link: https://patch.msgid.link/20251111060307.194196-2-jiayuan.chen@linux.dev commit 0a8fb03fe7b0abab0ff16522e2625163183e7ae4 Author: Kiryl Shutsemau Date: Thu Nov 13 12:10:06 2025 +0000 MAINTAINERS: Update name spelling Use transliteration from the Belarusian language instead of Russian. Signed-off-by: Kiryl Shutsemau Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251113121006.651992-1-kas%40kernel.org commit ebd4469e7af61019daaf904fdcba07a9ecd18440 Author: Andrew Donnellan Date: Wed Nov 5 14:40:32 2025 +1100 entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub The stub implementation of arch_xfer_to_guest_mode_handle_work() is guarded by an #ifndef that incorrectly checks for the name arch_xfer_to_guest_mode_work instead. It seems the function was renamed to add "_handle" as a late change to the original patch, and the #ifndef wasn't updated to go with it. Change the #ifndef to match the name of the function. No users right now, so no need to update any architecture code. Fixes: 935ace2fb5cc4 ("entry: Provide infrastructure for work before transitioning to guest mode") Signed-off-by: Andrew Donnellan Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251105-entry-fix-ifndef-v1-1-d8d28045b627@linux.ibm.com commit 94909c53e442474a432c57c96b99d99357ac3593 Merge: 0eff2eaa5322b5 b2c26c82f7a94e Author: Paolo Abeni Date: Thu Nov 13 15:55:06 2025 +0100 Merge branch 'hsr-send-correct-hsrv0-supervision-frames' Felix Maurer says: ==================== hsr: Send correct HSRv0 supervision frames Hangbin recently reported that the hsr selftests were failing and noted that the entries in the node table were not merged, i.e., had 00:00:00:00:00:00 as MacAddressB forever [1]. This failure only occured with HSRv0 because it was not sending supervision frames anymore. While debugging this I found that we were not really following the HSRv0 standard for the supervision frames we sent, so I additionally made a few changes to get closer to the standard and restore a more correct behavior we had a while ago. The selftests can still fail because they take a while and run into the timeout. I did not include a change of the timeout because I have more improvements to the selftests mostly ready that change the test duration but are net-next material. [1]: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/ ==================== Link: https://patch.msgid.link/cover.1762876095.git.fmaurer@redhat.com Signed-off-by: Paolo Abeni commit b2c26c82f7a94ec4da096f370e3612ee14424450 Author: Felix Maurer Date: Tue Nov 11 17:29:33 2025 +0100 hsr: Follow standard for HSRv0 supervision frames For HSRv0, the path_id has the following meaning: - 0000: PRP supervision frame - 0001-1001: HSR ring identifier - 1010-1011: Frames from PRP network (A/B, with RedBoxes) - 1111: HSR supervision frame Follow the IEC 62439-3:2010 standard more closely by setting the right path_id for HSRv0 supervision frames (actually, it is correctly set when the frame is constructed, but hsr_set_path_id() overwrites it) and set a fixed HSR ring identifier of 1. The ring identifier seems to be generally unused and we ignore it anyways on reception, but some fixed identifier is definitely better than using one identifier in one direction and a wrong identifier in the other. This was also the behavior before commit f266a683a480 ("net/hsr: Better frame dispatch") which introduced the alternating path_id. This was later moved to hsr_set_path_id() in commit 451d8123f897 ("net: prp: add packet handling support"). The IEC 62439-3:2010 also contains 6 unused bytes after the MacAddressA in the HSRv0 supervision frames. Adjust a TODO comment accordingly. Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Fixes: 451d8123f897 ("net: prp: add packet handling support") Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/ea0d5133cd593856b2fa673d6e2067bf1d4d1794.1762876095.git.fmaurer@redhat.com Tested-by: Hangbin Liu Signed-off-by: Paolo Abeni commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f Author: Felix Maurer Date: Tue Nov 11 17:29:32 2025 +0100 hsr: Fix supervision frame sending on HSRv0 On HSRv0, no supervision frames were sent. The supervison frames were generated successfully, but failed the check for a sufficiently long mac header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info() because the mac header only contained the ethernet header. Fix this by including the HSR header in the mac header when generating HSR supervision frames. Note that the mac header now also includes the TLV fields. This matches how we set the headers on rx and also the size of struct hsrv0_ethhdr_sp. Reported-by: Hangbin Liu Closes: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/ Fixes: 9cfb5e7f0ded ("net: hsr: fix hsr_init_sk() vs network/transport headers.") Signed-off-by: Felix Maurer Reviewed-by: Sebastian Andrzej Siewior Tested-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/4354114fea9a642fe71f49aeeb6c6159d1d61840.1762876095.git.fmaurer@redhat.com Tested-by: Hangbin Liu Signed-off-by: Paolo Abeni commit 0a4a18e888ae8c8004582f665c5792c84a681668 Author: Randy Dunlap Date: Tue Nov 11 17:09:20 2025 -0800 drm/client: fix MODULE_PARM_DESC string for "active" The MODULE_PARM_DESC string for the "active" parameter is missing a space and has an extraneous trailing ']' character. Correct these. Before patch: $ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default isfbdev] (string) After patch: $ modinfo -p ./drm_client_lib.ko active:Choose which drm client to start, default is fbdev (string) Fixes: f7b42442c4ac ("drm/log: Introduce a new boot logger to draw the kmsg on the screen") Signed-off-by: Randy Dunlap Reviewed-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251112010920.2355712-1-rdunlap@infradead.org commit 2ccec5944606ee1389abc7ee41986825c6ceb574 Merge: 967a72fa7f6b77 f2a12cc3b97f06 Author: Linus Torvalds Date: Thu Nov 13 05:02:59 2025 -0800 Merge tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Add Chunhai Guo as a EROFS reviewer to get more eyes from interested industry vendors - Fix infinite loop caused by incomplete crafted zstd-compressed data (thanks to Robert again!) * tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: avoid infinite loop due to incomplete zstd-compressed data MAINTAINERS: erofs: add myself as reviewer commit 967a72fa7f6b77eb9f65c7365487662a4d04dbe4 Merge: 6fa9041b7177f6 55286b1e1bf4ce Author: Linus Torvalds Date: Thu Nov 13 04:57:38 2025 -0800 Merge tag 'v6.18-rc5-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix smbdirect (RDMA) disconnect hang bug - Fix potential Denial of Service when connection limit exceeded - Fix smbdirect (RDMA) connection (potentially accessing freed memory) bug * tag 'v6.18-rc5-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let smb_direct_disconnect_rdma_connection() turn CREATED into DISCONNECTED ksmbd: close accepted socket when per-IP limit rejects connection smb: server: rdma: avoid unmapping posted recv on accept failure commit 921b3f59b7b00cd7067ab775b0e0ca4eca436c2f Author: Shawn Lin Date: Wed Nov 12 18:53:18 2025 -0600 PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi This Wi-Fi advertises the L0s and L1 capabilities but actually it doesn't support them. This is confirmed by HiSilicon team in actual productization. Signed-off-by: Shawn Lin Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1762916319-139532-1-git-send-email-shawn.lin@rock-chips.com commit 0eff2eaa5322b5b141ff5d5ded26fac4a52b5f7b Author: Xuan Zhuo Date: Tue Nov 11 17:08:28 2025 +0800 virtio-net: fix incorrect flags recording in big mode The purpose of commit 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") is to record the flags in advance, as their value may be overwritten in the XDP case. However, the flags recorded under big mode are incorrect, because in big mode, the passed buf does not point to the rx buffer, but rather to the page of the submitted buffer. This commit fixes this issue. For the small mode, the commit c11a49d58ad2 ("virtio_net: Fix mismatched buf address when unmapping for small packets") fixed it. Tested-by: Alyssa Ross Fixes: 703eec1b2422 ("virtio_net: fixing XDP for fully checksummed packets handling") Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251111090828.23186-1-xuanzhuo@linux.alibaba.com Signed-off-by: Paolo Abeni commit 6fa9041b7177f6771817b95e83f6df17b147c8c6 Merge: 92385a075a0112 324be6dcbf0913 Author: Linus Torvalds Date: Wed Nov 12 18:41:01 2025 -0800 Merge tag 'nfsd-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Address recently reported issues or issues found at the recent NFS bake-a-thon held in Raleigh, NC. Issues reported with v6.18-rc: - Address a kernel build issue - Reorder SEQUENCE processing to avoid spurious NFS4ERR_SEQ_MISORDERED Issues that need expedient stable backports: - Close a refcount leak exposure - Report support for NFSv4.2 CLONE correctly - Fix oops during COPY_NOTIFY processing - Prevent rare crash after XDR encoding failure - Prevent crash due to confused or malicious NFSv4.1 client" * tag 'nfsd-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: Revert "SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it" nfsd: ensure SEQUENCE replay sends a valid reply. NFSD: Never cache a COMPOUND when the SEQUENCE operation fails NFSD: Skip close replay processing if XDR encoding fails NFSD: free copynotify stateid in nfs4_free_ol_stateid() nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes nfsd: fix refcount leak in nfsd_set_fh_dentry() commit 92385a075a01124100edc581e3b8285268d8591e Merge: e927c520e1ba6b a50f7456f853ec Author: Linus Torvalds Date: Wed Nov 12 18:31:22 2025 -0800 Merge tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - two minor fixes for DMA API infrastructure: restoring proper structure padding used in benchmark tests (Qinxin Xia) and global DMA_BIT_MASK macro rework to make it a bit more clang friendly (James Clark) * tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope dma-mapping: benchmark: Restore padding to ensure uABI remained consistent commit e927c520e1ba6b6a0b2022adf5ba455ee1553fc1 Merge: 89ee862a4dd30c 237e74bfa261fb Author: Linus Torvalds Date: Wed Nov 12 18:21:30 2025 -0800 Merge tag 'loongarch-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - Fix a Rust build error - Fix exception/interrupt, memory management, perf event, hardware breakpoint, kexec and KVM bugs * tag 'loongarch-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix max supported vCPUs set with EIOINTC LoongArch: KVM: Skip PMU checking on vCPU context switch LoongArch: KVM: Restore guest PMU if it is enabled LoongArch: KVM: Add delay until timer interrupt injected LoongArch: KVM: Set page with write attribute if dirty track disabled LoongArch: kexec: Print out debugging message if required LoongArch: kexec: Initialize the kexec_buf structure LoongArch: Use correct accessor to read FWPC/MWPC LoongArch: Refine the init_hw_perf_events() function LoongArch: Remove __GFP_HIGHMEM masking in pud_alloc_one() LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY LoongArch: Consolidate max_pfn & max_low_pfn calculation LoongArch: Consolidate early_ioremap()/ioremap_prot() LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY LoongArch: Clarify 3 MSG interrupt features rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags commit 89ee862a4dd30c3f00e1aedbca5ce0d8bc3c1ddc Merge: 24172e0d799009 d58041d2c63e09 Author: Linus Torvalds Date: Wed Nov 12 18:18:12 2025 -0800 Merge tag 'alpha-fixes-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha fix from Matt Turner: "Add Magnus as a maintainer of the alpha port" * tag 'alpha-fixes-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: MAINTAINERS: Add Magnus Lindholm as maintainer for alpha port commit 823576c894d73255d35c0d0dabbb6ffecf1f2667 Author: Bjorn Helgaas Date: Wed Nov 12 18:36:24 2025 -0600 PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports Christian reported that f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") broke booting on the A-EON AmigaOne X1000. Override the L0s and L1 Support advertised in Link Capabilities by the X1000 Root Ports ([1959:a002]) so we don't try to enable those states. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/a41d2ca1-fcd9-c416-b111-a958e92e94bf@xenosoft.de Signed-off-by: Bjorn Helgaas commit 5b40a5080c39933e7ce28bcb63cd4c1818d6c873 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:28 2025 -0600 PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports Christian reported that f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") broke booting on the A-EON X5000. Override the L0s and L1 Support advertised in Link Capabilities by the X5000 Root Ports ([1957:0451]) so we don't try to enable those states. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/db5c95a1-cf3e-46f9-8045-a1b04908051a@xenosoft.de Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-5-helgaas@kernel.org commit 30579eebba6ae52dc7441479aec9dd8d782256d3 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:27 2025 -0600 PCI/ASPM: Convert quirks to override advertised link states Existing quirks to disable ASPM L0s and L1 use pci_disable_link_state(), which disables ASPM states and prevents their use in the future. But since they are FINAL quirks, they happen after ASPM has already been enabled. Here's a typical call path: pci_host_probe pci_scan_root_bus_bridge pci_scan_child_bus pci_scan_slot pci_scan_single_device pci_device_add pci_fixup_device(pci_fixup_header) # HEADER quirks pcie_aspm_init_link_state pcie_config_aspm_path pcie_config_aspm_link pcie_config_aspm_dev # ASPM may be enabled pci_bus_add_devices pci_bus_add_devices pci_fixup_device(pci_fixup_final) # FINAL quirks quirk_disable_aspm_l0s pci_disable_link_state(dev, PCIE_LINK_STATE_L0S) Sometimes enabling ASPM can make the link non-functional, so if we know ASPM is broken on a device, we shouldn't enable it at all, even temporarily. Convert the existing quirks to use pcie_aspm_remove_cap() instead, which overrides the ASPM Support advertised in PCIe Link Capabilities, and make them HEADER quirks so they run before pcie_aspm_init_link_state() has a chance to enable ASPM. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-4-helgaas@kernel.org commit 575b98e39d817537afdc6c39d35c1de484a64d42 Author: Bjorn Helgaas Date: Mon Nov 10 16:22:26 2025 -0600 PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states Add pcie_aspm_remove_cap(). A quirk can use this to prevent use of ASPM L0s or L1 link states, even if the device advertised support for them. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-3-helgaas@kernel.org commit 4495bffd86ba0fdabfaef0c41d12f68ec2a1e05b Author: Bjorn Helgaas Date: Mon Nov 10 16:22:25 2025 -0600 PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden Defective devices sometimes advertise support for ASPM L0s or L1 states even if they don't work correctly. Cache the L0s Supported and L1 Supported bits early in enumeration so HEADER quirks can override the ASPM states advertised in Link Capabilities before pcie_aspm_cap_init() enables ASPM. Signed-off-by: Bjorn Helgaas Tested-by: Shawn Lin Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251110222929.2140564-2-helgaas@kernel.org commit 360b3730f8eab6c4467c6cca4cb0e30902174a63 Author: Haotian Zhang Date: Wed Nov 12 14:57:09 2025 +0800 ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe() rsnd_ssiu_probe() leaks an OF node reference obtained by rsnd_ssiu_of_node(). The node reference is acquired but never released across all return paths. Fix it by declaring the device node with the __free(device_node) cleanup construct to ensure automatic release when the variable goes out of scope. Fixes: 4e7788fb8018 ("ASoC: rsnd: add SSIU BUSIF support") Signed-off-by: Haotian Zhang Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20251112065709.1522-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 214291cbaaceeb28debd773336642b1fca393ae0 Author: Dave Jiang Date: Wed Nov 5 16:51:15 2025 -0700 acpi/hmat: Fix lockdep warning for hmem_register_resource() The following lockdep splat was observed while kernel auto-online a CXL memory region: ====================================================== WARNING: possible circular locking dependency detected 6.17.0djtest+ #53 Tainted: G W ------------------------------------------------------ systemd-udevd/3334 is trying to acquire lock: ffffffff90346188 (hmem_resource_lock){+.+.}-{4:4}, at: hmem_register_resource+0x31/0x50 but task is already holding lock: ffffffff90338890 ((node_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x2e/0x70 which lock already depends on the new lock. [..] Chain exists of: hmem_resource_lock --> mem_hotplug_lock --> (node_chain).rwsem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock((node_chain).rwsem); lock(mem_hotplug_lock); lock((node_chain).rwsem); lock(hmem_resource_lock); The lock ordering can cause potential deadlock. There are instances where hmem_resource_lock is taken after (node_chain).rwsem, and vice versa. Split out the target update section of hmat_register_target() so that hmat_callback() only envokes that section instead of attempt to register hmem devices that it does not need to. [ dj: Fix up comment to be closer to 80cols. (Jonathan) ] Fixes: cf8741ac57ed ("ACPI: NUMA: HMAT: Register "soft reserved" memory as an "hmem" device") Reviewed-by: Jonathan Cameron Tested-by: Smita Koralahalli Reviewed-by: Smita Koralahalli Reviewed-by: Dan Williams Link: https://patch.msgid.link/20251105235115.85062-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit c55a8e24cd129b6d8fed20e3d63c10c2263e2fc8 Author: Cryolitia PukNgae Date: Thu Oct 30 22:30:06 2025 +0800 hwmon: (gpd-fan) initialize EC on driver load for Win 4 The original implement will re-init the EC when it reports a zero value, and it's a workaround for the black box buggy firmware. Now a contributer test and report that, the bug is that, the firmware won't initialize the EC on boot, so the EC ramains in unusable status. And it won't need to re-init it during runtime. The original implement is not perfect, any write command will be ignored until we first read it. Just re-init it unconditionally when the driver load could work. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Co-developed-by: kylon <3252255+kylon@users.noreply.github.com> Signed-off-by: kylon <3252255+kylon@users.noreply.github.com> Link: https://github.com/Cryolitia/gpd-fan-driver/pull/20 Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20251030-win4-v1-1-c374dcb86985@uniontech.com Signed-off-by: Guenter Roeck commit 9efb297c520f392ab04bc45544a03770c98c3798 Author: Gopi Krishna Menon Date: Sat Oct 25 01:50:40 2025 +0530 hwmon: (gpd-fan) Fix compilation error in non-ACPI builds Building gpd-fan driver without CONFIG_ACPI results in the following build errors: drivers/hwmon/gpd-fan.c: In function ‘gpd_ecram_read’: drivers/hwmon/gpd-fan.c:228:9: error: implicit declaration of function ‘outb’ [-Werror=implicit-function-declaration] 228 | outb(0x2E, addr_port); | ^~~~ drivers/hwmon/gpd-fan.c:241:16: error: implicit declaration of function ‘inb’ [-Werror=implicit-function-declaration] 241 | *val = inb(data_port); The definitions for inb() and outb() come from (specifically through ), which is implicitly included via . When CONFIG_ACPI is not set, is not included resulting in to be omitted as well. Since the driver does not depend on ACPI, remove and add directly to fix the compilation errors. Signed-off-by: Gopi Krishna Menon Link: https://lore.kernel.org/r/20251024202042.752160-1-krishnagopi487@gmail.com Signed-off-by: Guenter Roeck commit c87488a12393a23f8a1b9850b989b386c58cac3f Author: Emil Tsalapatis Date: Wed Nov 12 08:42:02 2025 -1000 sched/ext: convert scx_tasks_lock to raw spinlock Update scx_task_locks so that it's safe to lock/unlock in a non-sleepable context in PREEMPT_RT kernels. scx_task_locks is (non-raw) spinlock used to protect the list of tasks under SCX. This list is updated during from finish_task_switch(), which cannot sleep. Regular spinlocks can be locked in such a context in non-RT kernels, but are sleepable under when CONFIG_PREEMPT_RT=y. Convert scx_task_locks into a raw spinlock, which is not sleepable even on RT kernels. Sample backtrace: dump_stack_lvl+0x83/0xa0 __might_resched+0x14a/0x200 rt_spin_lock+0x61/0x1c0 ? sched_ext_dead+0x2d/0xf0 ? lock_release+0xc6/0x280 sched_ext_dead+0x2d/0xf0 ? srso_alias_return_thunk+0x5/0xfbef5 finish_task_switch.isra.0+0x254/0x360 __schedule+0x584/0x11d0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? tick_nohz_idle_exit+0x7e/0x120 schedule_idle+0x23/0x40 cpu_startup_entry+0x29/0x30 start_secondary+0xf8/0x100 common_startup_64+0x13e/0x148 Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit fe82c4f8a228d3b3ec2462ea2d43fa532a20ac67 Merge: ac1499fcd40fe0 a35f64a216ca1c Author: Jakub Kicinski Date: Wed Nov 12 09:33:09 2025 -0800 Merge tag 'wireless-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple more fixes: - mwl8k: work around FW expecting a DSSS element in beacons - ath11k: report correct TX status - iwlwifi: avoid toggling links due to wrong element use - iwlwifi: fix beacon template rate on older devices - iwlwifi: fix loop iterator being used after loop - mac80211: disallow address changes while using the address - mac80211: avoid bad rate warning in monitor/sniffer mode - hwsim: fix potential NULL deref (on monitor injection) * tag 'wireless-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: mld: always take beacon ies in link grading wifi: iwlwifi: mvm: fix beacon template/fixed rate wifi: iwlwifi: fix aux ROC time event iterator usage wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing wifi: mac80211_hwsim: Fix possible NULL dereference wifi: mac80211: skip rate verification for not captured PSDUs wifi: mac80211: reject address change while connecting wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() ==================== Link: https://patch.msgid.link/20251112114621.15716-5-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 4b747cc628d8f500d56cf1338280eacc66362ff3 Author: Srinivas Pandruvada Date: Mon Nov 10 17:08:40 2025 -0800 cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes Commit ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") introduced a check for feature X86_FEATURE_IDA to verify turbo mode support. Although this is the correct way to check for turbo mode support, it causes issues on some platforms that disable turbo during OS boot, but enable it later [1]. Before adding this feature check, users were able to get turbo mode frequencies by writing 0 to /sys/devices/system/cpu/intel_pstate/no_turbo post-boot. To restore the old behavior on the affected systems while still addressing the unchecked MSR issue on some Skylake-X systems, check X86_FEATURE_IDA only immediately before updates of MSR_IA32_PERF_CTL that may involve setting the Turbo Engage Bit (bit 32). Fixes: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode") Reported-by: Aaron Rainbolt Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2122531 [1] Tested-by: Aaron Rainbolt Signed-off-by: Srinivas Pandruvada [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20251111010840.141490-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5f02151c411dda46efcc5dc57b0845efcdcfc26d Author: Zqiang Date: Wed Nov 12 15:33:28 2025 +0800 sched_ext: Fix unsafe locking in the scx_dump_state() For built with CONFIG_PREEMPT_RT=y kernels, the dump_lock will be converted sleepable spinlock and not disable-irq, so the following scenarios occur: inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. irq_work/0/27 [HC0[0]:SC0[0]:HE1:SE1] takes: (&rq->__lock){?...}-{2:2}, at: raw_spin_rq_lock_nested+0x2b/0x40 {IN-HARDIRQ-W} state was registered at: lock_acquire+0x1e1/0x510 _raw_spin_lock_nested+0x42/0x80 raw_spin_rq_lock_nested+0x2b/0x40 sched_tick+0xae/0x7b0 update_process_times+0x14c/0x1b0 tick_periodic+0x62/0x1f0 tick_handle_periodic+0x48/0xf0 timer_interrupt+0x55/0x80 __handle_irq_event_percpu+0x20a/0x5c0 handle_irq_event_percpu+0x18/0xc0 handle_irq_event+0xb5/0x150 handle_level_irq+0x220/0x460 __common_interrupt+0xa2/0x1e0 common_interrupt+0xb0/0xd0 asm_common_interrupt+0x2b/0x40 _raw_spin_unlock_irqrestore+0x45/0x80 __setup_irq+0xc34/0x1a30 request_threaded_irq+0x214/0x2f0 hpet_time_init+0x3e/0x60 x86_late_time_init+0x5b/0xb0 start_kernel+0x308/0x410 x86_64_start_reservations+0x1c/0x30 x86_64_start_kernel+0x96/0xa0 common_startup_64+0x13e/0x148 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&rq->__lock); lock(&rq->__lock); *** DEADLOCK *** stack backtrace: CPU: 0 UID: 0 PID: 27 Comm: irq_work/0 Call Trace: dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 print_usage_bug+0x42e/0x690 mark_lock.part.44+0x867/0xa70 ? __pfx_mark_lock.part.44+0x10/0x10 ? string_nocheck+0x19c/0x310 ? number+0x739/0x9f0 ? __pfx_string_nocheck+0x10/0x10 ? __pfx_check_pointer+0x10/0x10 ? kvm_sched_clock_read+0x15/0x30 ? sched_clock_noinstr+0xd/0x20 ? local_clock_noinstr+0x1c/0xe0 __lock_acquire+0xc4b/0x62b0 ? __pfx_format_decode+0x10/0x10 ? __pfx_string+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_vsnprintf+0x10/0x10 lock_acquire+0x1e1/0x510 ? raw_spin_rq_lock_nested+0x2b/0x40 ? __pfx_lock_acquire+0x10/0x10 ? dump_line+0x12e/0x270 ? raw_spin_rq_lock_nested+0x20/0x40 _raw_spin_lock_nested+0x42/0x80 ? raw_spin_rq_lock_nested+0x2b/0x40 raw_spin_rq_lock_nested+0x2b/0x40 scx_dump_state+0x3b3/0x1270 ? finish_task_switch+0x27e/0x840 scx_ops_error_irq_workfn+0x67/0x80 irq_work_single+0x113/0x260 irq_work_run_list.part.3+0x44/0x70 run_irq_workd+0x6b/0x90 ? __pfx_run_irq_workd+0x10/0x10 smpboot_thread_fn+0x529/0x870 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x305/0x3f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x40/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 This commit therefore use rq_lock_irqsave/irqrestore() to replace rq_lock/unlock() in the scx_dump_state(). Fixes: 07814a9439a3 ("sched_ext: Print debug dump after an error exit") Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit 2d0e88f3fd1dcb37072d499c36162baf5b009d41 Author: Caleb Sander Mateos Date: Tue Nov 11 12:15:29 2025 -0700 io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs io_buffer_register_bvec() currently uses blk_rq_nr_phys_segments() as the number of bvecs in the request. However, bvecs may be split into multiple segments depending on the queue limits. Thus, the number of segments may overestimate the number of bvecs. For ublk devices, the only current users of io_buffer_register_bvec(), virt_boundary_mask, seg_boundary_mask, max_segments, and max_segment_size can all be set arbitrarily by the ublk server process. Set imu->nr_bvecs based on the number of bvecs the rq_for_each_bvec() loop actually yields. However, continue using blk_rq_nr_phys_segments() as an upper bound on the number of bvecs when allocating imu to avoid needing to iterate the bvecs a second time. Link: https://lore.kernel.org/io-uring/20251111191530.1268875-1-csander@purestorage.com/ Signed-off-by: Caleb Sander Mateos Fixes: 27cb27b6d5ea ("io_uring: add support for kernel registered bvecs") Reviewed-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit d323ad739666761646048fca587734f4ae64f2c8 Author: Alex Mastro Date: Tue Nov 11 10:48:27 2025 -0800 vfio: selftests: replace iova=vaddr with allocated iovas vfio_dma_mapping_test and vfio_pci_driver_test currently use iova=vaddr as part of DMA mapping operations. However, not all IOMMUs support the same virtual address width as the processor. For instance, older Intel consumer platforms only support 39-bits of IOMMU address space. On such platforms, using the virtual address as the IOVA fails. Make the tests more robust by using iova_allocator to vend IOVAs, which queries legally accessible IOVAs from the underlying IOMMUFD or VFIO container. Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-4-7960244642c5@fb.com Signed-off-by: Alex Williamson commit ce0e3c403e00e9e03e80aca6570bf936a44279e2 Author: Alex Mastro Date: Tue Nov 11 10:48:26 2025 -0800 vfio: selftests: add iova allocator Add struct iova_allocator, which gives tests a convenient way to generate legally-accessible IOVAs to map. This allocator traverses the sorted available IOVA ranges linearly, requires power-of-two size allocations, and does not support freeing iova allocations. The assumption is that tests are not IOVA space-bounded, and will not need to recycle IOVAs. This is based on Alex Williamson's patch series for adding an IOVA allocator [1]. [1] https://lore.kernel.org/all/20251108212954.26477-1-alex@shazbot.org/ Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-3-7960244642c5@fb.com Signed-off-by: Alex Williamson commit a77fa0b9222d2f23a764061a3be18e6bc738672e Author: Alex Mastro Date: Tue Nov 11 10:48:25 2025 -0800 vfio: selftests: fix map limit tests to use last available iova Use the newly available vfio_pci_iova_ranges() to determine the last legal IOVA, and use this as the basis for vfio_dma_map_limit_test tests. Fixes: de8d1f2fd5a5 ("vfio: selftests: add end of address space DMA map/unmap tests") Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-2-7960244642c5@fb.com Signed-off-by: Alex Williamson commit 7c44656ab3ea6f8429027ed14c23b314502e2541 Author: Alex Mastro Date: Tue Nov 11 10:48:24 2025 -0800 vfio: selftests: add iova range query helpers VFIO selftests need to map IOVAs from legally accessible ranges, which could vary between hardware. Tests in vfio_dma_mapping_test.c are making excessively strong assumptions about which IOVAs can be mapped. Add vfio_iommu_iova_ranges(), which queries IOVA ranges from the IOMMUFD or VFIO container associated with the device. The queried ranges are normalized to IOMMUFD's iommu_iova_range representation so that handling of IOVA ranges up the stack can be implementation-agnostic. iommu_iova_range and vfio_iova_range are equivalent, so bias to using the new interface's struct. Query IOMMUFD's ranges with IOMMU_IOAS_IOVA_RANGES. Query VFIO container's ranges with VFIO_IOMMU_GET_INFO and VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE. The underlying vfio_iommu_type1_info buffer-related functionality has been kept generic so the same helpers can be used to query other capability chain information, if needed. Reviewed-by: David Matlack Tested-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251111-iova-ranges-v3-1-7960244642c5@fb.com Signed-off-by: Alex Williamson commit ac1499fcd40fe06479e9b933347b837ccabc2a40 Author: Chuang Wang Date: Tue Nov 11 14:43:24 2025 +0800 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random. The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked. CPU 0 CPU 1 __mkroute_output() find_exception() [fnheX] update_or_create_fnhe() fnhe_remove_oldest() [fnheX] rt_bind_exception() [bind dst] RCU callback [fnheX freed, dst leak] This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device: unregister_netdevice: waiting for sitX to become free. Usage count = N Ido Schimmel provided the simple test validation method [1]. The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed. [1] ip netns add ns1 ip -n ns1 link set dev lo up ip -n ns1 address add 192.0.2.1/32 dev lo ip -n ns1 link add name dummy1 up type dummy ip -n ns1 route add 192.0.2.2/32 dev dummy1 ip -n ns1 link add name gretap1 up arp off type gretap \ local 192.0.2.1 remote 192.0.2.2 ip -n ns1 route add 198.51.0.0/16 dev gretap1 taskset -c 0 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & taskset -c 2 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & sleep 10 ip netns pids ns1 | xargs kill ip netns del ns1 Cc: stable@vger.kernel.org Fixes: 67d6d681e15b ("ipv4: make exception cache less predictible") Signed-off-by: Chuang Wang Reviewed-by: Ido Schimmel Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com Signed-off-by: Jakub Kicinski commit f2687d3cc9f905505d7b510c50970176115066a2 Author: Imre Deak Date: Fri Nov 7 14:41:41 2025 +0200 drm/i915/dp_mst: Disable Panel Replay Disable Panel Replay on MST links until it's properly implemented. For instance the required VSC SDP is not programmed on MST and FEC is not enabled if Panel Replay is enabled. Fixes: 3257e55d3ea7 ("drm/i915/panelreplay: enable/disable panel replay") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15174 Cc: Jouni Högander Cc: Animesh Manna Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20251107124141.911895-1-imre.deak@intel.com (cherry picked from commit e109f644b871df8440c886a69cdce971ed533088) Signed-off-by: Rodrigo Vivi commit 1c2e70397b4125022dba80f6111271a37fb36bae Author: Praveen Talari Date: Mon Nov 10 15:40:41 2025 +0530 pinctrl: qcom: msm: Fix deadlock in pinmux configuration Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured. The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock. Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration. Suggested-by: Prasad Sodagudi Signed-off-by: Praveen Talari Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit fa0498f8047536b877819ce4ab154d332b243d43 Author: Marcos Vega Date: Sat Nov 8 12:47:41 2025 +0100 platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile New HP Omen laptops follow the same WMI thermal profile as Victus 16-r1000 and 16-s1000. Add DMI board 8D41 to victus_s_thermal_profile_boards. Signed-off-by: Marcos Vega Link: https://patch.msgid.link/20251108114739.9255-3-marcosmola2@gmail.com [ij: changelog taken partially from v1] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2e558d86e0975fdfb048bd600e253993edc068fe Merge: 23379a17334fc2 523bf0a59e674b Author: Greg Kroah-Hartman Date: Wed Nov 12 06:17:12 2025 -0500 Merge tag 'usb-serial-6.18-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial devices ids for 6.18-rc6 Here are some more modem and ftdi device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add support for Rolling RW101R-GL USB: serial: ftdi_sio: add support for u-blox EVK-M101 commit 85592114ffda568b507bc2b04f5e9afbe7c13b62 Author: Alexandru Elisei Date: Wed Nov 12 10:28:53 2025 +0000 KVM: arm64: VHE: Compute fgt traps before activating them On VHE, the Fine Grain Traps registers are written to hardware in kvm_arch_vcpu_load()->..->__activate_traps_hfgxtr(), but the fgt array is computed later, in kvm_vcpu_load_fgt(). This can lead to zero being written to the FGT registers the first time a VCPU is loaded. Also, any changes to the fgt array will be visible only after the VCPU is scheduled out, and then back in, which is not the intended behaviour. Fix it by computing the fgt array just before the fgt traps are written to hardware. Fixes: fb10ddf35c1c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()") Signed-off-by: Alexandru Elisei Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251112102853.47759-1-alexandru.elisei@arm.com Signed-off-by: Marc Zyngier commit e9d50b78fdfe675b038ddaec7a139dbe3082174c Merge: 3cd1548a278c7d 56325e8c68c072 Author: Christian Brauner Date: Wed Nov 12 10:47:52 2025 +0100 Merge patch series "fs: add iput_not_last()" Add iput_not_last() and switch landlock over to it to remove false-positives from might_sleep() annotations in iput(). Link: https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com * patches from https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com: landlock: fix splats from iput() after it started calling might_sleep() fs: add iput_not_last() Signed-off-by: Christian Brauner commit 56325e8c68c0724d626f665773a5005dcf44e329 Author: Mateusz Guzik Date: Wed Nov 5 22:20:25 2025 +0100 landlock: fix splats from iput() after it started calling might_sleep() At this point it is guaranteed this is not the last reference. However, a recent addition of might_sleep() at top of iput() started generating false-positives as it was executing for all values. Remedy the problem by using the newly introduced iput_not_last(). Reported-by: syzbot+12479ae15958fc3f54ec@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d32659.a70a0220.4f78.0012.GAE@google.com/ Fixes: 2ef435a872ab ("fs: add might_sleep() annotation to iput() and more") Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105212025.807549-2-mjguzik@gmail.com Reviewed-by: Mickaël Salaün Signed-off-by: Christian Brauner commit 12741624645e098b2234a5ae341045a97473caf1 Author: Mateusz Guzik Date: Wed Nov 5 22:20:24 2025 +0100 fs: add iput_not_last() Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3cd1548a278c7d6a9bdef1f1866e7cf66bfd3518 Author: Mike Yuan Date: Sat Nov 8 19:09:47 2025 +0000 shmem: fix tmpfs reconfiguration (remount) when noswap is set In systemd we're trying to switch the internal credentials setup logic to new mount API [1], and I noticed fsconfig(FSCONFIG_CMD_RECONFIGURE) consistently fails on tmpfs with noswap option. This can be trivially reproduced with the following: ``` int fs_fd = fsopen("tmpfs", 0); fsconfig(fs_fd, FSCONFIG_SET_FLAG, "noswap", NULL, 0); fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0); fsmount(fs_fd, 0, 0); fsconfig(fs_fd, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0); <------ EINVAL ``` After some digging the culprit is shmem_reconfigure() rejecting !(ctx->seen & SHMEM_SEEN_NOSWAP) && sbinfo->noswap, which is bogus as ctx->seen serves as a mask for whether certain options are touched at all. On top of that, noswap option doesn't use fsparam_flag_no, hence it's not really possible to "reenable" swap to begin with. Drop the check and redundant SHMEM_SEEN_NOSWAP flag. [1] https://github.com/systemd/systemd/pull/39637 Fixes: 2c6efe9cf2d7 ("shmem: add support to ignore swap") Signed-off-by: Mike Yuan Link: https://patch.msgid.link/20251108190930.440685-1-me@yhndnzj.com Cc: Luis Chamberlain Cc: Christian Brauner Cc: Hugh Dickins Cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 78f0e33cd6c939a555aa80dbed2fec6b333a7660 Author: Andrei Vagin Date: Tue Nov 11 06:28:15 2025 +0000 fs/namespace: correctly handle errors returned by grab_requested_mnt_ns grab_requested_mnt_ns was changed to return error codes on failure, but its callers were not updated to check for error pointers, still checking only for a NULL return value. This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and PTR_ERR() to correctly check for and propagate errors. This also makes sure that the logic actually works and mount namespace file descriptors can be used to refere to mounts. Christian Brauner says: Rework the patch to be more ergonomic and in line with our overall error handling patterns. Fixes: 7b9d14af8777 ("fs: allow mount namespace fd") Cc: Christian Brauner Signed-off-by: Andrei Vagin Link: https://patch.msgid.link/20251111062815.2546189-1-avagin@google.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f6fdd77b3e0d519a2535a1e923558cd07d9acda9 Author: Baojun Xu Date: Wed Nov 12 17:26:09 2025 +0800 ALSA: hda/tas2781: Correct the wrong project ID The project hardware ID should be ALC287_FIXUP_TXNW2781_I2C, not ALC287_FIXUP_TAS2781_I2C for HP Lampass projects. Fixes: 7a39c723b747 ("ALSA: hda/tas2781: Add new quirk for HP new projects") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251112092609.15865-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit a3f8f8662771285511ae26c4c8d3ba1cd22159b9 Author: Christian Brauner Date: Wed Nov 5 14:39:45 2025 +0100 power: always freeze efivarfs The efivarfs filesystems must always be frozen and thawed to resync variable state. Make it so. Link: https://patch.msgid.link/20251105-vorbild-zutreffen-fe00d1dd98db@brauner Signed-off-by: Christian Brauner commit a35f64a216ca1c9e3c3f0f91fdb54ef9515a7fe7 Merge: c4e1ac09ee1c75 1a222625b468ef Author: Johannes Berg Date: Wed Nov 12 09:50:45 2025 +0100 Merge tag 'iwlwifi-fixes-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fixes: - avoid link toggling - fix beacon template rate - don't use iterator outside the loop ==================== Link: https://patch.msgid.link/DM3PPF63A6024A9E52FF4A7B23F283B7FC7A3CCA@DM3PPF63A6024A9.namprd11.prod.outlook.com Signed-off-by: Johannes Berg commit 1a222625b468effd13d1ebb662c36a41c28a835a Author: Miri Korenblit Date: Mon Nov 10 14:57:00 2025 +0200 wifi: iwlwifi: mld: always take beacon ies in link grading One of the factors of a link's grade is the channel load, which is calculated from the AP's bss load element. The current code takes this element from the beacon for an active link, and from bss->ies for an inactive link. bss->ies is set to either the beacon's ies or to the probe response ones, with preference to the probe response (meaning that if there was even one probe response, the ies of it will be stored in bss->ies and won't be overiden by the beacon ies). The probe response can be very old, i.e. from the connection time, where a beacon is updated before each link selection (which is triggered only after a passive scan). In such case, the bss load element in the probe response will not include the channel load caused by the STA, where the beacon will. This will cause the inactive link to always have a lower channel load, and therefore an higher grade than the active link's one. This causes repeated link switches, causing the throughput to drop. Fix this by always taking the ies from the beacon, as those are for sure new. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110145652.b493dbb1853a.I058ba7309c84159f640cc9682d1bda56dd56a536@changeid Signed-off-by: Miri Korenblit commit 3592c0083fb29cca13cd9978b8844d58b4eff548 Author: Johannes Berg Date: Wed Oct 8 11:20:44 2025 +0200 wifi: iwlwifi: mvm: fix beacon template/fixed rate During the development of the rate changes, I evidently made some changes that shouldn't have been there; beacon templates with rate_n_flags are only in old versions, so no changes to them should have been necessary, and evidently broke on some devices. This also would have broken fixed (injection) rates, it would seem. Restore the old handling of this. Fixes: dabc88cb3b78 ("wifi: iwlwifi: handle v3 rates") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220558 Reviewed-by: Benjamin Berg Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20251008112044.3bb8ea849d8d.I90f4d2b2c1f62eaedaf304a61d2ab9e50c491c2d@changeid Signed-off-by: Miri Korenblit commit f4c737d44969c38dac2478039d353edddffd120d Author: Junjie Cao Date: Thu Oct 16 09:49:19 2025 +0800 wifi: iwlwifi: fix aux ROC time event iterator usage The list_for_each_entry() iterator must not be used outside the loop. Even though we break and check for NULL, doing so still violates kernel iteration rules and triggers Coccinelle's use_after_iter.cocci warning. Cache the matched entry in aux_roc_te and use it consistently after the loop. This follows iterator best practices, resolves the warning, and makes the code more maintainable. Signed-off-by: Junjie Cao Link: https://patch.msgid.link/20251016014919.383565-1-junjie.cao@intel.com Signed-off-by: Miri Korenblit commit eac32ff42393efa6657efc821231b8d802c1d485 Author: Harish Kasiviswanathan Date: Tue Oct 28 14:37:07 2025 -0400 drm/amdkfd: Fix GPU mappings for APU after prefetch Fix the following corner case:- Consider a 2M huge page SVM allocation, followed by prefetch call for the first 4K page. The whole range is initially mapped with single PTE. After the prefetch, this range gets split to first page + rest of the pages. Currently, the first page mapping is not updated on MI300A (APU) since page hasn't migrated. However, after range split PTE mapping it not valid. Fix this by forcing page table update for the whole range when prefetch is called. Calling prefetch on APU doesn't improve performance. If all it deteriotes. However, functionality has to be supported. v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout VRAM v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU v4: Remove v2 and v3 changes. Force update_mapping when range is split at a size that is not aligned to prange granularity Suggested-by: Philip Yang Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7) commit d15deafab5d722afb9e2f83c5edcdef9d9d98bd1 Author: Jonathan Kim Date: Thu Nov 6 10:17:06 2025 -0500 drm/amdkfd: relax checks for over allocation of save area Over allocation of save area is not fatal, only under allocation is. ROCm has various components that independently claim authority over save area size. Unless KFD decides to claim single authority, relax size checks. Signed-off-by: Jonathan Kim Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 15bd4958fe38e763bc17b607ba55155254a01f55) Cc: stable@vger.kernel.org commit bbe3c115030da431c9ec843c18d5583e59482dd2 Author: Sathishkumar S Date: Tue Oct 7 13:17:51 2025 +0530 drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1 enable parse_cs callback for JPEG5_0_1. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit 547985579932c1de13f57f8bcf62cd9361b9d3d3) Cc: stable@vger.kernel.org commit 7132f7e025f9382157543dd86a62d161335b48b9 Author: Sultan Alsawaf Date: Fri Nov 7 13:07:13 2025 -0500 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO When the BO pointer provided to amdgpu_bo_create_kernel() points to non-NULL, amdgpu_bo_create_kernel() takes it as a hint to pin that address rather than allocate a new BO. This functionality is never desired for allocating ISP buffers. A new BO should always be created when isp_kernel_buffer_alloc() is called, per the description for isp_kernel_buffer_alloc(). Ensure this by zeroing *bo right before the amdgpu_bo_create_kernel() call. Fixes: 55d42f616976 ("drm/amd/amdgpu: Add helper functions for isp buffers") Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Pratap Nirujogi Signed-off-by: Sultan Alsawaf Signed-off-by: Alex Deucher (cherry picked from commit 73c8c29baac7f0c7e703d92eba009008cbb5228e) commit 33c995709121a3a29d4567a08c943bf7a5b24b78 Author: Ivan Lipski Date: Thu Oct 23 10:03:59 2025 -0400 drm/amd/display: Allow VRR params change if unsynced with the stream [Why] When changing resolution (e.g., 4K → FHD) in mirror/clone mode with certain monitors, the monitor blanks and loses connection due to an early exit in vrr_settings_require_update(). The function only checks if VRR state, fixed refresh target, or min/max refresh rate range has changed. During mode changes, if the calculated min/max refresh values remain the same even though the stream's v_total changed, the function returns early without updating vrr_params.adjust.v_total_min/max, leaving the monitor's VRR timing parameters unsynced with the new mode, causing it to blank out. [How] Explicitly adjust VRR parameters to the stream's nominal v_total when VRR is supported, but inactive. Fixes: 6d31602a9f57 ("drm/amd/display: more liberal vmin/vmax update for freesync") Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 607df8248a011524211ee34850345305a1913f9e) commit 6623c5f9fd877868fba133b4ae4dab0052e82dad Author: Jesse.Zhang Date: Fri Oct 24 16:09:25 2025 +0800 drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process Fix a potential deadlock caused by inconsistent spinlock usage between interrupt and process contexts in the userq fence driver. The issue occurs when amdgpu_userq_fence_driver_process() is called from both: - Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process() - Process context: amdgpu_eviction_fence_suspend_worker() -> amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process() In interrupt context, the spinlock was acquired without disabling interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock is acquired in process context, the kernel detects inconsistent locking since the process context acquisition would enable interrupts while holding a lock previously acquired in interrupt context. Kernel log shows: [ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3}, [ 4039.310993] {IN-HARDIRQ-W} state was registered at: [ 4039.311004] lock_acquire+0xc6/0x300 [ 4039.311018] _raw_spin_lock+0x39/0x80 [ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu] [ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu] [ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu] Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly manage interrupt state regardless of calling context. Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2) Cc: stable@vger.kernel.org commit 9f8fd538e244b87e4556833da51ddd986f50cc81 Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 4 10:42:45 2025 +0100 drm/amdgpu: jump to the correct label on failure drm_sched_entity_init wasn't called yet, so the only thing to do is to release allocated memory. This doesn't fix any bug since entity is zero allocated and drm_sched_entity_fini does nothing in this case. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Acked-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit ec49374ccb8da86b465beaf09c367f3dfd648d8f) commit 22a36e660d014925114feb09a2680bb3c2d1e279 Author: Vitaly Prosyak Date: Thu Nov 6 12:35:53 2025 -0500 drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces Certain multi-GPU configurations (especially GFX12) may hit data corruption when a DCC-compressed VRAM surface is shared across GPUs using peer-to-peer (P2P) DMA transfers. Such surfaces rely on device-local metadata and cannot be safely accessed through a remote GPU’s page tables. Attempting to import a DCC-enabled surface through P2P leads to incorrect rendering or GPU faults. This change disables P2P for DCC-enabled VRAM buffers that are contiguous and allocated on GFX12+ hardware. In these cases, the importer falls back to the standard system-memory path, avoiding invalid access to compressed surfaces. Future work could consider optional migration (VRAM→System→VRAM) if a performance regression is observed when `attach->peer2peer = false`. Tested on: - Dual RX 9700 XT (Navi4x) setup - GNOME and Wayland compositor scenarios - Confirmed no corruption after disabling P2P under these conditions v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS. v3: simplify for upsteam and fix ip version check (Alex) Suggested-by: Christian König Signed-off-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf) Cc: stable@vger.kernel.org commit 0345552a653ce5542affeb69ac5aa52177a5199b Author: Eric Dumazet Date: Sun Nov 9 16:12:15 2025 +0000 net_sched: limit try_bulk_dequeue_skb() batches After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption") I started seeing many qdisc requeues on IDPF under high TX workload. $ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1: qdisc mq 1: root Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114) backlog 1056Kb 6675p requeues 3532840114 qdisc mq 1: root Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653) backlog 781164b 4822p requeues 3537737653 This is caused by try_bulk_dequeue_skb() being only limited by BQL budget. perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script ... netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200 netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500 netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100 netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00 netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300 netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00 netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000 ... This is bad because : 1) Large batches hold one victim cpu for a very long time. 2) Driver often hit their own TX ring limit (all slots are used). 3) We call dev_requeue_skb() 4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to implement FQ or priority scheduling. 5) dequeue_skb() gets packets from q->gso_skb one skb at a time with no xmit_more support. This is causing many spinlock games between the qdisc and the device driver. Requeues were supposed to be very rare, lets keep them this way. Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as __qdisc_run() was designed to use. Fixes: 5772e9a3463b ("qdisc: bulk dequeue support for qdiscs with TCQ_F_ONETXQUEUE") Signed-off-by: Eric Dumazet Reviewed-by: Toke Høiland-Jørgensen Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20251109161215.2574081-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d58041d2c63e09a1c9083e0e9f4151e487c4e16a Author: Magnus Lindholm Date: Tue Nov 4 11:33:43 2025 +0100 MAINTAINERS: Add Magnus Lindholm as maintainer for alpha port Acked-by: John Paul Adrian Glaubitz Acked-by: Matt Turner Signed-off-by: Magnus Lindholm Signed-off-by: Matt Turner commit 7a6fa4f89e8d13b36a6259fd963aecfedf8726ba Merge: 27bcc05b886952 852b644acbce15 Author: Jakub Kicinski Date: Tue Nov 11 17:49:52 2025 -0800 Merge branch 'selftests-mptcp-join-fix-some-flaky-tests' Matthieu Baerts says: ==================== selftests: mptcp: join: fix some flaky tests When looking at the recent CI results on NIPA and MPTCP CIs, a few MPTCP Join tests are marked as unstable. Here are some fixes for that. - Patch 1: a small fix for mptcp_connect.sh, printing a note as initially intended. For >=v5.13. - Patch 2: avoid unexpected reset when closing subflows. For >= 5.13. - Patches 3-4: longer transfer when not waiting for the end. For >=5.18. - Patch 5: read all received data when expecting a reset. For >= v6.1. - Patch 6: a fix to properly kill background tasks. For >= v6.5. ==================== Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-0-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 852b644acbce1529307a4bb283752c4e77b5cda7 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:45 2025 +0100 selftests: mptcp: join: properly kill background tasks The 'run_tests' function is executed in the background, but killing its associated PID would not kill the children tasks running in the background. To properly kill all background tasks, 'kill -- -PID' could be used, but this requires kill from procps-ng. Instead, all children tasks are listed using 'ps', and 'kill' is called with all PIDs of this group. Fixes: 31ee4ad86afd ("selftests: mptcp: join: stop transfer when check is done (part 1)") Cc: stable@vger.kernel.org Fixes: 04b57c9e096a ("selftests: mptcp: join: stop transfer when check is done (part 2)") Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-6-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit ee79980f7a428ec299f6261bea4c1084dcbc9631 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:44 2025 +0100 selftests: mptcp: connect: trunc: read all recv data MPTCP Join "fastclose server" selftest is sometimes failing because the client output file doesn't have the expected size, e.g. 296B instead of 1024B. When looking at a packet trace when this happens, the server sent the expected 1024B in two parts -- 100B, then 924B -- then the MP_FASTCLOSE. It is then strange to see the client only receiving 296B, which would mean it only got a part of the second packet. The problem is then not on the networking side, but rather on the data reception side. When mptcp_connect is launched with '-f -1', it means the connection might stop before having sent everything, because a reset has been received. When this happens, the program was directly stopped. But it is also possible there are still some data to read, simply because the previous 'read' step was done with a buffer smaller than the pending data, see do_rnd_read(). In this case, it is important to read what's left in the kernel buffers before stopping without error like before. SIGPIPE is now ignored, not to quit the app before having read everything. Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-5-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 290493078b96ce2ce3e60f55c23654acb678042a Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:43 2025 +0100 selftests: mptcp: join: userspace: longer transfer In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to make the connection longer. This connection will be killed at the end, after the verifications, so making it longer doesn't change anything, apart from avoid it to end before the end of the verifications To play it safe, all userspace tests not waiting for the end of the transfer are now sharing a longer file (128KB) at slow speed. Fixes: 4369c198e599 ("selftests: mptcp: test userspace pm out of transfer") Cc: stable@vger.kernel.org Fixes: b2e2248f365a ("selftests: mptcp: userspace pm create id 0 subflow") Fixes: e3b47e460b4b ("selftests: mptcp: userspace pm remove initial subflow") Fixes: b9fb176081fb ("selftests: mptcp: userspace pm send RM_ADDR for ID 0") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-4-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 6457595db9870298ee30b6d75287b8548e33fe19 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:42 2025 +0100 selftests: mptcp: join: endpoints: longer transfer In rare cases, when the test environment is very slow, some userspace tests can fail because some expected events have not been seen. Because the tests are expecting a long on-going connection, and they are not waiting for the end of the transfer, it is fine to make the connection longer. This connection will be killed at the end, after the verifications, so making it longer doesn't change anything, apart from avoid it to end before the end of the verifications To play it safe, all endpoints tests not waiting for the end of the transfer are now sharing a longer file (128KB) at slow speed. Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case") Cc: stable@vger.kernel.org Fixes: e274f7154008 ("selftests: mptcp: add subflow limits test-cases") Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-3-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit aea73bae662a0e184393d6d7d0feb18d2577b9b9 Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:41 2025 +0100 selftests: mptcp: join: rm: set backup flag Some of these 'remove' tests rarely fail because a subflow has been reset instead of cleanly removed. This can happen when one extra subflow which has never carried data is being closed (FIN) on one side, while the other is sending data for the first time. To avoid such subflows to be used right at the end, the backup flag has been added. With that, data will be only carried on the initial subflow. Fixes: d2c4333a801c ("selftests: mptcp: add testcases for removing addrs") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-2-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 63c643aa7b7287fdbb0167063785f89ece3f000f Author: Matthieu Baerts (NGI0) Date: Mon Nov 10 19:23:40 2025 +0100 selftests: mptcp: connect: fix fallback note due to OoO The "fallback due to TCP OoO" was never printed because the stat_ooo_now variable was checked twice: once in the parent if-statement, and one in the child one. The second condition was then always true then, and the 'else' branch was never taken. The idea is that when there are more ACK + MP_CAPABLE than expected, the test either fails if there was no out of order packets, or a notice is printed. Fixes: 69ca3d29a755 ("mptcp: update selftest for fallback due to OoO") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251110-net-mptcp-sft-join-unstable-v1-1-a4332c714e10@kernel.org Signed-off-by: Jakub Kicinski commit 27bcc05b886952b52a3f368ffb374e6e55076d15 Merge: bb8336a5163a58 cd8dbd9ef60043 Author: Jakub Kicinski Date: Tue Nov 11 17:43:32 2025 -0800 Merge tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_conn: Fix not cleaning up PA_LINK connections - hci_event: Fix not handling PA Sync Lost event - MGMT: cancel mesh send timer when hdev removed - 6lowpan: reset link-local header on ipv6 recv path - 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - L2CAP: export l2cap_chan_hold for modules - 6lowpan: Don't hold spin lock over sleeping functions - 6lowpan: add missing l2cap_chan_lock() - btusb: reorder cleanup in btusb_disconnect to avoid UAF - btrtl: Avoid loading the config file on security chips * tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btrtl: Avoid loading the config file on security chips Bluetooth: hci_event: Fix not handling PA Sync Lost event Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections Bluetooth: 6lowpan: add missing l2cap_chan_lock() Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions Bluetooth: L2CAP: export l2cap_chan_hold for modules Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Bluetooth: MGMT: cancel mesh send timer when hdev removed ==================== Link: https://patch.msgid.link/20251111141357.1983153-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit bb8336a5163a5839476f27ed1ad69df4a19e13ca Author: Kriish Sharma Date: Mon Nov 10 18:25:45 2025 +0000 ethtool: fix incorrect kernel-doc style comment in ethtool.h Building documentation produced the following warning: WARNING: ./include/linux/ethtool.h:495 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * IEEE 802.3ck/df defines 16 bins for FEC histogram plus one more for This comment was not intended to be parsed as kernel-doc, so replace the '/**' with '/*' to silence the warning and align with normal comment style in header files. No functional changes. Signed-off-by: Kriish Sharma Link: https://patch.msgid.link/20251110182545.2112596-1-kriish.sharma2006@gmail.com Signed-off-by: Jakub Kicinski commit 3aa385a9c75c09b59dcab2ff76423439d23673ab Author: Linus Walleij Date: Mon Nov 3 10:36:18 2025 +0100 iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts: Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4 This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why. Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not. Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit fdf302e6bea1822a9144a0cc2e8e17527e746162 Author: Sami Tolvanen Date: Mon Nov 10 14:19:13 2025 +0100 gendwarfksyms: Skip files with no exports Starting with Rust 1.91.0 (released 2025-10-30), in upstream commit ab91a63d403b ("Ignore intrinsic calls in cross-crate-inlining cost model") [1][2], `bindings.o` stops containing DWARF debug information because the `Default` implementations contained `write_bytes()` calls which are now ignored in that cost model (note that `CLIPPY=1` does not reproduce it). This means `gendwarfksyms` complains: RUSTC L rust/bindings.o error: gendwarfksyms: process_module: dwarf_get_units failed: no debugging information? There are several alternatives that would work here: conditionally skipping in the cases needed (but that is subtle and brittle), forcing DWARF generation with e.g. a dummy `static` (ugly and we may need to do it in several crates), skipping the call to the tool in the Kbuild command when there are no exports (fine) or teaching the tool to do so itself (simple and clean). Thus do the last one: don't attempt to process files if we have no symbol versions to calculate. [ I used the commit log of my patch linked below since it explained the root issue and expanded it a bit more to summarize the alternatives. - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.17.y. Reported-by: Haiyue Wang Closes: https://lore.kernel.org/rust-for-linux/b8c1c73d-bf8b-4bf2-beb1-84ffdcd60547@163.com/ Suggested-by: Miguel Ojeda Link: https://lore.kernel.org/rust-for-linux/CANiq72nKC5r24VHAp9oUPR1HVPqT+=0ab9N0w6GqTF-kJOeiSw@mail.gmail.com/ Link: https://github.com/rust-lang/rust/commit/ab91a63d403b0105cacd72809cd292a72984ed99 [1] Link: https://github.com/rust-lang/rust/pull/145910 [2] Signed-off-by: Sami Tolvanen Tested-by: Haiyue Wang Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251110131913.1789896-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 24172e0d79900908cf5ebf366600616d29c9b417 Merge: 8341374f67f6e6 8e8ae788964aa2 Author: Linus Torvalds Date: Tue Nov 11 10:31:17 2025 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "There's more here than I would ideally like at this stage, but there's been a steady trickle of fixes and some of them took a few rounds of review. The bulk of the changes are fixing some fallout from the recent BBM level two support which allows the linear map to be split from block to page mappings at runtime, but inadvertently led to sleeping in atomic context on some paths where the linear map was already mapped with page granularity. The fix is simply to avoid splitting in those cases but the implementation of that is a little involved. The other interesting fix is addressing a catastophic performance issue with our per-cpu atomics discovered by Paul in the SRCU locking code but which took some interactions with the hardware folks to resolve. Summary: - Avoid sleeping in atomic context when changing linear map permissions for DEBUG_PAGEALLOC or KFENCE - Rework printing of Spectre mitigation status to avoid hardlockup when enabling per-task mitigations on the context-switch path - Reject kernel modules when instruction patching fails either due to the DWARF-based SCS patching or because of an alternatives callback residing outside of the core kernel text - Propagate error when updating kernel memory permissions in kprobes - Drop pointless, incorrect message when enabling the ACPI SPCR console - Use value-returning LSE instructions for per-cpu atomics to reduce latency in SRCU locking routines" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Reject modules with internal alternative callbacks arm64: Fail module loading if dynamic SCS patching fails arm64: proton-pack: Fix hard lockup due to print in scheduler context arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY arm64: mm: Tidy up force_pte_mapping() arm64: mm: Optimize range_split_to_ptes() arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: kprobes: check the return value of set_memory_rox() arm64: acpi: Drop message logging SPCR default console Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" arm64: Use load LSE atomics for the non-return per-CPU atomic operations commit 8341374f67f6e6350de98baaf5b05bca88f4ad81 Merge: 537d196186e0a0 c367af440e03eb Author: Linus Torvalds Date: Tue Nov 11 10:13:17 2025 -0800 Merge tag 'for-6.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix new inode name tracking in tree-log - fix conventional zone and stripe calculations in zoned mode - fix bio reference counts on error paths in relocation and scrub * tag 'for-6.18-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: release root after error in data_reloc_print_warning_inode() btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() btrfs: do not update last_log_commit when logging inode due to a new name btrfs: zoned: fix stripe width calculation btrfs: zoned: fix conventional zone capacity calculation commit 537d196186e0a0ce28e494ca1881885accc35a12 Merge: 4427259cc7f757 b05addf6f0596e Author: Linus Torvalds Date: Tue Nov 11 09:49:56 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "26 hotfixes. 22(!) are cc:stable, 22 are MM. - address some Kexec Handover issues (Pasha Tatashin) - fix handling of large folios which are mapped outside i_size (Kiryl Shutsemau) - fix some DAMON time issues on 32-bit machines (Quanmin Yan) Plus the usual shower of singletons" * tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (26 commits) kho: warn and exit when unpreserved page wasn't preserved kho: fix unpreservation of higher-order vmalloc preservations kho: fix out-of-bounds access of vmalloc chunk MAINTAINERS: add Chris and Kairui as the swap maintainer mm/secretmem: fix use-after-free race in fault handler mm/huge_memory: initialise the tags of the huge zero folio nilfs2: avoid having an active sc_timer before freeing sci scripts/decode_stacktrace.sh: fix build ID and PC source parsing mm/damon/sysfs: change next_update_jiffies to a global variable mm/damon/stat: change last_refresh_jiffies to a global variable maple_tree: fix tracepoint string pointers codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext mm/mremap: honour writable bit in mremap pte batching gcov: add support for GCC 15 mm/mm_init: fix hash table order logging in alloc_large_system_hash() mm/truncate: unmap large folio on split failure mm/memory: do not populate page table entries beyond i_size fs/proc: fix uaf in proc_readdir_de() mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order ksm: use range-walk function to jump over holes in scan_get_next_rmap_item ... commit d93a89684dce949c2ea817b6f07feee9a45241a7 Author: Stefan Metzmacher Date: Mon Nov 10 16:23:52 2025 +0100 smb: client: let smbd_disconnect_rdma_connection() turn CREATED into DISCONNECTED When smbd_disconnect_rdma_connection() turns SMBDIRECT_SOCKET_CREATED into SMBDIRECT_SOCKET_ERROR, we'll have the situation that smbd_disconnect_rdma_work() will set SMBDIRECT_SOCKET_DISCONNECTING and call rdma_disconnect(), which likely fails as we never reached the RDMA_CM_EVENT_ESTABLISHED. it means that wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED) in smbd_destroy() will hang forever in SMBDIRECT_SOCKET_DISCONNECTING never reaching SMBDIRECT_SOCKET_DISCONNECTED. So we directly go from SMBDIRECT_SOCKET_CREATED to SMBDIRECT_SOCKET_DISCONNECTED. Fixes: ffbfc73e84eb ("smb: client: let smbd_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR...") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 Author: Haein Lee Date: Wed Nov 12 00:37:54 2025 +0900 ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this call fails, a fallback routine attempts to obtain the IAD from the next interface and sets a BADD profile. However, snd_usb_mixer_controls_badd() assumes that the IAD retrieved from usb_ifnum_to_if() is always valid, without performing a NULL check. This can lead to a NULL pointer dereference when usb_ifnum_to_if() fails to find the interface descriptor. This patch adds a NULL pointer check after calling usb_ifnum_to_if() in snd_usb_mixer_controls_badd() to prevent the dereference. This issue was discovered by syzkaller, which triggered the bug by sending a crafted USB device descriptor. Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support") Signed-off-by: Haein Lee Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com Signed-off-by: Takashi Iwai commit 739f04f4a46237536aff07ff223c231da53ed8ce Author: Shawn Lin Date: Tue Nov 4 11:51:23 2025 +0800 mmc: dw_mmc-rockchip: Fix wrong internal phase calculate ciu clock is 2 times of io clock, but the sample clk used is derived from io clock provided to the card. So we should use io clock to calculate the phase. Fixes: 59903441f5e4 ("mmc: dw_mmc-rockchip: Add internal phase support") Signed-off-by: Shawn Lin Acked-by: Heiko Stuebner Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 9e805625218b70d865fcee2105dbf835d473c074 Author: Rakuram Eswaran Date: Thu Oct 23 20:24:32 2025 +0530 mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs This patch refactors pxamci_probe() to use devm-managed resource allocation (e.g. devm_dma_request_chan) and dev_err_probe() for improved readability and automatic cleanup on probe failure. It also removes redundant NULL assignments and manual resource release logic from pxamci_probe(), and eliminates the corresponding release calls from pxamci_remove(). Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510041841.pRlunIfl-lkp@intel.com/ Fixes: 58c40f3faf742c ("mmc: pxamci: Use devm_mmc_alloc_host() helper") Suggested-by: Uwe Kleine-König Signed-off-by: Rakuram Eswaran Reviewed-by: Khalid Aziz Acked-by: Uwe Kleine-König Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c42af83c59b65d01c0f7a074e450bbbb43b22f0d Author: Akinobu Mita Date: Tue Nov 11 10:00:10 2025 +0900 memblock: fix memblock_estimated_nr_free_pages() for soft-reserved memory memblock_estimated_nr_free_pages() returns the difference between the total size of the "memory" memblock type and the "reserved" memblock type. The "soft-reserved" memory regions are added to the "reserved" memblock type, but not to the "memory" memblock type. Therefore, memblock_estimated_nr_free_pages() may return a smaller value than expected, or if it underflows, an extremely large value. /proc/sys/kernel/threads-max is determined by the value of memblock_estimated_nr_free_pages(). This issue was discovered on machines with CXL memory because kernel.threads-max was either smaller than expected or extremely large for the installed DRAM size. This fixes the issue by replacing memblock_reserved_size() with memblock_reserved_kern_size() that tells how much memory was reserved from the actual RAM. Suggested-by: Mike Rapoport Signed-off-by: Akinobu Mita Link: https://patch.msgid.link/20251111010010.7800-1-akinobu.mita@gmail.com Signed-off-by: Mike Rapoport (Microsoft) commit ed6612165b74f09db00ef0abaf9831895ab28b7f Author: Yiqi Sun Date: Tue Nov 11 15:05:39 2025 +0800 smb: fix invalid username check in smb3_fs_context_parse_param() Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid. Fix the comparison in if statement. Signed-off-by: Yiqi Sun Signed-off-by: Steve French commit 55286b1e1bf4ce55f61ad2816d4ff8a7861a8cbb Author: Stefan Metzmacher Date: Mon Nov 10 16:24:20 2025 +0100 smb: server: let smb_direct_disconnect_rdma_connection() turn CREATED into DISCONNECTED When smb_direct_disconnect_rdma_connection() turns SMBDIRECT_SOCKET_CREATED into SMBDIRECT_SOCKET_ERROR, we'll have the situation that smb_direct_disconnect_rdma_work() will set SMBDIRECT_SOCKET_DISCONNECTING and call rdma_disconnect(), which likely fails as we never reached the RDMA_CM_EVENT_ESTABLISHED. it means that wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED) in free_transport() will hang forever in SMBDIRECT_SOCKET_DISCONNECTING never reaching SMBDIRECT_SOCKET_DISCONNECTED. So we directly go from SMBDIRECT_SOCKET_CREATED to SMBDIRECT_SOCKET_DISCONNECTED. Fixes: b3fd52a0d85c ("smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR...") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e5eba42f01340f73888dfe560be2806057c25913 Author: Akiva Goldberger Date: Sun Nov 9 11:49:03 2025 +0200 mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, allowing FW to send interrupts to polling-only CQs in certain corner cases. These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception. Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause. This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values. Callers of mlx5_core_create_cq are responsible for changing the completion function and arming the CQ per their needs. Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") Signed-off-by: Akiva Goldberger Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Acked-by: Leon Romanovsky Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb Author: Max Chou Date: Wed Nov 5 20:02:04 2025 +0800 Bluetooth: btrtl: Avoid loading the config file on security chips For chips with security enabled, it's only possible to load firmware with a valid signature pattern. If key_id is not zero, it indicates a security chip, and the driver will not load the config file. - Example log for a security chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 1 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 Bluetooth: hci0: RTL: fw version 0x41c0c905 - Example log for a normal chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 0 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 Bluetooth: hci0: RTL: fw version 0x41c0c905 Tested-by: Hilda Wu Signed-off-by: Nial Ni Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit ed6b5632e0acc247cf483da1ba40201258af46ff Merge: 02e9578c3e47f2 9fcc2b6c10523f Author: Paolo Abeni Date: Tue Nov 11 15:05:45 2025 +0100 Merge branch 'mlx5e-misc-fixes-2025-11-09' Tariq Toukan says: ==================== mlx5e misc fixes 2025-11-09 This patchset provides misc bug fixes from the team to the mlx5 Eth driver. ==================== Link: https://patch.msgid.link/1762681073-1084058-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e Author: Gal Pressman Date: Sun Nov 9 11:37:53 2025 +0200 net/mlx5e: Fix potentially misleading debug message Change the debug message to print the correct units instead of always assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units. Fixes: 5da8bc3effb6 ("net/mlx5e: DCBNL, Add debug messages log") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-6-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e Author: Gal Pressman Date: Sun Nov 9 11:37:52 2025 +0200 net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit a7bf4d5063c7837096aab2853224eb23628514d9 Author: Gal Pressman Date: Sun Nov 9 11:37:51 2025 +0200 net/mlx5e: Fix maxrate wraparound in threshold between units The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps. For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field. Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 2dc768c05217e667f987907a3404926e7ba89ff3 Author: Cosmin Ratiu Date: Sun Nov 9 11:37:50 2025 +0200 net/mlx5e: Trim the length of the num_doorbell error When trying to set num_doorbells to a value greater than the max number of channels, the error message was going over the netlink limit of 80 chars, truncating the most important part of the message, the number of channels. Fix that by trimming the length a bit. Fixes: 11bbcfb7668c ("net/mlx5e: Use the 'num_doorbells' devlink param") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 0bcd5b3b50cc1fcbf775479322cc37c15d35a489 Author: Carolina Jubran Date: Sun Nov 9 11:37:49 2025 +0200 net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() Assign the return value of mlx5_eswitch_block_mode() to 'err' before checking it to avoid returning an uninitialized error code. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510271649.uwsIxD6O-lkp@intel.com/ Closes: http://lore.kernel.org/linux-rdma/aPIEK4rLB586FdDt@stanley.mountain/ Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762681073-1084058-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 02e9578c3e47f2e1b8a12c66b42fe2f287c7f66d Merge: 60e6489f8e3b08 ce50039be49eea Author: Paolo Abeni Date: Tue Nov 11 15:00:10 2025 +0100 Merge branch 'net-sched-initialize-struct-tc_ife-to-fix-kernel-infoleak' Ranganath says: ==================== net: sched: initialize struct tc_ife to fix kernel-infoleak This series addresses the uninitialization of the struct which has 2 bytes of padding. And copying this uninitialized data to userspace can leak info from kernel memory. This series ensures all members and padding are cleared prior to begin copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. v3: https://lore.kernel.org/lkml/20251106195635.2438-1-vnranganath.20@gmail.com/#t v2: https://lore.kernel.org/r/20251101-infoleak-v2-0-01a501d41c09@gmail.com v1: https://lore.kernel.org/r/20251031-infoleak-v1-1-9f7250ee33aa@gmail.com Signed-off-by: Ranganath V N Acked-by: Cong Wang ==================== Link: https://patch.msgid.link/20251109091336.9277-1-vnranganath.20@gmail.com Signed-off-by: Paolo Abeni commit ce50039be49eea9b4cd8873ca6eccded1b4a130a Author: Ranganath V N Date: Sun Nov 9 14:43:36 2025 +0530 net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: ef6980b6becb ("introduce IFE action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni commit 62b656e43eaeae445a39cd8021a4f47065af4389 Author: Ranganath V N Date: Sun Nov 9 14:43:35 2025 +0530 net: sched: act_connmark: initialize struct tc_ife to fix kernel leak In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: 22a5dc0e5e3e ("net: sched: Introduce connmark action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-2-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni commit 281326be67252ac5794d1383f67526606b1d6b13 Author: Niravkumar L Rabara Date: Tue Nov 11 16:13:33 2025 +0800 EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection The current single-bit error injection mechanism flips bits directly in ECC RAM by performing write and read operations. When the ECC RAM is actively used by the Ethernet or USB controller, this approach sometimes trigger a false double-bit error. Switch both Ethernet and USB EDAC devices to use the INTTEST register (altr_edac_a10_device_inject_fops) for single-bit error injection, similar to the existing double-bit error injection method. Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support") Signed-off-by: Niravkumar L Rabara Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com commit 485e0626e58768f3c53ba61ab9e09d6b60a455f4 Author: Luiz Augusto von Dentz Date: Thu Nov 6 13:05:35 2025 -0500 Bluetooth: hci_event: Fix not handling PA Sync Lost event This handles PA Sync Lost event which previously was assumed to be handled with BIG Sync Lost but their lifetime are not the same thus why there are 2 different events to inform when each sync is lost. Fixes: b2a5f2e1c127 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event") Signed-off-by: Luiz Augusto von Dentz commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 Author: Niravkumar L Rabara Date: Tue Nov 11 16:08:01 2025 +0800 EDAC/altera: Handle OCRAM ECC enable after warm reset The OCRAM ECC is always enabled either by the BootROM or by the Secure Device Manager (SDM) during a power-on reset on SoCFPGA. However, during a warm reset, the OCRAM content is retained to preserve data, while the control and status registers are reset to their default values. As a result, ECC must be explicitly re-enabled after a warm reset. Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support") Signed-off-by: Niravkumar L Rabara Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com commit 60e6489f8e3b086bd1130ad4450a2c112e863791 Author: Kuniyuki Iwashima Date: Sun Nov 9 02:52:22 2025 +0000 af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments. Fixes: ad081928a8b0 ("af_unix: Avoid Tarjan's algorithm if unnecessary.") Reported-by: Quang Le Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit 0f559cd91e37b7978e4198ca2fbf7eb95df11361 Author: Marc Zyngier Date: Mon Nov 10 17:30:10 2025 +0000 KVM: arm64: Finalize ID registers only once per VM Owing to the ID registers being global to the VM, there is no point in computing them more than once. However, recent changes making use of kvm_set_vm_id_reg() outlined that we repeatedly hammer the ID registers when we shouldn't. Gate the ID reg update on the VM having never run. Fixes: 50e7cce81b9b2 ("KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip") Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Closes: https://lore.kernel.org/r/aRHf6x5umkTYhYJ3@finisterre.sirena.org.uk Reported-by: Mark Brown Tested-by: Mark Brown Link: https://patch.msgid.link/20251110173010.1918424-1-maz@kernel.org Signed-off-by: Marc Zyngier commit 09782e72eec451fa14d327595f86cdc338ebe53c Author: Aleksander Jan Bajkowski Date: Fri Oct 17 20:01:19 2025 +0200 mips: dts: econet: fix EN751221 core type In fact, it is a multi-threaded MIPS34Kc, not a single-threaded MIPS24Kc. Fixes: 0ec488700972 ("mips: dts: Add EcoNet DTS with EN751221 and SmartFiber XP8421-B board") Signed-off-by: Aleksander Jan Bajkowski Signed-off-by: Thomas Bogendoerfer commit ebd729fef31620e0bf74cbf8a4c7fda73a2a4e7e Author: Maciej W. Rozycki Date: Mon Oct 20 02:11:49 2025 +0100 MIPS: Malta: Fix !EVA SOC-it PCI MMIO Fix a regression that has caused accesses to the PCI MMIO window to complete unclaimed in non-EVA configurations with the SOC-it family of system controllers, preventing PCI devices from working that use MMIO. In the non-EVA case PHYS_OFFSET is set to 0, meaning that PCI_BAR0 is set with an empty mask (and PCI_HEAD4 matches addresses starting from 0 accordingly). Consequently all addresses are matched for incoming DMA accesses from PCI. This seems to confuse the system controller's logic and outgoing bus cycles targeting the PCI MMIO window seem not to make it to the intended devices. This happens as well when a wider mask is used with PCI_BAR0, such as 0x80000000 or 0xe0000000, that makes addresses match that overlap with the PCI MMIO window, which starts at 0x10000000 in our configuration. Set the mask in PCI_BAR0 to 0xf0000000 for non-EVA then, covering the non-EVA maximum 256 MiB of RAM, which is what YAMON does and which used to work correctly up to the offending commit. Set PCI_P2SCMSKL to match PCI_BAR0 as required by the system controller's specification, and match PCI_P2SCMAPL to PCI_HEAD4 for identity mapping. Verified with: Core board type/revision = 0x0d (Core74K) / 0x01 System controller/revision = MIPS SOC-it 101 OCP / 1.3 SDR-FW-4:1 Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x1c Processor ID/revision = 0x97 (MIPS 74Kf) / 0x4c for non-EVA and with: Core board type/revision = 0x0c (CoreFPGA-5) / 0x00 System controller/revision = MIPS ROC-it2 / 0.0 FW-1:1 (CLK_unknown) GIC Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x00 Processor ID/revision = 0xa0 (MIPS interAptiv UP) / 0x20 for EVA/non-EVA, fixing: defxx 0000:00:12.0: assign IRQ: got 10 defxx: v1.12 2021/03/10 Lawrence V. Stefani and others 0000:00:12.0: Could not read adapter factory MAC address! vs: defxx 0000:00:12.0: assign IRQ: got 10 defxx: v1.12 2021/03/10 Lawrence V. Stefani and others 0000:00:12.0: DEFPA at MMIO addr = 0x10142000, IRQ = 10, Hardware addr = 00-00-f8-xx-xx-xx 0000:00:12.0: registered as fddi0 for non-EVA and causing no change for EVA. Signed-off-by: Maciej W. Rozycki Fixes: 422dd256642b ("MIPS: Malta: Allow PCI devices DMA to lower 2GB physical") Cc: stable@vger.kernel.org # v4.9+ Signed-off-by: Thomas Bogendoerfer commit c4e1ac09ee1c750890e36cb1f841f25518f23589 Author: Pawel Dembicki Date: Tue Nov 11 11:07:29 2025 +0100 wifi: mwl8k: inject DSSS Parameter Set element into beacons if missing Some Marvell AP firmware used with mwl8k misbehaves when beacon frames do not contain a WLAN_EID_DS_PARAMS element with the current channel. It was reported on OpenWrt Github issues [0]. When hostapd/mac80211 omits DSSS Parameter Set from the beacon (which is valid on some bands), the firmware stops transmitting sane frames and RX status starts reporting bogus channel information. This makes AP mode unusable. Newer Marvell drivers (mwlwifi [1]) hard-code DSSS Parameter Set into AP beacons for all chips, which suggests this is a firmware requirement rather than a mwl8k-specific quirk. Mirror that behaviour in mwl8k: when setting the beacon, check if WLAN_EID_DS_PARAMS is present, and if not, extend the beacon and inject a DSSS Parameter Set element, using the current channel from hw->conf.chandef.chan. Tested on Linksys EA4500 (88W8366). [0] https://github.com/openwrt/openwrt/issues/19088 [1] https://github.com/kaloz/mwlwifi/blob/db97edf20fadea2617805006f5230665fadc6a8c/hif/fwcmd.c#L675 Fixes: b64fe619e371 ("mwl8k: basic AP interface support") Tested-by: Antony Kolitsos Signed-off-by: Pawel Dembicki Link: https://patch.msgid.link/20251111100733.2825970-3-paweldembicki@gmail.com Signed-off-by: Johannes Berg commit 1b03346314b791ad966d3c6d59253328226a2b2d Author: Maarten Zanders Date: Fri Oct 24 16:21:06 2025 +0200 ARM: dts: nxp: imx6ul: correct SAI3 interrupt line The i.MX6UL reference manual lists two possible interrupt lines for SAI3 (56 and 57, offset +32). The current device tree entry uses the first one (24), which prevents IRQs from being handled properly. Use the second interrupt line (25), which does allow interrupts to work as expected. Fixes: 36e2edf6ac07 ("ARM: dts: imx6ul: add sai support") Signed-off-by: Maarten Zanders Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit eaa7ce66c3e2ccda035022b5e8af09caabecd635 Author: Ilan Peer Date: Mon Nov 10 14:01:54 2025 +0200 wifi: mac80211_hwsim: Fix possible NULL dereference The 'vif' pointer in the Tx information might be NULL, e.g., in case of injected frames etc. and is not checked in all paths. Fix it. While at it, also directly use the local 'vif' pointer. Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Ilan Peer Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aNJUlyIiSTW9zZdr@stanley.mountain Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110140128.ec00ae795a32.I9c65659b52434189d8b2ba06710d482669a3887a@changeid Signed-off-by: Johannes Berg commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 Author: Benjamin Berg Date: Mon Nov 10 14:26:18 2025 +0200 wifi: mac80211: skip rate verification for not captured PSDUs If for example the sniffer did not follow any AIDs in an MU frame, then some of the information may not be filled in or is even expected to be invalid. As an example, in that case it is expected that Nss is zero. Fixes: 2ff5e52e7836 ("radiotap: add 0-length PSDU "not captured" type") Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110142554.83a2858ee15b.I9f78ce7984872f474722f9278691ae16378f0a3e@changeid Signed-off-by: Johannes Berg commit 2027e3bcbf00e24560bc9d2a14f62b49364a9236 Merge: a9da90e618cd06 9065b968752334 Author: Johannes Berg Date: Tue Nov 11 09:18:06 2025 +0100 Merge tag 'ath-current-20251110' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc6 Fix an ath11k transmit status reporting issue. This issue has always been present, but not reported until recently. Bringing this through the current release since there is now a userspace entity that wants to leverage this. ================== Signed-off-by: Johannes Berg commit 5b6677d6451bbbac3b6ab93fae6506b59e2c19bd Author: Frank Li Date: Wed Oct 22 12:50:22 2025 -0400 arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos Swap interrupt numbers of eqos because the below commit just swap interrupt-names and missed swap interrupts also. The driver (drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c) use interrupt-names to get irq numbers. Fixes: f29c19a6e488 ("arm64: dts: imx8dxl-ss-conn: Fix Ethernet interrupt-names order") Signed-off-by: Frank Li Tested-by: Alexander Dahl Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit f10a788e4b6a0ebe8629177894ca779b2dc6203d Author: Frank Li Date: Wed Oct 22 12:50:21 2025 -0400 arm64: dts: imx8dxl: Correct pcie-ep interrupt number Correct i.MX8DXL's pcie-ep interrupt number. Fixes: d03743c5659a9 ("arm64: dts: imx8q: add PCIe EP for i.MX8QM and i.MX8QXP") Signed-off-by: Frank Li Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo commit 8c0726e861f3920bac958d76cf134b5a3aa14ce4 Merge: e6ca8f533ed411 236682db3b6fe7 Author: Jakub Kicinski Date: Mon Nov 10 18:34:46 2025 -0800 Merge branch 'net-netpoll-fix-memory-leak-and-add-comprehensive-selftests' Breno Leitao says: ==================== net: netpoll: fix memory leak and add comprehensive selftests Fix a memory leak in netpoll and introduce netconsole selftests that expose the issue when running with kmemleak detection enabled. This patchset includes a selftest for netpoll with multiple concurrent users (netconsole + bonding), which simulates the scenario from test[1] that originally demonstrated the issue allegedly fixed by commit efa95b01da18 ("netpoll: fix use after free") - a commit that is now being reverted. Sending this to "net" branch because this is a fix, and the selftest might help with the backports validation. Link: https://lore.kernel.org/lkml/96b940137a50e5c387687bb4f57de8b0435a653f.1404857349.git.decot@googlers.com/ [1] ==================== Link: https://patch.msgid.link/20251107-netconsole_torture-v10-0-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 236682db3b6fe71cad76ac5e920ea4c14a33178e Author: Breno Leitao Date: Fri Nov 7 06:03:40 2025 -0800 selftest: netcons: add test for netconsole over bonded interfaces This patch adds a selftest that verifies netconsole functionality over bonded network interfaces using netdevsim. It sets up two bonded interfaces acting as transmit (TX) and receive (RX) ends, placed in separate network namespaces. The test sends kernel log messages and verifies that they are properly received on the bonded RX interfaces with both IPv4 and IPv6, and using basic and extended netconsole formats. This patchset aims to test a long-standing netpoll subsystem where netpoll has multiple users. (in this case netconsole and bonding). A similar selftest has been discussed in [1] and [2]. This test also tries to enable bonding and netpoll in different order, just to guarantee that all the possibilities are exercised. Link: https://lore.kernel.org/all/20250905-netconsole_torture-v3-0-875c7febd316@debian.org/ [1] Link: https://lore.kernel.org/lkml/96b940137a50e5c387687bb4f57de8b0435a653f.1404857349.git.decot@googlers.com/ [2] Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-4-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 6701896eb90998ff16338f199144bd9deefb79ba Author: Breno Leitao Date: Fri Nov 7 06:03:39 2025 -0800 selftest: netcons: create a torture test Create a netconsole test that puts a lot of pressure on the netconsole list manipulation. Do it by creating dynamic targets and deleting targets while messages are being sent. Also put interface down while the messages are being sent, as creating parallel targets. The code launches three background jobs on distinct schedules: * Toggle netcons target every 30 iterations * create and delete random_target every 50 iterations * toggle iface every 70 iterations This creates multiple concurrency sources that interact with netconsole states. This is good practice to simulate stress, and exercise netpoll and netconsole locks. This test already found an issue as reported in [1] Link: https://lore.kernel.org/all/20250901-netpoll_memleak-v1-1-34a181977dfc@debian.org/ [1] Signed-off-by: Breno Leitao Reviewed-by: Andre Carvalho Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-3-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 39acc6a95eefcf814efa226d8813f89e7e03496e Author: Breno Leitao Date: Fri Nov 7 06:03:38 2025 -0800 selftest: netcons: refactor target creation Extract the netconsole target creation from create_dynamic_target(), by moving it from create_dynamic_target() into a new helper function. This enables other tests to use the creation of netconsole targets with arbitrary parameters and no sleep. The new helper will be utilized by forthcoming torture-type selftests that require dynamic target management. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-2-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit 49c8d2c1f94cc2f4d1a108530d7ba52614b874c2 Author: Breno Leitao Date: Fri Nov 7 06:03:37 2025 -0800 net: netpoll: fix incorrect refcount handling causing incorrect cleanup commit efa95b01da18 ("netpoll: fix use after free") incorrectly ignored the refcount and prematurely set dev->npinfo to NULL during netpoll cleanup, leading to improper behavior and memory leaks. Scenario causing lack of proper cleanup: 1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is allocated, and refcnt = 1 - Keep in mind that npinfo is shared among all netpoll instances. In this case, there is just one. 2) Another netpoll is also associated with the same NIC and npinfo->refcnt += 1. - Now dev->npinfo->refcnt = 2; - There is just one npinfo associated to the netdev. 3) When the first netpolls goes to clean up: - The first cleanup succeeds and clears np->dev->npinfo, ignoring refcnt. - It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);` - Set dev->npinfo = NULL, without proper cleanup - No ->ndo_netpoll_cleanup() is either called 4) Now the second target tries to clean up - The second cleanup fails because np->dev->npinfo is already NULL. * In this case, ops->ndo_netpoll_cleanup() was never called, and the skb pool is not cleaned as well (for the second netpoll instance) - This leaks npinfo and skbpool skbs, which is clearly reported by kmemleak. Revert commit efa95b01da18 ("netpoll: fix use after free") and adds clarifying comments emphasizing that npinfo cleanup should only happen once the refcount reaches zero, ensuring stable and correct netpoll behavior. Cc: # 3.17.x Cc: Jay Vosburgh Fixes: efa95b01da18 ("netpoll: fix use after free") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107-netconsole_torture-v10-1-749227b55f63@debian.org Signed-off-by: Jakub Kicinski commit e6ca8f533ed41129fcf052297718f417f021cc7d Author: Buday Csaba Date: Sat Nov 8 07:49:22 2025 +0100 net: mdio: fix resource leak in mdiobus_register_device() Fix a possible leak in mdiobus_register_device() when both a reset-gpio and a reset-controller are present. Clean up the already claimed reset-gpio, when the registration of the reset-controller fails, so when an error code is returned, the device retains its state before the registration attempt. Link: https://lore.kernel.org/all/20251106144603.39053c81@kernel.org/ Fixes: 71dd6c0dff51 ("net: phy: add support for reset-controller") Signed-off-by: Buday Csaba Link: https://patch.msgid.link/4b419377f8dd7d2f63f919d0f74a336c734f8fff.1762584481.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 0725e6afb55128be21a2ca36e9674f573ccec173 Author: Kuniyuki Iwashima Date: Fri Nov 7 06:40:25 2025 +0000 tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6088: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kfree+0x195/0x550 mm/slub.c:4894 tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166 unregister_netdevice_many net/core/dev.c:12229 [inline] unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073 unregister_netdevice include/linux/netdevice.h:3385 [inline] __tun_detach+0xe4d/0x1620 drivers/net/tun.c:621 tun_detach drivers/net/tun.c:637 [inline] tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433 __fput+0x458/0xa80 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated") Reported-by: syzbot+d7dad7fd4b3921104957@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690c323a.050a0220.baf87.007f.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251107064038.2361188-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 142b02cc48dff2c0a33b1fa509902f3dc3d181b2 Merge: 3072f00bba7640 d4b00d132d7cb7 Author: Jakub Kicinski Date: Mon Nov 10 18:00:44 2025 -0800 Merge branch 'fix-iet-verification-implementation-for-cpsw-driver' Aksh Garg says: ==================== Fix IET verification implementation for CPSW driver The CPSW module supports Intersperse Express Traffic (IET) and allows the MAC layer to verify whether the peer supports IET through its MAC merge sublayer, by sending a verification packet and waiting for its response until the timeout. As defined in IEEE 802.3 Clause 99, the verification process involves up to 3 verification attempts to establish support. This patch series fixes issues in the implementation of this IET verification process. ==================== Link: https://patch.msgid.link/20251106092305.1437347-1-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit d4b00d132d7cb70a74bc039c91c1d6120943c71b Author: Aksh Garg Date: Thu Nov 6 14:53:05 2025 +0530 net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism The am65_cpsw_iet_verify_wait() function attempts verification 20 times, toggling the AM65_CPSW_PN_IET_MAC_LINKFAIL bit in each iteration. When the LINKFAIL bit transitions from 1 to 0, the MAC merge layer initiates the verification process and waits for the timeout configured in MAC_VERIFY_CNT before automatically retransmitting. The MAC_VERIFY_CNT register is configured according to the user-defined verify/response timeout in am65_cpsw_iet_set_verify_timeout_count(). As per IEEE 802.3 Clause 99, the hardware performs this automatic retry up to 3 times. Current implementation toggles LINKFAIL after the user-configured verify/response timeout in each iteration, forcing the hardware to restart verification instead of respecting the MAC_VERIFY_CNT timeout. This bypasses the hardware's automatic retry mechanism. Fix this by moving the LINKFAIL bit toggle outside the retry loop and reducing the retry count from 20 to 3. The software now only monitors the status register while the hardware autonomously handles the 3 verification attempts at proper MAC_VERIFY_CNT intervals. Fixes: 49a2eb9068246 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support") Signed-off-by: Aksh Garg Link: https://patch.msgid.link/20251106092305.1437347-3-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit 49b3916465176a5abcb29a0e464825f553d55d58 Author: Aksh Garg Date: Thu Nov 6 14:53:04 2025 +0530 net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout The CPSW module uses the MAC_VERIFY_CNT bit field in the CPSW_PN_IET_VERIFY_REG_k register to set the verify/response timeout count. This register specifies the number of clock cycles to wait before resending a verify packet if the verification fails. The verify/response timeout count, as being set by the function am65_cpsw_iet_set_verify_timeout_count() is hardcoded for 125MHz clock frequency, which varies based on PHY mode and link speed. The respective clock frequencies are as follows: - RGMII mode: * 1000 Mbps: 125 MHz * 100 Mbps: 25 MHz * 10 Mbps: 2.5 MHz - QSGMII/SGMII mode: 125 MHz (all speeds) Fix this by adding logic to calculate the correct timeout counts based on the actual PHY interface mode and link speed. Fixes: 49a2eb9068246 ("net: ethernet: ti: am65-cpsw-qos: Add Frame Preemption MAC Merge support") Signed-off-by: Aksh Garg Link: https://patch.msgid.link/20251106092305.1437347-2-a-garg7@ti.com Signed-off-by: Jakub Kicinski commit 3072f00bba764082fa41b3c3a2a7b013335353d2 Author: Zilin Guan Date: Thu Nov 6 14:45:11 2025 +0000 net/handshake: Fix memory leak in tls_handshake_accept() In tls_handshake_accept(), a netlink message is allocated using genlmsg_new(). In the error handling path, genlmsg_cancel() is called to cancel the message construction, but the message itself is not freed. This leads to a memory leak. Fix this by calling nlmsg_free() in the error path after genlmsg_cancel() to release the allocated memory. Fixes: 2fd5532044a89 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake") Signed-off-by: Zilin Guan Reviewed-by: Chuck Lever Link: https://patch.msgid.link/20251106144511.3859535-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 Author: D. Wythe Date: Fri Nov 7 10:40:29 2025 +0800 net/smc: fix mismatch between CLC header and proposal The current CLC proposal message construction uses a mix of `ini->smc_type_v1/v2` and `pclc_base->hdr.typev1/v2` to decide whether to include optional extensions (IPv6 prefix extension for v1, and v2 extension). This leads to a critical inconsistency: when `smc_clc_prfx_set()` fails - for example, in IPv6-only environments with only link-local addresses, or when the local IP address and the outgoing interface’s network address are not in the same subnet. As a result, the proposal message is assembled using the stale `ini->smc_type_v1` value—causing the IPv6 prefix extension to be included even though the header indicates v1 is not supported. The peer then receives a malformed CLC proposal where the header type does not match the payload, and immediately resets the connection. The fix ensures consistency between the CLC header flags and the actual payload by synchronizing `ini->smc_type_v1` with `pclc_base->hdr.typev1` when prefix setup fails. Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal") Signed-off-by: D. Wythe Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/20251107024029.88753-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 2554559aba883803475e4ca4fae22eaad6d33d86 Author: Nicolas Dichtel Date: Thu Nov 6 19:02:52 2025 +0100 bonding: fix mii_status when slave is down netif_carrier_ok() doesn't check if the slave is up. Before the below commit, netif_running() was also checked. Fixes: 23a6037ce76c ("bonding: Remove support for use_carrier") Signed-off-by: Nicolas Dichtel Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251106180252.3974772-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit 41d0c31be29fdee2535028ce70a6661e3a67bb25 Author: Zahari Doychev Date: Thu Nov 6 16:15:28 2025 +0100 tools: ynl: call nested attribute free function for indexed arrays When freeing indexed arrays, the corresponding free function should be called for each entry of the indexed array. For example, for for 'struct tc_act_attrs' 'tc_act_attrs_free(...)' needs to be called for each entry. Previously, memory leaks were reported when enabling the ASAN analyzer. ================================================================= ==874==ERROR: LeakSanitizer: detected memory leaks Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db048af in tc_act_attrs_set_options_vlan_parms ../generated/tc-user.h:2813 #2 0x55c98db048af in main ./linux/tools/net/ynl/samples/tc-filter-add.c:71 Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db04a93 in tc_act_attrs_set_options_vlan_parms ../generated/tc-user.h:2813 #2 0x55c98db04a93 in main ./linux/tools/net/ynl/samples/tc-filter-add.c:74 Direct leak of 10 byte(s) in 2 object(s) allocated from: #0 0x7f221fd20cb5 in malloc ./debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67 #1 0x55c98db0527d in tc_act_attrs_set_kind ../generated/tc-user.h:1622 SUMMARY: AddressSanitizer: 58 byte(s) leaked in 4 allocation(s). The following diff illustrates the changes introduced compared to the previous version of the code. void tc_flower_attrs_free(struct tc_flower_attrs *obj) { + unsigned int i; + free(obj->indev); + for (i = 0; i < obj->_count.act; i++) + tc_act_attrs_free(&obj->act[i]); free(obj->act); free(obj->key_eth_dst); free(obj->key_eth_dst_mask); Signed-off-by: Zahari Doychev Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20251106151529.453026-3-zahari.doychev@linux.com Signed-off-by: Jakub Kicinski commit 762e7e174da91cf4babfe77e45bc6b67334b1503 Author: Jonas Gorski Date: Sun Nov 9 14:46:35 2025 +0100 net: dsa: tag_brcm: do not mark link local traffic as offloaded Broadcom switches locally terminate link local traffic and do not forward it, so we should not mark it as offloaded. In some situations we still want/need to flood this traffic, e.g. if STP is disabled, or it is explicitly enabled via the group_fwd_mask. But if the skb is marked as offloaded, the kernel will assume this was already done in hardware, and the packets never reach other bridge ports. So ensure that link local traffic is never marked as offloaded, so that the kernel can forward/flood these packets in software if needed. Since the local termination in not configurable, check the destination MAC, and never mark packets as offloaded if it is a link local ether address. While modern switches set the tag reason code to BRCM_EG_RC_PROT_TERM for trapped link local traffic, they also set it for link local traffic that is flooded (01:80:c2:00:00:10 to 01:80:c2:00:00:2f), so we cannot use it and need to look at the destination address for them as well. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Fixes: 0e62f543bed0 ("net: dsa: Fix duplicate frames flooded by learning") Signed-off-by: Jonas Gorski Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251109134635.243951-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit dd4adb986a86727ed8f56c48b6d0695f1e211e65 Author: Steven Rostedt Date: Tue Oct 28 12:27:24 2025 -0400 selftests/tracing: Run sample events to clear page cache events The tracing selftest "event-filter-function.tc" was failing because it first runs the "sample_events" function that triggers the kmem_cache_free event and it looks at what function was used during a call to "ls". But the first time it calls this, it could trigger events that are used to pull pages into the page cache. The rest of the test uses the function it finds during that call to see if it will be called in subsequent "sample_events" calls. But if there's no need to pull pages into the page cache, it will not trigger that function and the test will fail. Call the "sample_events" twice to trigger all the page cache work before it calls it to find a function to use in subsequent checks. Cc: stable@vger.kernel.org Fixes: eb50d0f250e96 ("selftests/ftrace: Choose target function for filter test from samples") Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Shuah Khan commit 60260ad935861f6b8db7c65c23faa41c98d8fb15 Author: Victor Nogueira Date: Thu Nov 6 17:56:21 2025 -0300 selftests/tc-testing: Create tests trying to add children to clsact/ingress qdiscs In response to Wang's bug report [1], add the following test cases: - Try and fail to add an fq child to an ingress qdisc - Try and fail to add an fq child to a clsact qdisc [1] https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Reviewed-by: Pedro Tammela Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Cong Wang Link: https://patch.msgid.link/20251106205621.3307639-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit e781122d76f018ad17752ab1018b3ffbf7fad84e Author: Victor Nogueira Date: Thu Nov 6 17:56:20 2025 -0300 net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc Wang reported an illegal configuration [1] where the user attempts to add a child qdisc to the ingress qdisc as follows: tc qdisc add dev eth0 handle ffff:0 ingress tc qdisc add dev eth0 handle ffe0:0 parent ffff:a fq To solve this, we reject any configuration attempt to add a child qdisc to ingress or clsact. [1] https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: Wang Liang Closes: https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.com/ Reviewed-by: Pedro Tammela Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Cong Wang Link: https://patch.msgid.link/20251106205621.3307639-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa Author: Eric Dumazet Date: Thu Nov 6 11:10:54 2025 +0000 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline] Fixes: b58537a1f562 ("net: sctp: fix permissions for rto_alpha and rto_beta knobs") Reported-by: syzbot+f8c46c8b2b7f6e076e99@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690c81ae.050a0220.3d0d33.014e.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Daniel Borkmann Acked-by: Xin Long Link: https://patch.msgid.link/20251106111054.3288127-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4427259cc7f7571a157fbc9b5011e1ef6fe0a4a8 Merge: 4ea7c1717f3f23 dc20452e6caf96 Author: Linus Torvalds Date: Mon Nov 10 15:35:45 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - fix broken clang build on versions earlier than 19 and binutils versions earlier than 2.38. (This exposed that we're not properly testing earlier toolchain versions in our linux-next builds and PR submissions. This was fixed for this PR, and is being addressed more generally for -next builds.) - remove some redundant Makefile code - avoid building Canaan Kendryte K210-specific code on targets that don't build for the K210 * tag 'riscv-for-linus-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix CONFIG_AS_HAS_INSN for new .insn usage riscv: Remove redundant judgment for the default build target riscv: Build loader.bin exclusively for Canaan K210 commit 6a77267d97b5b6cd0e35099ab4eb054e5f965ee6 Author: Pavel Begunkov Date: Mon Nov 10 13:03:53 2025 +0000 io_uring/query: return number of available queries It's useful to know which query opcodes are available. Extend the structure and return that. It's a trivial change, and even though it can be painlessly extended later, it'd still require adding a v2 of the structure. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d3c9c213c0b86ac5dd8fe2c53c24db20f1f510bc Author: Jens Axboe Date: Mon Nov 10 14:30:41 2025 -0700 io_uring/rw: ensure allocated iovec gets cleared for early failure A previous commit reused the recyling infrastructure for early cleanup, but this is not enough for the case where our internal caches have overflowed. If this happens, then the allocated iovec can get leaked if the request is also aborted early. Reinstate the previous forced free of the iovec for that situation. Cc: stable@vger.kernel.org Reported-by: syzbot+3c93637d7648c24e1fd0@syzkaller.appspotmail.com Tested-by: syzbot+3c93637d7648c24e1fd0@syzkaller.appspotmail.com Fixes: 9ac273ae3dc2 ("io_uring/rw: use io_rw_recycle() from cleanup path") Link: https://lore.kernel.org/io-uring/69122a59.a70a0220.22f260.00fd.GAE@google.com/ Signed-off-by: Jens Axboe commit b623390045a81fc559decb9bfeb79319721d3dfb Author: Dai Ngo Date: Sun Nov 9 09:05:08 2025 -0800 NFS: Fix LTP test failures when timestamps are delegated The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID. The problem can be reproduced as follow: # echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06 This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode. This patch adds the UID check and if it does not match then the request is sent to the server for permission checking. Fixes: e12912d94137 ("NFSv4: Add support for delegated atime and mtime attributes") Signed-off-by: Dai Ngo Signed-off-by: Anna Schumaker commit 41bf23338a501e745c398e0faee948dd05d0be98 Author: Luiz Augusto von Dentz Date: Tue Nov 4 17:02:04 2025 -0500 Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does in fact needs to run bis_cleanup in order to terminate the PA Sync, since that is bond to the listening socket which is the entity that controls the lifetime of PA Sync, so if it is closed/released the PA Sync shall be terminated, terminating the PA Sync shall not result in the BIG Sync being terminated since once the later is established it doesn't depend on the former anymore. If the use user wants to reconnect/rebind a number of BIS(s) it shall keep the socket open until it no longer needs the PA Sync, which means it retains full control of the lifetime of both PA and BIG Syncs. Fixes: d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit 15f32cabf426143ec1d2c8faf2bbca40c0fbd61b Author: Pauli Virtanen Date: Mon Nov 3 20:29:50 2025 +0200 Bluetooth: 6lowpan: add missing l2cap_chan_lock() l2cap_chan_close() needs to be called in l2cap_chan_lock(), otherwise l2cap_le_sig_cmd() etc. may run concurrently. Add missing locks around l2cap_chan_close(). Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 98454bc812f3611551e4b1f81732da4aa7b9597e Author: Pauli Virtanen Date: Mon Nov 3 20:29:49 2025 +0200 Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions disconnect_all_peers() calls sleeping function (l2cap_chan_close) under spinlock. Holding the lock doesn't actually do any good -- we work on a local copy of the list, and the lock doesn't protect against peer->chan having already been freed. Fix by taking refcounts of peer->chan instead. Clean up the code and old comments a bit. Take devices_lock instead of RCU, because the kfree_rcu(); l2cap_chan_put(); construct in chan_close_cb() does not guarantee peer->chan is necessarily valid in RCU. Also take l2cap_chan_lock() which is required for l2cap_chan_close(). Log: (bluez 6lowpan-tester Client Connect - Disable) ------ BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 ... ... l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495) ... ? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809) do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068) ------ Fixes: 90305829635d ("Bluetooth: 6lowpan: Converting rwlocks to use RCU") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c Author: Pauli Virtanen Date: Mon Nov 3 20:29:48 2025 +0200 Bluetooth: L2CAP: export l2cap_chan_hold for modules l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules. l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit b454505bf57a2e4f5d49951d4deb03730a9348d9 Author: Pauli Virtanen Date: Mon Nov 3 20:29:47 2025 +0200 Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types, e.g. debugfs "connect" command takes the former, and "disconnect" and "connect" to already connected device take the latter. This is due to using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le which take different dst_type values. Fix address type passed to hci_conn_hash_lookup_le(). Retain the debugfs API difference between "connect" and "disconnect" commands since it's been like this since 2015 and nobody apparently complained. Fixes: f5ad4ffceba0 ("Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible") Reviewed-by: Paul Menzel Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 3b78f50918276ab28fb22eac9aa49401ac436a3b Author: Pauli Virtanen Date: Mon Nov 3 20:29:46 2025 +0200 Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW Add missing skb_reset_mac_header() for uncompressed ipv6 RX path. For the compressed one, it is done in lowpan_header_decompress(). Log: (BlueZ 6lowpan-tester Client Recv Raw - Success) ------ kernel BUG at net/core/skbuff.c:212! Call Trace: ... packet_rcv (net/packet/af_packet.c:2152) ... __local_bh_enable_ip (kernel/softirq.c:407) netif_rx (net/core/dev.c:5648) chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359) ------ Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices") Reviewed-by: Paul Menzel Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 23d22f2f71768034d6ef86168213843fc49bf550 Author: Raphael Pinsonneault-Thibeault Date: Wed Nov 5 14:28:41 2025 -0500 Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd. Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com Fixes: fd913ef7ce619 ("Bluetooth: btusb: Add out-of-band wakeup support") Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Luiz Augusto von Dentz commit 55fb52ffdd62850d667ebed842815e072d3c9961 Author: Pauli Virtanen Date: Sun Nov 2 20:16:12 2025 +0200 Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone. Cancel the timer when MGMT removes the hdev, like other MGMT timers. Should fix the BUG: sporadically seen by BlueZ test bot (in "Mesh - Send cancel - 1" test). Log: ------ BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240 ------ Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Link: https://lore.kernel.org/linux-bluetooth/67364c09.0c0a0220.113cba.39ff@mx.google.com/ Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 1f214e9c3aef2d0936be971072e991d78a174d71 Author: Trond Myklebust Date: Fri Oct 31 10:51:42 2025 -0400 NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() The Smatch static checker noted that in _nfs4_proc_lookupp(), the flag RPC_TASK_TIMEOUT is being passed as an argument to nfs4_init_sequence(), which is clearly incorrect. Since LOOKUPP is an idempotent operation, nfs4_init_sequence() should not ask the server to cache the result. The RPC_TASK_TIMEOUT flag needs to be passed down to the RPC layer. Reported-by: Dan Carpenter Reported-by: Harshit Mogalapalli Fixes: 76998ebb9158 ("NFSv4: Observe the NFS_MOUNT_SOFTREVAL flag in _nfs4_proc_lookupp") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 7a7a3456520b309a0bffa1d9d62bd6c9dcab89b3 Author: Yang Xiuwei Date: Thu Oct 30 11:03:25 2025 +0800 NFS: sysfs: fix leak when nfs_client kobject add fails If adding the second kobject fails, drop both references to avoid sysfs residue and memory leak. Fixes: e96f9268eea6 ("NFS: Make all of /sys/fs/nfs network-namespace unique") Signed-off-by: Yang Xiuwei Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 85d2c2392ac6348e1171d627497034a341a250c1 Author: Trond Myklebust Date: Tue Oct 28 17:27:43 2025 -0400 NFSv2/v3: Fix error handling in nfs_atomic_open_v23() When nfs_do_create() returns an EEXIST error, it means that a regular file could not be created. That could mean that a symlink needs to be resolved. If that's the case, a lookup needs to be kicked off. Reported-by: Stephen Abbene Link: https://bugzilla.kernel.org/show_bug.cgi?id=220710 Fixes: 7c6c5249f061 ("NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly.") Signed-off-by: Trond Myklebust Reviewed-by: NeilBrown Signed-off-by: Anna Schumaker commit 6a218b9c3183ed19d5703130025282cf20463d87 Author: Mike Snitzer Date: Wed Nov 5 22:03:04 2025 -0500 nfs/localio: do not issue misaligned DIO out-of-order From https://lore.kernel.org/linux-nfs/aQHASIumLJyOoZGH@infradead.org/ On Wed, Oct 29, 2025 at 12:20:40AM -0700, Christoph Hellwig wrote: > On Mon, Oct 27, 2025 at 12:18:30PM -0400, Mike Snitzer wrote: > > LOCALIO's misaligned DIO will issue head/tail followed by O_DIRECT > > middle (via AIO completion of that aligned middle). So out of order > > relative to file offset. > > That's in general a really bad idea. It will obviously work, but > both on SSDs and out of place write file systems it is a sure way > to increase your garbage collection overhead a lot down the line. Fix this by never issuing misaligned DIO out of order. This fix means the DIO-aligned middle will only use AIO completion if there is no misaligned end segment. Otherwise, all 3 segments of a misaligned DIO will be issued without AIO completion to ensure file offset increases properly for all partial READ or WRITE situations. Factoring out nfs_local_iter_setup() helps standardize repetitive nfs_local_iters_setup_dio() code and is inspired by cleanup work that Chuck Lever did on the NFSD Direct code. Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Reported-by: Christoph Hellwig Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 240372edaf854c9136f5ead45f2d8cd9496a9cb3 Author: Nitin Gote Date: Thu Nov 6 15:35:17 2025 +0530 drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg Wa_15016589081 applies to Xe3_LPG renderCS Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20251106100516.318863-2-nitin.r.gote@intel.com Signed-off-by: Matt Roper (cherry picked from commit 715974499a2199bd199fb4630501f55545342ea4) Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Lucas De Marchi commit fa3376319b83ba8b7fd55f2c1a268dcbf9d6eedc Author: Tangudu Tilak Tirumalesh Date: Thu Oct 30 21:16:26 2025 +0530 drm/xe/xe3: Extend wa_14023061436 Extend wa_14023061436 to Graphics Versions 30.03, 30.04 and 30.05. Signed-off-by: Tangudu Tilak Tirumalesh Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251030154626.3124565-1-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper (cherry picked from commit 0dd656d06f50ae4cedf160634cf13fd9e0944cf7) Cc: stable@vger.kernel.org # v6.17+ Signed-off-by: Lucas De Marchi commit 0b2f7be548006b0651e1e8320790f49723265cbc Author: Nitin Gote Date: Mon Oct 27 14:56:43 2025 +0530 drm/xe/xe3: Add WA_14024681466 for Xe3_LPG Apply WA_14024681466 to Xe3_LPG graphics IP versions from 30.00 to 30.05. v2: (Matthew Roper) - Remove stepping filter as workaround applies to all steppings. - Add an engine class filter so it only applies to the RENDER engine. Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20251027092643.335904-1-nitin.r.gote@intel.com Reviewed-by: Matt Roper Signed-off-by: Matt Roper (cherry picked from commit 071089a69e199bd810ff31c4c933bd528e502743) Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Lucas De Marchi commit 97b726eb1dc2b4a2532544eb3da72bb6acbd39a3 Author: Armin Wolf Date: Mon Nov 10 12:12:53 2025 +0100 platform/x86: msi-wmi-platform: Fix typo in WMI GUID The WMI driver core only supports GUID strings containing only uppercase characters, however the GUID string used by the msi-wmi-platform driver contains a single lowercase character. This prevents the WMI driver core from matching said driver to its WMI device. Fix this by turning the lowercase character into a uppercase character. Also update the WMI driver development guide to warn about this. Reported-by: Antheas Kapenekakis Fixes: 9c0beb6b29e7 ("platform/x86: wmi: Add MSI WMI Platform driver") Tested-by: Antheas Kapenekakis Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251110111253.16204-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c93433fd4e2bbbe7caa67b53d808b4a084852ff3 Author: Armin Wolf Date: Mon Nov 10 12:12:52 2025 +0100 platform/x86: msi-wmi-platform: Only load on MSI devices It turns out that the GUID used by the msi-wmi-platform driver (ABBC0F60-8EA1-11D1-00A0-C90629100000) is not unique, but was instead copied from the WIndows Driver Samples. This means that this driver could load on devices from other manufacturers that also copied this GUID, potentially causing hardware errors. Prevent this by only loading on devices whitelisted via DMI. The DMI matches where taken from the msi-ec driver. Reported-by: Antheas Kapenekakis Fixes: 9c0beb6b29e7 ("platform/x86: wmi: Add MSI WMI Platform driver") Tested-by: Antheas Kapenekakis Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251110111253.16204-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4ea7c1717f3f2344f7a1cdab4f5875cfa89c87a9 Merge: e9a6fb0bcdd760 8a4821412cf2c1 Author: Linus Torvalds Date: Mon Nov 10 08:54:36 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Arm: - Fix trapping regression when no in-kernel irqchip is present - Check host-provided, untrusted ranges and offsets in pKVM - Fix regression restoring the ID_PFR1_EL1 register - Fix vgic ITS locking issues when LPIs are not directly injected Arm selftests: - Correct target CPU programming in vgic_lpi_stress selftest - Fix exposure of SCTLR2_EL2 and ZCR_EL2 in get-reg-list selftest RISC-V: - Fix check for local interrupts on riscv32 - Read HGEIP CSR on the correct cpu when checking for IMSIC interrupts - Remove automatic I/O mapping from kvm_arch_prepare_memory_region() x86: - Inject #UD if the guest attempts to execute SEAMCALL or TDCALL as KVM doesn't support virtualization the instructions, but the instructions are gated only by VMXON. That is, they will VM-Exit instead of taking a #UD and until now this resulted in KVM exiting to userspace with an emulation error. - Unload the "FPU" when emulating INIT of XSTATE features if and only if the FPU is actually loaded, instead of trying to predict when KVM will emulate an INIT (CET support missed the MP_STATE path). Add sanity checks to detect and harden against similar bugs in the future. - Unregister KVM's GALog notifier (for AVIC) when kvm-amd.ko is unloaded. - Use a raw spinlock for svm->ir_list_lock as the lock is taken during schedule(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. - Remove guest_memfd bindings on memslot deletion when a gmem file is dying to fix a use-after-free race found by syzkaller. - Fix a goof in the EPT Violation handler where KVM checks the wrong variable when determining if the reported GVA is valid. - Fix and simplify the handling of LBR virtualization on AMD, which was made buggy and unnecessarily complicated by nested VM support Misc: - Update Oliver's email address" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (28 commits) KVM: nSVM: Fix and simplify LBR virtualization handling with nested KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated MAINTAINERS: Switch myself to using kernel.org address KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock KVM: arm64: vgic-v3: Reinstate IRQ lock ordering for LPI xarray KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured KVM: arm64: Make all 32bit ID registers fully writable KVM: VMX: Fix check for valid GVA on an EPT violation KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying KVM: SVM: switch to raw spinlock for svm->ir_list_lock KVM: SVM: Make avic_ga_log_notifier() local to avic.c KVM: SVM: Unregister KVM's GALog notifier on kvm-amd.ko exit KVM: SVM: Initialize per-CPU svm_data at the end of hardware setup KVM: x86: Call out MSR_IA32_S_CET is not handled by XSAVES KVM: x86: Harden KVM against imbalanced load/put of guest FPU state KVM: x86: Unload "FPU" state on INIT if and only if its currently in-use KVM: arm64: Check the untrusted offset in FF-A memory share KVM: arm64: Check range args for pKVM mem transitions ... commit eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 Author: Niranjan H Y Date: Mon Nov 10 20:56:46 2025 +0530 ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list "struct sdca_control" declares "values" field as integer array. But the memory allocated to it is of char array. This causes crash for sdca_parse_function API. This patch addresses the issue by allocating correct data size. Signed-off-by: Niranjan H Y Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251110152646.192-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit d32ddfeb559342e89a4d06b1df4e7e5e96df3762 Author: Mike Snitzer Date: Mon Oct 27 13:52:28 2025 -0400 nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion LOCALIO's misaligned DIO WRITE support requires synchronous IO for any misaligned head and/or tail that are issued using buffered IO. In addition, it is important that the O_DIRECT middle be on stable storage upon its completion via AIO. Otherwise, a misaligned DIO WRITE could mix buffered IO for the head/tail and direct IO for the DIO-aligned middle -- which could lead to problems associated with deferred writes to stable storage (such as out of order partial completions causing incorrect advancement of the file's offset, etc). Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit d0497dd27452c79a48414df813a16cd12d274b3b Author: Mike Snitzer Date: Mon Oct 27 09:08:33 2025 -0400 nfs/localio: backfill missing partial read support for misaligned DIO Misaligned DIO read can be split into 3 IOs, must handle potential for short read from each component IO (follows same pattern used for handling partial writes, except upper layer read code handles advancing offset before retry). Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit f2060bdc21d70f3d8a4753a9fd3b0b02cb48c0bc Author: Mike Snitzer Date: Mon Oct 27 09:08:32 2025 -0400 nfs/localio: add refcounting for each iocb IO associated with NFS pgio header Improve completion handling of as many as 3 IOs associated with each misaligned DIO by using a atomic_t to track completion of each IO. Update nfs_local_pgio_done() to use precise atomic_t accounting for remaining iov_iter (up to 3) associated with each iocb, so that each NFS LOCALIO pgio header is only released after all IOs have completed. But also allow early return if/when a short read or write occurs. Fixes reported BUG: KASAN: slab-use-after-free in nfs_local_call_read: https://lore.kernel.org/linux-nfs/aPSvi5Yr2lGOh5Jh@dell-per750-06-vm-07.rhts.eng.pek2.redhat.com/ Reported-by: Yongcheng Yang Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 51a491f2708de79da76791523d40926921823b7e Author: Mike Snitzer Date: Mon Oct 27 09:08:31 2025 -0400 nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support Each filesystem is meant to fallback to retrying DIO in terms buffered IO when it might encounter -ENOTBLK when issuing DIO (which can happen if the VFS cannot invalidate the page cache). So NFS doesn't need special handling for -ENOTBLK. Also, explicitly initialize a couple DIO related iocb members rather than simply rely on data structure zeroing. Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Reported-by: Christoph Hellwig Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit fb2cba0854a7f315c8100a807a6959b99d72479e Author: Trond Myklebust Date: Sat Oct 18 20:10:36 2025 -0400 NFS: Check the TLS certificate fields in nfs_match_client() If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the cert_serial and privkey_serial fields need to match as well since they define the client's identity, as presented to the server. Fixes: 90c9550a8d65 ("NFS: support the kernel keyring for TLS") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 8ab523ce78d4ca13add6b4ecbacff0f84c274603 Author: Trond Myklebust Date: Sat Oct 18 20:10:35 2025 -0400 pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS The default setting for the transport security policy must be RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS. Conversely, when using TLS, the security policy needs to be set. Fixes: 6c0a8c5fcf71 ("NFS: Have struct nfs_client carry a TLS policy field") Signed-off-by: Trond Myklebust Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker commit 28e19737e1570c7c71890547c2e43c3e0da79df9 Author: Trond Myklebust Date: Sat Oct 18 20:10:34 2025 -0400 pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport. Fixes: a35518cae4b3 ("NFSv4.1/pnfs: fix NFS with TLS in pnfs") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 7aca00d950e782e66c34fbd045c9605eca343a36 Author: Trond Myklebust Date: Sat Oct 18 20:10:33 2025 -0400 pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect() Don't try to add an RDMA transport to a client that is already marked as being a TCP/TLS transport. Fixes: 04a15263662a ("pnfs/flexfiles: connect to NFSv3 DS using TLS if MDS connection uses TLS") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 994dec10991b53beac3e16109d876ae363e8a329 Author: Jani Nikula Date: Thu Nov 6 22:00:00 2025 +0200 drm/i915/psr: fix pipe to vblank conversion First, we can't assume pipe == crtc index. If a pipe is fused off in between, it no longer holds. intel_crtc_for_pipe() is the only proper way to get from a pipe to the corresponding crtc. Second, drivers aren't supposed to access or index drm->vblank[] directly. There's drm_crtc_vblank_crtc() for this. Use both functions to fix the pipe to vblank conversion. Fixes: f02658c46cf7 ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable") Cc: Jouni Högander Cc: stable@vger.kernel.org # v6.16+ Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd) Signed-off-by: Rodrigo Vivi commit 576c930e5e7dcb937648490611a83f1bf0171048 Author: Boris Brezillon Date: Fri Nov 7 18:12:14 2025 +0100 drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines behind, leading to potential data leaks and/or asynchronous buffer corruption when dirty cachelines are evicted. Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block") Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Signed-off-by: Steven Price Link: https://patch.msgid.link/20251107171214.1186299-1-boris.brezillon@collabora.com commit 324be6dcbf09133a322db16977a84fbb45c16129 Author: Chuck Lever Date: Thu Oct 16 11:09:13 2025 -0400 Revert "SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it" Geert reports: > This is now commit d8e97cc476e33037 ("SUNRPC: Make RPCSEC_GSS_KRB5 > select CRYPTO instead of depending on it") in v6.18-rc1. > As RPCSEC_GSS_KRB5 defaults to "y", CRYPTO is now auto-enabled in > defconfigs that didn't enable it before. Revert while we work out a proper solution and then test it. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-nfs/b97cea29-4ab7-4fb6-85ba-83f9830e524f@kernel.org/T/#t Signed-off-by: Chuck Lever commit 1cff14b7fc7f31363c39d0269563ce75c714f7ae Author: NeilBrown Date: Thu Oct 16 09:49:57 2025 -0400 nfsd: ensure SEQUENCE replay sends a valid reply. nfsd4_enc_sequence_replay() uses nfsd4_encode_operation() to encode a new SEQUENCE reply when replaying a request from the slot cache - only ops after the SEQUENCE are replayed from the cache in ->sl_data. However it does this in nfsd4_replay_cache_entry() which is called *before* nfsd4_sequence() has filled in reply fields. This means that in the replayed SEQUENCE reply: maxslots will be whatever the client sent target_maxslots will be -1 (assuming init to zero, and nfsd4_encode_sequence() subtracts 1) status_flags will be zero The incorrect maxslots value, in particular, can cause the client to think the slot table has been reduced in size so it can discard its knowledge of current sequence number of the later slots, though the server has not discarded those slots. When the client later wants to use a later slot, it can get NFS4ERR_SEQ_MISORDERED from the server. This patch moves the setup of the reply into a new helper function and call it *before* nfsd4_replay_cache_entry() is called. Only one of the updated fields was used after this point - maxslots. So the nfsd4_sequence struct has been extended to have separate maxslots for the request and the response. Reported-by: Olga Kornievskaia Closes: https://lore.kernel.org/linux-nfs/20251010194449.10281-1-okorniev@redhat.com/ Tested-by: Olga Kornievskaia Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c96573c0d75db3f8478000d0d392a9cdb95adbed Author: Chuck Lever Date: Thu Oct 16 09:49:56 2025 -0400 NFSD: Never cache a COMPOUND when the SEQUENCE operation fails RFC 8881 normatively mandates that operations where the initial SEQUENCE operation in a compound fails must not modify the slot's replay cache. nfsd4_cache_this() doesn't prevent such caching. So when SEQUENCE fails, cstate.data_offset is not set, allowing read_bytes_from_xdr_buf() to access uninitialized memory. Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/c3628d57-94ae-48cf-8c9e-49087a28cec9@oracle.com/T/#t Fixes: 468de9e54a90 ("nfsd41: expand solo sequence check") Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit ff8141e49cf70d2d093a5228f5299ce188de6142 Author: Chuck Lever Date: Thu Oct 16 09:49:55 2025 -0400 NFSD: Skip close replay processing if XDR encoding fails The replay logic added by commit 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") cannot be done if encoding failed due to a short send buffer; there's no guarantee that the operation encoder has actually encoded the data that is being copied to the replay cache. Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/c3628d57-94ae-48cf-8c9e-49087a28cec9@oracle.com/T/#t Fixes: 9411b1d4c7df ("nfsd4: cleanup handling of nfsv4.0 closed stateid's") Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 4aa17144d5abc3c756883e3a010246f0dba8b468 Author: Olga Kornievskaia Date: Tue Oct 14 13:59:59 2025 -0400 NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm@csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@oracle.com/T/#t Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit 66e9feb03e7cf8983b1d0c540e2dad90d5146d48 Author: Hans de Goede Date: Sun Nov 9 16:53:39 2025 +0100 spi: Add TODO comment about ACPI GPIO setup Add a TODO comment that ideally the ACPI/gpiolib core code should take care of setting GPIO direction and/or bias according to ACPI GPIO resources. If this TODO gets implemented then the acpi_dev_gpio_irq_get() call in acpi_register_spi_device() can be dropped. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251109155340.26199-1-johannes.goede@oss.qualcomm.com Signed-off-by: Mark Brown commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 Author: Vanillan Wang Date: Mon Nov 10 12:20:41 2025 +0800 USB: serial: option: add support for Rolling RW101R-GL - VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x0301: mbim, pipe T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=0301 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x01a8: mbim, diag, AT, ADB, pipe1, pipe2 T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=33f8 ProdID=01a8 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x0302: mbim, pipe T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=0302 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms - VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM interface for Linux/Chrome OS) 0x01a9: mbim, diag, AT, ADB, pipe1, pipe2 T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=33f8 ProdID=01a9 Rev=05.04 S: Manufacturer=Rolling Wireless S.a.r.l. S: Product=Rolling RW101R-GL Module S: SerialNumber=3ec4efdf C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Vanillan Wang Cc: stable@vger.kernel.org [ johan: sort vendor entries, edit commit message slightly ] Signed-off-by: Johan Hovold commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf Author: Takashi Iwai Date: Sun Nov 9 10:12:07 2025 +0100 ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet sizes are limited by some factors such as wMaxPacketSize USB descriptor. OTOH, in the current code, the actually used packet sizes are determined only by the rate and the PPS, which may be bigger than the size limit above. This results in a buffer overflow, as reported by syzbot. Basically when the limit is smaller than the calculated packet size, it implies that something is wrong, most likely a weird USB descriptor. So the best option would be just to return an error at the parameter setup time before doing any further operations. This patch introduces such a sanity check, and returns -EINVAL when the packet size is greater than maxpacksize. The comparison with ep->packsize[1] alone should suffice since it's always equal or greater than ep->packsize[0]. Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7 Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com Cc: Lizhi Xu Cc: Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit aaf46c6a6df6052881c2e75cba65aeb6f1cfa88a Author: Randy Dunlap Date: Thu Oct 23 22:21:02 2025 -0700 tee: : - add ending ':' to some struct members as needed for kernel-doc - change struct name in kernel-doc to match the actual struct name (2x) - add a @params: kernel-doc entry multiple times Warning: tee.h:265 struct member 'ret_origin' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'num_params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:265 struct member 'params' not described in 'tee_ioctl_open_session_arg' Warning: tee.h:351 struct member 'num_params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:351 struct member 'params' not described in 'tee_iocl_supp_recv_arg' Warning: tee.h:372 struct member 'num_params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:372 struct member 'params' not described in 'tee_iocl_supp_send_arg' Warning: tee.h:298: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_invoke_arg instead Warning: tee.h:473: expecting prototype for struct tee_ioctl_invoke_func_arg. Prototype was for struct tee_ioctl_object_invoke_arg instead Signed-off-by: Randy Dunlap Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit b05addf6f0596edb1f82ab4059438c7ef2d2686d Author: Pratyush Yadav Date: Mon Nov 3 19:02:32 2025 +0100 kho: warn and exit when unpreserved page wasn't preserved Calling __kho_unpreserve() on a pair of (pfn, end_pfn) that wasn't preserved is a bug. Currently, if that is done, the physxa or bits can be NULL. This results in a soft lockup since a NULL physxa or bits results in redoing the loop without ever making any progress. Return when physxa or bits are not found, but WARN first to loudly indicate invalid behaviour. Link: https://lkml.kernel.org/r/20251103180235.71409-3-pratyush@kernel.org Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit 7ecd2e439d1272ac02d798b0033a426e3b00dff5 Author: Pratyush Yadav Date: Mon Nov 3 19:02:31 2025 +0100 kho: fix unpreservation of higher-order vmalloc preservations kho_vmalloc_unpreserve_chunk() calls __kho_unpreserve() with end_pfn as pfn + 1. This happens to work for 0-order pages, but leaks higher order pages. For example, say order 2 pages back the allocation. During preservation, they get preserved in the order 2 bitmaps, but kho_vmalloc_unpreserve_chunk() would try to unpreserve them from the order 0 bitmaps, which should not have these bits set anyway, leaving the order 2 bitmaps untouched. This results in the pages being carried over to the next kernel. Nothing will free those pages in the next boot, leaking them. Fix this by taking the order into account when calculating the end PFN for __kho_unpreserve(). Link: https://lkml.kernel.org/r/20251103180235.71409-2-pratyush@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 0b07092d09e54e49b85379a9c60f82d54a881514 Author: Pratyush Yadav Date: Mon Nov 3 12:01:57 2025 +0100 kho: fix out-of-bounds access of vmalloc chunk The list of pages in a vmalloc chunk is NULL-terminated. So when looping through the pages in a vmalloc chunk, both kho_restore_vmalloc() and kho_vmalloc_unpreserve_chunk() rightly make sure to stop when encountering a NULL page. But when the chunk is full, the loops do not stop and go past the bounds of chunk->phys, resulting in out-of-bounds memory access, and possibly the restoration or unpreservation of an invalid page. Fix this by making sure the processing of chunk stops at the end of the array. Link: https://lkml.kernel.org/r/20251103110159.8399-1-pratyush@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit bba717bbc466ab24d25964034f5e16ead1720512 Author: Chris Li Date: Sun Nov 2 07:11:07 2025 -0800 MAINTAINERS: add Chris and Kairui as the swap maintainer We have been collaborating on a systematic effort to clean up and improve the Linux swap system, and might as well take responsibility for it. Link: https://lkml.kernel.org/r/20251102-swap-m-v1-1-582f275d5bce@kernel.org Signed-off-by: Chris Li Acked-by: Kairui Song Acked-by: Barry Song Acked-by: Baoquan He Cc: Johannes Weiner Cc: Kemeng Shi Cc: Michal Hocko Cc: Minchan Kim Cc: Nhat Pham Cc: Roman Gushchin Cc: SeongJae Park Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 6f86d0534fddfbd08687fa0f01479d4226bc3c3d Author: Lance Yang Date: Fri Oct 31 20:09:55 2025 +0800 mm/secretmem: fix use-after-free race in fault handler When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the underlying page as not-present in the direct map, and add it to the file mapping. If two tasks cause a fault in the same page concurrently, both could end up allocating a folio and removing the page from the direct map, but only one would succeed in adding the folio to the file mapping. The task that failed undoes the effects of its attempt by (a) freeing the folio again and (b) putting the page back into the direct map. However, by doing these two operations in this order, the page becomes available to the allocator again before it is placed back in the direct mapping. If another task attempts to allocate the page between (a) and (b), and the kernel tries to access it via the direct map, it would result in a supervisor not-present page fault. Fix the ordering to restore the direct map before the folio is freed. Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Lance Yang Reported-by: Google Big Sleep Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWKrdQJ-ATdg@mail.gmail.com/ Acked-by: David Hildenbrand Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit adfb6609c6809e107ded9a1cd46f519c882e64ea Author: Catalin Marinas Date: Fri Oct 31 16:57:50 2025 +0000 mm/huge_memory: initialise the tags of the huge zero folio On arm64 with MTE enabled, a page mapped as Normal Tagged (PROT_MTE) in user space will need to have its allocation tags initialised. This is normally done in the arm64 set_pte_at() after checking the memory attributes. Such page is also marked with the PG_mte_tagged flag to avoid subsequent clearing. Since this relies on having a struct page, pte_special() mappings are ignored. Commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special") maps the huge zero folio special and the arm64 set_pmd_at() will no longer zero the tags. There is no guarantee that the tags are zero, especially if parts of this huge page have been previously tagged. It's fairly easy to detect this by regularly dropping the caches to force the reallocation of the huge zero folio. Allocate the huge zero folio with the __GFP_ZEROTAGS flag. In addition, do not warn in the arm64 __access_remote_tags() when reading tags from the huge zero page. I bundled the arm64 change in here as well since they are both related to the commit mapping the huge zero folio as special. [catalin.marinas@arm.com: handle arch mte_zero_clear_page_tags() code issuing MTE instructions] Link: https://lkml.kernel.org/r/aQi8dA_QpXM8XqrE@arm.com Link: https://lkml.kernel.org/r/20251031170133.280742-1-catalin.marinas@arm.com Fixes: d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special") Signed-off-by: Catalin Marinas Acked-by: David Hildenbrand Reviewed-by: Lance Yang Tested-by: Beleswar Padhi Cc: Will Deacon Cc: Mark Brown Cc: Aishwarya TCV Cc: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 9a6b60cb147d53968753a34805211d2e5e08c027 Author: Edward Adam Davis Date: Thu Oct 30 07:51:52 2025 +0900 nilfs2: avoid having an active sc_timer before freeing sci Because kthread_stop did not stop sc_task properly and returned -EINTR, the sc_timer was not properly closed, ultimately causing the problem [1] reported by syzbot when freeing sci due to the sc_timer not being closed. Because the thread sc_task main function nilfs_segctor_thread() returns 0 when it succeeds, when the return value of kthread_stop() is not 0 in nilfs_segctor_destroy(), we believe that it has not properly closed sc_timer. We use timer_shutdown_sync() to sync wait for sc_timer to shutdown, and set the value of sc_task to NULL under the protection of lock sc_state_lock, so as to avoid the issue caused by sc_timer not being properly shutdowned. [1] ODEBUG: free active (active state 0) object: 00000000dacb411a object type: timer_list hint: nilfs_construction_timeout Call trace: nilfs_segctor_destroy fs/nilfs2/segment.c:2811 [inline] nilfs_detach_log_writer+0x668/0x8cc fs/nilfs2/segment.c:2877 nilfs_put_super+0x4c/0x12c fs/nilfs2/super.c:509 Link: https://lkml.kernel.org/r/20251029225226.16044-1-konishi.ryusuke@gmail.com Fixes: 3f66cc261ccb ("nilfs2: use kthread_create and kthread_stop for the log writer thread") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24d8b70f039151f65590 Tested-by: syzbot+24d8b70f039151f65590@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Cc: [6.12+] Signed-off-by: Andrew Morton commit 7d9f7d390f6af3a29614e81e802e2b9c238eb7b2 Author: Carlos Llamas Date: Thu Oct 30 01:03:33 2025 +0000 scripts/decode_stacktrace.sh: fix build ID and PC source parsing Support for parsing PC source info in stacktraces (e.g. '(P)') was added in commit 2bff77c665ed ("scripts/decode_stacktrace.sh: fix decoding of lines with an additional info"). However, this logic was placed after the build ID processing. This incorrect order fails to parse lines containing both elements, e.g.: drm_gem_mmap_obj+0x114/0x200 [drm 03d0564e0529947d67bb2008c3548be77279fd27] (P) This patch fixes the problem by extracting the PC source info first and then processing the module build ID. With this change, the line above is now properly parsed as such: drm_gem_mmap_obj (./include/linux/mmap_lock.h:212 ./include/linux/mm.h:811 drivers/gpu/drm/drm_gem.c:1177) drm (P) While here, also add a brief explanation the build ID section. Link: https://lkml.kernel.org/r/20251030010347.2731925-1-cmllamas@google.com Fixes: 2bff77c665ed ("scripts/decode_stacktrace.sh: fix decoding of lines with an additional info") Signed-off-by: Carlos Llamas Reviewed-by: Matthieu Baerts (NGI0) Reviewed-by: Luca Ceresoli Cc: Breno Leitao Cc: Catalin Marinas Cc: Marc Rutland Cc: Mark Brown Cc: Matthieu Baerts Cc: Miroslav Benes Cc: Puranjay Mohan Cc: Signed-off-by: Andrew Morton commit 9fd7bb5083d1e1027b8ac1e365c29921ab88b177 Author: Quanmin Yan Date: Thu Oct 30 10:07:46 2025 +0800 mm/damon/sysfs: change next_update_jiffies to a global variable In DAMON's damon_sysfs_repeat_call_fn(), time_before() is used to compare the current jiffies with next_update_jiffies to determine whether to update the sysfs files at this moment. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this causes time_before() in damon_sysfs_repeat_call_fn() to unexpectedly return true during the first 5 minutes after boot on 32-bit systems (see [1] for more explanation, which fixes another jiffies-related issue before). As a result, DAMON does not update sysfs files during that period. There is also an issue unrelated to the system's word size[2]: if the user stops DAMON just after next_update_jiffies is updated and restarts it after 'refresh_ms' or a longer delay, next_update_jiffies will retain an older value, causing time_before() to return false and the update to happen earlier than expected. Fix these issues by making next_update_jiffies a global variable and initializing it each time DAMON is started. Link: https://lkml.kernel.org/r/20251030020746.967174-3-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1] Link: https://lore.kernel.org/all/20251029013038.66625-1-sj@kernel.org/ [2] Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Signed-off-by: Quanmin Yan Cc: Kefeng Wang Cc: ze zuo Cc: Signed-off-by: Andrew Morton commit 2f6ce7e714ef842e43120ecd6a7ed287b502026d Author: Quanmin Yan Date: Thu Oct 30 10:07:45 2025 +0800 mm/damon/stat: change last_refresh_jiffies to a global variable Patch series "mm/damon: fixes for the jiffies-related issues", v2. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this may cause the time_before() series of functions to return unexpected values, resulting in DAMON not functioning as intended. Meanwhile, similar issues exist in some specific user operation scenarios. This patchset addresses these issues. The first patch is about the DAMON_STAT module, and the second patch is about the core layer's sysfs. This patch (of 2): In DAMON_STAT's damon_stat_damon_call_fn(), time_before_eq() is used to avoid unnecessarily frequent stat update. On 32-bit systems, the kernel initializes jiffies to "-5 minutes" to make jiffies wrap bugs appear earlier. However, this causes time_before_eq() in DAMON_STAT to unexpectedly return true during the first 5 minutes after boot on 32-bit systems (see [1] for more explanation, which fixes another jiffies-related issue before). As a result, DAMON_STAT does not update any monitoring results during that period, which becomes more confusing when DAMON_STAT_ENABLED_DEFAULT is enabled. There is also an issue unrelated to the system's word size[2]: if the user stops DAMON_STAT just after last_refresh_jiffies is updated and restarts it after 5 seconds or a longer delay, last_refresh_jiffies will retain an older value, causing time_before_eq() to return false and the update to happen earlier than expected. Fix these issues by making last_refresh_jiffies a global variable and initializing it each time DAMON_STAT is started. Link: https://lkml.kernel.org/r/20251030020746.967174-2-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com [1] Link: https://lore.kernel.org/all/20251028143250.50144-1-sj@kernel.org/ [2] Fixes: fabdd1e911da ("mm/damon/stat: calculate and expose estimated memory bandwidth") Signed-off-by: Quanmin Yan Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Cc: Signed-off-by: Andrew Morton commit 91a54090026f84ceffaa12ac53c99b9f162946f6 Author: Martin Kaiser Date: Thu Oct 30 16:55:05 2025 +0100 maple_tree: fix tracepoint string pointers maple_tree tracepoints contain pointers to function names. Such a pointer is saved when a tracepoint logs an event. There's no guarantee that it's still valid when the event is parsed later and the pointer is dereferenced. The kernel warns about these unsafe pointers. event 'ma_read' has unsafe pointer field 'fn' WARNING: kernel/trace/trace.c:3779 at ignore_event+0x1da/0x1e4 Mark the function names as tracepoint_string() to fix the events. One case that doesn't work without my patch would be trace-cmd record to save the binary ringbuffer and trace-cmd report to parse it in userspace. The address of __func__ can't be dereferenced from userspace but tracepoint_string will add an entry to /sys/kernel/tracing/printk_formats Link: https://lkml.kernel.org/r/20251030155537.87972-1-martin@kaiser.cx Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Martin Kaiser Acked-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 1abbdf3d57aa964e572940d67c9ec5dc87710738 Author: Hao Ge Date: Wed Oct 29 09:43:17 2025 +0800 codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls handle_failed_objexts_alloc() to mark all objects in the vector as empty. As a result all objects in this slab (slabA) will have their extensions set to CODETAG_EMPTY. Later on if this slabA is used to allocate a slabobj_ext vector for another slab (slabB), we end up with the slabB->obj_exts pointing to a slabobj_ext vector that itself has a non-NULL slabobj_ext equal to CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to free slabB->obj_exts vector. free_slab_obj_exts() calls mark_objexts_empty(slabB->obj_exts) which will generate a warning because it expects slabobj_ext vectors to have a NULL obj_ext, not CODETAG_EMPTY. Modify mark_objexts_empty() to skip the warning and setting the obj_ext value if it's already set to CODETAG_EMPTY. To quickly detect this WARN, I modified the code from WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1); We then obtained this message: [21630.898561] ------------[ cut here ]------------ [21630.898596] kernel BUG at mm/slub.c:2050! [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1 vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi net_failover virtio_console failover virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary) [21630.910495] Tainted: [W]=WARN [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [21630.912392] pc : __free_slab+0x228/0x250 [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : ffff8000a02f73e0 [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: ffff0000c0011c40 [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: ffff000102199b40 [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: ffff0000c0011c40 [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: 0000000000000000 [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: ffff70001405ee66 [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : ffff800080a295dc [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : 0000000000003000 [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : 0000000000000007 [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : 0000000000000001 [21630.921810] Call trace: [21630.922130]  __free_slab+0x228/0x250 (P) [21630.922669]  free_slab+0x38/0x118 [21630.923079]  free_to_partial_list+0x1d4/0x340 [21630.923591]  __slab_free+0x24c/0x348 [21630.924024]  ___cache_free+0xf0/0x110 [21630.924468]  qlist_free_all+0x78/0x130 [21630.924922]  kasan_quarantine_reduce+0x114/0x148 [21630.925525]  __kasan_slab_alloc+0x7c/0xb0 [21630.926006]  kmem_cache_alloc_noprof+0x164/0x5c8 [21630.926699]  __alloc_object+0x44/0x1f8 [21630.927153]  __create_object+0x34/0xc8 [21630.927604]  kmemleak_alloc+0xb8/0xd8 [21630.928052]  kmem_cache_alloc_noprof+0x368/0x5c8 [21630.928606]  getname_flags.part.0+0xa4/0x610 [21630.929112]  getname_flags+0x80/0xd8 [21630.929557]  vfs_fstatat+0xc8/0xe0 [21630.929975]  __do_sys_newfstatat+0xa0/0x100 [21630.930469]  __arm64_sys_newfstatat+0x90/0xd8 [21630.931046]  invoke_syscall+0xd4/0x258 [21630.931685]  el0_svc_common.constprop.0+0xb4/0x240 [21630.932467]  do_el0_svc+0x48/0x68 [21630.932972]  el0_svc+0x40/0xe0 [21630.933472]  el0t_64_sync_handler+0xa0/0xe8 [21630.934151]  el0t_64_sync+0x1ac/0x1b0 [21630.934923] Code: aa1803e0 97ffef2b a9446bf9 17ffff9c (d4210000) [21630.936461] SMP: stopping secondary CPUs [21630.939550] Starting crashdump kernel... [21630.940108] Bye! Link: https://lkml.kernel.org/r/20251029014317.1533488-1-hao.ge@linux.dev Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Signed-off-by: Hao Ge Reviewed-by: Suren Baghdasaryan Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: gehao Cc: Roman Gushchin Cc: Shakeel Butt Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 04d1c9d60c6ec4c0003d433572eaa45f8b217788 Author: Dev Jain Date: Tue Oct 28 12:09:52 2025 +0530 mm/mremap: honour writable bit in mremap pte batching Currently mremap folio pte batch ignores the writable bit during figuring out a set of similar ptes mapping the same folio. Suppose that the first pte of the batch is writable while the others are not - set_ptes will end up setting the writable bit on the other ptes, which is a violation of mremap semantics. Therefore, use FPB_RESPECT_WRITE to check the writable bit while determining the pte batch. Link: https://lkml.kernel.org/r/20251028063952.90313-1-dev.jain@arm.com Signed-off-by: Dev Jain Fixes: f822a9a81a31 ("mm: optimize mremap() by PTE batching") Reported-by: David Hildenbrand Debugged-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes Cc: Barry Song Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Cc: [6.17+] Signed-off-by: Andrew Morton commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 Author: Peter Oberparleiter Date: Tue Oct 28 12:51:25 2025 +0100 gcov: add support for GCC 15 Using gcov on kernels compiled with GCC 15 results in truncated 16-byte long .gcda files with no usable data. To fix this, update GCOV_COUNTERS to match the value defined by GCC 15. Tested with GCC 14.3.0 and GCC 15.2.0. Link: https://lkml.kernel.org/r/20251028115125.1319410-1-oberpar@linux.ibm.com Signed-off-by: Peter Oberparleiter Reported-by: Matthieu Baerts Closes: https://github.com/linux-test-project/lcov/issues/445 Tested-by: Matthieu Baerts Cc: Signed-off-by: Andrew Morton commit 0d6c356dd6547adac2b06b461528e3573f52d953 Author: Isaac J. Manjarres Date: Tue Oct 28 12:10:12 2025 -0700 mm/mm_init: fix hash table order logging in alloc_large_system_hash() When emitting the order of the allocation for a hash table, alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log base 2 of the allocation size. This is not correct if the allocation size is smaller than a page, and yields a negative value for the order as seen below: TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP bind hash table entries: 32 (order: -2, 1024 bytes, linear) Use get_order() to compute the order when emitting the hash table information to correctly handle cases where the allocation size is smaller than a page: TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP bind hash table entries: 32 (order: 0, 1024 bytes, linear) Link: https://lkml.kernel.org/r/20251028191020.413002-1-isaacmanjarres@google.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Isaac J. Manjarres Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: David Hildenbrand Cc: Signed-off-by: Andrew Morton commit fa04f5b60fda62c98a53a60de3a1e763f11feb41 Author: Kiryl Shutsemau Date: Mon Oct 27 11:56:36 2025 +0000 mm/truncate: unmap large folio on split failure Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS. This behavior might not be respected on truncation. During truncation, the kernel splits a large folio in order to reclaim memory. As a side effect, it unmaps the folio and destroys PMD mappings of the folio. The folio will be refaulted as PTEs and SIGBUS semantics are preserved. However, if the split fails, PMD mappings are preserved and the user will not receive SIGBUS on any accesses within the PMD. Unmap the folio on split failure. It will lead to refault as PTEs and preserve SIGBUS semantics. Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size. Link: https://lkml.kernel.org/r/20251027115636.82382-3-kirill@shutemov.name Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios") Signed-off-by: Kiryl Shutsemau Cc: Al Viro Cc: Baolin Wang Cc: Christian Brauner Cc: "Darrick J. Wong" Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 74207de2ba10c2973334906822dc94d2e859ffc5 Author: Kiryl Shutsemau Date: Mon Oct 27 11:56:35 2025 +0000 mm/memory: do not populate page table entries beyond i_size Patch series "Fix SIGBUS semantics with large folios", v3. Accessing memory within a VMA, but beyond i_size rounded up to the next page size, is supposed to generate SIGBUS. Darrick reported[1] an xfstests regression in v6.18-rc1. generic/749 failed due to missing SIGBUS. This was caused by my recent changes that try to fault in the whole folio where possible: 19773df031bc ("mm/fault: try to map the entire file folio in finish_fault()") 357b92761d94 ("mm/filemap: map entire large folio faultaround") These changes did not consider i_size when setting up PTEs, leading to xfstest breakage. However, the problem has been present in the kernel for a long time - since huge tmpfs was introduced in 2016. The kernel happily maps PMD-sized folios as PMD without checking i_size. And huge=always tmpfs allocates PMD-size folios on any writes. I considered this corner case when I implemented a large tmpfs, and my conclusion was that no one in their right mind should rely on receiving a SIGBUS signal when accessing beyond i_size. I cannot imagine how it could be useful for the workload. But apparently filesystem folks care a lot about preserving strict SIGBUS semantics. Generic/749 was introduced last year with reference to POSIX, but no real workloads were mentioned. It also acknowledged the tmpfs deviation from the test case. POSIX indeed says[3]: References within the address range starting at pa and continuing for len bytes to whole pages following the end of an object shall result in delivery of a SIGBUS signal. The patchset fixes the regression introduced by recent changes as well as more subtle SIGBUS breakage due to split failure on truncation. This patch (of 2): Accesses within VMA, but beyond i_size rounded up to PAGE_SIZE are supposed to generate SIGBUS. Recent changes attempted to fault in full folio where possible. They did not respect i_size, which led to populating PTEs beyond i_size and breaking SIGBUS semantics. Darrick reported generic/749 breakage because of this. However, the problem existed before the recent changes. With huge=always tmpfs, any write to a file leads to PMD-size allocation. Following the fault-in of the folio will install PMD mapping regardless of i_size. Fix filemap_map_pages() and finish_fault() to not install: - PTEs beyond i_size; - PMD mappings across i_size; Make an exception for shmem/tmpfs that for long time intentionally mapped with PMDs across i_size. Link: https://lkml.kernel.org/r/20251027115636.82382-1-kirill@shutemov.name Link: https://lkml.kernel.org/r/20251027115636.82382-2-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Fixes: 6795801366da ("xfs: Support large folios") Reported-by: "Darrick J. Wong" Cc: Al Viro Cc: Baolin Wang Cc: Christian Brauner Cc: Dave Chinner Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 895b4c0c79b092d732544011c3cecaf7322c36a1 Author: Wei Yang Date: Sat Oct 25 10:42:33 2025 +0800 fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang Cc: Al Viro Cc: Christian Brauner Cc: wangzijie Cc: Alexey Dobriyan Cc: Signed-off-by: Andrew Morton commit fa5a061700364bc28ee1cb1095372f8033645dcb Author: Zi Yan Date: Wed Oct 22 23:05:21 2025 -0400 mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order folio split clears PG_has_hwpoisoned, but the flag should be preserved in after-split folios containing pages with PG_hwpoisoned flag if the folio is split to >0 order folios. Scan all pages in a to-be-split folio to determine which after-split folios need the flag. An alternatives is to change PG_has_hwpoisoned to PG_maybe_hwpoisoned to avoid the scan and set it on all after-split folios, but resulting false positive has undesirable negative impact. To remove false positive, caller of folio_test_has_hwpoisoned() and folio_contain_hwpoisoned_page() needs to do the scan. That might be causing a hassle for current and future callers and more costly than doing the scan in the split code. More details are discussed in [1]. This issue can be exposed via: 1. splitting a has_hwpoisoned folio to >0 order from debugfs interface; 2. truncating part of a has_hwpoisoned folio in truncate_inode_partial_folio(). And later accesses to a hwpoisoned page could be possible due to the missing has_hwpoisoned folio flag. This will lead to MCE errors. Link: https://lore.kernel.org/all/CAHbLzkoOZm0PXxE9qwtF4gKR=cpRXrSrJ9V9Pm2DJexs985q4g@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20251023030521.473097-1-ziy@nvidia.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Yang Shi Reviewed-by: Lorenzo Stoakes Reviewed-by: Lance Yang Reviewed-by: Miaohe Lin Reviewed-by: Baolin Wang Reviewed-by: Wei Yang Cc: Pankaj Raghav Cc: Barry Song Cc: Dev Jain Cc: Jane Chu Cc: Liam Howlett Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit f5548c318d6520d4fa3c5ed6003eeb710763cbc5 Author: Pedro Demarchi Gomes Date: Wed Oct 22 12:30:59 2025 -0300 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: #include #include #include /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu. Link: https://lkml.kernel.org/r/20251023035841.41406-1-pedrodemargomes@gmail.com Link: https://lkml.kernel.org/r/20251022153059.22763-1-pedrodemargomes@gmail.com Link: https://lore.kernel.org/linux-mm/423de7a3-1c62-4e72-8e79-19a6413e420c@redhat.com/ [1] Fixes: 31dbd01f3143 ("ksm: Kernel SamePage Merging") Signed-off-by: Pedro Demarchi Gomes Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Reported-by: craftfever Closes: https://lkml.kernel.org/r/020cf8de6e773bb78ba7614ef250129f11a63781@murena.io Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Chengming Zhou Cc: xu xin Cc: Signed-off-by: Andrew Morton commit 7e76b75e5ab3339bebab3a4738226cd9b27d8c42 Author: Aleksei Nikiforov Date: Tue Sep 30 13:56:01 2025 +0200 mm/kmsan: fix kmsan kmalloc hook when no stack depots are allocated yet If no stack depot is allocated yet, due to masking out __GFP_RECLAIM flags kmsan called from kmalloc cannot allocate stack depot. kmsan fails to record origin and report issues. This may result in KMSAN failing to report issues. Reusing flags from kmalloc without modifying them should be safe for kmsan. For example, such chain of calls is possible: test_uninit_kmalloc -> kmalloc -> __kmalloc_cache_noprof -> slab_alloc_node -> slab_post_alloc_hook -> kmsan_slab_alloc -> kmsan_internal_poison_memory. Only when it is called in a context without flags present should __GFP_RECLAIM flags be masked. With this change all kmsan tests start working reliably. Eric reported: : Yes, KMSAN seems to be at least partially broken currently. Besides the : fact that the kmsan KUnit test is currently failing (which I reported at : https://lore.kernel.org/r/20250911175145.GA1376@sol), I've confirmed that : the poly1305 KUnit test causes a KMSAN warning with Aleksei's patch : applied but does not cause a warning without it. The warning did get : reached via syzbot somehow : (https://lore.kernel.org/r/751b3d80293a6f599bb07770afcef24f623c7da0.1761026343.git.xiaopei01@kylinos.cn/), : so KMSAN must still work in some cases. But it didn't work for me. Link: https://lkml.kernel.org/r/20250930115600.709776-2-aleksei.nikiforov@linux.ibm.com Link: https://lkml.kernel.org/r/20251022030213.GA35717@sol Fixes: 97769a53f117 ("mm, bpf: Introduce try_alloc_pages() for opportunistic page allocation") Signed-off-by: Aleksei Nikiforov Reviewed-by: Alexander Potapenko Tested-by: Eric Biggers Cc: Alexei Starovoitov Cc: Dmitriy Vyukov Cc: Ilya Leoshkevich Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit fc745ff317566ec299e16346ebb9eacc8fe5b9d2 Author: Kairui Song Date: Wed Oct 22 18:57:19 2025 +0800 mm/shmem: fix THP allocation and fallback loop The order check and fallback loop is updating the index value on every loop. This will cause the index to be wrongly aligned by a larger value while the loop shrinks the order. This may result in inserting and returning a folio of the wrong index and cause data corruption with some userspace workloads [1]. [kasong@tencent.com: introduce a temporary variable to improve code] Link: https://lkml.kernel.org/r/20251023065913.36925-1-ryncsn@gmail.com Link: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ [1] Link: https://lkml.kernel.org/r/20251022105719.18321-1-ryncsn@gmail.com Link: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ [1] Fixes: e7a2ab7b3bb5 ("mm: shmem: add mTHP support for anonymous shmem") Closes: https://lore.kernel.org/linux-mm/CAMgjq7DqgAmj25nDUwwu1U2cSGSn8n4-Hqpgottedy0S6YYeUw@mail.gmail.com/ Signed-off-by: Kairui Song Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Barry Song Reviewed-by: Lorenzo Stoakes Cc: Dev Jain Cc: Hugh Dickins Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit fa759cd75bce5489eed34596daa53f721849a86f Author: Pasha Tatashin Date: Mon Oct 20 20:08:52 2025 -0400 kho: allocate metadata directly from the buddy allocator KHO allocates metadata for its preserved memory map using the slab allocator via kzalloc(). This metadata is temporary and is used by the next kernel during early boot to find preserved memory. A problem arises when KFENCE is enabled. kzalloc() calls can be randomly intercepted by kfence_alloc(), which services the allocation from a dedicated KFENCE memory pool. This pool is allocated early in boot via memblock. When booting via KHO, the memblock allocator is restricted to a "scratch area", forcing the KFENCE pool to be allocated within it. This creates a conflict, as the scratch area is expected to be ephemeral and overwriteable by a subsequent kexec. If KHO metadata is placed in this KFENCE pool, it leads to memory corruption when the next kernel is loaded. To fix this, modify KHO to allocate its metadata directly from the buddy allocator instead of slab. Link: https://lkml.kernel.org/r/20251021000852.2924827-4-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: David Matlack Cc: Alexander Graf Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit a2fff99f92dae9c0eaf0d75de3def70ec68dad92 Author: Pasha Tatashin Date: Mon Oct 20 20:08:51 2025 -0400 kho: increase metadata bitmap size to PAGE_SIZE KHO memory preservation metadata is preserved in 512 byte chunks which requires their allocation from slab allocator. Slabs are not safe to be used with KHO because of kfence, and because partial slabs may lead leaks to the next kernel. Change the size to be PAGE_SIZE. The kfence specifically may cause memory corruption, where it randomly provides slab objects that can be within the scratch area. The reason for that is that kfence allocates its objects prior to KHO scratch is marked as CMA region. While this change could potentially increase metadata overhead on systems with sparsely preserved memory, this is being mitigated by ongoing work to reduce sparseness during preservation via 1G guest pages. Furthermore, this change aligns with future work on a stateless KHO, which will also use page-sized bitmaps for its radix tree metadata. Link: https://lkml.kernel.org/r/20251021000852.2924827-3-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Christian Brauner Cc: David Matlack Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit e38f65d317df1fd2dcafe614d9c537475ecf9992 Author: Pasha Tatashin Date: Mon Oct 20 20:08:50 2025 -0400 kho: warn and fail on metadata or preserved memory in scratch area Patch series "KHO: kfence + KHO memory corruption fix", v3. This series fixes a memory corruption bug in KHO that occurs when KFENCE is enabled. The root cause is that KHO metadata, allocated via kzalloc(), can be randomly serviced by kfence_alloc(). When a kernel boots via KHO, the early memblock allocator is restricted to a "scratch area". This forces the KFENCE pool to be allocated within this scratch area, creating a conflict. If KHO metadata is subsequently placed in this pool, it gets corrupted during the next kexec operation. Google is using KHO and have had obscure crashes due to this memory corruption, with stacks all over the place. I would prefer this fix to be properly backported to stable so we can also automatically consume it once we switch to the upstream KHO. Patch 1/3 introduces a debug-only feature (CONFIG_KEXEC_HANDOVER_DEBUG) that adds checks to detect and fail any operation that attempts to place KHO metadata or preserved memory within the scratch area. This serves as a validation and diagnostic tool to confirm the problem without affecting production builds. Patch 2/3 Increases bitmap to PAGE_SIZE, so buddy allocator can be used. Patch 3/3 Provides the fix by modifying KHO to allocate its metadata directly from the buddy allocator instead of slab. This bypasses the KFENCE interception entirely. This patch (of 3): It is invalid for KHO metadata or preserved memory regions to be located within the KHO scratch area, as this area is overwritten when the next kernel is loaded, and used early in boot by the next kernel. This can lead to memory corruption. Add checks to kho_preserve_* and KHO's internal metadata allocators (xa_load_or_alloc, new_chunk) to verify that the physical address of the memory does not overlap with any defined scratch region. If an overlap is detected, the operation will fail and a WARN_ON is triggered. To avoid performance overhead in production kernels, these checks are enabled only when CONFIG_KEXEC_HANDOVER_DEBUG is selected. [rppt@kernel.org: fix KEXEC_HANDOVER_DEBUG Kconfig dependency] Link: https://lkml.kernel.org/r/aQHUyyFtiNZhx8jo@kernel.org [pasha.tatashin@soleen.com: build fix] Link: https://lkml.kernel.org/r/CA+CK2bBnorfsTymKtv4rKvqGBHs=y=MjEMMRg_tE-RME6n-zUw@mail.gmail.com Link: https://lkml.kernel.org/r/20251021000852.2924827-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20251021000852.2924827-2-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Signed-off-by: Mike Rapoport Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Christian Brauner Cc: David Matlack Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Samiullah Khawaja Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 77008e1b2ef73249bceb078a321a3ff6bc087afb Author: Zi Yan Date: Thu Oct 16 21:36:30 2025 -0400 mm/huge_memory: do not change split_huge_page*() target order silently Page cache folios from a file system that support large block size (LBS) can have minimal folio order greater than 0, thus a high order folio might not be able to be split down to order-0. Commit e220917fa507 ("mm: split a folio in minimum folio order chunks") bumps the target order of split_huge_page*() to the minimum allowed order when splitting a LBS folio. This causes confusion for some split_huge_page*() callers like memory failure handling code, since they expect after-split folios all have order-0 when split succeeds but in reality get min_order_for_split() order folios and give warnings. Fix it by failing a split if the folio cannot be split to the target order. Rename try_folio_split() to try_folio_split_to_order() to reflect the added new_order parameter. Remove its unused list parameter. [The test poisons LBS folios, which cannot be split to order-0 folios, and also tries to poison all memory. The non split LBS folios take more memory than the test anticipated, leading to OOM. The patch fixed the kernel warning and the test needs some change to avoid OOM.] Link: https://lkml.kernel.org/r/20251017013630.139907-1-ziy@nvidia.com Fixes: e220917fa507 ("mm: split a folio in minimum folio order chunks") Signed-off-by: Zi Yan Reported-by: syzbot+e6367ea2fdab6ed46056@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d2c943.a70a0220.1b52b.02b3.GAE@google.com/ Reviewed-by: Luis Chamberlain Reviewed-by: Pankaj Raghav Reviewed-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Miaohe Lin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jane Chu Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Ryan Roberts Cc: Christian Brauner Cc: Signed-off-by: Andrew Morton commit 237e74bfa261fb0cf75bd08c9be0c5094018ee20 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Fix max supported vCPUs set with EIOINTC VM fails to boot with 256 vCPUs, the detailed command is qemu-system-loongarch64 -smp 256 and there is an error reported as follows: KVM_LOONGARCH_EXTIOI_INIT_NUM_CPU failed: Invalid argument There is typo issue in function kvm_eiointc_ctrl_access() when set max supported vCPUs. Cc: stable@vger.kernel.org Fixes: 47256c4c8b1b ("LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access()") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 11f340ece403e71aa2b643a2562a58ed3ac12e2c Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Skip PMU checking on vCPU context switch PMU hardware about VM is switched on VM exit to host rather than vCPU context sched off, PMU is checked and restored on return to VM. It is not necessary to check PMU on vCPU context sched on callback, since the request is made on the VM exit entry or VM PMU CSR access abort routine already. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 5001bcf86edf2de02f025a0f789bcac37fa040e6 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Restore guest PMU if it is enabled On LoongArch system, guest PMU hardware is shared by guest and host but PMU interrupt is separated. PMU is pass-through to VM, and there is PMU context switch when exit to host and return to guest. There is optimiation to check whether PMU is enabled by guest. If not, it is not necessary to return to guest. However, if it is enabled, PMU context for guest need switch on. Now KVM_REQ_PMU notification is set on vCPU context switch, but it is missing if there is no vCPU context switch while PMU is used by guest VM, so fix it. Cc: Fixes: f4e40ea9f78f ("LoongArch: KVM: Add PMU support for guest") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit d3c9515e4f9d10ccb113adb4809db5cc31e7ef65 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Add delay until timer interrupt injected When timer is fired in oneshot mode, CSR.TVAL will stop with value -1 rather than 0. However when the register CSR.TVAL is restored, it will continue to count down rather than stop there. Now the method is to write 0 to CSR.TVAL, wait to count down for 1 cycle at least, which is 10ns with a timer freq 100MHz, and then retore timer interrupt status. Here add 2 cycles delay to assure that timer interrupt is injected. With this patch, timer selftest case passes to run always. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 37e9d1a91382661c2d1f656b54c5d22dfe7a8606 Author: Bibo Mao Date: Sun Nov 9 16:02:09 2025 +0800 LoongArch: KVM: Set page with write attribute if dirty track disabled With secondary MMU page table, if there is a read page fault, the page's write attribute will not set even if it is writable from master MMU page table. This logic only works if dirty tracking is enabled, so page table should be set with _PAGE_WRITE if dirty tracking is disabled. It reduces extra page fault on secondary MMU page table if a VM finishes migration, when the master MMU page table is ready and the secondary MMU page is fresh. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 62cda5e54f7c5e773911b458dd4d10ee8c91b60b Author: Qiang Ma Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: kexec: Print out debugging message if required When specifying '-d' for kexec_file_load interface, loaded locations of kernel/initrd/cmdline etc can be printed out to help debug. Commit eb7622d908a0 ("kexec_file, riscv: print out debugging message if required") fixes the same issue on RISC-V. So, remove kexec_image_info() because the content has been printed out in generic code. And on Loongson-3A5000, the printed messages look like below: kexec_file: kernel: 00000000d9aad283 kernel_size: 0x2e77f30 kexec_file(EFI): No LoongArch PE image header. kexec_file: Loaded initrd at 0x80000000 bufsz=0x1637cd0 memsz=0x1638000 kexec_file(ELF): Loaded kernel at 0x9c20000 bufsz=0x27f1800 memsz=0x2950000 kexec_file: nr_segments = 2 kexec_file: segment[0]: buf=0x00000000cc3e6c33 bufsz=0x27f1800 mem=0x9c20000 memsz=0x2950000 kexec_file: segment[1]: buf=0x00000000bb75a541 bufsz=0x1637cd0 mem=0x80000000 memsz=0x1638000 kexec_file: kexec_file_load: type:0, start:0xb15d000 head:0x18db60002 flags:0x8 Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit df16b8956cae970027f4be4a1500272201e2d5c1 Author: Youling Tang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: kexec: Initialize the kexec_buf structure The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data is accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Link: https://lore.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit eeeeaafa62ea0cd4b86390f657dc0aea73bff4f5 Author: Huacai Chen Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Use correct accessor to read FWPC/MWPC CSR.FWPC and CSR.MWPC are 32bit registers, so use csr_read32() rather than csr_read64() to read the values of FWPC/MWPC. Cc: stable@vger.kernel.org Fixes: edffa33c7bb5a73 ("LoongArch: Add hardware breakpoints/watchpoints support") Signed-off-by: Huacai Chen commit 4c8a7c9827726f6e987b7a04af8ef58f1c7fe8d3 Author: Tiezhu Yang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Refine the init_hw_perf_events() function (1) Use the existing CPUCFG6_PMNUM_SHIFT macro definition instead of the magic value 4 to get the PMU number. (2) Detect the value of PMU bits via CPUCFG instruction according to the ISA manual instead of hard-coded as 64, because the value may be different for various micro-architectures. Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#_cpucfg Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 17f838512ae50203ae2e3ce9b9f2689cc67beaa3 Author: Vishal Moola (Oracle) Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Remove __GFP_HIGHMEM masking in pud_alloc_one() Remove the unnecessary __GFP_HIGHMEM masking in pud_alloc_one(), which was introduced with commit 382739797f79ec2 ("loongarch: convert various functions to use ptdescs"). GFP_KERNEL doesn't contain __GFP_HIGHMEM. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Huacai Chen commit a073d637c8cfbfbab39b7272226a3fbf3b887580 Author: Tianyang Zhang Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY Now if the PTE/PMD is dirty with _PAGE_DIRTY but without _PAGE_MODIFIED, after {pte,pmd}_modify() we lose _PAGE_DIRTY, then {pte,pmd}_dirty() return false and lead to data loss. This can happen in certain scenarios such as HW PTW doesn't set _PAGE_MODIFIED automatically, so here we need _PAGE_MODIFIED to record the dirty status (_PAGE_DIRTY). The new modification involves checking whether the original PTE/PMD has the _PAGE_DIRTY flag. If it exists, the _PAGE_MODIFIED bit is also set, ensuring that the {pte,pmd}_dirty() interface can always return accurate information. Cc: stable@vger.kernel.org Co-developed-by: Liupu Wang Signed-off-by: Liupu Wang Signed-off-by: Tianyang Zhang commit ce5ad03e459ecb3b4993a8f311fd4f2fb3e6ef81 Author: Huacai Chen Date: Sun Nov 9 16:02:01 2025 +0800 LoongArch: Consolidate max_pfn & max_low_pfn calculation Now there 5 places which calculate max_pfn & max_low_pfn: 1. in fdt_setup() for FDT systems; 2. in memblock_init() for ACPI systems; 3. in init_numa_memory() for NUMA systems; 4. in arch_mem_init() to recalculate for "mem=" cmdline; 5. in paging_init() to recalculate for NUMA systems. Since memblock_init() is called both for ACPI and FDT systems, move the calculation out of the for_each_efi_memory_desc() loop can eliminate the first case. The last case is very questionable (may be derived from the MIPS/Loongson code) and breaks the "mem=" cmdline, so should be removed. And then the NUMA version of paging_init() can be also eliminated. After consolidation there are 3 places of calculation: 1. in memblock_init() for both ACPI and FDT systems; 2. in init_numa_memory() to recalculate for NUMA systems; 3. in arch_mem_init() to recalculate for the "mem=" cmdline. For all cases the calculation is: max_pfn = PFN_DOWN(memblock_end_of_DRAM()); max_low_pfn = min(PFN_DOWN(HIGHMEM_START), max_pfn); Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 43a9e6a10bdde32445ad2725f568e08a94e51dc9 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Consolidate early_ioremap()/ioremap_prot() 1. Use phys_addr_t instead of u64, which can work for both 32/64 bits. 2. Check whether the input physical address is above TO_PHYS_MASK (and return NULL if yes) for the DMW version. Note: In theory early_ioremap() also need the TO_PHYS_MASK checking, but the UEFI BIOS pass some DMW virtual addresses. Cc: stable@vger.kernel.org Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 4e67526840fc55917581b90f6a4b65849a616dd8 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY Now we use virtual addresses to fill CSR_MERRENTRY/CSR_TLBRENTRY, but hardware hope physical addresses. Now it works well because the high bits are ignored above PA_BITS (48 bits), but explicitly use physical addresses can avoid potential bugs. So fix it. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit f28abb9f96e65a28d46885afd6b70cfc4d5df5a2 Author: Huacai Chen Date: Sun Nov 9 16:02:00 2025 +0800 LoongArch: Clarify 3 MSG interrupt features LoongArch's MSG interrupt features are used across multiple subsystems. Clarify these features to avoid misuse, existing users will be adjusted if necessary. MSGINT: Infrastructure, means the CPU core supports message interupts. Indicated by CPUCFG1.MSGINT. AVECINT: AVEC interrupt controller based on MSGINT, means the CPU chip supports direct message interrupts. Indicated by IOCSR.FEATURES.DMSI. REDIRECTINT: REDIRECT interrupt controller based on MSGINT and AVECINT, means the CPU chip supports redirect message interrupts. Indicated by IOCSR.FEATURES.RMSI. For example: Loongson-3A5000/3C5000 doesn't support MSGINT/AVECINT/REDIRECTINT; Loongson-3A6000 supports MSGINT but doesn't support AVECINT/REDIRECTINT; Loongson-3C6000 supports MSGINT/AVECINT/REDIRECTINT. Signed-off-by: Huacai Chen commit fe4b3a34e9a9654d98d274218dac0270779db0ae Author: Xi Ruoyao Date: Sun Nov 9 16:01:50 2025 +0800 rust: Add -fno-isolate-erroneous-paths-dereference to bindgen_skip_c_flags It's used to work around an objtool issue since commit abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference"), but it's then passed to bindgen and cause an error because Clang does not have this option. Fixes: abb2a5572264 ("LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference") Acked-by: Miguel Ojeda Tested-by: Mingcong Bai Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9 Author: Joshua Rogers Date: Sat Nov 8 22:59:23 2025 +0800 ksmbd: close accepted socket when per-IP limit rejects connection When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS. Release client_sk before continuing. This bug was found with ZeroPath. Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Acked-by: Namjae Jeon Signed-off-by: Steve French commit e904d81ad1c04394e1cda4610de799a006cc141c Author: Joshua Rogers Date: Fri Nov 7 00:15:37 2025 +0800 smb: server: rdma: avoid unmapping posted recv on accept failure smb_direct_prepare_negotiation() posts a recv and then, if smb_direct_accept_client() fails, calls put_recvmsg() on the same buffer. That unmaps and recycles a buffer that is still posted on the QP., which can lead to device DMA into unmapped or reused memory. Track whether the recv was posted and only return it if it was never posted. If accept fails after a post, leave it for teardown to drain and complete safely. Signed-off-by: Joshua Rogers Acked-by: Namjae Jeon Signed-off-by: Steve French commit e8c73eb7db0a498cd4b22d2819e6ab1a6f506bd6 Author: Edward Adam Davis Date: Fri Nov 7 22:01:39 2025 +0800 cifs: client: fix memory leak in smb3_fs_context_parse_param The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. Regarding fc->source, there is no code in the fs context related to its memory reclamation. To fix this memory leak, release the source memory corresponding to ctx or fc before each parsing. syzbot reported: BUG: memory leak unreferenced object 0xffff888128afa360 (size 96): backtrace (crc 79c9c7ba): kstrdup+0x3c/0x80 mm/util.c:84 smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444 BUG: memory leak unreferenced object 0xffff888112c7d900 (size 96): backtrace (crc 79c9c7ba): smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629 smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438 Reported-by: syzbot+72afd4c236e6bc3f4bac@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72afd4c236e6bc3f4bac Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Edward Adam Davis Signed-off-by: Steve French commit 79280191c2fd7f24899bbd640003b5389d3c109c Author: Henrique Carvalho Date: Fri Nov 7 18:59:53 2025 -0300 smb: client: fix cifs_pick_channel when channel needs reconnect cifs_pick_channel iterates candidate channels using cur. The reconnect-state test mistakenly used a different variable. This checked the wrong slot and would cause us to skip a healthy channel and to dispatch on one that needs reconnect, occasionally failing operations when a channel was down. Fix by replacing for the correct variable. Fixes: fc43a8ac396d ("cifs: cifs_pick_channel should try selecting active channels") Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit e9a6fb0bcdd7609be6969112f3fbfcce3b1d4a7c Author: Linus Torvalds Date: Sun Nov 9 15:10:19 2025 -0800 Linux 6.18-rc5 commit 9b07cdf86a0b90556f5b68a6b20b35833b558df3 Author: Haotian Zhang Date: Tue Oct 28 11:05:09 2025 +0800 pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() The driver calls fwnode_get_named_child_node() which takes a reference on the child node, but never releases it, which causes a reference leak. Fix by using devm_add_action_or_reset() to automatically release the reference when the device is removed. Fixes: d5282a539297 ("pinctrl: cs42l43: Add support for the cs42l43") Suggested-by: Charles Keepax Signed-off-by: Haotian Zhang Signed-off-by: Linus Walleij commit f850568efe3a7a9ec4df357cfad1f997f0058924 Merge: 3461e958c10521 6a0dddc53f6f04 Author: Linus Torvalds Date: Sun Nov 9 09:29:44 2025 -0800 Merge tag 'i2c-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "Two reverts merged into one commit to handle a regression caused by a wrong cleanup because the underlying implications were unclear" * tag 'i2c-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: muxes: pca954x: Fix broken reset-gpio usage commit 3461e958c1052111f9729d74861cdf44fa2eda61 Merge: 439fc29dfd3b9c 002621a4df3c16 Author: Linus Torvalds Date: Sun Nov 9 09:22:08 2025 -0800 Merge tag 'kbuild-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Strip trailing padding bytes from modules.builtin.modinfo to fix error during modules_install with certain versions of kmod - Drop unused static inline function warning in .c files with clang from W=1 to W=2 - Ensure kernel-doc.py invocations use the PYTHON3 make variable to ensure user's choice of Python interpreter is always respected * tag 'kbuild-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Let kernel-doc.py use PYTHON3 override compiler_types: Move unused static inline functions warning to W=2 kbuild: Strip trailing padding bytes from modules.builtin.modinfo commit 7a39c723b7472b8aaa2e0a67d2b6c7cf1c45cafb Author: Baojun Xu Date: Sat Nov 8 22:23:25 2025 +0800 ALSA: hda/tas2781: Add new quirk for HP new projects Add new vendor_id and subsystem_id in quirk for HP new projects. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251108142325.2563-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 8a4821412cf2c1429fffa07c012dd150f2edf78c Author: Yosry Ahmed Date: Sat Nov 8 00:45:21 2025 +0000 KVM: nSVM: Fix and simplify LBR virtualization handling with nested The current scheme for handling LBRV when nested is used is very complicated, especially when L1 does not enable LBRV (i.e. does not set LBR_CTL_ENABLE_MASK). To avoid copying LBRs between VMCB01 and VMCB02 on every nested transition, the current implementation switches between using VMCB01 or VMCB02 as the source of truth for the LBRs while L2 is running. If L2 enables LBR, VMCB02 is used as the source of truth. When L2 disables LBR, the LBRs are copied to VMCB01 and VMCB01 is used as the source of truth. This introduces significant complexity, and incorrect behavior in some cases. For example, on a nested #VMEXIT, the LBRs are only copied from VMCB02 to VMCB01 if LBRV is enabled in VMCB01. This is because L2's writes to MSR_IA32_DEBUGCTLMSR to enable LBR are intercepted and propagated to VMCB01 instead of VMCB02. However, LBRV is only enabled in VMCB02 when L2 is running. This means that if L2 enables LBR and exits to L1, the LBRs will not be propagated from VMCB02 to VMCB01, because LBRV is disabled in VMCB01. There is no meaningful difference in CPUID rate in L2 when copying LBRs on every nested transition vs. the current approach, so do the simple and correct thing and always copy LBRs between VMCB01 and VMCB02 on nested transitions (when LBRV is disabled by L1). Drop the conditional LBRs copying in __svm_{enable/disable}_lbrv() as it is now unnecessary. VMCB02 becomes the only source of truth for LBRs when L2 is running, regardless of LBRV being enabled by L1, drop svm_get_lbr_vmcb() and use svm->vmcb directly in its place. Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-4-yosry.ahmed@linux.dev Signed-off-by: Paolo Bonzini commit fbe5e5f030c22ae717ee422aaab0e00ea84fab5e Author: Yosry Ahmed Date: Sat Nov 8 00:45:20 2025 +0000 KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() svm_update_lbrv() is called when MSR_IA32_DEBUGCTLMSR is updated, and on nested transitions where LBRV is used. It checks whether LBRV enablement needs to be changed in the current VMCB, and if it does, it also recalculate intercepts to LBR MSRs. However, there are cases where intercepts need to be updated even when LBRV enablement doesn't. Example scenario: - L1 has MSR_IA32_DEBUGCTLMSR cleared. - L1 runs L2 without LBR_CTL_ENABLE (no LBRV). - L2 sets DEBUGCTLMSR_LBR in MSR_IA32_DEBUGCTLMSR, svm_update_lbrv() sets LBR_CTL_ENABLE in VMCB02 and disables intercepts to LBR MSRs. - L2 exits to L1, svm_update_lbrv() is not called on this transition. - L1 clears MSR_IA32_DEBUGCTLMSR, svm_update_lbrv() finds that LBR_CTL_ENABLE is already cleared in VMCB01 and does nothing. - Intercepts remain disabled, L1 reads to LBR MSRs read the host MSRs. Fix it by always recalculating intercepts in svm_update_lbrv(). Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-3-yosry.ahmed@linux.dev Signed-off-by: Paolo Bonzini commit dc55b3c3f61246e483e50c85d8d5366f9567e188 Author: Yosry Ahmed Date: Sat Nov 8 00:45:19 2025 +0000 KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated. The history is complicated, it was correctly cleared for L1 before commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running"). At that point svm_set_msr() started to rely on svm_update_lbrv() to clear the bit, but when nested virtualization is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR changed. Go back to clearing it directly in svm_set_msr(). Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running") Reported-by: Matteo Rizzo Reported-by: evn@google.com Co-developed-by: Jim Mattson Signed-off-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251108004524.1600006-2-yosry.ahmed@linux.dev Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit ca00c3af8ede65d16097d322be330146d9231bd2 Merge: 0e5ba55750c1f7 4af235bf645516 Author: Paolo Bonzini Date: Sun Nov 9 08:07:55 2025 +0100 Merge tag 'kvmarm-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm654 fixes for 6.18, take #2 * Core fixes - Fix trapping regression when no in-kernel irqchip is present (20251021094358.1963807-1-sascha.bischoff@arm.com) - Check host-provided, untrusted ranges and offsets in pKVM (20251016164541.3771235-1-vdonnefort@google.com) (20251017075710.2605118-1-sebastianene@google.com) - Fix regression restoring the ID_PFR1_EL1 register (20251030122707.2033690-1-maz@kernel.org - Fix vgic ITS locking issues when LPIs are not directly injected (20251107184847.1784820-1-oupton@kernel.org) * Test fixes - Correct target CPU programming in vgic_lpi_stress selftest (20251020145946.48288-1-mdittgen@amazon.de) - Fix exposure of SCTLR2_EL2 and ZCR_EL2 in get-reg-list selftest (20251023-b4-kvm-arm64-get-reg-list-sctlr-el2-v1-1-088f88ff992a@kernel.org) (20251024-kvm-arm64-get-reg-list-zcr-el2-v1-1-0cd0ff75e22f@kernel.org) * Misc - Update Oliver's email address (20251107012830.1708225-1-oupton@kernel.org) commit 0e5ba55750c1f7fb194a0022b8c887e6413da9b1 Merge: 36567f1de1b332 d0164c161923ac Author: Paolo Bonzini Date: Sun Nov 9 08:07:32 2025 +0100 Merge tag 'kvm-x86-fixes-6.18-rc5' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.18: - Inject #UD if the guest attempts to execute SEAMCALL or TDCALL as KVM doesn't support virtualization the instructions, but the instructions are gated only by VMXON, i.e. will VM-Exit instead of taking a #UD and thus result in KVM exiting to userspace with an emulation error. - Unload the "FPU" when emulating INIT of XSTATE features if and only if the FPU is actually loaded, instead of trying to predict when KVM will emulate an INIT (CET support missed the MP_STATE path). Add sanity checks to detect and harden against similar bugs in the future. - Unregister KVM's GALog notifier (for AVIC) when kvm-amd.ko is unloaded. - Use a raw spinlock for svm->ir_list_lock as the lock is taken during schedule(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. - Remove guest_memfd bindings on memslot deletion when a gmem file is dying to fix a use-after-free race found by syzkaller. - Fix a goof in the EPT Violation handler where KVM checks the wrong variable when determining if the reported GVA is valid. commit 36567f1de1b3324ab0cfef313882842dd3d75524 Merge: 6146a0f1dfae5d 8c5fa3764facaa Author: Paolo Bonzini Date: Sun Nov 9 08:07:03 2025 +0100 Merge tag 'kvm-riscv-fixes-6.18-2' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.18, take #2 - Fix check for local interrupts on riscv32 - Read HGEIP CSR on the correct cpu when checking for IMSIC interrupts - Remove automatic I/O mapping from kvm_arch_prepare_memory_region() commit 002621a4df3c166fab1427e8e502bc15acc26b13 Author: Jean Delvare Date: Fri Nov 7 19:29:33 2025 +0100 kbuild: Let kernel-doc.py use PYTHON3 override It is possible to force a specific version of python to be used when building the kernel by passing PYTHON3= on the make command line. However kernel-doc.py is currently called with python3 hard-coded and thus ignores this setting. Use $(PYTHON3) to run $(KERNELDOC) so that the desired version of python is used. Signed-off-by: Jean Delvare Reviewed-by: Nicolas Schier Reviewed-by: Mauro Carvalho Chehab Link: https://patch.msgid.link/20251107192933.2bfe9e57@endymion Signed-off-by: Nathan Chancellor commit baadf2a5c26e802a46573eaad331b427b49aaa36 Author: Johan Hovold Date: Wed Oct 29 10:30:29 2025 +0100 most: usb: fix double free on late probe failure The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This unsurprisingly leads to bugs in the MOST drivers, and a couple of recent changes turned a reference underflow and use-after-free in the USB driver into several double free and a use-after-free on late probe failures. Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect") Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization") Cc: stable@vger.kernel.org Cc: Christian Gromm Cc: Victoria Votokina Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e Author: Miaoqian Lin Date: Mon Oct 27 14:06:01 2025 +0800 slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which internally uses device_find_child() to obtain a device reference. According to the device_find_child() documentation, the caller must drop the reference with put_device() after use. Found via static analysis and this is similar to commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") Cc: stable Signed-off-by: Miaoqian Lin Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c Author: Jameson Thies Date: Thu Nov 6 01:14:46 2025 +0000 usb: typec: ucsi: psy: Set max current to zero when disconnected The ucsi_psy_get_current_max function defaults to 0.1A when it is not clear how much current the partner device can support. But this does not check the port is connected, and will report 0.1A max current when nothing is connected. Update ucsi_psy_get_current_max to report 0A when there is no connection. Fixes: af833e7f7db3 ("usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default") Cc: stable@vger.kernel.org Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Reviewed-by: Heikki Krogerus Reviewed-by: Sebastian Reichel Tested-by: Kenneth R. Crudup Rule: add Link: https://lore.kernel.org/stable/20251017000051.2094101-1-jthies%40google.com Link: https://patch.msgid.link/20251106011446.2052583-1-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 Author: Kuen-Han Tsai Date: Mon Nov 3 20:17:59 2025 +0800 usb: gadget: f_eem: Fix memory leak in eem_unwrap The existing code did not handle the failure case of usb_ep_queue in the command path, potentially leading to memory leaks. Improve error handling to free all allocated resources on usb_ep_queue failure. This patch continues to use goto logic for error handling, as the existing error handling is complex and not easily adaptable to auto-cleanup helpers. kmemleak results: unreferenced object 0xffffff895a512300 (size 240): backtrace: slab_post_alloc_hook+0xbc/0x3a4 kmem_cache_alloc+0x1b4/0x358 skb_clone+0x90/0xd8 eem_unwrap+0x1cc/0x36c unreferenced object 0xffffff8a157f4000 (size 256): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc kmalloc_trace+0x48/0x140 dwc3_gadget_ep_alloc_request+0x58/0x11c usb_ep_alloc_request+0x40/0xe4 eem_unwrap+0x204/0x36c unreferenced object 0xffffff8aadbaac00 (size 128): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc __kmalloc+0x64/0x1a8 eem_unwrap+0x218/0x36c unreferenced object 0xffffff89ccef3500 (size 64): backtrace: slab_post_alloc_hook+0xbc/0x3a4 __kmem_cache_alloc_node+0x1b4/0x2dc kmalloc_trace+0x48/0x140 eem_unwrap+0x238/0x36c Fixes: 4249d6fbc10f ("usb: gadget: eem: fix echo command packet response issue") Cc: stable@kernel.org Signed-off-by: Kuen-Han Tsai Link: https://patch.msgid.link/20251103121814.1559719-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 46b28d2fbd13148981d91246bc0e13f4fc055987 Author: Heikki Krogerus Date: Fri Nov 7 13:15:47 2025 +0100 usb: dwc3: pci: Sort out the Intel device IDs The PCI device IDs were organised based on the Intel architecture generation in most cases, but not with every ID. That left the device ID table with no real order. Sorting the table based on the device ID. Suggested-by: Thinh Nguyen Cc: stable Signed-off-by: Heikki Krogerus Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251107121548.2702900-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit c57ce99ec6cb55b53910b6b3d7437f80159ff9d8 Author: Heikki Krogerus Date: Thu Nov 6 12:59:26 2025 +0100 usb: dwc3: pci: add support for the Intel Nova Lake -S This patch adds the necessary PCI ID for Intel Nova Lake -S devices. Signed-off-by: Heikki Krogerus Cc: stable Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251106115926.2317877-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 40f8d17eed7533ed2bbb5e3cc680049b19411b2e Author: Jamie Iles Date: Fri Nov 7 10:44:37 2025 +0000 drivers/usb/dwc3: fix PCI parent check The sysdev_is_parent check was being used to infer PCI devices that have the DMA mask set from the PCI capabilities, but sysdev_is_parent is also used for non-PCI ACPI devices in which case the DMA mask would be the bus default or as set by the _DMA method. Without this fix the DMA mask would default to 32-bits and so allocation would fail if there was no DRAM below 4GB. Fixes: 47ce45906ca9 ("usb: dwc3: leave default DMA for PCI devices") Cc: stable Signed-off-by: Jamie Iles Signed-off-by: Punit Agrawal Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251107104437.1602509-1-punit.agrawal@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 41e99fe2005182139b1058db71f0d241f8f0078c Author: Desnes Nunes Date: Fri Oct 31 01:34:36 2025 -0300 usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x53425355. When USB storage devices incorrectly skip the data phase with status data, the code extracts/validates the CSW from the sg buffer, but fails to clear it afterwards. This leaves status protocol data in srb's transfer buffer, such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can lead to USB protocols leaks to user space through SCSI generic (/dev/sg*) interfaces, such as the one seen here when the LTP test requested 512 KiB. Fix the leak by zeroing the CSW data in srb's transfer buffer immediately after the validation of devices that skip data phase. Note: Differently from CVE-2018-1000204, which fixed a big leak by zero- ing pages at allocation time, this leak occurs after allocation, when USB protocol data is written to already-allocated sg pages. Fixes: a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") Cc: stable Signed-off-by: Desnes Nunes Reviewed-by: Alan Stern Link: https://patch.msgid.link/20251031043436.55929-1-desnesn@redhat.com Signed-off-by: Greg Kroah-Hartman commit 8c13a7323b847c0370aec66f655e2596a2174a17 Author: Mathias Nyman Date: Fri Nov 7 18:28:18 2025 +0200 xhci: sideband: Fix race condition in sideband unregister Uttkarsh Aggarwal observed a kernel panic during sideband un-register and found it was caused by a race condition between sideband unregister, and creating sideband interrupters. The issue occurrs when thread T1 runs uaudio_disconnect() and released sb->xhci via sideband_unregister, while thread T2 simultaneously accessed the now-NULL sb->xhci in xhci_sideband_create_interrupter() resulting in a crash. Ensure new endpoints or interrupter can't be added to a sidenband after xhci_sideband_unregister() cleared the existing ones, and unlocked the sideband mutex. Reorganize code so that mutex is only taken and released once in xhci_sideband_unregister(), and clear sb->vdev while mutex is taken. Use mutex guards to reduce human unlock errors in code Refuse to add endpoints or interrupter if sb->vdev is not set. sb->vdev is set when sideband is created and registered. Reported-by: Uttkarsh Aggarwal Closes: https://lore.kernel.org/linux-usb/20251028080043.27760-1-uttkarsh.aggarwal@oss.qualcomm.com Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f6bb3b67be9af0cfb90075c60850b6af5338a508 Author: Mathias Nyman Date: Fri Nov 7 18:28:17 2025 +0200 xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Data read from a DbC device may be corrupted due to a race between ongoing write and write request completion handler both queuing new transfer blocks (TRBs) if there are remining data in the kfifo. TRBs may be in incorrct order compared to the data in the kfifo. Driver fails to keep lock between reading data from kfifo into a dbc request buffer, and queuing the request to the transfer ring. This allows completed request to re-queue itself in the middle of an ongoing transfer loop, forcing itself between a kfifo read and request TRB write of another request cpu0 cpu1 (re-queue completed req2) lock(port_lock) dbc_start_tx() kfifo_out(fifo, req1->buffer) unlock(port_lock) lock(port_lock) dbc_write_complete(req2) dbc_start_tx() kfifo_out(fifo, req2->buffer) unlock(port_lock) lock(port_lock) req2->trb = ring->enqueue; ring->enqueue++ unlock(port_lock) lock(port_lock) req1->trb = ring->enqueue; ring->enqueue++ unlock(port_lock) In the above scenario a kfifo containing "12345678" would read "1234" to req1 and "5678" to req2, but req2 is queued before req1 leading to data being transmitted as "56781234" Solve this by adding a flag that prevents starting a new tx if we are already mid dbc_start_tx() during the unlocked part. The already running dbc_do_start_tx() will make sure the newly completed request gets re-queued as it is added to the request write_pool while holding the lock. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit b69dfcab6894b1fed5362a364411502a7469fce3 Author: Mathias Nyman Date: Fri Nov 7 18:28:16 2025 +0200 xhci: fix stale flag preventig URBs after link state error is cleared A usb device caught behind a link in ss.Inactive error state needs to be reset to recover. A VDEV_PORT_ERROR flag is used to track this state, preventing new transfers from being queued until error is cleared. This flag may be left uncleared if link goes to error state between two resets, and print the following message: "xhci_hcd 0000:00:14.0: Can't queue urb, port error, link inactive" Fix setting and clearing the flag. The flag is cleared after hub driver has successfully reset the device when hcd->reset_device is called. xhci-hcd issues an internal "reset device" command in this callback, and clear all flags once the command completes successfully. This command may complete with a context state error if slot was recently reset and is already in the defauilt state. This is treated as a success but flag was left uncleared. The link state field is also unreliable if port is currently in reset, so don't set the flag in active reset cases. Also clear the flag immediately when link is no longer in ss.Inactive state and port event handler detects a completed reset. This issue was discovered while debugging kernel bugzilla issue 220491. It is likely one small part of the problem, causing some of the failures, but root cause remains unknown Link: https://bugzilla.kernel.org/show_bug.cgi?id=220491 Fixes: b8c3b718087b ("usb: xhci: Don't try to recover an endpoint if port is in error state.") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251107162819.1362579-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 439fc29dfd3b9c072dfff292d91cfa2f6cfb702b Merge: 41d318c47fa209 411336159064c5 Author: Linus Torvalds Date: Sat Nov 8 15:37:03 2025 -0800 Merge tag 'drm-fixes-2025-11-09' of https://gitlab.freedesktop.org/drm/kernel Pull drm fix from Dave Airlie: "Brown paper bag, the dma mask fix which I applied and actually looked through for bad things, actually broke newer GPUs, there might be some latent part in the boot path that is assuming 32-bit still, but we will figure that out elsewhere. nouveau: - revert DMA mask change" * tag 'drm-fixes-2025-11-09' of https://gitlab.freedesktop.org/drm/kernel: Revert "drm/nouveau: set DMA mask before creating the flush page" commit 41d318c47fa2090dbca7329037e5d63abeddebdf Merge: 7bb4d6512545a7 162f24cbb0f6ec Author: Linus Torvalds Date: Sat Nov 8 15:34:23 2025 -0800 Merge tag 'rtc-6.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixes from Alexandre Belloni: "The two reverts are for patches that I shouldn't have applied. The rx8025 patch fixes an issue present since 2022: - cpcap, tps6586x: revert incorrect irq enable/disable balance fix - rx8025: fix incorrect register reference" * tag 'rtc-6.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: rx8025: fix incorrect register reference Revert "rtc: cpcap: Fix initial enable_irq/disable_irq balance" Revert "rtc: tps6586x: Fix initial enable_irq/disable_irq balance" commit 162f24cbb0f6ec596e7e9f3e91610d79dc805229 Author: Yuta Hayama Date: Wed Oct 15 12:07:05 2025 +0900 rtc: rx8025: fix incorrect register reference This code is intended to operate on the CTRL1 register, but ctrl[1] is actually CTRL2. Correctly, ctrl[0] is CTRL1. Signed-off-by: Yuta Hayama Fixes: 71af91565052 ("rtc: rx8025: fix 12/24 hour mode detection on RX-8035") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/eae5f479-5d28-4a37-859d-d54794e7628c@lineo.co.jp Signed-off-by: Alexandre Belloni commit 7bb4d6512545a792a6cd8d6c8be5718920b9b11a Merge: 0d7bee10beeb59 4012abe8a78fbb Author: Linus Torvalds Date: Sat Nov 8 10:17:30 2025 -0800 Merge tag 'v6.18rc4-SMB-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix change notify packet validation check - Refcount fix (e.g. rename error paths) - Fix potential UAF due to missing locks on directory lease refcount * tag 'v6.18rc4-SMB-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: validate change notify buffer before copy smb: client: fix refcount leak in smb2_set_path_attr smb: client: fix potential UAF in smb2_close_cached_fid() commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc Author: Hamza Mahfooz Date: Wed Nov 5 11:25:46 2025 -0800 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_show() we will get a segfault, see below for an example. So, check tl_hba->sh before dereferencing it. Unable to allocate struct scsi_host BUG: kernel NULL pointer dereference, address: 0000000000000194 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024 RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop] ... Call Trace: configfs_read_iter+0x12d/0x1d0 [configfs] vfs_read+0x1b5/0x300 ksys_read+0x6f/0xf0 ... Cc: stable@vger.kernel.org Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs") Signed-off-by: Hamza Mahfooz Reviewed-by: Chaitanya Kulkarni Reviewed-by: Allen Pais Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com Signed-off-by: Martin K. Petersen commit 0d7bee10beeb59b1133bf5a4749b17a4ef3bbb01 Merge: b5c0946029200d d23550efc68008 Author: Linus Torvalds Date: Sat Nov 8 09:01:11 2025 -0800 Merge tag 'x86-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix AMD PCI root device caching regression that triggers on certain firmware variants - Fix the zen5_rdseed_microcode[] array to be NULL-terminated - Add more AMD models to microcode signature checking * tag 'x86-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Add more known models to entry sign checking x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode x86/amd_node: Fix AMD root device caching commit b5c0946029200d93f1239d3f310efa3f075abf79 Merge: 133262cae98fcc 956dfda6a70885 Author: Linus Torvalds Date: Sat Nov 8 08:59:05 2025 -0800 Merge tag 'sched-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a group-throttling bug in the fair scheduler" * tag 'sched-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Prevent cfs_rq from being unthrottled with zero runtime_remaining commit 133262cae98fcc0d36fec97213b69268eb166fd5 Merge: e6f55fe790a698 eb3182ef0405ff Author: Linus Torvalds Date: Sat Nov 8 08:54:13 2025 -0800 Merge tag 'perf-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix a system hang caused by cpu-clock events deadlock" * tag 'perf-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix system hang caused by cpu-clock usage commit e6f55fe790a698aba6f98bf6ae4f1c04246c5040 Merge: 3636cfa745e6a4 4cb5ac2626b570 Author: Linus Torvalds Date: Sat Nov 8 08:51:22 2025 -0800 Merge tag 'locking-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix (well, cut in half) a futex performance regression on PowerPC" * tag 'locking-urgent-2025-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Optimize per-cpu reference counting commit 3636cfa745e6a4ff0142e29068750439059867b0 Merge: e284d5118ac3e4 146eb58629f45f Author: Linus Torvalds Date: Sat Nov 8 08:47:31 2025 -0800 Merge tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Single fix in there, fixing an overflow in calculating the needed segments for converting into a bvec array" * tag 'io_uring-6.18-20251107' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix regbuf vector size truncation commit e284d5118ac3e430da32820215c08b2787de8eef Merge: e811c33b1f137b d8a823c6f04ef0 Author: Linus Torvalds Date: Sat Nov 8 08:43:01 2025 -0800 Merge tag 'xfs-fixes-6.18-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This contain fixes for the RT and zoned allocator, and a few fixes for atomic writes" * tag 'xfs-fixes-6.18-rc5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: free xfs_busy_extents structure when no RT extents are queued xfs: fix zone selection in xfs_select_open_zone_mru xfs: fix a rtgroup leak when xfs_init_zone fails xfs: fix various problems in xfs_atomic_write_cow_iomap_begin xfs: fix delalloc write failures in software-provided atomic writes commit 4af235bf645516481a82227d82d1352b9788903a Author: Oliver Upton Date: Thu Nov 6 17:28:25 2025 -0800 MAINTAINERS: Switch myself to using kernel.org address I've been running into issues with the linux.dev email semi-periodically, switching to my kernel.org address while I go figure out a better home for my inbox. Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107012830.1708225-1-oupton@kernel.org Signed-off-by: Marc Zyngier commit 66768669f27d98b45b20ed401cca913c387a9934 Author: Oliver Upton Date: Fri Nov 7 10:48:47 2025 -0800 KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock xa_release() expects to be called outside of the xa_lock. Fix vgic_add_lpi() to drop the lock before calling and restructure to get rid of the goto label. Reported-by: Zenghui Yu Closes: https://lore.kernel.org/kvmarm/d0853e82-7d95-5025-7abf-c6f1e0cdf7b5@huawei.com/ Fixes: 481c9ee846d2 ("KVM: arm64: vgic-its: Get rid of the lpi_list_lock") Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107184847.1784820-3-oupton@kernel.org Signed-off-by: Marc Zyngier commit 75360a9a338580990c1ee188d40a838c025bbd30 Author: Oliver Upton Date: Fri Nov 7 10:48:46 2025 -0800 KVM: arm64: vgic-v3: Reinstate IRQ lock ordering for LPI xarray Zenghui reports that running a KVM guest with an assigned device and lockdep enabled produces an unfriendly splat due to an inconsistent irq context when taking the lpi_xa's spinlock. This is no good as in rare cases the last reference to an LPI can get dropped after injection of a cached LPI translation. In this case, vgic_put_irq() will release the IRQ struct and take the lpi_xa's spinlock to erase it from the xarray. Reinstate the IRQ ordering and update the lockdep hint accordingly. Note that there is no irqsave equivalent of might_lock(), so just explictly grab and release the spinlock on lockdep kernels. Reported-by: Zenghui Yu Closes: https://lore.kernel.org/kvmarm/b4d7cb0f-f007-0b81-46d1-998b15cc14bc@huawei.com/ Fixes: 982f31bbb5b0 ("KVM: arm64: vgic-v3: Don't require IRQs be disabled for LPI xarray lock") Signed-off-by: Oliver Upton Link: https://patch.msgid.link/20251107184847.1784820-2-oupton@kernel.org Signed-off-by: Marc Zyngier commit 50e7cce81b9b2fbd6f0104c1698959d45ce3cf58 Author: Marc Zyngier Date: Thu Oct 30 12:27:07 2025 +0000 KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip Now that the idreg's GIC field is in sync with the irqchip, limit the runtime clearing of these fields to the pathological case where we do not have an in-kernel GIC. While we're at it, use the existing API instead of open-coded accessors to access the ID regs. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-4-maz@kernel.org Signed-off-by: Marc Zyngier commit 8a9866ff860052efc5f9766f3f87fae30c983156 Author: Marc Zyngier Date: Thu Oct 30 12:27:06 2025 +0000 KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured Drive the idreg fields indicating the presence of GICv3 directly from the vgic code. This avoids having to do any sort of runtime clearing of the idreg. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-3-maz@kernel.org Signed-off-by: Marc Zyngier commit 3f9eacf4f0705876a5d6526d7d320ca91d7d7a16 Author: Marc Zyngier Date: Thu Oct 30 12:27:05 2025 +0000 KVM: arm64: Make all 32bit ID registers fully writable 32bit ID registers aren't getting much love these days, and are often missed in updates. One of these updates broke restoring a GICv2 guest on a GICv3 machine. Instead of performing a piecemeal fix, just bite the bullet and make all 32bit ID regs fully writable. KVM itself never relies on them for anything, and if the VMM wants to mess up the guest, so be it. Fixes: 5cb57a1aff755 ("KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest") Reported-by: Peter Maydell Cc: stable@vger.kernel.org Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20251030122707.2033690-2-maz@kernel.org Signed-off-by: Marc Zyngier commit 411336159064c5e89e8b89d30c6855db4bb92814 Author: Dave Airlie Date: Sat Nov 8 19:41:09 2025 +1000 Revert "drm/nouveau: set DMA mask before creating the flush page" This reverts commit ebe755605082eddff80eafe0c50915b1366ee98f. Tested the latest kernel on my GB203 and this seems to break it somehow. Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: gsp: GSP-FMC boot failed (mbox: 0x0000000b) Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: gsp: init failed, -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: init failed with -5 Nov 09 04:16:14 bighp kernel: nouveau: drm:00000000:00000080: init failed with -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: drm: Device allocation failed: -5 Nov 09 04:16:14 bighp kernel: nouveau 0000:02:00.0: probe with driver nouveau failed with error -5 Not sure why, I went over the patch and thought it should have worked, but there must be some 32-bit problem maybe in the FMC boot path. Signed-off-by: Dave Airlie commit 96a9178a29a6b84bb632ebeb4e84cf61191c73d5 Author: Horatiu Vultur Date: Thu Nov 6 10:06:37 2025 +0100 net: phy: micrel: lan8814 fix reset of the QSGMII interface The lan8814 is a quad-phy and it is using QSGMII towards the MAC. The problem is that everytime when one of the ports is configured then the PCS is reseted for all the PHYs. Meaning that the other ports can loose traffic until the link is establish again. To fix this, do the reset one time for the entire PHY package. Fixes: ece19502834d ("net: phy: micrel: 1588 support for LAN8814 phy") Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Reviewed-by: Divya Koppera Link: https://patch.msgid.link/20251106090637.2030625-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit ad17e7e92a7c52ce70bb764813fcf99464f96903 Author: Wei Fang Date: Thu Nov 6 10:14:21 2025 +0800 net: fec: correct rx_bytes statistic for the case SHIFT16 is set Two additional bytes in front of each frame received into the RX FIFO if SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len to correct the statistic of rx_bytes. Fixes: 3ac72b7b63d5 ("net: fec: align IP header in hardware") Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251106021421.2096585-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 57531b3416448d1ced36a2a974a4085ec43d57b0 Author: Alexander Sverdlin Date: Thu Nov 6 17:12:09 2025 +0100 selftests: net: local_termination: Wait for interfaces to come up It seems that most of the tests prepare the interfaces once before the test run (setup_prepare()), rely on setup_wait() to wait for link and only then run the test(s). local_termination brings the physical interfaces down and up during test run but never wait for them to come up. If the auto-negotiation takes some seconds, first test packets are being lost, which leads to false-negative test results. Use setup_wait() in run_test() to make sure auto-negotiation has been completed after all simple_if_init() calls on physical interfaces and test packets will not be lost because of the race against link establishment. Fixes: 90b9566aa5cd3f ("selftests: forwarding: add a test for local_termination.sh") Reviewed-by: Vladimir Oltean Signed-off-by: Alexander Sverdlin Link: https://patch.msgid.link/20251106161213.459501-1-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee Author: Nate Karstens Date: Thu Nov 6 16:28:33 2025 -0600 strparser: Fix signed/unsigned mismatch bug The `len` member of the sk_buff is an unsigned int. This is cast to `ssize_t` (a signed type) for the first sk_buff in the comparison, but not the second sk_buff. On 32-bit systems, this can result in an integer underflow for certain values because unsigned arithmetic is being used. This appears to be an oversight: if the intention was to use unsigned arithmetic, then the first cast would have been omitted. The change ensures both len values are cast to `ssize_t`. The underflow causes an issue with ktls when multiple TLS PDUs are included in a single TCP segment. The mainline kernel does not use strparser for ktls anymore, but this is still useful for other features that still use strparser, and for backporting. Signed-off-by: Nate Karstens Cc: stable@vger.kernel.org Fixes: 43a0c6751a32 ("strparser: Stream parser for messages") Reviewed-by: Jacob Keller Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com Signed-off-by: Jakub Kicinski commit dc20452e6caf962f04ede7f364267b0c37784ab4 Author: Nathan Chancellor Date: Fri Nov 7 14:56:59 2025 -0700 riscv: Fix CONFIG_AS_HAS_INSN for new .insn usage After commit 44aa25c000b4 ("riscv: asm: use .insn for making custom instructions"), builds using LLVM older that 19 or binutils older than 2.38 fail with: arch/riscv/include/asm/vdso/processor.h: Assembler messages: arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' arch/riscv/include/asm/vdso/processor.h:27: Error: unrecognized opcode `0x100000f' make[4]: *** [scripts/Makefile.build:287: arch/riscv/kernel/vdso/vgettimeofday.o] Error 1 In file included from :4: In file included from lib/vdso/gettimeofday.c:6: In file included from include/vdso/datapage.h:21: In file included from include/vdso/processor.h:10: arch/riscv/include/asm/vdso/processor.h:23:2: error: expected instruction format 23 | ALT_RISCV_PAUSE(); | ^ arch/riscv/include/asm/errata_list.h:47:3: note: expanded from macro 'ALT_RISCV_PAUSE' 47 | RISCV_PAUSE, /* Original RISC‑V pause insn */ \ | ^ arch/riscv/include/asm/insn-def.h:259:21: note: expanded from macro 'RISCV_PAUSE' 259 | #define RISCV_PAUSE ASM_INSN_I("0x100000f") | ^ arch/riscv/include/asm/asm.h:16:26: note: expanded from macro 'ASM_INSN_I' 16 | #define ASM_INSN_I(__x) ".insn " __x | ^ :5:7: note: instantiated into assembly here 5 | .insn 0x100000f | ^ binutils gained support for '.insn ' in 2.38 [1] and LLVM gained support in 19 [2]. Adjust the test for CONFIG_AS_HAS_INSN to ensure that all versions of .insn are supported before being used. Fixes: 44aa25c000b4 ("riscv: asm: use .insn for making custom instructions") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=a262b82fdbf4cda3b0648b1adc32245ca3f78b7a [1] Link: https://github.com/llvm/llvm-project/commit/2a086dce691e3cc34a2fc27f4fb255bb2cbbfac9 [2] Suggested-by: Andrew Jones Signed-off-by: Nathan Chancellor Reviewed-by: Andrew Jones Link: https://patch.msgid.link/20251107-riscv-fix-new-insn-usage-v1-1-9a186c5928a0@kernel.org Signed-off-by: Paul Walmsley commit 5e8632987dd1882ed4d1e1039032ab1b0c1ec12b Author: Feng Jiang Date: Wed Oct 29 17:44:29 2025 +0800 riscv: Remove redundant judgment for the default build target The value of KBUILD_IMAGE is derived from $(boot-image-y), so there's no need for redundant checks before this. Signed-off-by: Feng Jiang Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20251029094429.553842-2-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 3ad1b71fdc5707d14332d9ae710a237de936be9b Author: Feng Jiang Date: Wed Oct 29 17:44:28 2025 +0800 riscv: Build loader.bin exclusively for Canaan K210 According to the explanation in commit ef10bdf9c3e6 ("riscv: Kconfig.socs: Split ARCH_CANAAN and SOC_CANAAN_K210"), loader.bin is a special feature of the Canaan K210 and is not applicable to other SoCs. Fixes: e79dfcbfb902 ("riscv: make image compression configurable") Signed-off-by: Feng Jiang Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/r/20251029094429.553842-1-jiangfeng@kylinos.cn Signed-off-by: Paul Walmsley commit 146eb58629f45f8297e83d69e64d4eea4b28d972 Author: Pavel Begunkov Date: Fri Nov 7 18:41:26 2025 +0000 io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflow "int"s used later. Rough but simple, can be improved on top. Cc: stable@vger.kernel.org Fixes: 9ef4cbbcb4ac3 ("io_uring: add infra for importing vectored reg buffers") Reported-by: Google Big Sleep Signed-off-by: Pavel Begunkov Reviewed-by: Günther Noack Tested-by: Günther Noack Signed-off-by: Jens Axboe commit e811c33b1f137be26a20444b79db8cbc1fca1c89 Merge: 38a2c275c3d3f7 d439acbbfb9a98 Author: Linus Torvalds Date: Fri Nov 7 14:51:11 2025 -0800 Merge tag 'drm-fixes-2025-11-08' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Back from travel, thanks to Simona for handling things. regular fixes, seems about the right size, but spread out a bit. amdgpu has the usual range of fixes, xe has a few fixes, and nouveau has a couple of fixes, one for blackwell modifiers on 8/16 bit surfaces. Otherwise a few small fixes for mediatek, sched, imagination and pixpaper. sched: - Fix deadlock amdgpu: - Reset fixes - Misc fixes - Panel scaling fixes - HDMI fix - S0ix fixes - Hibernation fix - Secure display fix - Suspend fix - MST fix amdkfd: - Process cleanup fix xe: - Fix missing synchronization on unbind - Fix device shutdown when doing FLR - Fix user fence signaling order i915: - Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - Fix conversion between clock ticks and nanoseconds mediatek: - Disable AFBC support on Mediatek DRM driver - Add pm_runtime support for GCE power control imagination: - kconfig: Fix dependencies nouveau: - Set DMA mask earlier - Advertize correct modifiers for GB20x pixpaper: - kconfig: Fix dependencies" * tag 'drm-fixes-2025-11-08' of https://gitlab.freedesktop.org/drm/kernel: (26 commits) drm/xe: Enforce correct user fence signaling order using drm/xe: Do clean shutdown also when using flr drm/xe: Move declarations under conditional branch drm/xe/guc: Synchronize Dead CT worker with unbind drm/amd/display: Enable mst when it's detected but yet to be initialized drm/amdgpu: Fix wait after reset sequence in S3 drm/amd: Fix suspend failure with secure display TA drm/amdgpu: fix gpu page fault after hibernation on PF passthrough drm/tiny: pixpaper: add explicit dependency on MMU drm/nouveau: Advertise correct modifiers on GB20x drm: define NVIDIA DRM format modifiers for GB20x drm/nouveau: set DMA mask before creating the flush page drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb drm/amd/display: Fix NULL deref in debugfs odm_combine_segments drm/amdkfd: Don't clear PT after process killed drm/amdgpu/smu: Handle S0ix for vangogh drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() drm/amd/display: Fix black screen with HDMI outputs drm/amd/display: Don't stretch non-native images by default in eDP drm/amd/pm: fix missing device_attr cleanup in amdgpu_pm_sysfs_init() ... commit d439acbbfb9a982f152c5f806b4592431a80c4fd Merge: a18033f1309cdf 0995c2fc39b0f9 Author: Dave Airlie Date: Sat Nov 8 07:39:11 2025 +1000 Merge tag 'drm-xe-fixes-2025-11-07' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix missing synchronization on unbind (Balasubramani Vivekanandan) - Fix device shutdown when doing FLR (Jouni Högander) - Fix user fence signaling order (Matthew Brost) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://patch.msgid.link/mvfyflloncy76a7nmkatpj6f2afddavwsibz3y4u4wo6gznro5@rdulkuh5wvje commit 38a2c275c3d3f7d7180d012386cd6fcf87854400 Merge: a2e33fb92649f4 fd9f30d1038ee1 Author: Linus Torvalds Date: Fri Nov 7 13:19:18 2025 -0800 Merge tag 'parisc-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: - fix crash triggered by unaligned access in parisc unwinder * tag 'parisc-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Avoid crash due to unaligned access in unwinder commit a2e33fb92649f4efcc9e81c1d1a1905ca2a76d03 Merge: da32d155f4a893 afb47765f92351 Author: Linus Torvalds Date: Fri Nov 7 13:13:09 2025 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: - Syzkaller found a case where maths overflows can cause divide by 0 - Typo in a compiler bug warning fix in the selftests broke the selftests - type1 compatability had a mismatch when unmapping an already unmapped range, it should succeed * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Make vfio_compat's unmap succeed if the range is already empty iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents() iommufd: Don't overflow during division for dirty tracking commit 4b93d211bbffd3dce76664d95f2306d23e7215ce Author: Kaushlendra Kumar Date: Thu Oct 30 08:02:28 2025 +0530 ACPI: MRRM: Fix memory leaks and improve error handling Add proper error handling and resource cleanup to prevent memory leaks in add_boot_memory_ranges(). The function now checks for NULL return from kobject_create_and_add(), uses local buffer for range names to avoid dynamic allocation, and implements a cleanup path that removes previously created sysfs groups and kobjects on failure. This prevents resource leaks when kobject creation or sysfs group creation fails during boot memory range initialization. Signed-off-by: Kaushlendra Kumar Reviewed-by: Tony Luck Link: https://patch.msgid.link/20251030023228.3956296-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 2cf95b9baa52262bfb645cb3c04f902dd50c29e2 Author: Shubhrajyoti Datta Date: Thu Oct 23 17:01:08 2025 +0530 EDAC/versalnet: Handle split messages for non-standard errors The current code assumes that only DDR errors have split messages. Ensure proper logging of non-standard event errors that may be split across multiple messages too. [ bp: Massage, move comment too, fix it up. ] Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251023113108.3467132-1-shubhrajyoti.datta@amd.com commit 9818af18db4bfefd320d0fef41390a616365e6f7 Author: Peter Zijlstra Date: Thu Nov 6 11:50:00 2025 +0100 compiler_types: Move unused static inline functions warning to W=2 Per Nathan, clang catches unused "static inline" functions in C files since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build"). Linus said: > So I entirely ignore W=1 issues, because I think so many of the extra > warnings are bogus. > > But if this one in particular is causing more problems than most - > some teams do seem to use W=1 as part of their test builds - it's fine > to send me a patch that just moves bad warnings to W=2. > > And if anybody uses W=2 for their test builds, that's THEIR problem.. Here is the change to bump the warning from W=1 to W=2. Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") Signed-off-by: Peter Zijlstra Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com [nathan: Adjust comment as well] Signed-off-by: Nathan Chancellor commit 0fce75870666b46b700cfbd3216380b422f975da Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:44 2025 +0530 ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPU via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function cppc_perf_ctrs_in_pcc() checks if the CPPC perf-ctrs are in a PCC region for all the present CPUs, which breaks when the kernel is booted with "nosmt=force". Hence, limit the check only to the online CPUs. Fixes: ae2df912d1a5 ("ACPI: CPPC: Disable FIE if registers in PCC regions") Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-5-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 8821c8e80a65bc4eb73daf63b34aac6b8ad69461 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:43 2025 +0530 ACPI: CPPC: Perform fast check switch only for online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function cppc_allow_fast_switch() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force". Check fast_switch capability only on online CPUs Fixes: 15eece6c5b05 ("ACPI: CPPC: Fix NULL pointer dereference when nosmp is used") Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-4-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 6dd3b8a709a130a4d55c866af9804c81b8486d28 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:42 2025 +0530 ACPI: CPPC: Check _CPC validity for only the online CPUs per_cpu(cpc_desc_ptr, cpu) object is initialized for only the online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). However the function acpi_cpc_valid() checks for the validity of the _CPC object for all the present CPUs. This breaks when the kernel is booted with "nosmt=force". Hence check the validity of the _CPC objects of only the online CPUs. Fixes: 2aeca6bd0277 ("ACPI: CPPC: Check present CPUs for determining _CPC is valid") Reported-by: Christopher Harris Closes: https://lore.kernel.org/lkml/CAM+eXpdDT7KjLV0AxEwOLkSJ2QtrsvGvjA2cCHvt1d0k2_C4Cw@mail.gmail.com/ Suggested-by: Mario Limonciello Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Tested-by: Chrisopher Harris Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-3-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit 4fe5934db4a7187d358f1af1b3ef9b6dd59bce58 Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:41 2025 +0530 ACPI: CPPC: Detect preferred core availability on online CPUs Commit 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") introduced the ability to detect the preferred core on AMD platforms by checking if there at least two distinct highest_perf values. However, it uses for_each_present_cpu() to iterate through all the CPUs in the platform, which is problematic when the kernel is booted with "nosmt=force" commandline option. Hence limit the search to only the online CPUs. Fixes: 279f838a61f9 ("x86/amd: Detect preferred cores in amd_get_boost_ratio_numerator()") Reported-by: Christopher Harris Closes: https://lore.kernel.org/lkml/CAM+eXpdDT7KjLV0AxEwOLkSJ2QtrsvGvjA2cCHvt1d0k2_C4Cw@mail.gmail.com/ Reviewed-by: "Mario Limonciello (AMD) (kernel.org)" Tested-by: Chrisopher Harris Signed-off-by: Gautham R. Shenoy Link: https://patch.msgid.link/20251107074145.2340-2-gautham.shenoy@amd.com Signed-off-by: Rafael J. Wysocki commit b6cfddd26ec55e865b4715f73e9bbb17a15091ed Author: Dave Jiang Date: Fri Oct 31 10:32:24 2025 -0700 cxl: Adjust offset calculation for poison injection The HPA to DPA translation for poison injection assumes that the base address starts from where the CXL region begins. When the extended linear cache is active, the offset can be within the DRAM region. Adjust the offset so that it correctly reflects the offset within the CXL region. [ dj: Add fixes tag from Alison ] Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset") Link: https://patch.msgid.link/20251031173224.3537030-5-dave.jiang@intel.com Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 4012abe8a78fbb8869634130024266eaef7081fe Author: Joshua Rogers Date: Fri Nov 7 00:09:37 2025 +0800 smb: client: validate change notify buffer before copy SMB2_change_notify called smb2_validate_iov() but ignored the return code, then kmemdup()ed using server provided OutputBufferOffset/Length. Check the return of smb2_validate_iov() and bail out on error. Discovered with help from the ZeroPath security tooling. Signed-off-by: Joshua Rogers Reviewed-by: Paulo Alcantara (Red Hat) Cc: stable@vger.kernel.org Fixes: e3e9463414f61 ("smb3: improve SMB3 change notification support") Signed-off-by: Steve French commit da32d155f4a8937952ca6fd55d3270fec1c3799f Merge: 5b95a50001f1fb 4436f484cb437b Author: Linus Torvalds Date: Fri Nov 7 08:10:55 2025 -0800 Merge tag 'gpio-fixes-for-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use the firmware node of the GPIO chip, not its label for software node lookup - fix invalid pointer access in GPIO debugfs - drop unused functions from gpio-tb10x - fix a regression in gpio-aggregator: restore the set_config() callback in the driver - correct schema $id path in ti,twl4030 DT bindings * tag 'gpio-fixes-for-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: tb10x: Drop unused tb10x_set_bits() function gpio: aggregator: restore the set_config operation gpiolib: fix invalid pointer access in debugfs gpio: swnode: don't use the swnode's name as the key for GPIO lookup dt-bindings: gpio: ti,twl4030: Correct the schema $id path commit 5b95a50001f1fbcae6b7fe211a02f37a04dd9a4b Merge: a80abfbb1013ff 53afec2c8fb2a5 Author: Linus Torvalds Date: Fri Nov 7 08:07:11 2025 -0800 Merge tag 'trace-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Check for reader catching up in ring_buffer_map_get_reader() If the reader catches up to the writer in the memory mapped ring buffer then calling rb_get_reader_page() will return NULL as there's no pages left. But this isn't checked for before calling rb_get_reader_page() and the return of NULL causes a warning. If it is detected that the reader caught up to the writer, then simply exit the routine - Fix memory leak in histogram create_field_var() The couple of the error paths in create_field_var() did not properly clean up what was allocated. Make sure everything is freed properly on error - Fix help message of tools latency_collector The help message incorrectly stated that "-t" was the same as "--threads" whereas "--threads" is actually represented by "-e" * tag 'trace-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/tools: Fix incorrcet short option in usage text for --threads tracing: Fix memory leaks in create_field_var() ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up commit a80abfbb1013ffec7aa7e574b5ba9bcf02bd5462 Merge: 9dc520632a0dd3 c379b745e12a99 Author: Linus Torvalds Date: Fri Nov 7 08:01:58 2025 -0800 Merge tag 'slab-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - Fix for potential infinite loop in kmalloc_nolock() when debugging is enabled for the cache (Vlastimil Babka) * tag 'slab-for-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: prevent infinite loop in kmalloc_nolock() with debugging commit 0b6c10cb8479d0d1b7b208277df2e2afe082d4bd Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:07 2025 -0600 PM: hibernate: Fix style issues in save_compressed_image() Address two issues indicated by checkpatch: - Trailing statements should be on next line. - Prefer 'unsigned int' to bare use of 'unsigned'. Signed-off-by: Mario Limonciello (AMD) [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251106045158.3198061-4-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 66ededc694f1d06a71ca35a3c8e3689e9b85b3ce Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:06 2025 -0600 PM: hibernate: Use atomic64_t for compressed_size variable `compressed_size` can overflow, showing nonsensical values. Change from `atomic_t` to `atomic64_t` to prevent overflow. Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ Signed-off-by: Mario Limonciello (AMD) Tested-by: Askar Safin Cc: 6.9+ # 6.9+ Link: https://patch.msgid.link/20251106045158.3198061-3-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 62b9ca1706e1bbb60d945a58de7c7b5826f6b2a2 Author: Mario Limonciello (AMD) Date: Wed Nov 5 22:51:05 2025 -0600 PM: hibernate: Emit an error when image writing fails If image writing fails, a return code is passed up to the caller, but none of the callers log anything to the log and so the only record of it is the return code that userspace gets. Adjust the logging so that the image size and speed of writing is only emitted on success and if there is an error, it's saved to the logs. Fixes: a06c6f5d3cc9 ("PM: hibernate: Move to crypto APIs for LZO compression") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251105180506.137448-1-safinaskar@gmail.com/ Signed-off-by: Mario Limonciello (AMD) Tested-by: Askar Safin Cc: 6.9+ # 6.9+ [ rjw: Added missing braces after "else", changelog edits ] Link: https://patch.msgid.link/20251106045158.3198061-2-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 9dc520632a0dd3bdc37540528040771a96bdc8ff Merge: 11a6afabb4b38e 1fd5367391bf0e Author: Linus Torvalds Date: Fri Nov 7 07:52:45 2025 -0800 Merge tag 'io_uring-6.18-20251106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Remove the sync refill API that was added in this release, in anticipation of doing it in a better way for the next release - Fix type extension for calculating size off nr_pages, like we do in other spots * tag 'io_uring-6.18-20251106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix types for region size calulation io_uring/zcrx: remove sync refill uapi commit 11a6afabb4b38e70b6d697fd90fddedb9ad0ec43 Merge: cff0a1be08ae4e a2b32bc1d9e359 Author: Linus Torvalds Date: Fri Nov 7 07:47:08 2025 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes in the UFS driver. The big contributor to the diffstats is the Intel controller S0ix/S3 fix which has to special case the suspend/resume patch for intel controllers in ufshcd-pci.c" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Fix invalid probe error return value scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL scsi: ufs: core: Add a quirk to suppress link_startup_again scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers scsi: ufs: core: Revert "Make HID attributes visible" scsi: ufs: core: Reduce link startup failure logging scsi: ufs: core: Fix a race condition related to the "hid" attribute group scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) commit cff0a1be08ae4ee609362fc6500cec4724e79e18 Merge: 4a0c9b33919998 e6187655acfa2d Author: Linus Torvalds Date: Fri Nov 7 07:39:57 2025 -0800 Merge tag 'v6.18-rc4-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - More safely detect RDMA capable devices correctly * tag 'v6.18-rc4-smb-server-fixes' of git://git.samba.org/ksmbd: ksmbd: detect RDMA capable netdevs include IPoIB ksmbd: detect RDMA capable lower devices when bridge and vlan netdev is used commit 8e8ae788964aa2573b4335026db4068540fa6a86 Author: Adrian Barnaś Date: Mon Sep 22 13:04:27 2025 +0000 arm64: Reject modules with internal alternative callbacks During module loading, check if a callback function used by the alternatives specified in the '.altinstruction' ELF section (if present) is located in core kernel .text. If not fail module loading before callback is called. Reported-by: Fanqin Cui Closes: https://lore.kernel.org/all/20250807072700.348514-1-fanqincui@163.com/ Signed-off-by: Adrian Barnaś Reviewed-by: Ard Biesheuvel [will: Folded in 'noinstr' tweak from Mark] Signed-off-by: Will Deacon commit 6d4a0fbd34a40c9f877b136de874dc3498031309 Author: Adrian Barnaś Date: Mon Sep 22 13:04:26 2025 +0000 arm64: Fail module loading if dynamic SCS patching fails Disallow a module to load if SCS dynamic patching fails for its code. For module loading, instead of running a dry-run to check for patching errors, try to run patching in the first run and propagate any errors so module loading will fail. Signed-off-by: Adrian Barnaś Reviewed-by: Ard Biesheuvel Signed-off-by: Will Deacon commit 7f1635737823a6c0c412ccf3767a12bec642c10f Author: shechenglong Date: Fri Oct 31 17:15:06 2025 +0800 arm64: proton-pack: Fix hard lockup due to print in scheduler context Relocate the printk() calls from spectre_v4_mitigations_off() and spectre_v2_mitigations_off() into setup_system_capabilities() function, preventing hard lockups caused by printk calls in scheduler context: | _raw_spin_lock_nested+168 | ttwu_queue+180 （rq_lock(rq, &rf); 2nd acquiring the rq->__lock） | try_to_wake_up+548 | wake_up_process+32 | __up+88 | up+100 | __up_console_sem+96 | console_unlock+696 | vprintk_emit+428 | vprintk_default+64 | vprintk_func+220 | printk+104 | spectre_v4_enable_task_mitigation+344 | __switch_to+100 | __schedule+1028 (rq_lock(rq, &rf); 1st acquiring the rq->__lock) | schedule_idle+48 | do_idle+388 | cpu_startup_entry+44 | secondary_start_kernel+352 Suggested-by: Mark Rutland Suggested-by: Catalin Marinas Suggested-by: Will Deacon Signed-off-by: shechenglong Signed-off-by: Will Deacon commit 62e72463ca714073962eda450e80c5d71dfb0dcb Author: shechenglong Date: Fri Oct 31 17:15:05 2025 +0800 arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY Following the pattern established with other Spectre mitigations, do not print a message when the CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY Kconfig option is disabled. Suggested-by: Will Deacon Signed-off-by: shechenglong Signed-off-by: Will Deacon commit 53357f14f924a06cced46069755bb10c2a6891c1 Author: Ryan Roberts Date: Thu Nov 6 16:09:43 2025 +0000 arm64: mm: Tidy up force_pte_mapping() Tidy up the implementation of force_pte_mapping() to make it easier to read and introduce the split_leaf_mapping_possible() helper to reduce code duplication in split_kernel_leaf_mapping() and arch_kfence_init_pool(). Suggested-by: David Hildenbrand (Red Hat) Signed-off-by: Ryan Roberts Reviewed-by: David Hildenbrand (Red Hat) Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit 40a292f701474f7c21b27911677485efa233e94e Author: Ryan Roberts Date: Thu Nov 6 16:09:42 2025 +0000 arm64: mm: Optimize range_split_to_ptes() Enter lazy_mmu mode while splitting a range of memory to pte mappings. This causes barriers, which would otherwise be emitted after every pte (and pmd/pud) write, to be deferred until exiting lazy_mmu mode. For large systems, this is expected to significantly speed up fallback to pte-mapping the linear map for the case where the boot CPU has BBML2_NOABORT, but secondary CPUs do not. I haven't directly measured it, but this is equivalent to commit 1fcb7cea8a5f ("arm64: mm: Batch dsb and isb when populating pgtables"). Note that for the path from arch_kfence_init_pool(), we may sleep while allocating memory inside the lazy_mmu mode. Sleeping is not allowed by generic code inside lazy_mmu, but we know that the arm64 implementation is sleep-safe. So this is ok and follows the same pattern already used by split_kernel_leaf_mapping(). Signed-off-by: Ryan Roberts Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit ce2b3a50ad922abbba36425343a1bcec46903a26 Author: Ryan Roberts Date: Thu Nov 6 16:09:41 2025 +0000 arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context It has been reported that split_kernel_leaf_mapping() is trying to sleep in non-sleepable context. It does this when acquiring the pgtable_split_lock mutex, when either CONFIG_DEBUG_PAGEALLOC or CONFIG_KFENCE are enabled, which change linear map permissions within softirq context during memory allocation and/or freeing. All other paths into this function are called from sleepable context and so are safe. But it turns out that the memory for which these 2 features may attempt to modify the permissions is always mapped by pte, so there is no need to attempt to split the mapping. So let's exit early in these cases and avoid attempting to take the mutex. There is one wrinkle to this approach; late-initialized kfence allocates it's pool from the buddy which may be block mapped. So we must hook that allocation and convert it to pte-mappings up front. Previously this was done as a side-effect of kfence protecting all the individual pages in its pool at init-time, but this no longer works due to the added early exit path in split_kernel_leaf_mapping(). So instead, do this via the existing arch_kfence_init_pool() arch hook, and reuse the existing linear_map_split_to_ptes() infrastructure. Closes: https://lore.kernel.org/all/f24b9032-0ec9-47b1-8b95-c0eeac7a31c5@roeck-us.net/ Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Ryan Roberts Reviewed-by: David Hildenbrand (Red Hat) Reviewed-by: Yang Shi Signed-off-by: Will Deacon commit 0ec364c0c95fc85bcbc88f1a9a06ebe83c88e18c Author: Yang Shi Date: Tue Nov 4 13:49:47 2025 -0800 arm64: kprobes: check the return value of set_memory_rox() Since commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full"), __change_memory_common has more chance to fail due to memory allocation failure when splitting page table. So check the return value of set_memory_rox(), then bail out if it fails otherwise we may have RW memory mapping for kprobes insn page. Fixes: 195a1b7d8388 ("arm64: kprobes: call set_memory_rox() for kprobe page") Reviewed-by: Ryan Roberts Reviewed-by: Dev Jain Signed-off-by: Yang Shi Signed-off-by: Will Deacon commit 7991fda619f7251994ab364f03f3e6fc0aa143d9 Author: Punit Agrawal Date: Fri Oct 31 11:11:38 2025 +0000 arm64: acpi: Drop message logging SPCR default console Commit f5a4af3c7527 ("ACPI: Add acpi=nospcr to disable ACPI SPCR as default console on ARM64") introduced a command line parameter to prevent using SPCR provided console as default. It also introduced a message to log this choice. Drop the message as it is not particularly useful and can be incorrect in situations where no SPCR is provided by the firmware. Link: https://lore.kernel.org/all/aQN0YWUYaPYWpgJM@willie-the-truck/ Signed-off-by: Punit Agrawal Signed-off-by: Will Deacon commit eeb8c19896952e18fb538ec76e603884070a6c6a Author: Punit Agrawal Date: Fri Oct 31 11:11:37 2025 +0000 Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" This reverts commit bad3fa2fb9206f4dcec6ddef094ec2fbf6e8dcb2. Commit bad3fa2fb920 ("ACPI: Suppress misleading SPCR console message when SPCR table is absent") mistakenly assumes acpi_parse_spcr() returning 0 to indicate a failure to parse SPCR. While addressing the resultant incorrect logging it was deemed that dropping the message is a better approach as it is not particularly useful. Roll back the commit introducing the bug as a step towards dropping the log message. Link: https://lore.kernel.org/all/aQN0YWUYaPYWpgJM@willie-the-truck/ Signed-off-by: Punit Agrawal Signed-off-by: Will Deacon commit 535fdfc5a228524552ee8810c9175e877e127c27 Author: Catalin Marinas Date: Thu Nov 6 15:52:13 2025 +0000 arm64: Use load LSE atomics for the non-return per-CPU atomic operations The non-return per-CPU this_cpu_*() atomic operations are implemented as STADD/STCLR/STSET when FEAT_LSE is available. On many microarchitecture implementations, these instructions tend to be executed "far" in the interconnect or memory subsystem (unless the data is already in the L1 cache). This is in general more efficient when there is contention as it avoids bouncing cache lines between CPUs. The load atomics (e.g. LDADD without XZR as destination), OTOH, tend to be executed "near" with the data loaded into the L1 cache. STADD executed back to back as in srcu_read_{lock,unlock}*() incur an additional overhead due to the default posting behaviour on several CPU implementations. Since the per-CPU atomics are unlikely to be used concurrently on the same memory location, encourage the hardware to to execute them "near" by issuing load atomics - LDADD/LDCLR/LDSET - with the destination register unused (but not XZR). Signed-off-by: Catalin Marinas Link: https://lore.kernel.org/r/e7d539ed-ced0-4b96-8ecd-048a5b803b85@paulmck-laptop Reported-by: Paul E. McKenney Tested-by: Paul E. McKenney Cc: Will Deacon Reviewed-by: Palmer Dabbelt [will: Add comment and link to the discussion thread] Signed-off-by: Will Deacon commit 53afec2c8fb2a562222948cb1c2aac48598578c9 Author: Zhang Chujun Date: Thu Nov 6 11:10:40 2025 +0800 tracing/tools: Fix incorrcet short option in usage text for --threads The help message incorrectly listed '-t' as the short option for --threads, but the actual getopt_long configuration uses '-e'. This mismatch can confuse users and lead to incorrect command-line usage. This patch updates the usage string to correctly show: "-e, --threads NRTHR" to match the implementation. Note: checkpatch.pl reports a false-positive spelling warning on 'Run', which is intentional. Link: https://patch.msgid.link/20251106031040.1869-1-zhangchujun@cmss.chinamobile.com Signed-off-by: Zhang Chujun Signed-off-by: Steven Rostedt (Google) commit 0995c2fc39b0f998d40f5d276f67ae22fc1c37c3 Author: Matthew Brost Date: Fri Oct 31 16:40:45 2025 -0700 drm/xe: Enforce correct user fence signaling order using Prevent application hangs caused by out-of-order fence signaling when user fences are attached. Use drm_syncobj (via dma-fence-chain) to guarantee that each user fence signals in order, regardless of the signaling order of the attached fences. Ensure user fence writebacks to user space occur in the correct sequence. v7: - Skip drm_syncbj create of error (CI) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com (cherry picked from commit adda4e855ab6409a3edaa585293f1f2069ab7299) Signed-off-by: Lucas De Marchi commit d23550efc6800841b4d1639784afaebdea946ae0 Author: Mario Limonciello (AMD) Date: Thu Nov 6 12:28:54 2025 -0600 x86/microcode/AMD: Add more known models to entry sign checking Two Zen5 systems are missing from need_sha_check(). Add them. Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://patch.msgid.link/20251106182904.4143757-1-superm1@kernel.org commit b11a020d914c3b7628f56a9ea476a5b03679489b Author: Jouni Högander Date: Fri Oct 31 14:23:11 2025 +0200 drm/xe: Do clean shutdown also when using flr Currently Xe driver is triggering flr without any clean-up on shutdown. This is causing random warnings from pending related works as the underlying hardware is reset in the middle of their execution. Fix this by performing clean shutdown also when using flr. Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler") Cc: Maarten Lankhorst Signed-off-by: Jouni Högander Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com Signed-off-by: Maarten Lankhorst (cherry picked from commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4) Signed-off-by: Lucas De Marchi commit 9cd27eec872f0b95dcdd811edc39d2d32e4158c8 Author: Tejas Upadhyay Date: Tue Oct 7 15:32:08 2025 +0530 drm/xe: Move declarations under conditional branch The xe_device_shutdown() function was needing a few declarations that were only required under a specific condition. This change moves those declarations to be within that conditional branch to avoid unnecessary declarations. Reviewed-by: Nitin Gote Link: https://patchwork.freedesktop.org/patch/msgid/20251007100208.1407021-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay (cherry picked from commit 15b3036045188f4da4ca62b2ed01b0f160252e9b) Signed-off-by: Lucas De Marchi commit 95af8f4fdce8349a5fe75264007f1af2aa1082ea Author: Balasubramani Vivekanandan Date: Mon Nov 3 18:01:47 2025 +0530 drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. Cc: Zhanjun Dong Fixes: d2c5a5a926f4 ("drm/xe/guc: Dead CT helper") Signed-off-by: Balasubramani Vivekanandan Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20251103123144.3231829-6-balasubramani.vivekanandan@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 492671339114e376aaa38626d637a2751cdef263) Signed-off-by: Lucas De Marchi commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 Author: Alvaro Gamez Machado Date: Thu Nov 6 14:45:35 2025 +0100 spi: xilinx: increase number of retries before declaring stall SPI devices using a (relative) slow frequency need a larger time. For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin. Signed-off-by: Alvaro Gamez Machado Reviewed-by: Ricardo Ribalda Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com Signed-off-by: Mark Brown commit 29528c8e643bb0c54da01237a35010c6438423d2 Author: Shenghao Ding Date: Fri Nov 7 13:49:59 2025 +0800 ASoC: tas2781: fix getting the wrong device number The return value of device_property_read_u32_array used for getting the property is the status instead of the number of the property. Fixes: ef3bcde75d06 ("ASoC: tas2781: Add tas2781 driver") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20251107054959.950-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit eef295a8508202e750e4f103a97447f3c9d5e3d0 Author: Ian Forbes Date: Mon Nov 3 14:19:20 2025 -0600 drm/vmwgfx: Restore Guest-Backed only cursor plane support The referenced fixes commit broke the cursor plane for configurations which have Guest-Backed surfaces but no cursor MOB support. Fixes: 965544150d1c ("drm/vmwgfx: Refactor cursor handling") Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251103201920.381503-1-ian.forbes@broadcom.com commit c1962742ffff7e245f935903a4658eb6f94f6058 Author: Ian Forbes Date: Thu Oct 30 14:36:40 2025 -0500 drm/vmwgfx: Use kref in vmw_bo_dirty Rather than using an ad hoc reference count use kref which is atomic and has underflow warnings. Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af Author: Ian Forbes Date: Tue Oct 21 14:01:28 2025 -0500 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality") Reported-by: Rohit Keshri Signed-off-by: Ian Forbes Reviewed-by: Maaz Mombasawala Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com commit a18033f1309cdfd6772799a9b9e72a098c52268b Merge: b57b47741ec15a afcfb6c8474d9e Author: Dave Airlie Date: Fri Nov 7 12:41:23 2025 +1000 Merge tag 'mediatek-drm-fixes-20251105' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20251105 1. Disable AFBC support on Mediatek DRM driver 2. Add pm_runtime support for GCE power control Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20251105151443.3909-1-chunkuang.hu@kernel.org commit 80f0d631dcc76ee1b7755bfca1d8417d91d71414 Author: Zilin Guan Date: Thu Nov 6 12:01:32 2025 +0000 tracing: Fix memory leaks in create_field_var() The function create_field_var() allocates memory for 'val' through create_hist_field() inside parse_atom(), and for 'var' through create_var(), which in turn allocates var->type and var->var.name internally. Simply calling kfree() to release these structures will result in memory leaks. Use destroy_hist_field() to properly free 'val', and explicitly release the memory of var->type and var->var.name before freeing 'var' itself. Link: https://patch.msgid.link/20251106120132.3639920-1-zilin@seu.edu.cn Fixes: 02205a6752f22 ("tracing: Add support for 'field variables'") Signed-off-by: Zilin Guan Signed-off-by: Steven Rostedt (Google) commit aa997d2d2a0b2e76f4df0f1f12829f02acb4fb6b Author: Steven Rostedt Date: Thu Oct 16 13:28:48 2025 -0400 ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up The function ring_buffer_map_get_reader() is a bit more strict than the other get reader functions, and except for certain situations the rb_get_reader_page() should not return NULL. If it does, it triggers a warning. This warning was triggering but after looking at why, it was because another acceptable situation was happening and it wasn't checked for. If the reader catches up to the writer and there's still data to be read on the reader page, then the rb_get_reader_page() will return NULL as there's no new page to get. In this situation, the reader page should not be updated and no warning should trigger. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Vincent Donnefort Reported-by: syzbot+92a3745cea5ec6360309@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/690babec.050a0220.baf87.0064.GAE@google.com/ Link: https://lore.kernel.org/20251016132848.1b11bb37@gandalf.local.home Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions") Signed-off-by: Steven Rostedt (Google) commit 4a0c9b3391999818e2c5b93719699b255be1f682 Merge: f5f2e20b1cbc5f c91afa7610235f Author: Linus Torvalds Date: Thu Nov 6 16:24:12 2025 -0800 Merge tag 'probes-fixes-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fixes from Masami Hiramatsu: - tprobe-events: Fix to register tracepoint correctly tprobe-events missed to set tracepoint data structure before registering callback when enabling it. This sets it correctly. - tprobe-events: Fix to put tracepoint_user when disable the event tprobe-events missed to unregister tracepoint callback when the event is disabled. This ensures to unregister it. * tag 'probes-fixes-v6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe tracing: tprobe-events: Fix to register tracepoint correctly commit f5f2e20b1cbc5f9ea20b372d15967b24921ede19 Merge: 225a97d6d45456 7f17ef0d47b9aa Author: Linus Torvalds Date: Thu Nov 6 16:05:33 2025 -0800 Merge tag 'perf-tools-fixes-for-v6.18-1-2025-11-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Add James Clark as a perf tools reviewer - Handle '1' type symbols in /proc/kallsyms, related to anonymous Rust closures in the DRM panic QR encoder, caught by 'perf test' - Sync kernel header copies: MSRs, uprobe syscall, DRM_IOCTL_GEM_CHANGE_HANDLE, KVM exit reasons, etc * tag 'perf-tools-fixes-for-v6.18-1-2025-11-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf symbols: Handle '1' symbols in /proc/kallsyms tools headers asm: Sync fls headers header with the kernel sources tools headers UAPI: Sync KVM's vmx.h header with the kernel sources to handle new exit reasons tools headers svm: Sync svm headers with the kernel sources tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources MAINTAINERS: Add James Clark as a perf tools reviewer tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers UAPI: Update tools's copy of drm.h to pick DRM_IOCTL_GEM_CHANGE_HANDLE tools headers x86 cpufeatures: Sync with the kernel sources tools headers x86: Sync table due to introducion of uprobe syscall tools headers: Sync uapi/linux/fcntl.h with the kernel sources tools headers: Sync uapi/linux/prctl.h with the kernel source tools headers uapi: Update fs.h with the kernel sources tools arch x86: Sync msr-index.h to pick AMD64_{PERF_CNTR_GLOBAL_STATUS_SET,SAVIC_CONTROL}, IA32_L3_QOS_{ABMC,EXT}_CFG commit 225a97d6d45456a7627633da09cb842a43ef1b85 Merge: 3a157bdfc8d23c 2e448567839c65 Author: Linus Torvalds Date: Thu Nov 6 15:44:18 2025 -0800 Merge tag 'riscv-for-linus-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - A fix to disable KASAN checks while walking a non-current task's stackframe (following x86) - A fix for a kvrealloc()-related memory leak in module_frob_arch_sections() - Two replacements of strcpy() with strscpy() - A change to use the RISC-V .insn assembler directive when possible to assemble instructions from hex opcodes - Some low-impact fixes in the ptdump code and kprobes test code * tag 'riscv-for-linus-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: cpuidle: riscv-sbi: Replace deprecated strcpy in sbi_cpuidle_init_cpu riscv: KGDB: Replace deprecated strcpy in kgdb_arch_handle_qxfer_pkt riscv: asm: use .insn for making custom instructions riscv: tests: Make RISCV_KPROBES_KUNIT tristate riscv: tests: Rename kprobes_test_riscv to kprobes_riscv riscv: Fix memory leak in module_frob_arch_sections() riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro riscv: stacktrace: Disable KASAN checks for non-current tasks commit 3a157bdfc8d23c3fbfbeea47ff721fe9ef254b25 Merge: a1388fcb52fcad 771e8f48358372 Author: Linus Torvalds Date: Thu Nov 6 15:40:14 2025 -0800 Merge tag 'acpi-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix a coding mistake in the ACPI Smart Battery Subsystem (SBS) driver and two documentation issues: - Fix computation of the battery->present value in acpi_battery_read() to work when battery->id is not zero (Dan Carpenter) - Fix comment typo in the ACPI CPPC library (Chu Guangqing) - Fix I2C device references in two ASL examples in the firmware guide that were broken by a previous update (Jonas Gorski)" * tag 'acpi-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: SBS: Fix present test in acpi_battery_read() ACPI: CPPC: Fix typo in a comment Documentation: ACPI: i2c-muxes: fix I2C device references commit b57b47741ec15a7e15190c93ce5aa3198bd3cba4 Merge: 6ec8a47c553007 3c6a743c6961cc Author: Dave Airlie Date: Fri Nov 7 09:20:30 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-11-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-11-06: amdgpu: - Reset fixes - Misc fixes - Panel scaling fixes - HDMI fix - S0ix fixes - Hibernation fix - Secure display fix - Suspend fix - MST fix amdkfd: - Process cleanup fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251106201326.807230-1-alexander.deucher@amd.com commit 6ec8a47c553007aa97afb357bc24112effbabe5e Merge: faf66a71079b5d 7d44ad6b43d0be Author: Dave Airlie Date: Fri Nov 7 09:14:55 2025 +1000 Merge tag 'drm-intel-fixes-2025-11-06' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz) - Fix conversion between clock ticks and nanoseconds (Umesh) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patch.msgid.link/aQyxT1D8IW-xcDbM@intel.com commit faf66a71079b5d916028fab51a9b537df7b28b9f Merge: 6146a0f1dfae5d b750f5a9d64df6 Author: Dave Airlie Date: Fri Nov 7 08:21:15 2025 +1000 Merge tag 'drm-misc-fixes-2025-11-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: imagination: - kconfig: Fix dependencies nouveau: - Set DMA mask earlier - Advertize correct modifiers for GB20x pixpaper: - kconfig: Fix dependencies sched: - Fix deadlock Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patch.msgid.link/20251106131244.GA155679@2a02-2454-fd5e-fd00-d540-1fd5-75b4-d5e2.dyn6.pyur.net commit 74d4432421a3e2669fbccc08c0f4fc2980bf0e39 Author: Gal Pressman Date: Wed Nov 5 21:29:08 2025 +0200 docs: netlink: Couple of intro-specs documentation fixes Fix typo "handul" to "handful" and remove outdated limitation stating only generic netlink is supported (we have netlink-raw). Reviewed-by: Carolina Jubran Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20251105192908.686458-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit c91afa7610235f89a5e8f5686aac23892ab227ed Author: Masami Hiramatsu (Google) Date: Fri Nov 7 01:52:24 2025 +0900 tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe __unregister_trace_fprobe() checks tf->tuser to put it when removing tprobe. However, disable_trace_fprobe() does not use it and only calls unregister_fprobe(). Thus it forgets to disable tracepoint_user. If the trace_fprobe has tuser, put it for unregistering the tracepoint callbacks when disabling tprobe correctly. Link: https://lore.kernel.org/all/176244794466.155515.3971904050506100243.stgit@devnote2/ Fixes: 2867495dea86 ("tracing: tprobe-events: Register tracepoint when enable tprobe event") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Tested-by: Beau Belgrave Reviewed-by: Beau Belgrave commit 10d9dda426d684e98b17161f02f77894c6de9b60 Author: Masami Hiramatsu (Google) Date: Fri Nov 7 01:52:15 2025 +0900 tracing: tprobe-events: Fix to register tracepoint correctly Since __tracepoint_user_init() calls tracepoint_user_register() without initializing tuser->tpoint with given tracpoint, it does not register tracepoint stub function as callback correctly, and tprobe does not work. Initializing tuser->tpoint correctly before tracepoint_user_register() so that it sets up tracepoint callback. I confirmed below example works fine again. echo "t sched_switch preempt prev_pid=prev->pid next_pid=next->pid" > /sys/kernel/tracing/dynamic_events echo 1 > /sys/kernel/tracing/events/tracepoints/sched_switch/enable cat /sys/kernel/tracing/trace_pipe Link: https://lore.kernel.org/all/176244793514.155515.6466348656998627773.stgit@devnote2/ Fixes: 2867495dea86 ("tracing: tprobe-events: Register tracepoint when enable tprobe event") Reported-by: Beau Belgrave Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Tested-by: Beau Belgrave Reviewed-by: Beau Belgrave commit a59e927ff46a967f84ddf94e89cbb045810e8974 Author: Andrey Leonchikov Date: Wed Nov 5 22:07:33 2025 +0100 arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2 Fix typo into regulator GPIO definition. With current definition - USB powered off. Valid definition can be found on "pinctrl" section: vcc5v0_usb2t_en: vcc5v0-usb2t-en { rockchip,pins = <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_none>; }; vcc5v0_usb2b_en: vcc5v0-usb2b-en { rockchip,pins = <4 RK_PC4 RK_FUNC_GPIO &pcfg_pull_none>; }; Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Andrey Leonchikov Link: https://patch.msgid.link/20251105210741.850031-1-andreil499@gmail.com Signed-off-by: Heiko Stuebner commit 771e8f483583728cd2ef164f7c2256c4bf2adf4c Merge: 01e11d18da818e 1642fabff19f76 bd9e119951b527 Author: Rafael J. Wysocki Date: Thu Nov 6 22:10:27 2025 +0100 Merge branches 'acpi-cppc' and 'acpi-docs' Merge two documentation fixes for 6.18-rc5, a commet typo fix in the ACPI CPPC library (Chu Guangqing) and fixes for two ASL examples in the firmware guide (Jonas Gorski). * acpi-cppc: ACPI: CPPC: Fix typo in a comment * acpi-docs: Documentation: ACPI: i2c-muxes: fix I2C device references commit a1388fcb52fcad3e0b06e2cdd0ed757a82a5be30 Merge: c668da99b923bc 44e8241c51f762 Author: Linus Torvalds Date: Thu Nov 6 12:48:18 2025 -0800 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Two Curve25519 related fixes: - Re-enable KASAN support on curve25519-hacl64.c with gcc. - Disable the arm optimized Curve25519 code on CPU_BIG_ENDIAN kernels. It has always been broken in that configuration" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC commit c668da99b923bc0527f19e361bb8496be087970f Merge: c90841db352465 1e39da974ce621 Author: Linus Torvalds Date: Thu Nov 6 12:45:15 2025 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt fix from Eric Biggers: "Fix an UBSAN warning that started occurring when the block layer started supporting logical_block_size > PAGE_SIZE" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT commit f2a12cc3b97f062186568a7b94ddb7aa2ef68140 Author: Gao Xiang Date: Fri Oct 31 13:47:39 2025 +0800 erofs: avoid infinite loop due to incomplete zstd-compressed data Currently, the decompression logic incorrectly spins if compressed data is truncated in crafted (deliberately corrupted) images. Fixes: 7c35de4df105 ("erofs: Zstandard compression support") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/50958.1761605413@localhost Signed-off-by: Gao Xiang Reviewed-by: Chunhai Guo Reviewed-by: Chao Yu commit c90841db3524657204c096fd47283817cfdbd2f9 Merge: c2c2ccfd4ba727 c57f5fee54dfc8 Author: Linus Torvalds Date: Thu Nov 6 11:54:59 2025 -0800 Merge tag 'hardening-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: "This is a work-around for a (now fixed) corner case in the arm32 build with Clang KCFI enabled. - Introduce __nocfi_generic for arm32 Clang (Nathan Chancellor)" * tag 'hardening-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: libeth: xdp: Disable generic kCFI pass for libeth_xdp_tx_xmit_bulk() ARM: Select ARCH_USES_CFI_GENERIC_LLVM_PASS compiler_types: Introduce __nocfi_generic commit a9da90e618cd0669a22bcc06a96209db5dd96e9b Author: Johannes Berg Date: Wed Nov 5 15:41:19 2025 +0100 wifi: mac80211: reject address change while connecting While connecting, the MAC address can already no longer be changed. The change is already rejected if netif_carrier_ok(), but of course that's not true yet while connecting. Check for auth_data or assoc_data, so the MAC address cannot be changed. Also more comprehensively check that there are no stations on the interface being changed - if any peer station is added it will know about our address already, so we cannot change it. Cc: stable@vger.kernel.org Fixes: 3c06e91b40db ("wifi: mac80211: Support POWERED_ADDR_CHANGE feature") Link: https://patch.msgid.link/20251105154119.f9f6c1df81bb.I9bb3760ede650fb96588be0d09a5a7bdec21b217@changeid Signed-off-by: Johannes Berg commit 4436f484cb437ba28dc58b7f787a6f80a65aa5c3 Author: Krzysztof Kozlowski Date: Thu Nov 6 17:16:25 2025 +0100 gpio: tb10x: Drop unused tb10x_set_bits() function tb10x_set_bits() is not referenced anywhere leading to W=1 warning: gpio-tb10x.c:59:20: error: unused function 'tb10x_set_bits' [-Werror,-Wunused-function] After its removal, tb10x_reg_write() becomes unused as well. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251106-gpio-of-match-v1-1-50c7115a045e@linaro.org Signed-off-by: Bartosz Golaszewski commit 3dc8c73365d3ca25c99e7e1a0f493039d7291df5 Author: Haotian Zhang Date: Thu Nov 6 22:31:14 2025 +0800 ASoC: codecs: va-macro: fix resource leak in probe error path In the commit referenced by the Fixes tag, clk_hw_get_clk() was added in va_macro_probe() to get the fsgen clock, but forgot to add the corresponding clk_put() in va_macro_remove(). This leads to a clock reference leak when the driver is unloaded. Switch to devm_clk_hw_get_clk() to automatically manage the clock resource. Fixes: 30097967e056 ("ASoC: codecs: va-macro: use fsgen as clock") Suggested-by: Konrad Dybcio Signed-off-by: Haotian Zhang Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20251106143114.729-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 3c6a743c6961cc2cab453b343bb157d6bbbf8120 Author: Wayne Lin Date: Wed Nov 5 10:36:31 2025 +0800 drm/amd/display: Enable mst when it's detected but yet to be initialized [Why] drm_dp_mst_topology_queue_probe() is used under the assumption that mst is already initialized. If we connect system with SST first then switch to the mst branch during suspend, we will fail probing topology by calling the wrong API since the mst manager is yet to be initialized. [How] At dm_resume(), once it's detected as mst branc connected, check if the mst is initialized already. If not, call dm_helpers_dp_mst_start_top_mgr() instead to initialize mst V2: Adjust the commit msg a bit Fixes: bc068194f548 ("drm/amd/display: Don't write DP_MSTM_CTRL after LT") Cc: Fangzhi Zuo Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Tom Chung Signed-off-by: Wayne Lin Signed-off-by: Alex Deucher (cherry picked from commit 62320fb8d91a0bddc44a228203cfa9bfbb5395bd) Cc: stable@vger.kernel.org commit 570a66b48c22214851949fcd71816fee280aa096 Author: Lijo Lazar Date: Mon Nov 3 16:21:50 2025 +0530 drm/amdgpu: Fix wait after reset sequence in S3 For a mode-1 reset done at the end of S3 on PSPv11 dGPUs, only check if TOS is unloaded. Fixes: 32f73741d6ee ("drm/amdgpu: Wait for bootloader after PSPv11 reset") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4649 Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 1ad25fd272753db14c5d1cc8c68e20ce01f3f888) commit b09cb2996cdf50cd1ab4020e002c95d742c81313 Author: Mario Limonciello Date: Tue Nov 4 13:38:02 2025 -0600 drm/amd: Fix suspend failure with secure display TA commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded successfully") attempted to fix extra messages, but failed to port the cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable secure display TA multiple times") to prevent multiple tries. Add that to the failure handling path even on a quick failure. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240) commit eb6e7f520d6efa4d4ebf1671455abe4a681f7a05 Author: Samuel Zhang Date: Wed Nov 5 03:04:08 2025 +0000 drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens during hibernate, but partition mode is not restored on resume, register mmCP_HYP_XCP_CTL and mmCP_PSP_XCP_CTL is not right after resume. When CP access the MQD BO, wrong stride size is used, this will cause out of bound access on the MQD BO, resulting page fault. The fix is to ensure gfx_v9_4_3_switch_compute_partition() is called when resume from a hibernation. KFD resume is called separately during a reset recovery or resume from suspend sequence. Hence it's not required to be called as part of partition switch. Signed-off-by: Samuel Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 5d1b32cfe4a676fe552416cb5ae847b215463a1a) commit c2c2ccfd4ba72718266a56f3ecc34c989cb5b7a0 Merge: dc77806cf3b478 3534e03e0ec2e0 Author: Linus Torvalds Date: Thu Nov 6 08:52:30 2025 -0800 Merge tag 'net-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: Including fixes from bluetooth and wireless. Current release - new code bugs: - ptp: expose raw cycles only for clocks with free-running counter - bonding: fix null-deref in actor_port_prio setting - mdio: ERR_PTR-check regmap pointer returned by device_node_to_regmap() - eth: libie: depend on DEBUG_FS when building LIBIE_FWLOG Previous releases - regressions: - virtio_net: fix perf regression due to bad alignment of virtio_net_hdr_v1_hash - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" caused regressions for QCA988x and QCA9984 - Revert "wifi: ath12k: Fix missing station power save configuration" caused regressions for WCN7850 - eth: bnxt_en: shutdown FW DMA in bnxt_shutdown(), fix memory corruptions after kexec Previous releases - always broken: - virtio-net: fix received packet length check for big packets - sctp: fix races in socket diag handling - wifi: add an hrtimer-based delayed work item to avoid low granularity of timers set relatively far in the future, and use it where it matters (e.g. when performing AP-scheduled channel switch) - eth: mlx5e: - correctly propagate error in case of module EEPROM read failure - fix HW-GRO on systems with PAGE_SIZE == 64kB - dsa: b53: fixes for tagging, link configuration / RMII, FDB, multicast - phy: lan8842: implement latest errata" * tag 'net-6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (63 commits) selftests/vsock: avoid false-positives when checking dmesg net: bridge: fix MST static key usage net: bridge: fix use-after-free due to MST port state bypass lan966x: Fix sleeping in atomic context bonding: fix NULL pointer dereference in actor_port_prio setting net: dsa: microchip: Fix reserved multicast address table programming net: wan: framer: pef2256: Switch to devm_mfd_add_devices() net: libwx: fix device bus LAN ID net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages net/mlx5e: SHAMPO, Fix skb size check for 64K pages net/mlx5e: SHAMPO, Fix header mapping for 64K pages net: ti: icssg-prueth: Fix fdb hash size configuration net/mlx5e: Fix return value in case of module EEPROM read error net: gro_cells: Reduce lock scope in gro_cell_poll libie: depend on DEBUG_FS when building LIBIE_FWLOG wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup netpoll: Fix deadlock in memory allocation under spinlock net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error virtio-net: fix received length check in big packets bnxt_en: Fix warning in bnxt_dl_reload_down() ... commit a26a6c93edfeee82cb73f55e87d995eea59ddfe8 Author: Nathan Chancellor Date: Wed Nov 5 15:30:27 2025 -0700 kbuild: Strip trailing padding bytes from modules.builtin.modinfo After commit d50f21091358 ("kbuild: align modinfo section for Secureboot Authenticode EDK2 compat"), running modules_install with certain versions of kmod (such as 29.1 in Ubuntu Jammy) in certain configurations may fail with: depmod: ERROR: kmod_builtin_iter_next: unexpected string without modname prefix The additional padding bytes to ensure .modinfo is aligned within vmlinux.unstripped are unexpected by kmod, as this section has always just been null-terminated strings. Strip the trailing padding bytes from modules.builtin.modinfo after it has been extracted from vmlinux.unstripped to restore the format that kmod expects while keeping .modinfo aligned within vmlinux.unstripped to avoid regressing the Authenticode calculation fix for EDK2. Cc: stable@vger.kernel.org Fixes: d50f21091358 ("kbuild: align modinfo section for Secureboot Authenticode EDK2 compat") Reported-by: Omar Sandoval Reported-by: Samir M Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/7fef7507-ad64-4e51-9bb8-c9fb6532e51e@linux.ibm.com/ Tested-by: Omar Sandoval Tested-by: Samir M Tested-by: Venkat Rao Bagalkote Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251105-kbuild-fix-builtin-modinfo-for-kmod-v1-1-b419d8ad4606@kernel.org Signed-off-by: Nathan Chancellor commit 3534e03e0ec2e00908765549828a69df5ebefb91 Author: Bobby Eshleman Date: Wed Nov 5 07:59:19 2025 -0800 selftests/vsock: avoid false-positives when checking dmesg Sometimes VMs will have some intermittent dmesg warnings that are unrelated to vsock. Change the dmesg parsing to filter on strings containing 'vsock' to avoid false positive failures that are unrelated to vsock. The downside is that it is possible for some vsock related warnings to not contain the substring 'vsock', so those will be missed. Fixes: a4a65c6fe08b ("selftests/vsock: add initial vmtest.sh for vsock") Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251105-vsock-vmtest-dmesg-fix-v2-1-1a042a14892c@meta.com Signed-off-by: Jakub Kicinski commit 13fef4fb0536c80e8c4a77e69fe0b5deeb7c331b Merge: 0216721ce71252 ee87c63f9b2a41 Author: Jakub Kicinski Date: Thu Nov 6 07:32:19 2025 -0800 Merge branch 'net-bridge-fix-two-mst-bugs' Nikolay Aleksandrov says: ==================== net: bridge: fix two MST bugs Patch 01 fixes a race condition that exists between expired fdb deletion and port deletion when MST is enabled. Learning can happen after the port's state has been changed to disabled which could lead to that port's memory being used after it's been freed. The issue was reported by syzbot, more information in patch 01. Patch 02 fixes an issue with MST's static key which Ido spotted, we can have multiple bridges with MST and a single bridge can erroneously disable it for all. ==================== Link: https://patch.msgid.link/20251105111919.1499702-1-razor@blackwall.org Signed-off-by: Jakub Kicinski commit ee87c63f9b2a418f698d79c2991347e31a7d2c27 Author: Nikolay Aleksandrov Date: Wed Nov 5 13:19:19 2025 +0200 net: bridge: fix MST static key usage As Ido pointed out, the static key usage in MST is buggy and should use inc/dec instead of enable/disable because we can have multiple bridges with MST enabled which means a single bridge can disable MST for all. Use static_branch_inc/dec to avoid that. When destroying a bridge decrement the key if MST was enabled. Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: Ido Schimmel Closes: https://lore.kernel.org/netdev/20251104120313.1306566-1-razor@blackwall.org/T/#m6888d87658f94ed1725433940f4f4ebb00b5a68b Signed-off-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251105111919.1499702-3-razor@blackwall.org Signed-off-by: Jakub Kicinski commit 8dca36978aa80bab9d4da130c211db75c9e00048 Author: Nikolay Aleksandrov Date: Wed Nov 5 13:19:18 2025 +0200 net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") Reported-by: syzbot+dd280197f0f7ab3917be@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69088ffa.050a0220.29fc44.003d.GAE@google.com/ Signed-off-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251105111919.1499702-2-razor@blackwall.org Signed-off-by: Jakub Kicinski commit 0216721ce71252f60d89af49c8dff613358058d3 Author: Horatiu Vultur Date: Wed Nov 5 08:49:55 2025 +0100 lan966x: Fix sleeping in atomic context The following warning was seen when we try to connect using ssh to the device. BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 104, name: dropbear preempt_count: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 104 Comm: dropbear Tainted: G W 6.18.0-rc2-00399-g6f1ab1b109b9-dirty #530 NONE Tainted: [W]=WARN Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __might_resched+0x16c/0x2b0 __might_resched from __mutex_lock+0x64/0xd34 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from lan966x_stats_get+0x5c/0x558 lan966x_stats_get from dev_get_stats+0x40/0x43c dev_get_stats from dev_seq_printf_stats+0x3c/0x184 dev_seq_printf_stats from dev_seq_show+0x10/0x30 dev_seq_show from seq_read_iter+0x350/0x4ec seq_read_iter from seq_read+0xfc/0x194 seq_read from proc_reg_read+0xac/0x100 proc_reg_read from vfs_read+0xb0/0x2b0 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b11fa8 to 0xf0b11ff0) 1fa0: 00000001 00001000 00000008 be9048d8 00001000 00000001 1fc0: 00000001 00001000 00000008 00000003 be905920 0000001e 00000000 00000001 1fe0: 0005404c be9048c0 00018684 b6ec2cd8 It seems that we are using a mutex in a atomic context which is wrong. Change the mutex with a spinlock. Fixes: 12c2d0a5b8e2 ("net: lan966x: add ethtool configuration and statistics") Signed-off-by: Horatiu Vultur Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251105074955.1766792-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 9065b968752334f972e0d48e50c4463a172fc2a7 Author: Nicolas Escande Date: Tue Nov 4 09:39:57 2025 +0100 wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() When reporting tx completion using ieee80211_tx_status_xxx() family of functions, the status part of the struct ieee80211_tx_info nested in the skb is used to report things like transmit rates & retry count to mac80211 On the TX data path, this is correctly memset to 0 before calling ieee80211_tx_status_ext(), but on the tx mgmt path this was not done. This leads to mac80211 treating garbage values as valid transmit counters (like tx retries for example) and accounting them as real statistics that makes their way to userland via station dump. The same issue was resolved in ath12k by commit 9903c0986f78 ("wifi: ath12k: Add memset and update default rate value in wmi tx completion") Tested-on: QCN9074 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Nicolas Escande Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251104083957.717825-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson commit 067bf016e99ad72aa4ff869d6dec1fd62a9c6202 Author: Hangbin Liu Date: Wed Nov 5 07:26:20 2025 +0000 bonding: fix NULL pointer dereference in actor_port_prio setting Liang reported an issue where setting a slave’s actor_port_prio to predefined values such as 0, 255, or 65535 would cause a system crash. The problem occurs because in bond_opt_parse(), when the provided value matches a predefined table entry, the function returns that table entry, which does not contain slave information. Later, in bond_option_actor_port_prio_set(), calling bond_slave_get_rtnl() leads to a NULL pointer dereference. Since actor_port_prio is defined as a u16 and initialized to the default value of 255 in ad_initialize_port(), there is no need for the bond_actor_port_prio_tbl. Using the BOND_OPTFLAG_RAWVAL flag is sufficient. Fixes: 6b6dc81ee7e8 ("bonding: add support for per-port LACP actor priority") Reported-by: Liang Li Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251105072620.164841-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 96baf482ca1f69f0da9d10a5bd8422c87ea9039e Author: Tristram Ha Date: Tue Nov 4 19:37:41 2025 -0800 net: dsa: microchip: Fix reserved multicast address table programming KSZ9477/KSZ9897 and LAN937X families of switches use a reserved multicast address table for some specific forwarding with some multicast addresses, like the one used in STP. The hardware assumes the host port is the last port in KSZ9897 family and port 5 in LAN937X family. Most of the time this assumption is correct but not in other cases like KSZ9477. Originally the function just setups the first entry, but the others still need update, especially for one common multicast address that is used by PTP operation. LAN937x also uses different register bits when accessing the reserved table. Fixes: 457c182af597 ("net: dsa: microchip: generic access to ksz9477 static and reserved table") Signed-off-by: Tristram Ha Tested-by: Łukasz Majewski Link: https://patch.msgid.link/20251105033741.6455-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit d0164c161923ac303bd843e04ebe95cfd03c6e19 Author: Sukrit Bhatnagar Date: Thu Nov 6 14:28:51 2025 +0900 KVM: VMX: Fix check for valid GVA on an EPT violation On an EPT violation, bit 7 of the exit qualification is set if the guest linear-address is valid. The derived page fault error code should not be checked for this bit. Fixes: f3009482512e ("KVM: VMX: Set PFERR_GUEST_{FINAL,PAGE}_MASK if and only if the GVA is valid") Cc: stable@vger.kernel.org Signed-off-by: Sukrit Bhatnagar Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20251106052853.3071088-1-Sukrit.Bhatnagar@sony.com Signed-off-by: Sean Christopherson commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 Author: Robin Gong Date: Fri Oct 24 13:53:20 2025 +0800 spi: imx: keep dma request disabled before dma transfer setup Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below: "It is thus essential for the Arm platform to program them before any DMA request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started." Signed-off-by: Carlos Song Signed-off-by: Robin Gong Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 84f5526e4dce0a44d050ceb1b1bf21d43016d91b Author: Niranjan H Y Date: Thu Oct 30 20:46:37 2025 +0530 ASoC: tas2783A: Fix issues in firmware parsing During firmware download, if the size of the firmware is too small, it wrongly assumes the firmware download is successful. If there is size mismatch with chunk's header, invalid memory is accessed. Fix these issues by throwing error during these cases. Fixes: 4cc9bd8d7b32 (ASoc: tas2783A: Add soundwire based codec driver) Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202510291226.2R3fbYNh-lkp@intel.com/ Signed-off-by: Niranjan H Y Link: https://patch.msgid.link/20251030151637.566-1-niranjan.hy@ti.com Signed-off-by: Mark Brown commit 1a58d865f423f4339edf59053e496089075fa950 Author: Miaoqian Lin Date: Wed Oct 29 15:17:58 2025 +0800 ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() The bus_find_device_by_name() function returns a device pointer with an incremented reference count, but the original code was missing put_device() calls in some return paths, leading to reference count leaks. Fix this by ensuring put_device() is called before function exit after bus_find_device_by_name() succeeds This follows the same pattern used elsewhere in the kernel where bus_find_device_by_name() is properly paired with put_device(). Found via static analysis and code review. Fixes: 4f8ef33dd44a ("ASoC: soc_sdw_utils: skip the endpoint that doesn't present") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://patch.msgid.link/20251029071804.8425-1-linmq006@gmail.com Signed-off-by: Mark Brown commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 Author: Haotian Zhang Date: Wed Nov 5 14:22:46 2025 +0800 ASoC: cs4271: Fix regulator leak on probe failure The probe function enables regulators at the beginning but fails to disable them in its error handling path. If any operation after enabling the regulators fails, the probe will exit with an error, leaving the regulators permanently enabled, which could lead to a resource leak. Add a proper error handling path to call regulator_bulk_disable() before returning an error. Fixes: 9a397f473657 ("ASoC: cs4271: add regulator consumer support") Signed-off-by: Haotian Zhang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251105062246.1955-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit b750f5a9d64df6cfe9103c7feb7314694318818d Author: LiangCheng Wang Date: Tue Oct 28 10:55:38 2025 +0800 drm/tiny: pixpaper: add explicit dependency on MMU The DRM_GEM_SHMEM_HELPER helper requires MMU enabled because it uses vmf_insert_pfn() in its mmap implementation. On NOMMU configurations (e.g. some RISC-V randconfig builds), this symbol is unavailable and selecting DRM_GEM_SHMEM_HELPER causes a modpost undefined reference: ERROR: modpost: "vmf_insert_pfn" [drivers/gpu/drm/drm_shmem_helper.ko] undefined! Normally, Kconfig prevents this helper from being selected when CONFIG_MMU=n. However, in some randconfig builds (such as those used by 0day CI), select statements can override unmet dependencies, triggering the issue. Add an explicit dependency on MMU to DRM_PIXPAPER to prevent this. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510280213.0rlYA4T3-lkp@intel.com/ Fixes: 0c4932f6ddf8 ("drm/tiny: pixpaper: Fix missing dependency on DRM_GEM_SHMEM_HELPER") Acked-by: Thomas Zimmermann Signed-off-by: LiangCheng Wang Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251028-bar-v1-1-edfbd13fafff@gmail.com commit f945afe01c6768dcfed7868c671a26e1164c2284 Author: Antheas Kapenekakis Date: Wed Oct 8 15:50:57 2025 +0200 platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list The Lenovo Legion Go 2 takes a long time to resume from suspend. This is due to it having an nvme resume handler that interferes with IOMMU mappings. It is a common issue with older Lenovo laptops. Adding it to that quirk list fixes this issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618 Suggested-by: Mario Limonciello Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 Author: Antheas Kapenekakis Date: Fri Oct 24 17:21:51 2025 +0200 platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally The Xbox Ally features a Van Gogh SoC that has spurious interrupts during resume. We get the following logs: atkbd_receive_byte: 20 callbacks suppressed atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly. So, add the spurious_8042 quirk for it. It does not have a keyboard, so this does not result in any functional loss. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb Author: Antheas Kapenekakis Date: Fri Oct 24 17:21:50 2025 +0200 platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Signed-off-by: Antheas Kapenekakis Reviewed-by: Mario Limonciello (AMD) Acked-by: Shyam Sundar S K Link: https://patch.msgid.link/20251024152152.3981721-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a6003d90f02863898babbcb3f55b1cd33f7867c2 Author: Kurt Borja Date: Mon Nov 3 14:01:48 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "G" family Add support for the whole "Dell G" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-5-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 21ebfff1cf4727bc325c89b94ed93741f870744f Author: Kurt Borja Date: Mon Nov 3 14:01:47 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "X" family Add support for the whole "Alienware X" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-4-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e8c3c875e1017c04c594f0e6127ba82095b1cb87 Author: Kurt Borja Date: Mon Nov 3 14:01:46 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for the whole "M" family Add support for the whole "Alienware M" laptop family. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-3-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 173b23808768ce5a9210d7783b06dce8a0cb3c2e Author: Kurt Borja Date: Mon Nov 3 14:01:45 2025 -0500 platform/x86: alienware-wmi-wmax: Drop redundant DMI entries The awcc_dmi_table[] uses DMI_MATCH() that supports partial matches. As there is already "Alienware Area-51m" entry, "Alienware Area-51m R2" entry is redundant. Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-2-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bd4f9f113dda07293ed4002a17d14f62121d324f Author: Kurt Borja Date: Mon Nov 3 14:01:44 2025 -0500 platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order Quirks are matched using dmi_first_match(), therefore move the "Alienware m16 R1 AMD" entry above other m16 entries. Reported-by: Cihan Ozakca Fixes: e2468dc70074 ("Revert "platform/x86: alienware-wmi-wmax: Add G-Mode support to Alienware m16 R1"") Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-family-supp-v1-1-a241075d1787@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5f20bc206beb902e32b77216cb7935b46ca00b0a Author: Randy Dunlap Date: Thu Oct 23 12:46:14 2025 -0700 platform/x86: ISST: isst_if.h: fix all kernel-doc warnings Fix all kernel-doc warnings in : - don't use "[]" in the variable name in kernel-doc - add a few missing entries - change "power_domain" to "power_domain_id" in kernel-doc to match the struct member name - add a leading '@' on a few existing kernel-doc lines - use '_' instead of '-' in struct member names Examples (but not all 27 warnings): Warning: include/uapi/linux/isst_if.h:63 struct member 'cpu_map' not described in 'isst_if_cpu_maps' Warning: ../include/uapi/linux/isst_if.h:95 struct member 'req_count' not described in 'isst_if_io_regs' Warning: include/uapi/linux/isst_if.h:132 struct member 'mbox_cmd' not described in 'isst_if_mbox_cmds' Warning: ../include/uapi/linux/isst_if.h:183 struct member 'supported' not described in 'isst_core_power' Warning: ../include/uapi/linux/isst_if.h:206 struct member 'power_domain_id' not described in 'isst_clos_param' Warning: ../include/uapi/linux/isst_if.h:239 struct member 'assoc_info' not described in 'isst_if_clos_assoc_cmds' Warning: ../include/uapi/linux/isst_if.h:286 struct member 'sst_tf_support' not described in 'isst_perf_level_info' Warning: ../include/uapi/linux/isst_if.h:375 struct member 'trl_freq_mhz' not described in 'isst_perf_level_data_info' Warning: ../include/uapi/linux/isst_if.h:475 struct member 'max_buckets' not described in 'isst_turbo_freq_info' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251023194615.180824-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a229809c18926e79aeca232d5b502157beb0dec3 Author: Kuppuswamy Sathyanarayanan Date: Wed Oct 22 14:17:33 2025 -0700 platform/x86: intel-uncore-freq: Add additional client processors Add Intel uncore frequency driver support for Pantherlake, Wildcatlake and Novalake processors. Signed-off-by: Kuppuswamy Sathyanarayanan Link: https://patch.msgid.link/20251022211733.3565526-1-sathyanarayanan.kuppuswamy@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fb146a38cb119c8d69633851c7a2ce2c8d34861a Author: Krishna Chomal Date: Sat Oct 18 16:40:01 2025 +0530 platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support The newer HP Omen laptops, such as Omen 16-wf1xxx, use the same WMI-based thermal profile interface as Victus 16-r1000 and 16-s1000 models. Add the DMI board name "8C78" to the victus_s_thermal_profile_boards list to enable proper fan and thermal mode control. Tested on: HP Omen 16-wf1xxx (board 8C78) Result: * Fan RPMs are readable * echo 0 | sudo tee /sys/devices/platform/hp-wmi/hwmon/*/pwm1_enable allows the fans to run on max RPM. Signed-off-by: Krishna Chomal Link: https://patch.msgid.link/20251018111001.56625-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5c72329716d0858621021193330594d5d26bf44d Author: Jia Ston Date: Wed Oct 29 05:18:38 2025 +0000 platform/x86: huawei-wmi: add keys for HONOR models HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e). To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models. Signed-off-by: Ston Jia Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 54afb047cd7eb40149f3fc42d69fd4ddde2be9f0 Author: Edip Hazuri Date: Wed Oct 15 21:10:44 2025 +0300 platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support This patch adds Victus 16-r0 (8bbe) and Victus 16-s0(8bd4, 8bd5) laptop DMI board name into existing list Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20251015181042.23961-3-edip@medip.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4cb5ac2626b5704ed712ac1d46b9d89fdfc12c5d Author: Peter Zijlstra Date: Wed Jul 16 16:29:46 2025 +0200 futex: Optimize per-cpu reference counting Shrikanth noted that the per-cpu reference counter was still some 10% slower than the old immutable option (which removes the reference counting entirely). Further optimize the per-cpu reference counter by: - switching from RCU to preempt; - using __this_cpu_*() since we now have preempt disabled; - switching from smp_load_acquire() to READ_ONCE(). This is all safe because disabling preemption inhibits the RCU grace period exactly like rcu_read_lock(). Having preemption disabled allows using __this_cpu_*() provided the only access to the variable is in task context -- which is the case here. Furthermore, since we know changing fph->state to FR_ATOMIC demands a full RCU grace period we can rely on the implied smp_mb() from that to replace the acquire barrier(). This is very similar to the percpu_down_read_internal() fast-path. The reason this is significant for PowerPC is that it uses the generic this_cpu_*() implementation which relies on local_irq_disable() (the x86 implementation relies on it being a single memop instruction to be IRQ-safe). Switching to preempt_disable() and __this_cpu*() avoids this IRQ state swizzling. Also, PowerPC needs LWSYNC for the ACQUIRE barrier, not having to use explicit barriers safes a bunch. Combined this reduces the performance gap by half, down to some 5%. Fixes: 760e6f7befba ("futex: Remove support for IMMUTABLE") Reported-by: Shrikanth Hegde Tested-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251106092929.GR4067720@noisy.programming.kicks-ass.net commit 956dfda6a70885f18c0f8236a461aa2bc4f556ad Author: Aaron Lu Date: Thu Oct 30 11:27:55 2025 +0800 sched/fair: Prevent cfs_rq from being unthrottled with zero runtime_remaining When a cfs_rq is to be throttled, its limbo list should be empty and that's why there is a warn in tg_throttle_down() for non empty cfs_rq->throttled_limbo_list. When running a test with the following hierarchy: root / \ A* ... / | \ ... B / \ C* where both A and C have quota settings, that warn on non empty limbo list is triggered for a cfs_rq of C, let's call it cfs_rq_c(and ignore the cpu part of the cfs_rq for the sake of simpler representation). Debug showed it happened like this: Task group C is created and quota is set, so in tg_set_cfs_bandwidth(), cfs_rq_c is initialized with runtime_enabled set, runtime_remaining equals to 0 and *unthrottled*. Before any tasks are enqueued to cfs_rq_c, *multiple* throttled tasks can migrate to cfs_rq_c (e.g., due to task group changes). When enqueue_task_fair(cfs_rq_c, throttled_task) is called and cfs_rq_c is in a throttled hierarchy (e.g., A is throttled), these throttled tasks are directly placed into cfs_rq_c's limbo list by enqueue_throttled_task(). Later, when A is unthrottled, tg_unthrottle_up(cfs_rq_c) enqueues these tasks. The first enqueue triggers check_enqueue_throttle(), and with zero runtime_remaining, cfs_rq_c can be throttled in throttle_cfs_rq() if it can't get more runtime and enters tg_throttle_down(), where the warning is hit due to remaining tasks in the limbo list. I think it's a chaos to trigger throttle on unthrottle path, the status of a being unthrottled cfs_rq can be in a mixed state in the end, so fix this by granting 1ns to cfs_rq in tg_set_cfs_bandwidth(). This ensures cfs_rq_c has a positive runtime_remaining when initialized as unthrottled and cannot enter tg_unthrottle_up() with zero runtime_remaining. Also, update outdated comments in tg_throttle_down() since unthrottle_cfs_rq() is no longer called with zero runtime_remaining. While at it, remove a redundant assignment to se in tg_throttle_down(). Fixes: e1fad12dcb66 ("sched/fair: Switch to task based throttle model") Reviewed-By: Benjamin Segall Suggested-by: Benjamin Segall Signed-off-by: Aaron Lu Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Tested-by: Hao Jia Link: https://patch.msgid.link/20251030032755.560-1-ziqianlu@bytedance.com commit 82420bd4e17bdaba8453fbf9e10c58c9ed0c9727 Author: Takashi Iwai Date: Thu Nov 6 11:46:45 2025 +0100 ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver After restructuring and splitting the HDMI codec driver code, each HDMI codec driver contains the own build_controls and build_pcms ops. A copy-n-paste error put the wrong entries for nvhdmi-mcp driver; both build_controls and build_pcms are swapped. Unfortunately both callbacks have the very same form, and the compiler didn't complain it, either. This resulted in a NULL dereference because the PCM instance hasn't been initialized at calling the build_controls callback. Fix it by passing the proper entries. Fixes: ad781b550f9a ("ALSA: hda/hdmi: Rewrite to new probe method") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=220743 Link: https://patch.msgid.link/20251106104647.25805-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d8a823c6f04ef03e3bd7249d2e796da903e7238d Author: Christoph Hellwig Date: Tue Nov 4 05:43:01 2025 -0500 xfs: free xfs_busy_extents structure when no RT extents are queued kmemleak occasionally reports leaking xfs_busy_extents structure from xfs_scrub calls after running xfs/528 (but attributed to following tests), which seems to be caused by not freeing the xfs_busy_extents structure when tr.queued is 0 and xfs_trim_rtgroup_extents breaks out of the main loop. Free the structure in this case. Fixes: a3315d11305f ("xfs: use rtgroup busy extent list for FITRIM") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit c379b745e12a99f0a54bafaaf75fc710614511ce Author: Vlastimil Babka Date: Mon Nov 3 13:24:15 2025 +0100 slab: prevent infinite loop in kmalloc_nolock() with debugging In review of a followup work, Harry noticed a potential infinite loop. Upon closed inspection, it already exists for kmalloc_nolock() on a cache with debugging enabled, since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") When alloc_single_from_new_slab() fails to trylock node list_lock, we keep retrying to get partial slab or allocate a new slab. If we indeed interrupted somebody holding the list_lock, the trylock fill fail deterministically and we end up allocating and defer-freeing slabs indefinitely with no progress. To fix it, fail the allocation if spinning is not allowed. This is acceptable in the restricted context of kmalloc_nolock(), especially with debugging enabled. Reported-by: Harry Yoo Closes: https://lore.kernel.org/all/aQLqZjjq1SPD3Fml@hyeyoo/ Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Acked-by: Alexei Starovoitov Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251103-fix-nolock-loop-v1-1-6e2b3e82b9da@suse.cz Signed-off-by: Vlastimil Babka commit 59b0afd01b2ce353ab422ea9c8375b03db313a21 Author: Miaoqian Lin Date: Mon Oct 27 23:09:34 2025 +0800 crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value The qm_get_qos_value() function calls bus_find_device_by_name() which increases the device reference count, but fails to call put_device() to balance the reference count and lead to a device reference leak. Add put_device() calls in both the error path and success path to properly balance the reference count. Found via static analysis. Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Longfang Liu Signed-off-by: Herbert Xu commit 7d1988a943850c584e8e2e4bcc7a3b5275024072 Merge: 4d6ec3a7932ca5 4c740c4d8bac55 Author: Jakub Kicinski Date: Wed Nov 5 18:04:54 2025 -0800 Merge tag 'wireless-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just two small fixes: - ath12k: revert a change that caused performance regressions - hwsim: don't ignore netns on netlink socket matching * tag 'wireless-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup Revert "wifi: ath12k: Fix missing station power save configuration" ==================== Link: https://patch.msgid.link/20251105152827.53254-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 4d6ec3a7932ca5b168426f7b5b40abab2b41d2da Author: Haotian Zhang Date: Wed Nov 5 11:47:16 2025 +0800 net: wan: framer: pef2256: Switch to devm_mfd_add_devices() The driver calls mfd_add_devices() but fails to call mfd_remove_devices() in error paths after successful MFD device registration and in the remove function. This leads to resource leaks where MFD child devices are not properly unregistered. Replace mfd_add_devices with devm_mfd_add_devices to automatically manage the device resources. Fixes: c96e976d9a05 ("net: wan: framer: Add support for the Lantiq PEF2256 framer") Suggested-by: Herve Codina Signed-off-by: Haotian Zhang Acked-by: Herve Codina Link: https://patch.msgid.link/20251105034716.662-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski commit a04ea57aae375bdda1cb57034d8bcbb351e1f973 Author: Jiawen Wu Date: Tue Nov 4 14:23:21 2025 +0800 net: libwx: fix device bus LAN ID The device bus LAN ID was obtained from PCI_FUNC(), but when a PF port is passthrough to a virtual machine, the function number may not match the actual port index on the device. This could cause the driver to perform operations such as LAN reset on the wrong port. Fix this by reading the LAN ID from port status register. Fixes: a34b3e6ed8fb ("net: txgbe: Store PCI info") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/B60A670C1F52CB8E+20251104062321.40059-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit b1d9154878ce310d46dde5a8545366d807179b28 Merge: ae4789affd1e18 d8a7ed9586c757 Author: Jakub Kicinski Date: Wed Nov 5 17:48:40 2025 -0800 Merge branch 'net-mlx5e-shampo-fixes-for-64kb-page-size' Tariq Toukan says: ==================== net/mlx5e: SHAMPO fixes for 64KB page size This series by Dragos contains fixes for HW-GRO issues found on systems with 64KB page size. ==================== Link: https://patch.msgid.link/1762238915-1027590-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d8a7ed9586c7579a99e9e2d90988c9eceeee61ff Author: Dragos Tatulea Date: Tue Nov 4 08:48:35 2025 +0200 net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages The MLX5E_SHAMPO_WQ_HEADER_PER_PAGE and MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE macros are used directly in several places under the assumption that there will always be more headers per WQE than headers per page. However, this assumption doesn't hold for 64K page sizes and higher MTUs (> 4K). This can be first observed during header page allocation: ksm_entries will become 0 during alignment to MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. This patch introduces 2 additional members to the mlx5e_shampo_hd struct which are meant to be used instead of the macrose mentioned above. When the number of headers per WQE goes below MLX5E_SHAMPO_WQ_HEADER_PER_PAGE, clamp the number of headers per page and expand the header size accordingly so that the headers for one WQE cover a full page. All the formulas are adapted to use these two new members. Fixes: 945ca432bfd0 ("net/mlx5e: SHAMPO, Drop info array") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bacd8d80181ebe34b599a39aa26bf73a44c91e55 Author: Dragos Tatulea Date: Tue Nov 4 08:48:34 2025 +0200 net/mlx5e: SHAMPO, Fix skb size check for 64K pages mlx5e_hw_gro_skb_has_enough_space() uses a formula to check if there is enough space in the skb frags to store more data. This formula is incorrect for 64K page sizes and it triggers early GRO session termination because the first fragment will blow up beyond GRO_LEGACY_MAX_SIZE. This patch adds a special case for page sizes >= GRO_LEGACY_MAX_SIZE (64K) which uses the skb->len instead. Within this context, the check is safe from fragment overflow because the hardware will continuously fill the data up to the reservation size of 64K and the driver will coalesce all data from the same page to the same fragment. This means that the data will span one fragment or at most two for such a large page size. It is expected that the if statement will be optimized out as the check is done with constants. Fixes: 92552d3abd32 ("net/mlx5e: HW_GRO cqe handler implementation") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 665a7e13c220bbde55531a24bd5524320648df10 Author: Dragos Tatulea Date: Tue Nov 4 08:48:33 2025 +0200 net/mlx5e: SHAMPO, Fix header mapping for 64K pages HW-GRO is broken on mlx5 for 64K page sizes. The patch in the fixes tag didn't take into account larger page sizes when doing an align down of max_ksm_entries. For 64K page size, max_ksm_entries is 0 which will skip mapping header pages via WQE UMR. This breaks header-data split and will result in the following syndrome: mlx5_core 0000:00:08.0 eth2: Error cqe on cqn 0x4c9, ci 0x0, qn 0x1133, opcode 0xe, syndrome 0x4, vendor syndrome 0x32 00000000: 00 00 00 00 04 4a 00 00 00 00 00 00 20 00 93 32 00000010: 55 00 00 00 fb cc 00 00 00 00 00 00 07 18 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a 00000030: 00 00 3b c7 93 01 32 04 00 00 00 00 00 00 bf e0 mlx5_core 0000:00:08.0 eth2: ERR CQE on RQ: 0x1133 Furthermore, the function that fills in WQE UMRs for the headers (mlx5e_build_shampo_hd_umr()) only supports mapping page sizes that fit in a single UMR WQE. This patch goes back to the old non-aligned max_ksm_entries value and it changes mlx5e_build_shampo_hd_umr() to support mapping a large page over multiple UMR WQEs. This means that mlx5e_build_shampo_hd_umr() can now leave a page only partially mapped. The caller, mlx5e_alloc_rx_hd_mpwqe(), ensures that there are enough UMR WQEs to cover complete pages by working on ksm_entries that are multiples of MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. Fixes: 8a0ee54027b1 ("net/mlx5e: SHAMPO, Simplify UMR allocation for headers") Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762238915-1027590-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ae4789affd1e181ae46e72e2b5fbe2d6d7b6616a Author: Meghana Malladi Date: Tue Nov 4 16:14:15 2025 +0530 net: ti: icssg-prueth: Fix fdb hash size configuration The ICSSG driver does the initial FDB configuration which includes setting the control registers. Other run time management like learning is managed by the PRU's. The default FDB hash size used by the firmware is 512 slots, which is currently missing in the current driver. Update the driver FDB config to include FDB hash size as well. Please refer trm [1] 6.4.14.12.17 section on how the FDB config register gets configured. From the table 6-1404, there is a reset field for FDB_HAS_SIZE which is 4, meaning 1024 slots. Currently the driver is not updating this reset value from 4(1024 slots) to 3(512 slots). This patch fixes this by updating the reset value to 512 slots. [1]: https://www.ti.com/lit/pdf/spruim2 Fixes: abd5576b9c57f ("net: ti: icssg-prueth: Add support for ICSSG switch firmware") Signed-off-by: Meghana Malladi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251104104415.3110537-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski commit d1c94bc5b90c21b65469d30d4a6bc8ed715c1bfe Author: Gal Pressman Date: Tue Nov 4 16:15:36 2025 +0200 net/mlx5e: Fix return value in case of module EEPROM read error mlx5e_get_module_eeprom_by_page() has weird error handling. First, it is treating -EINVAL as a special case, but it is unclear why. Second, it tries to fail "gracefully" by returning the number of bytes read even in case of an error. This results in wrongly returning success (0 return value) if the error occurs before any bytes were read. Simplify the error handling by returning an error when such occurs. This also aligns with the error handling we have in mlx5e_get_module_eeprom() for the old API. This fixes the following case where the query fails, but userspace ethtool wrongly treats it as success and dumps an output: # ethtool -m eth2 netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 Offset Values ------ ------ 0x0000: 00 00 00 00 05 00 04 00 00 00 00 00 05 00 05 00 0x0010: 00 00 00 00 05 00 06 00 50 00 00 00 67 65 20 66 0x0020: 61 69 6c 65 64 2c 20 72 65 61 64 20 30 20 62 79 0x0030: 74 65 73 2c 20 65 72 72 20 2d 35 00 14 00 03 00 0x0040: 08 00 01 00 03 00 00 00 08 00 02 00 1a 00 00 00 0x0050: 14 00 04 00 08 00 01 00 04 00 00 00 08 00 02 00 0x0060: 0e 00 00 00 14 00 05 00 08 00 01 00 05 00 00 00 0x0070: 08 00 02 00 1a 00 00 00 14 00 06 00 08 00 01 00 Fixes: e109d2b204da ("net/mlx5: Implement get_module_eeprom_by_page()") Signed-off-by: Gal Pressman Reviewed-by: Alex Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1762265736-1028868-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d917c217b612971ea05ae1582e8740b747e0e7e8 Author: Sebastian Andrzej Siewior Date: Tue Nov 4 16:34:35 2025 +0100 net: gro_cells: Reduce lock scope in gro_cell_poll One GRO-cell device's NAPI callback can nest into the GRO-cell of another device if the underlying device is also using GRO-cell. This is the case for IPsec over vxlan. These two GRO-cells are separate devices. From lockdep's point of view it is the same because each device is sharing the same lock class and so it reports a possible deadlock assuming one device is nesting into itself. Hold the bh_lock only while accessing gro_cell::napi_skbs in gro_cell_poll(). This reduces the locking scope and avoids acquiring the same lock class multiple times. Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell") Reported-by: Gal Pressman Closes: https://lore.kernel.org/all/66664116-edb8-48dc-ad72-d5223696dd19@nvidia.com/ Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251104153435.ty88xDQt@linutronix.de Signed-off-by: Jakub Kicinski commit b1d16f7c0063b7209fd3251ce40c77d37b477b83 Author: Michal Swiatkowski Date: Tue Nov 4 09:23:31 2025 -0800 libie: depend on DEBUG_FS when building LIBIE_FWLOG LIBIE_FWLOG is unusable without DEBUG_FS. Mark it in Kconfig. Fix build error on ixgbe when DEBUG_FS is not set. To not add another layer of #if IS_ENABLED(LIBIE_FWLOG) in ixgbe fwlog code define debugfs dentry even when DEBUG_FS isn't enabled. In this case the dummy functions of LIBIE_FWLOG will be used, so not initialized dentry isn't a problem. Fixes: 641585bc978e ("ixgbe: fwlog support for e610") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/lkml/f594c621-f9e1-49f2-af31-23fbcb176058@roeck-us.net/ Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251104172333.752445-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e427054ae7bc8b1268cf1989381a43885795616f Merge: 44e8f13f07cfaa 3490d29964bdd5 Author: Alexei Starovoitov Date: Wed Nov 5 17:05:19 2025 -0800 Merge branch 'x86-fgraph-bpf-fix-orc-stack-unwind-from-return-probe' Jiri Olsa says: ==================== x86/fgraph,bpf: Fix ORC stack unwind from return probe sending fix for ORC stack unwind issue reported in here [1], where the ORC unwinder won't go pass the return_to_handler function and we get no stacktrace. Sending fix for that together with unrelated stacktrace fix (patch 1), so the attached test can work properly. It's based on: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git probes/for-next v1: https://lore.kernel.org/bpf/20251027131354.1984006-1-jolsa@kernel.org/ v2: https://lore.kernel.org/bpf/20251103220924.36371-3-jolsa@kernel.org/ v3 changes: - fix assert condition in test thanks, jirka [1] https://lore.kernel.org/bpf/aObSyt3qOnS_BMcy@krava/ ==================== Acked-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20251104215405.168643-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 3490d29964bdd524366d266b655112cb549c7460 Author: Jiri Olsa Date: Tue Nov 4 22:54:05 2025 +0100 selftests/bpf: Add stacktrace ips test for raw_tp Adding test that verifies we get expected initial 2 entries from stacktrace for rawtp probe via ORC unwind. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit c9e208fa93cd66f8077ee15df0728e62b105a687 Author: Jiri Olsa Date: Tue Nov 4 22:54:04 2025 +0100 selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi Adding test that attaches kprobe/kretprobe multi and verifies the ORC stacktrace matches expected functions. Adding bpf_testmod_stacktrace_test function to bpf_testmod kernel module which is called through several functions so we get reliable call path for stacktrace. The test is only for ORC unwinder to keep it simple. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 20a0bc10272fa17a44fc857c31574a8306f60d20 Author: Jiri Olsa Date: Tue Nov 4 22:54:03 2025 +0100 x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe Currently we don't get stack trace via ORC unwinder on top of fgraph exit handler. We can see that when generating stacktrace from kretprobe_multi bpf program which is based on fprobe/fgraph. The reason is that the ORC unwind code won't get pass the return_to_handler callback installed by fgraph return probe machinery. Solving this by creating stack frame in return_to_handler expected by ftrace_graph_ret_addr function to recover original return address and continue with the unwind. Also updating the pt_regs data with cs/flags/rsp which are needed for successful stack retrieval from ebpf bpf_get_stackid helper. - in get_perf_callchain we check user_mode(regs) so CS has to be set - in perf_callchain_kernel we call perf_hw_regs(regs), so EFLAGS/FIXED has to be unset Acked-by: Masami Hiramatsu (Google) Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed Author: Jiri Olsa Date: Tue Nov 4 22:54:02 2025 +0100 Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3. Currently we store initial stacktrace entry twice for non-HW ot_regs, which means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel. It's easy to reproduce this bpftrace: # bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }' Attaching 1 probe... bprm_execve+1767 bprm_execve+1767 do_execveat_common.isra.0+425 __x64_sys_execve+56 do_syscall_64+133 entry_SYSCALL_64_after_hwframe+118 When perf_callchain_kernel calls unwind_start with first_frame, AFAICS we do not skip regs->ip, but it's added as part of the unwind process. Hence reverting the extra perf_callchain_store for non-hw regs leg. I was not able to bisect this, so I'm not really sure why this was needed in v5.2 and why it's not working anymore, but I could see double entries as far as v5.10. I did the test for both ORC and framepointer unwind with and without the this fix and except for the initial entry the stacktraces are the same. Acked-by: Song Liu Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 664ce10246ba00746af94a08b7fbda8ccaacd930 Author: James Jones Date: Thu Oct 30 11:11:53 2025 -0700 drm/nouveau: Advertise correct modifiers on GB20x 8 and 16 bit formats use a different layout on GB20x than they did on prior chips. Add the corresponding DRM format modifiers to the list of modifiers supported by the display engine on such chips, and filter the supported modifiers for each format based on its bytes per pixel in nv50_plane_format_mod_supported(). Note this logic will need to be updated when GB10 support is added, since it is a GB20x chip that uses the pre-GB20x sector layout for all formats. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Signed-off-by: James Jones Reviewed-by: Faith Ekstrand Signed-off-by: Dave Airlie Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030181153.1208-3-jajones@nvidia.com commit 1cf52a0d4ba079fb354fa1339f5fb34142228dae Author: James Jones Date: Thu Oct 30 11:11:52 2025 -0700 drm: define NVIDIA DRM format modifiers for GB20x The layout of bits within the individual tiles (referred to as sectors in the DRM_FORMAT_MOD_NVIDIA_BLOCK_LINEAR_2D() macro) changed for 8 and 16-bit surfaces starting in Blackwell 2 GPUs (With the exception of GB10). To denote the difference, extend the sector field in the parametric format modifier definition used to generate modifier values for NVIDIA hardware. Without this change, it would be impossible to differentiate the two layouts based on modifiers, and as a result software could attempt to share surfaces directly between pre-GB20x and GB20x cards, resulting in corruption when the surface was accessed on one of the GPUs after being populated with content by the other. Of note: This change causes the DRM_FORMAT_MOD_NVIDIA_BLOCK_LINEAR_2D() macro to evaluate its "s" parameter twice, with the side effects that entails. I surveyed all usage of the modifier in the kernel and Mesa code, and that does not appear to be problematic in any current usage, but I thought it was worth calling out. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Signed-off-by: James Jones Reviewed-by: Faith Ekstrand Signed-off-by: Dave Airlie Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030181153.1208-2-jajones@nvidia.com commit ebe755605082eddff80eafe0c50915b1366ee98f Author: Timur Tabi Date: Tue Oct 14 12:45:12 2025 -0500 drm/nouveau: set DMA mask before creating the flush page Set the DMA mask before calling nvkm_device_ctor(), so that when the flush page is created in nvkm_fb_ctor(), the allocation will not fail if the page is outside of DMA address space, which can easily happen if IOMMU is disable. In such situations, you will get an error like this: nouveau 0000:65:00.0: DMA addr 0x0000000107c56000+4096 overflow (mask ffffffff, bus limit 0). Commit 38f5359354d4 ("rm/nouveau/pci: set streaming DMA mask early") set the mask after calling nvkm_device_ctor(), but back then there was no flush page being created, which might explain why the mask wasn't set earlier. Flush page allocation was added in commit 5728d064190e ("drm/nouveau/fb: handle sysmem flush page from common code"). nvkm_fb_ctor() calls alloc_page(), which can allocate a page anywhere in system memory, but then calls dma_map_page() on that page. But since the DMA mask is still set to 32, the map can fail if the page is allocated above 4GB. This is easy to reproduce on systems with a lot of memory and IOMMU disabled. An alternative approach would be to force the allocation of the flush page to low memory, by specifying __GFP_DMA32. However, this would always allocate the page in low memory, even though the hardware can access high memory. Signed-off-by: Timur Tabi Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20251014174512.3172102-1-ttabi@nvidia.com commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 Author: Keith Busch Date: Tue Nov 4 14:48:30 2025 -0800 nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug: BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 Reported-by: Casey Chen Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit dc77806cf3b4788d328fddf245e86c5b529f31a2 Merge: 5624d4c3781673 789521b4717fd6 Author: Linus Torvalds Date: Wed Nov 5 11:15:36 2025 -0800 Merge tag 'rust-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: - Fix/workaround a couple Rust 1.91.0 build issues when sanitizers are enabled due to extra checking performed by the compiler and an upstream issue already fixed for Rust 1.93.0 - Fix future Rust 1.93.0 builds by supporting the stabilized name for the 'no-jump-tables' flag - Fix a couple private/broken intra-doc links uncovered by the future move of pin-init to 'syn' * tag 'rust-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 rust: kbuild: workaround `rustdoc` doctests modifier bug rust: kbuild: treat `build_error` and `rustdoc` as kernel objects rust: condvar: fix broken intra-doc link rust: devres: fix private intra-doc link commit afb47765f9235181fddc61c8633b5a8cfae29fd2 Author: Jason Gunthorpe Date: Tue Nov 4 14:11:49 2025 -0400 iommufd: Make vfio_compat's unmap succeed if the range is already empty iommufd returns ENOENT when attempting to unmap a range that is already empty, while vfio type1 returns success. Fix vfio_compat to match. Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://patch.msgid.link/r/0-v1-76be45eff0be+5d-iommufd_unmap_compat_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Alex Mastro Reported-by: Alex Mastro Closes: https://lore.kernel.org/r/aP0S5ZF9l3sWkJ1G@devgpu012.nha5.facebook.com Signed-off-by: Jason Gunthorpe commit 5624d4c3781673da84e6144c359803ca31b66214 Merge: 1c353dc8d962de bd34bf518a5ffe Author: Linus Torvalds Date: Wed Nov 5 11:08:10 2025 -0800 Merge tag 'platform-drivers-x86-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes and New Hotkey Support: - input + dell-wmi-base: Electronic privacy screen on/off hotkey support - int3472: Fix unregister double free - wireless-hotkey: Fix Kconfig typo" * tag 'platform-drivers-x86-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform: x86: Kconfig: fix minor typo in help for WIRELESS_HOTKEY platform/x86: dell-wmi-base: Handle electronic privacy screen on/off events Input: Add keycodes for electronic privacy screen on/off hotkeys MAINTAINERS: Update int3472 maintainers platform/x86: int3472: Fix double free of GPIO device during unregister commit c367af440e03eba7beb0c9f3fe540f9bcb69134a Author: Zilin Guan Date: Wed Nov 5 02:37:22 2025 +0000 btrfs: release root after error in data_reloc_print_warning_inode() data_reloc_print_warning_inode() calls btrfs_get_fs_root() to obtain local_root, but fails to release its reference when paths_from_inode() returns an error. This causes a potential memory leak. Add a missing btrfs_put_root() call in the error path to properly decrease the reference count of local_root. Fixes: b9a9a85059cde ("btrfs: output affected files when relocation fails") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Qu Wenruo Signed-off-by: Zilin Guan Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5fea61aa1ca70c4b3738eebad9ce2d7e7938ebbd Author: Zilin Guan Date: Wed Nov 5 03:53:21 2025 +0000 btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() scrub_raid56_parity_stripe() allocates a bio with bio_alloc(), but fails to release it on some error paths, leading to a potential memory leak. Add the missing bio_put() calls to properly drop the bio reference in those error cases. Fixes: 1009254bf22a3 ("btrfs: scrub: use scrub_stripe to implement RAID56 P/Q scrub") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Qu Wenruo Signed-off-by: Zilin Guan Reviewed-by: David Sterba Signed-off-by: David Sterba commit bfe3d755ef7cec71aac6ecda34a107624735aac7 Author: Filipe Manana Date: Wed Oct 29 13:05:32 2025 +0000 btrfs: do not update last_log_commit when logging inode due to a new name When logging that a new name exists, we skip updating the inode's last_log_commit field to prevent a later explicit fsync against the inode from doing nothing (as updating last_log_commit makes btrfs_inode_in_log() return true). We are detecting, at btrfs_log_inode(), that logging a new name is happening by checking the logging mode is not LOG_INODE_EXISTS, but that is not enough because we may log parent directories when logging a new name of a file in LOG_INODE_ALL mode - we need to check that the logging_new_name field of the log context too. An example scenario where this results in an explicit fsync against a directory not persisting changes to the directory is the following: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt $ touch /mnt/foo $ sync $ mkdir /mnt/dir # Write some data to our file and fsync it. $ xfs_io -c "pwrite -S 0xab 0 64K" -c "fsync" /mnt/foo # Add a new link to our file. Since the file was logged before, we # update it in the log tree by calling btrfs_log_new_name(). $ ln /mnt/foo /mnt/dir/bar # fsync the root directory - we expect it to persist the dentry for # the new directory "dir". $ xfs_io -c "fsync" /mnt After mounting the fs the entry for directory "dir" does not exists, despite the explicit fsync on the root directory. Here's why this happens: 1) When we fsync the file we log the inode, so that it's present in the log tree; 2) When adding the new link we enter btrfs_log_new_name(), and since the inode is in the log tree we proceed to updating the inode in the log tree; 3) We first set the inode's last_unlink_trans to the current transaction (early in btrfs_log_new_name()); 4) We then eventually enter btrfs_log_inode_parent(), and after logging the file's inode, we call btrfs_log_all_parents() because the inode's last_unlink_trans matches the current transaction's ID (updated in the previous step); 5) So btrfs_log_all_parents() logs the root directory by calling btrfs_log_inode() for the root's inode with a log mode of LOG_INODE_ALL so that new dentries are logged; 6) At btrfs_log_inode(), because the log mode is LOG_INODE_ALL, we update root inode's last_log_commit to the last transaction that changed the inode (->last_sub_trans field of the inode), which corresponds to the current transaction's ID; 7) Then later when user space explicitly calls fsync against the root directory, we enter btrfs_sync_file(), which calls skip_inode_logging() and that returns true, since its call to btrfs_inode_in_log() returns true and there are no ordered extents (it's a directory, never has ordered extents). This results in btrfs_sync_file() returning without syncing the log or committing the current transaction, so all the updates we did when logging the new name, including logging the root directory, are not persisted. So fix this by but updating the inode's last_log_commit if we are sure we are not logging a new name (if ctx->logging_new_name is false). A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/03c5d7ec-5b3d-49d1-95bc-8970a7f82d87@gmail.com/ Fixes: 130341be7ffa ("btrfs: always update the logged transaction when logging new names") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6a1ab50135ce829b834b448ce49867b5210a1641 Author: Naohiro Aota Date: Tue Sep 16 11:46:11 2025 +0900 btrfs: zoned: fix stripe width calculation The stripe offset calculation in the zoned code for raid0 and raid10 wrongly uses map->stripe_size to calculate it. In fact, map->stripe_size is the size of the device extent composing the block group, which always is the zone_size on the zoned setup. Fix it by using BTRFS_STRIPE_LEN and BTRFS_STRIPE_LEN_SHIFT. Also, optimize the calculation a bit by doing the common calculation only once. Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups") CC: stable@vger.kernel.org # 6.17+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 94f54924b96d3565c6b559294b3401b5496c21ac Author: Naohiro Aota Date: Fri Sep 12 15:43:21 2025 +0900 btrfs: zoned: fix conventional zone capacity calculation When a block group contains both conventional zone and sequential zone, the capacity of the block group is wrongly set to the block group's full length. The capacity should be calculated in btrfs_load_block_group_* using the last allocation offset. Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree") CC: stable@vger.kernel.org # v6.12+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 1fd5367391bf0eeb09e624c4ab45121b54eaab96 Author: Pavel Begunkov Date: Wed Nov 5 15:47:01 2025 +0000 io_uring: fix types for region size calulation ->nr_pages is int, it needs type extension before calculating the region size. Fixes: a90558b36ccee ("io_uring/memmap: helper for pinning region pages") Signed-off-by: Pavel Begunkov [axboe: style fixup] Signed-off-by: Jens Axboe commit 5e44c5a2cc84bed6b92cdfd9c567fcdb9f792604 Author: Laurent Pinchart Date: Sun Nov 2 13:14:42 2025 +0200 arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias The RP1 ethernet controller DT node contains a local-mac-address property to pass the MAC address from the boot loader to the kernel. The boot loader does not fill the MAC address as the ethernet0 alias is missing. Add it. Signed-off-by: Laurent Pinchart Reviewed-by: Andrea della Porta Link: https://lore.kernel.org/r/20251102111443.18206-1-laurent.pinchart@ideasonboard.com Fixes: 43456fdfc014 ("arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5") Signed-off-by: Florian Fainelli commit a7da9c6a2fc08b6ad1a2e9aebbb14bcc59320374 Author: Andrea della Porta Date: Tue Oct 21 15:55:33 2025 +0200 arm64: dts: broadcom: Assign clock rates in eth node for RPi5 In Raspberry Pi 5 DTS, the Ethernet clock rates must be assigned as the default clock register values are not valid for the Ethernet interface to function. This can be done either in rp1_clocks node or in rp1_eth node. Define the rates in rp1_eth node, as those clocks are 'leaf' clocks used specifically by the Ethernet device only. Fixes: 43456fdfc014 ("arm64: dts: broadcom: Enable RP1 ethernet for Raspberry Pi 5") Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/20251021135533.5517-1-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 21ab5179aafa2ded7f3851bfe7e043f8a3b6199d Author: Christoph Hellwig Date: Mon Nov 3 05:15:13 2025 -0500 xfs: fix zone selection in xfs_select_open_zone_mru xfs_select_open_zone_mru needs to pass XFS_ZONE_ALLOC_OK to xfs_try_use_zone because we only want to tightly pack into zones of the same or a compatible temperature instead of any available zone. This got broken in commit 0301dae732a5 ("xfs: refactor hint based zone allocation"), which failed to update this particular caller when switching to an enum. xfs/638 sometimes, but not reliably fails due to this change. Fixes: 0301dae732a5 ("xfs: refactor hint based zone allocation") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit f5714a3c1a5658251360603231efe1bee21f9c2c Author: Christoph Hellwig Date: Tue Nov 4 08:50:53 2025 -0500 xfs: fix a rtgroup leak when xfs_init_zone fails Drop the rtgrop reference when xfs_init_zone fails for a conventional device. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 8d7bba1e8314013ecc817a91624104ceb9352ddc Author: Darrick J. Wong Date: Tue Nov 4 16:15:38 2025 -0800 xfs: fix various problems in xfs_atomic_write_cow_iomap_begin I think there are several things wrong with this function: A) xfs_bmapi_write can return a much larger unwritten mapping than what the caller asked for. We convert part of that range to written, but return the entire written mapping to iomap even though that's inaccurate. B) The arguments to xfs_reflink_convert_cow_locked are wrong -- an unwritten mapping could be *smaller* than the write range (or even the hole range). In this case, we convert too much file range to written state because we then return a smaller mapping to iomap. C) It doesn't handle delalloc mappings. This I covered in the patch that I already sent to the list. D) Reassigning count_fsb to handle the hole means that if the second cmap lookup attempt succeeds (due to racing with someone else) we trim the mapping more than is strictly necessary. The changing meaning of count_fsb makes this harder to notice. E) The tracepoint is kinda wrong because @length is mutated. That makes it harder to chase the data flows through this function because you can't just grep on the pos/bytecount strings. F) We don't actually check that the br_state = XFS_EXT_NORM assignment is accurate, i.e that the cow fork actually contains a written mapping for the range we're interested in G) Somewhat inadequate documentation of why we need to xfs_trim_extent so aggressively in this function. H) Not sure why xfs_iomap_end_fsb is used here, the vfs already clamped the write range to s_maxbytes. Fix these issues, and then the atomic writes regressions in generic/760, generic/617, generic/091, generic/263, and generic/521 all go away for me. Cc: stable@vger.kernel.org # v6.16 Fixes: bd1d2c21d5d249 ("xfs: add xfs_atomic_write_cow_iomap_begin()") Signed-off-by: Darrick J. Wong Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit 8d54eacd82a0623a963e0c150ad3b02970638b0d Author: Darrick J. Wong Date: Tue Nov 4 16:12:00 2025 -0800 xfs: fix delalloc write failures in software-provided atomic writes With the 20 Oct 2025 release of fstests, generic/521 fails for me on regular (aka non-block-atomic-writes) storage: QA output created by 521 dowrite: write: Input/output error LOG DUMP (8553 total operations): 1( 1 mod 256): SKIPPED (no operation) 2( 2 mod 256): WRITE 0x7e000 thru 0x8dfff (0x10000 bytes) HOLE 3( 3 mod 256): READ 0x69000 thru 0x79fff (0x11000 bytes) 4( 4 mod 256): FALLOC 0x53c38 thru 0x5e853 (0xac1b bytes) INTERIOR 5( 5 mod 256): COPY 0x55000 thru 0x59fff (0x5000 bytes) to 0x25000 thru 0x29fff 6( 6 mod 256): WRITE 0x74000 thru 0x88fff (0x15000 bytes) 7( 7 mod 256): ZERO 0xedb1 thru 0x11693 (0x28e3 bytes) with a warning in dmesg from iomap about XFS trying to give it a delalloc mapping for a directio write. Fix the software atomic write iomap_begin code to convert the reservation into a written mapping. This doesn't fix the data corruption problems reported by generic/760, but it's a start. Cc: stable@vger.kernel.org # v6.16 Fixes: bd1d2c21d5d249 ("xfs: add xfs_atomic_write_cow_iomap_begin()") Signed-off-by: Darrick J. Wong Reviewed-by: John Garry Signed-off-by: Carlos Maiolino commit 4c740c4d8bac5569c5bf5f86db65ce779178f9a2 Merge: c74619e7602e88 9222582ec52470 Author: Johannes Berg Date: Wed Nov 5 16:18:29 2025 +0100 Merge tag 'ath-current-20251103' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc5 Revert an ath12k change which resulted in a significance performance impact on WCN7850. ================== Signed-off-by: Johannes Berg commit c74619e7602e88a0239cd4999571dd31081e9adf Author: Martin Willi Date: Mon Nov 3 09:24:36 2025 +0100 wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup hwsim radios marked destroy_on_close are removed when the Netlink socket that created them is closed. As the portid is not unique across network namespaces, closing a socket in one namespace may remove radios in another if it has the destroy_on_close flag set. Instead of matching the network namespace, match the netgroup of the radio to limit radio removal to those that have been created by the closing Netlink socket. The netgroup of a radio identifies the network namespace it was created in, and matching on it removes a destroy_on_close radio even if it has been moved to another namespace. Fixes: 100cb9ff40e0 ("mac80211_hwsim: Allow managing radios from non-initial namespaces") Signed-off-by: Martin Willi Link: https://patch.msgid.link/20251103082436.30483-1-martin@strongswan.org Signed-off-by: Johannes Berg commit 997c06330fd5c2e220b692f2a358986c6c8fd5a2 Author: Laurentiu Mihalcea Date: Tue Nov 4 04:02:54 2025 -0800 reset: imx8mp-audiomix: Fix bad mask values As per the i.MX8MP TRM, section 14.2 "AUDIO_BLK_CTRL", table 14.2.3.1.1 "memory map", the definition of the EARC control register shows that the EARC controller software reset is controlled via bit 0, while the EARC PHY software reset is controlled via bit 1. This means that the current definitions of IMX8MP_AUDIOMIX_EARC_RESET_MASK and IMX8MP_AUDIOMIX_EARC_PHY_RESET_MASK are wrong since their values would imply that the EARC controller software reset is controlled via bit 1 and the EARC PHY software reset is controlled via bit 2. Fix them. Fixes: a83bc87cd30a ("reset: imx8mp-audiomix: Prepare the code for more reset bits") Cc: stable@vger.kernel.org Reviewed-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Signed-off-by: Philipp Zabel commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f Author: Hans de Goede Date: Sun Nov 2 20:09:21 2025 +0100 spi: Try to get ACPI GPIO IRQ earlier Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called on the SPI device. If there is no driver for the SPI device then the move to spi_probe() results in acpi_dev_gpio_irq_get() never getting called. This may cause problems by leaving the GPIO pin floating because this call is responsible for setting up the GPIO pin direction and/or bias according to the values from the ACPI tables. Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device() to ensure the GPIO pin is always correctly setup, while keeping the acpi_dev_gpio_irq_get() call added to spi_probe() to deal with -EPROBE_DEFER returns caused by the GPIO controller not having a driver yet. Link: https://bbs.archlinux.org/viewtopic.php?id=302348 Fixes: d24cfee7f63d ("spi: Fix acpi deferred irq probe") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20251102190921.30068-1-hansg@kernel.org Signed-off-by: Mark Brown commit 75fdd57499a392e97fc0cff8df64e44472c07f2f Merge: 90f601b497d76f 8637fa89e67842 Author: Christian Brauner Date: Wed Nov 5 12:16:54 2025 +0100 Merge patch series "sb_min_blocksize() fixes" Enforce checking of sb_min_blocksize() calls and update all callers accordingly. * patches from https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com: block: add __must_check attribute to sb_min_blocksize() xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super isofs: check the return value of sb_min_blocksize() in isofs_fill_super exfat: check return value of sb_min_blocksize in exfat_read_boot_sector vfat: fix missing sb_min_blocksize() return value checks Link: https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit 90f601b497d76f40fa66795c3ecf625b6aced9fd Author: Zilin Guan Date: Wed Nov 5 02:29:23 2025 +0000 binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail. Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly. Fixes: e7850f4d844e ("binfmt_misc: fix possible deadlock in bm_register_write") Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20251105022923.1813587-1-zilin@seu.edu.cn Signed-off-by: Christian Brauner commit 8637fa89e678422995301ddb20b74190dffcccee Author: Yongpeng Yang Date: Tue Nov 4 20:50:10 2025 +0800 block: add __must_check attribute to sb_min_blocksize() When sb_min_blocksize() returns 0 and the return value is not checked, it may lead to a situation where sb->s_blocksize is 0 when accessing the filesystem super block. After commit a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()"), this becomes more likely to happen when the block device’s logical_block_size is larger than PAGE_SIZE and the filesystem is unformatted. Add the __must_check attribute to ensure callers always check the return value. Cc: stable@vger.kernel.org # v6.15 Suggested-by: Matthew Wilcox Reviewed-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-6-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit c014021253d77cd89b2d8788ce522283d83fbd40 Author: Alok Tiwari Date: Mon Oct 27 03:46:47 2025 -0700 virtio-fs: fix incorrect check for fsvq->kobj In virtio_fs_add_queues_sysfs(), the code incorrectly checks fs->mqs_kobj after calling kobject_create_and_add(). Change the check to fsvq->kobj (fs->mqs_kobj -> fsvq->kobj) to ensure the per-queue kobject is successfully created. Fixes: 87cbdc396a31 ("virtio_fs: add sysfs entries for queue information") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251027104658.1668537-1-alok.a.tiwari@oracle.com Reviewed-by: Stefan Hajnoczi Signed-off-by: Christian Brauner commit 124af0868ec6929ba838fb76d25f00c06ba8fc0d Author: Yongpeng Yang Date: Tue Nov 4 20:50:09 2025 +0800 xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super sb_min_blocksize() may return 0. Check its return value to avoid the filesystem super block when sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()") Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-5-yangyongpeng.storage@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit e106e269c5cb38315eb0a0e7e38f71e9b20c8c66 Author: Yongpeng Yang Date: Tue Nov 4 20:50:08 2025 +0800 isofs: check the return value of sb_min_blocksize() in isofs_fill_super sb_min_blocksize() may return 0. Check its return value to avoid opt->blocksize and sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: 1b17a46c9243e9 ("isofs: convert isofs to use the new mount API") Reviewed-by: Jan Kara Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-4-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit f2c1f631630e01821fe4c3fdf6077bc7a8284f82 Author: Yongpeng Yang Date: Tue Nov 4 20:50:07 2025 +0800 exfat: check return value of sb_min_blocksize in exfat_read_boot_sector sb_min_blocksize() may return 0. Check its return value to avoid accessing the filesystem super block when sb->s_blocksize is 0. Cc: stable@vger.kernel.org # v6.15 Fixes: 719c1e1829166d ("exfat: add super block operations") Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-3-yangyongpeng.storage@gmail.com Signed-off-by: Christian Brauner commit 63b5aa01da0f38cdbd97d021477258e511631497 Author: Yongpeng Yang Date: Tue Nov 4 20:50:06 2025 +0800 vfat: fix missing sb_min_blocksize() return value checks When emulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, but without format, a kernel panic was triggered during the early boot stage while attempting to mount a vfat filesystem. [95553.682035] EXT4-fs (nvme0n1): unable to set blocksize [95553.684326] EXT4-fs (nvme0n1): unable to set blocksize [95553.686501] EXT4-fs (nvme0n1): unable to set blocksize [95553.696448] ISOFS: unsupported/invalid hardware sector size 8192 [95553.697117] ------------[ cut here ]------------ [95553.697567] kernel BUG at fs/buffer.c:1582! [95553.697984] Oops: invalid opcode: 0000 [#1] SMP NOPTI [95553.698602] CPU: 0 UID: 0 PID: 7212 Comm: mount Kdump: loaded Not tainted 6.18.0-rc2+ #38 PREEMPT(voluntary) [95553.699511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [95553.700534] RIP: 0010:folio_alloc_buffers+0x1bb/0x1c0 [95553.701018] Code: 48 8b 15 e8 93 18 02 65 48 89 35 e0 93 18 02 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc <0f> 0b 90 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f [95553.702648] RSP: 0018:ffffd1b0c676f990 EFLAGS: 00010246 [95553.703132] RAX: ffff8cfc4176d820 RBX: 0000000000508c48 RCX: 0000000000000001 [95553.703805] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000000 [95553.704481] RBP: ffffd1b0c676f9c8 R08: 0000000000000000 R09: 0000000000000000 [95553.705148] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [95553.705816] R13: 0000000000002000 R14: fffff8bc8257e800 R15: 0000000000000000 [95553.706483] FS: 000072ee77315840(0000) GS:ffff8cfdd2c8d000(0000) knlGS:0000000000000000 [95553.707248] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [95553.707782] CR2: 00007d8f2a9e5a20 CR3: 0000000039d0c006 CR4: 0000000000772ef0 [95553.708439] PKRU: 55555554 [95553.708734] Call Trace: [95553.709015] [95553.709266] __getblk_slow+0xd2/0x230 [95553.709641] ? find_get_block_common+0x8b/0x530 [95553.710084] bdev_getblk+0x77/0xa0 [95553.710449] __bread_gfp+0x22/0x140 [95553.710810] fat_fill_super+0x23a/0xfc0 [95553.711216] ? __pfx_setup+0x10/0x10 [95553.711580] ? __pfx_vfat_fill_super+0x10/0x10 [95553.712014] vfat_fill_super+0x15/0x30 [95553.712401] get_tree_bdev_flags+0x141/0x1e0 [95553.712817] get_tree_bdev+0x10/0x20 [95553.713177] vfat_get_tree+0x15/0x20 [95553.713550] vfs_get_tree+0x2a/0x100 [95553.713910] vfs_cmd_create+0x62/0xf0 [95553.714273] __do_sys_fsconfig+0x4e7/0x660 [95553.714669] __x64_sys_fsconfig+0x20/0x40 [95553.715062] x64_sys_call+0x21ee/0x26a0 [95553.715453] do_syscall_64+0x80/0x670 [95553.715816] ? __fs_parse+0x65/0x1e0 [95553.716172] ? fat_parse_param+0x103/0x4b0 [95553.716587] ? vfs_parse_fs_param_source+0x21/0xa0 [95553.717034] ? __do_sys_fsconfig+0x3d9/0x660 [95553.717548] ? __x64_sys_fsconfig+0x20/0x40 [95553.717957] ? x64_sys_call+0x21ee/0x26a0 [95553.718360] ? do_syscall_64+0xb8/0x670 [95553.718734] ? __x64_sys_fsconfig+0x20/0x40 [95553.719141] ? x64_sys_call+0x21ee/0x26a0 [95553.719545] ? do_syscall_64+0xb8/0x670 [95553.719922] ? x64_sys_call+0x1405/0x26a0 [95553.720317] ? do_syscall_64+0xb8/0x670 [95553.720702] ? __x64_sys_close+0x3e/0x90 [95553.721080] ? x64_sys_call+0x1b5e/0x26a0 [95553.721478] ? do_syscall_64+0xb8/0x670 [95553.721841] ? irqentry_exit+0x43/0x50 [95553.722211] ? exc_page_fault+0x90/0x1b0 [95553.722681] entry_SYSCALL_64_after_hwframe+0x76/0x7e [95553.723166] RIP: 0033:0x72ee774f3afe [95553.723562] Code: 73 01 c3 48 8b 0d 0a 33 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 49 89 ca b8 af 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d da 32 0f 00 f7 d8 64 89 01 48 [95553.725188] RSP: 002b:00007ffe97148978 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [95553.725892] RAX: ffffffffffffffda RBX: 00005dcfe53d0080 RCX: 000072ee774f3afe [95553.726526] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [95553.727176] RBP: 00007ffe97148ac0 R08: 0000000000000000 R09: 000072ee775e7ac0 [95553.727818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [95553.728459] R13: 00005dcfe53d04b0 R14: 000072ee77670b00 R15: 00005dcfe53d1a28 [95553.729086] The panic occurs as follows: 1. logical_block_size is 8KiB, causing {struct super_block *sb}->s_blocksize is initialized to 0. vfat_fill_super - fat_fill_super - sb_min_blocksize - sb_set_blocksize //return 0 when size is 8KiB. 2. __bread_gfp is called with size == 0, causing folio_alloc_buffers() to compute an offset equal to folio_size(folio), which triggers a BUG_ON. fat_fill_super - sb_bread - __bread_gfp // size == {struct super_block *sb}->s_blocksize == 0 - bdev_getblk - __getblk_slow - grow_buffers - grow_dev_folio - folio_alloc_buffers // size == 0 - folio_set_bh //offset == folio_size(folio) and panic To fix this issue, add proper return value checks for sb_min_blocksize(). Cc: stable@vger.kernel.org # v6.15 Fixes: a64e5a596067bd ("bdev: add back PAGE_SIZE block size validation for sb_set_blocksize()") Reviewed-by: Matthew Wilcox Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Reviewed-by: OGAWA Hirofumi Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Link: https://patch.msgid.link/20251104125009.2111925-2-yangyongpeng.storage@gmail.com Acked-by: OGAWA Hirofumi Signed-off-by: Christian Brauner commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 Author: James Clark Date: Thu Oct 30 14:05:27 2025 +0000 dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope Clang doesn't like that (1ULL<<(64)) overflows when initializing a global scope variable, even if that part of the ternary isn't used when n = 64. The same initialization can be done without warnings in function scopes, and GCC doesn't mind either way. The build failure that highlighted this was already fixed in a different way [1], which also has detailed links to the Clang issues. However it's not going to be long before the same thing happens again, so it's better to fix the root cause. Fix it by using GENMASK_ULL() which does exactly the same thing, is much more readable anyway, and doesn't have a shift that overflows. [1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/ Signed-off-by: James Clark Reviewed-by: Nathan Chancellor Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 Author: Haotian Zhang Date: Wed Oct 29 01:28:28 2025 +0800 regulator: fixed: fix GPIO descriptor leak on register failure In the commit referenced by the Fixes tag, devm_gpiod_get_optional() was replaced by manual GPIO management, relying on the regulator core to release the GPIO descriptor. However, this approach does not account for the error path: when regulator registration fails, the core never takes over the GPIO, resulting in a resource leak. Add gpiod_put() before returning on regulator registration failure. Fixes: 5e6f3ae5c13b ("regulator: fixed: Let core handle GPIO descriptor") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251028172828.625-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 487df8b698345dd5a91346335f05170ed5f29d4e Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 4 10:53:57 2025 +0100 drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xa_lock#17); [ 1231.611038] local_irq_disable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xa_lock#17); [ 1231.611044] [ 1231.611045] lock(&fence->lock); [ 1231.611047] *** DEADLOCK *** In this example, CPU0 would be any function accessing job->dependencies through the xa_* functions that don't disable interrupts (eg: drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()). CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xa_lock which is already held by CPU0. Replacing all xa_* usage by their xa_*_irq counterparts would fix this issue, but Christian pointed out another issue: dma_fence_signal takes fence.lock and so does dma_fence_add_callback. dma_fence_signal() // locks f1.lock -> drm_sched_entity_kill_jobs_cb() -> foreach dependencies -> dma_fence_add_callback() // locks f2.lock This will deadlock if f1 and f2 share the same spinlock. To fix both issues, the code iterating on dependencies and re-arming them is moved out to drm_sched_entity_kill_jobs_work(). Cc: stable@vger.kernel.org # v6.2+ Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13908 Reported-by: Mikhail Gavrilov Suggested-by: Christian König Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer [phasta: commit message nits] Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251104095358.15092-1-pierre-eric.pelloux-prayer@amd.com commit 5232334baec371a3c9d9192ba7d2da2d88a85333 Author: Thomas Richard Date: Mon Sep 29 12:03:13 2025 +0200 gpio: aggregator: restore the set_config operation Restore the set_config operation, as it was lost during the refactoring of the gpio-aggregator driver while creating the gpio forwarder library. Fixes: b31c68fd851e7 ("gpio: aggregator: handle runtime registration of gpio_desc in gpiochip_fwd") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509281206.a7334ae8-lkp@intel.com Signed-off-by: Thomas Richard Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250929-gpio-aggregator-fix-set-config-callback-v1-1-39046e1da609@bootlin.com Signed-off-by: Bartosz Golaszewski commit 1c353dc8d962de652bc7ad2ba2e63f553331391c Merge: 284922f4c563aa 27afd6e066cfd8 Author: Linus Torvalds Date: Wed Nov 5 18:56:15 2025 +0900 Merge tag 'media/v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - honour privacy led with pdx86/int3472 - fix invalid file access on cx18 and ivtv - forbid remove_bufs when legacy fileio is active on videbuf2 - add an heuristic to find stream entity on uvcvideo * tag 'media/v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: videobuf2: forbid remove_bufs when legacy fileio is active media: uvcvideo: Use heuristic to find stream entity media: v4l2-subdev / pdx86: int3472: Use "privacy" as con_id for the privacy LED media: ivtv: Fix invalid access to file * media: cx18: Fix invalid access to file * commit 327c20c21d80e0d87834b392d83ae73c955ad8ff Author: Breno Leitao Date: Mon Nov 3 08:38:17 2025 -0800 netpoll: Fix deadlock in memory allocation under spinlock Fix a AA deadlock in refill_skbs() where memory allocation while holding skb_pool->lock can trigger a recursive lock acquisition attempt. The deadlock scenario occurs when the system is under severe memory pressure: 1. refill_skbs() acquires skb_pool->lock (spinlock) 2. alloc_skb() is called while holding the lock 3. Memory allocator fails and calls slab_out_of_memory() 4. This triggers printk() for the OOM warning 5. The console output path calls netpoll_send_udp() 6. netpoll_send_udp() attempts to acquire the same skb_pool->lock 7. Deadlock: the lock is already held by the same CPU Call stack: refill_skbs() spin_lock_irqsave(&skb_pool->lock) <- lock acquired __alloc_skb() kmem_cache_alloc_node_noprof() slab_out_of_memory() printk() console_flush_all() netpoll_send_udp() skb_dequeue() spin_lock_irqsave(&skb_pool->lock) <- deadlock attempt This bug was exposed by commit 248f6571fd4c51 ("netpoll: Optimize skb refilling on critical path") which removed refill_skbs() from the critical path (where nested printk was being deferred), letting nested printk being called from inside refill_skbs() Refactor refill_skbs() to never allocate memory while holding the spinlock. Another possible solution to fix this problem is protecting the refill_skbs() from nested printks, basically calling printk_deferred_{enter,exit}() in refill_skbs(), then, any nested pr_warn() would be deferred. I prefer this approach, given I _think_ it might be a good idea to move the alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having the alloc_skb() outside of the lock will be necessary step. There is a possible TOCTOU issue when checking for the pool length, and queueing the new allocated skb, but, this is not an issue, given that an extra SKB in the pool is harmless and it will be eventually used. Signed-off-by: Breno Leitao Fixes: 248f6571fd4c51 ("netpoll: Optimize skb refilling on critical path") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251103-fix_netpoll_aa-v4-1-4cfecdf6da7c@debian.org Signed-off-by: Jakub Kicinski commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5 Author: Nishanth Menon Date: Mon Nov 3 10:28:11 2025 -0600 net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Make knav_dma_open_channel consistently return NULL on error instead of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h returns NULL when the driver is disabled, but the driver implementation does not even return NULL or ERR_PTR on failure, causing inconsistency in the users. This results in a crash in netcp_free_navigator_resources as followed (trimmed): Unhandled fault: alignment exception (0x221) at 0xfffffff2 [fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000 Internal error: : 221 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE Hardware name: Keystone PC is at knav_dma_close_channel+0x30/0x19c LR is at netcp_free_navigator_resources+0x2c/0x28c [... TRIM...] Call trace: knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c netcp_ndo_open from __dev_open+0x114/0x29c __dev_open from __dev_change_flags+0x190/0x208 __dev_change_flags from netif_change_flags+0x1c/0x58 netif_change_flags from dev_change_flags+0x38/0xa0 dev_change_flags from ip_auto_config+0x2c4/0x11f0 ip_auto_config from do_one_initcall+0x58/0x200 do_one_initcall from kernel_init_freeable+0x1cc/0x238 kernel_init_freeable from kernel_init+0x1c/0x12c kernel_init from ret_from_fork+0x14/0x38 [... TRIM...] Standardize the error handling by making the function return NULL on all error conditions. The API is used in just the netcp_core.c so the impact is limited. Note, this change, in effect reverts commit 5b6cb43b4d62 ("net: ethernet: ti: netcp_core: return error while dma channel open issue"), but provides a less error prone implementation. Suggested-by: Simon Horman Suggested-by: Jacob Keller Signed-off-by: Nishanth Menon Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251103162811.3730055-1-nm@ti.com Signed-off-by: Jakub Kicinski commit 0c716703965ffc5ef4311b65cb5d84a703784717 Author: Bui Quang Minh Date: Thu Oct 30 21:44:38 2025 +0700 virtio-net: fix received length check in big packets Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big packets is not MAX_SKB_FRAGS * PAGE_SIZE anymore but depends on negotiated MTU. The number of allocated frags for big packets is stored in vi->big_packets_num_skbfrags. Because the host announced buffer length can be malicious (e.g. the host vhost_net driver's get_rx_bufs is modified to announce incorrect length), we need a check in virtio_net receive path. Currently, the check is not adapted to the new change which can lead to NULL page pointer dereference in the below while loop when receiving length that is larger than the allocated one. This commit fixes the received length check corresponding to the new change. Fixes: 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets") Cc: stable@vger.kernel.org Signed-off-by: Bui Quang Minh Reviewed-by: Xuan Zhuo Tested-by: Lei Yang Link: https://patch.msgid.link/20251030144438.7582-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 44e8f13f07cfaa978c19fb4d66904f65905c7259 Merge: 156c75f596c988 137cc92ffe2e71 Author: Alexei Starovoitov Date: Tue Nov 4 17:50:26 2025 -0800 Merge branch 'bpf-add-_impl-suffix-for-kfuncs-with-implicit-args' Mykyta Yatsenko says: ==================== bpf: Add _impl suffix for kfuncs with implicit args We have established a pattern of function naming win "_impl" suffix; those functions accept verifier-provided bpf_prog_aux argument. Following uniform convention will allow for transparent backwards compatibility with the upcoming KF_IMPLICIT_ARGS feature. This patch set aims to fix current deviation from the convention to eliminate unnecessary backwards incompatibility in the future. Three kfuncs added in 6.18 don’t follow this *_impl convention and therefore won’t participate in the new KF_IMPLICIT_ARGS mechanism: * bpf_task_work_schedule_resume() * bpf_task_work_schedule_signal() * bpf_stream_vprintk() Rename them to align with the implicit-arg flow: bpf_task_work_schedule_resume() -> bpf_task_work_schedule_resume_impl() bpf_task_work_schedule_signal() -> bpf_task_work_schedule_signal_impl() bpf_stream_vprintk() -> bpf_stream_vprintk_impl() The KF_IMPLICIT_ARGS mechanism is not in tree yet, so callers must switch to the *_impl names for now. Once the new mechanism lands, the plain names (without _impl) will be reintroduced. Signed-off-by: Mykyta Yatsenko Acked-by: Ihor Solodrai --- Changes in v3: - Fix commit messages - Link to v2: https://lore.kernel.org/r/20251104-implv2-v2-0-6dbc35f39f28@meta.com Changes in v1: - Split commit into 2 - Rebase on the correct branch - Link to v1: https://lore.kernel.org/all/20251103232319.122965-1-mykyta.yatsenko5@gmail.com/ ==================== Link: https://patch.msgid.link/20251104-implv2-v3-0-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov commit 137cc92ffe2e71705fce112656a460d924934ebe Author: Mykyta Yatsenko Date: Tue Nov 4 22:54:26 2025 +0000 bpf: add _impl suffix for bpf_stream_vprintk() kfunc Rename bpf_stream_vprintk() to bpf_stream_vprintk_impl(). This makes bpf_stream_vprintk() follow the already established "_impl" suffix-based naming convention for kfuncs with the bpf_prog_aux argument provided by the verifier implicitly. This convention will be taken advantage of with the upcoming KF_IMPLICIT_ARGS feature to preserve backwards compatibility to BPF programs. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251104-implv2-v3-2-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov Acked-by: Ihor Solodrai commit ea0714d61dea6e00b853a0116d0afe2b2fe70ef3 Author: Mykyta Yatsenko Date: Tue Nov 4 22:54:25 2025 +0000 bpf:add _impl suffix for bpf_task_work_schedule* kfuncs Rename: bpf_task_work_schedule_resume()->bpf_task_work_schedule_resume_impl() bpf_task_work_schedule_signal()->bpf_task_work_schedule_signal_impl() This aligns task work scheduling kfuncs with the established naming scheme for kfuncs with the bpf_prog_aux argument provided by the verifier implicitly. This convention will be taken advantage of with the upcoming KF_IMPLICIT_ARGS feature to preserve backwards compatibility to BPF programs. Acked-by: Andrii Nakryiko Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251104-implv2-v3-1-4772b9ae0e06@meta.com Signed-off-by: Alexei Starovoitov Acked-by: Ihor Solodrai commit a30297d31b665e759806bc3635aab50780473ad9 Merge: c3838262b824c7 5204943a4c6efc Author: Jakub Kicinski Date: Tue Nov 4 17:25:21 2025 -0800 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes Patches 1, 3, and 4 are bug fixes related to the FW log tracing driver coredump feature recently added in 6.13. Patch #1 adds the necessary call to shutdown the FW logging DMA during PCI shutdown. Patch #3 fixes a possible null pointer derefernce when using early versions of the FW with this feature. Patch #4 adds the coredump header information unconditionally to make it more robust. Patch #2 fixes a possible memory leak during PTP shutdown. Patch #5 eliminates a dmesg warning when doing devlink reload. ==================== Link: https://patch.msgid.link/20251104005700.542174-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 5204943a4c6efc832993c0fa17dec275071eeccc Author: Shantiprasad Shettar Date: Mon Nov 3 16:56:59 2025 -0800 bnxt_en: Fix warning in bnxt_dl_reload_down() The existing code calls bnxt_cancel_reservations() after bnxt_hwrm_func_drv_unrgtr() in bnxt_dl_reload_down(). bnxt_cancel_reservations() calls the FW and it will always fail since the driver has already unregistered, triggering this warning: bnxt_en 0000:0a:00.0 ens2np0: resc_qcaps failed Fix it by calling bnxt_clear_reservations() which will skip the unnecessary FW call since we have unregistered. Fixes: 228ea8c187d8 ("bnxt_en: implement devlink dev reload driver_reinit") Reviewed-by: Mohammad Shuab Siddique Reviewed-by: Somnath Kotur Reviewed-by: Kalesh AP Signed-off-by: Shantiprasad Shettar Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-6-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 28d9a84ef0ce56cc623da2a1ebf7583c00d52b31 Author: Kashyap Desai Date: Mon Nov 3 16:56:58 2025 -0800 bnxt_en: Always provide max entry and entry size in coredump segments While populating firmware host logging segments for the coredump, it is possible for the FW command that flushes the segment to fail. When that happens, the existing code will not update the max entry and entry size in the segment header and this causes software that decodes the coredump to skip the segment. The segment most likely has already collected some DMA data, so always update these 2 segment fields in the header to allow the decoder to decode any data in the segment. Fixes: 3c2179e66355 ("bnxt_en: Add FW trace coredump segments to the coredump") Reviewed-by: Shruti Parab Signed-off-by: Kashyap Desai Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit ff02be05f78399c766be68ab0b2285ff90b2aaa8 Author: Gautam R A Date: Mon Nov 3 16:56:57 2025 -0800 bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() With older FW, we may get the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER for FW trace data type that has not been initialized. This will result in a crash in bnxt_bs_trace_type_wrap(). Add a guard to check for a valid magic_byte pointer before proceeding. Fixes: 84fcd9449fd7 ("bnxt_en: Manage the FW trace context memory") Reviewed-by: Somnath Kotur Reviewed-by: Shruti Parab Signed-off-by: Gautam R A Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit deb8eb39164382f1f67ef8e8af9176baf5e10f2d Author: Kalesh AP Date: Mon Nov 3 16:56:56 2025 -0800 bnxt_en: Fix a possible memory leak in bnxt_ptp_init In bnxt_ptp_init(), when ptp_clock_register() fails, the driver is not freeing the memory allocated for ptp_info->pin_config. Fix it to unconditionally free ptp_info->pin_config in bnxt_ptp_free(). Fixes: caf3eedbcd8d ("bnxt_en: 1PPS support for 5750X family chips") Reviewed-by: Pavan Chebbi Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit bc7208ca805ae6062f353a4753467d913d963bc6 Author: Michael Chan Date: Mon Nov 3 16:56:55 2025 -0800 bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we kexec to a new kernel, the DMA will corrupt memory in the new kernel. Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW. This will stop the FW DMA. In case the call fails, call pcie_flr() to reset the function and stop the DMA. Fixes: 24d694aec139 ("bnxt_en: Allocate backing store memory for FW trace logs") Reported-by: Jakub Kicinski Reviewed-by: Damodharam Ammepalli Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251104005700.542174-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 284922f4c563aa3a8558a00f2a05722133237fe8 Author: Linus Torvalds Date: Tue Nov 4 15:25:20 2025 +0900 x86: uaccess: don't use runtime-const rewriting in modules The runtime-const infrastructure was never designed to handle the modular case, because the constant fixup is only done at boot time for core kernel code. But by the time I used it for the x86-64 user space limit handling in commit 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue"), I had completely repressed that fact. And it all happens to work because the only code that currently actually gets inlined by modules is for the access_ok() limit check, where the default constant value works even when not fixed up. Because at least I had intentionally made it be something that is in the non-canonical address space region. But it's technically very wrong, and it does mean that at least in theory, the use of 'access_ok()' + '__get_user()' can trigger the same speculation issue with non-canonical addresses that the original commit was all about. The pattern is unusual enough that this probably doesn't matter in practice, but very wrong is still very wrong. Also, let's fix it before the nice optimized scoped user accessor helpers that Thomas Gleixner is working on cause this pseudo-constant to then be more widely used. This all came up due to an unrelated discussion with Mateusz Guzik about using the runtime const infrastructure for names_cachep accesses too. There the modular case was much more obviously broken, and Mateusz noted it in his 'v2' of the patch series. That then made me notice how broken 'access_ok()' had been in modules all along. Mea culpa, mea maxima culpa. Fix it by simply not using the runtime-const code in modules, and just using the USER_PTR_MAX variable value instead. This is not performance-critical like the core user accessor functions (get_user() and friends) are. Also make sure this doesn't get forgotten the next time somebody wants to do runtime constant optimizations by having the x86 runtime-const.h header file error out if included by modules. Fixes: 86e6b1547b3d ("x86: fix user address masking non-canonical speculation issue") Acked-by: Borislav Petkov Acked-by: Sean Christopherson Cc: Thomas Gleixner Triggered-by: Mateusz Guzik Link: https://lore.kernel.org/all/20251030105242.801528-1-mjguzik@gmail.com/ Signed-off-by: Linus Torvalds commit c3838262b824c71c145cd3668722e99a69bc9cd9 Author: Michael S. Tsirkin Date: Fri Oct 31 14:05:51 2025 +0800 virtio_net: fix alignment for virtio_net_hdr_v1_hash Changing alignment of header would mean it's no longer safe to cast a 2 byte aligned pointer between formats. Use two 16 bit fields to make it 2 byte aligned as previously. This fixes the performance regression since commit ("virtio_net: enable gso over UDP tunnel support.") as it uses virtio_net_hdr_v1_hash_tunnel which embeds virtio_net_hdr_v1_hash. Pktgen in guest + XDP_DROP on TAP + vhost_net shows the TX PPS is recovered from 2.4Mpps to 4.45Mpps. Fixes: 56a06bd40fab ("virtio_net: enable gso over UDP tunnel support.") Cc: stable@vger.kernel.org Signed-off-by: Michael S. Tsirkin Signed-off-by: Jason Wang Tested-by: Lei Yang Link: https://patch.msgid.link/20251031060551.126-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 1e39da974ce621ed874c6d3aaf65ad14848c9f0d Author: Yongpeng Yang Date: Tue Nov 4 16:36:42 2025 -0800 fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT When simulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, an error trace appears during partition table reading at boot time. The issue is caused by inode->i_blkbits being larger than PAGE_SHIFT, which leads to a left shift of -1 and triggering a UBSAN warning. [ 2.697306] ------------[ cut here ]------------ [ 2.697309] UBSAN: shift-out-of-bounds in fs/crypto/inline_crypt.c:336:37 [ 2.697311] shift exponent -1 is negative [ 2.697315] CPU: 3 UID: 0 PID: 274 Comm: (udev-worker) Not tainted 6.18.0-rc2+ #34 PREEMPT(voluntary) [ 2.697317] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 2.697320] Call Trace: [ 2.697324] [ 2.697325] dump_stack_lvl+0x76/0xa0 [ 2.697340] dump_stack+0x10/0x20 [ 2.697342] __ubsan_handle_shift_out_of_bounds+0x1e3/0x390 [ 2.697351] bh_get_inode_and_lblk_num.cold+0x12/0x94 [ 2.697359] fscrypt_set_bio_crypt_ctx_bh+0x44/0x90 [ 2.697365] submit_bh_wbc+0xb6/0x190 [ 2.697370] block_read_full_folio+0x194/0x270 [ 2.697371] ? __pfx_blkdev_get_block+0x10/0x10 [ 2.697375] ? __pfx_blkdev_read_folio+0x10/0x10 [ 2.697377] blkdev_read_folio+0x18/0x30 [ 2.697379] filemap_read_folio+0x40/0xe0 [ 2.697382] filemap_get_pages+0x5ef/0x7a0 [ 2.697385] ? mmap_region+0x63/0xd0 [ 2.697389] filemap_read+0x11d/0x520 [ 2.697392] blkdev_read_iter+0x7c/0x180 [ 2.697393] vfs_read+0x261/0x390 [ 2.697397] ksys_read+0x71/0xf0 [ 2.697398] __x64_sys_read+0x19/0x30 [ 2.697399] x64_sys_call+0x1e88/0x26a0 [ 2.697405] do_syscall_64+0x80/0x670 [ 2.697410] ? __x64_sys_newfstat+0x15/0x20 [ 2.697414] ? x64_sys_call+0x204a/0x26a0 [ 2.697415] ? do_syscall_64+0xb8/0x670 [ 2.697417] ? irqentry_exit_to_user_mode+0x2e/0x2a0 [ 2.697420] ? irqentry_exit+0x43/0x50 [ 2.697421] ? exc_page_fault+0x90/0x1b0 [ 2.697422] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 2.697425] RIP: 0033:0x75054cba4a06 [ 2.697426] Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 [ 2.697427] RSP: 002b:00007fff973723a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 2.697430] RAX: ffffffffffffffda RBX: 00005ea9a2c02760 RCX: 000075054cba4a06 [ 2.697432] RDX: 0000000000002000 RSI: 000075054c190000 RDI: 000000000000001b [ 2.697433] RBP: 00007fff973723c0 R08: 0000000000000000 R09: 0000000000000000 [ 2.697434] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2.697434] R13: 00005ea9a2c027c0 R14: 00005ea9a2be5608 R15: 00005ea9a2be55f0 [ 2.697436] [ 2.697436] ---[ end trace ]--- This situation can happen for block devices because when CONFIG_TRANSPARENT_HUGEPAGE is enabled, the maximum logical_block_size is 64 KiB. set_init_blocksize() then sets the block device inode->i_blkbits to 13, which is within this limit. File I/O does not trigger this problem because for filesystems that do not support the FS_LBS feature, sb_set_blocksize() prevents sb->s_blocksize_bits from being larger than PAGE_SHIFT. During inode allocation, alloc_inode()->inode_init_always() assigns inode->i_blkbits from sb->s_blocksize_bits. Currently, only xfs_fs_type has the FS_LBS flag, and since xfs I/O paths do not reach submit_bh_wbc(), it does not hit the left-shift underflow issue. Signed-off-by: Yongpeng Yang Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k") Cc: stable@vger.kernel.org [EB: use folio_pos() and consolidate the two shifts by i_blkbits] Link: https://lore.kernel.org/r/20251105003642.42796-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e08969c4d65ac31297fcb4d31d4808c789152f68 Author: Tzung-Bi Shih Date: Tue Nov 4 07:03:10 2025 +0000 Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case. Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access `ckdev->idev` and friends if the driver doesn't intend to initialize them. Signed-off-by: Tzung-Bi Shih Link: https://patch.msgid.link/20251104070310.3212712-1-tzungbi@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 3d1c795bdef43363ed1ff71e3f476d86c22e059b Author: Rafał Miłecki Date: Thu Oct 2 21:48:52 2025 +0200 ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY Luxul XAP-1440 has BCM54210E PHY at address 25. Fixes: 44ad82078069 ("ARM: dts: BCM53573: Fix Ethernet info for Luxul devices") Signed-off-by: Rafał Miłecki Link: https://lore.kernel.org/r/20251002194852.13929-1-zajec5@gmail.com Signed-off-by: Florian Fainelli commit 9c16e4d216d8103a8178bbe070eb21f779f190c0 Author: Stefan Wahren Date: Tue Nov 4 18:45:18 2025 +0100 arm64: defconfig: Fix V3D deferred probe timeout The commit 4adc20ba95d4 ("ARM: dts: broadcom: rpi: Switch to V3D firmware clock") causes a regression in arm64 developer setups, which stores the kernel modules via NFS. Before this change the involved V3D clock provider was builtin, but after this DT change the clk-raspberrypi is responsible for V3D and for arm64/defconfig this driver is build as a kernel module. In case these kernel modules are provided via NFS this takes too long and the PM domain core give up before the clock driver could be loaded: v3d fec00000.gpu: deferred probe timeout, ignoring dependency So resolve this issue by making this critical driver builtin. Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-arm-kernel/9ebda74e-e700-4fbe-bca5-382f92417a9c@sirena.org.uk/ Fixes: 4adc20ba95d4 ("ARM: dts: broadcom: rpi: Switch to V3D firmware clock") Signed-off-by: Stefan Wahren Link: https://lore.kernel.org/r/20251104174518.11783-1-wahrenst@gmx.net Signed-off-by: Florian Fainelli commit b540de9e3b4fab3b9e10f30714a6f5c1b2a50ec3 Author: Shuhao Fu Date: Tue Nov 4 23:13:15 2025 +0800 smb: client: fix refcount leak in smb2_set_path_attr Fix refcount leak in `smb2_set_path_attr` when path conversion fails. Function `cifs_get_writable_path` returns `cfile` with its reference counter `cfile->count` increased on success. Function `smb2_compound_op` would decrease the reference counter for `cfile`, as stated in its comment. By calling `smb2_rename_path`, the reference counter of `cfile` would leak if `cifs_convert_path_to_utf16` fails in `smb2_set_path_attr`. Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") Acked-by: Henrique Carvalho Signed-off-by: Shuhao Fu Signed-off-by: Steve French commit 17d85f33a83b84e7d36bc3356614ae06c90e7a08 Merge: c9cfc122f03711 b8126205dbe01e Author: Linus Torvalds Date: Wed Nov 5 04:08:55 2025 +0900 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Memory leak in bnxt GSI qp path - Failure in irdma registering large MRs - Failure to clean out the right CQ table entry in irdma - Invalid vf_id in some cases - Incorrect error unwind in EFA CQ create - hns doesn't use the optimal cq/qp relationships for it's HW banks - hns reports the wrong SGE size to userspace for its QPs - Corruption of the hns work queue entries in some cases * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: MAINTAINERS: Update irdma maintainers RDMA/irdma: Fix vf_id size to u16 to avoid overflow RDMA/hns: Remove an extra blank line RDMA/hns: Fix wrong WQE data when QP wraps around RDMA/hns: Fix the modification of max_send_sge RDMA/hns: Fix recv CQ and QP cache affinity RDMA/uverbs: Fix umem release in UVERBS_METHOD_CQ_CREATE RDMA/irdma: Set irdma_cq cq_num field during CQ create RDMA/irdma: Fix SD index calculation RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp commit d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4 Author: Dan Carpenter Date: Sat Nov 1 16:25:27 2025 +0300 Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &. Fixes: 768062fd1284 ("Input: imx_sc_key - use devm_add_action_or_reset() to handle all cleanups") Signed-off-by: Dan Carpenter Reviewed-by: Peng Fan Reviewed-by: Frank Li Link: https://patch.msgid.link/aQYKR75r2VMFJutT@stanley.mountain Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 6dd97ceb645c08aca9fc871a3006e47fe699f0ac Author: Rong Zhang Date: Tue Oct 14 00:47:35 2025 +0800 drm/amd/display: Fix NULL deref in debugfs odm_combine_segments When a connector is connected but inactive (e.g., disabled by desktop environments), pipe_ctx->stream_res.tg will be destroyed. Then, reading odm_combine_segments causes kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6 Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025 RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: seq_read_iter+0x125/0x490 ? __alloc_frozen_pages_noprof+0x18f/0x350 seq_read+0x12c/0x170 full_proxy_read+0x51/0x80 vfs_read+0xbc/0x390 ? __handle_mm_fault+0xa46/0xef0 ? do_syscall_64+0x71/0x900 ksys_read+0x73/0xf0 do_syscall_64+0x71/0x900 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f44d4031687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687 RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003 RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000 Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp> CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Fix this by checking pipe_ctx->stream_res.tg before dereferencing. Fixes: 07926ba8a44f ("drm/amd/display: Add debugfs interface for ODM combine info") Signed-off-by: Rong Zhang Reviewed-by: Mario Limoncello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit f19bbecd34e3c15eed7e5e593db2ac0fc7a0e6d8) Cc: stable@vger.kernel.org commit 597eb70f7ff7551ff795cd51754b81aabedab67b Author: Philip Yang Date: Fri Oct 31 10:50:02 2025 -0400 drm/amdkfd: Don't clear PT after process killed If process is killed. the vm entity is stopped, submit pt update job will trigger the error message "*ERROR* Trying to push to a killed entity", job will not execute. Suggested-by: Christian König Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 10c382ec6c6d1e11975a11962bec21cba6360391) Cc: stable@vger.kernel.org commit 7c5609b72bfe57d8c601d9561e0d2551b605c017 Author: Alex Deucher Date: Fri Oct 24 13:08:11 2025 -0400 drm/amdgpu/smu: Handle S0ix for vangogh Fix the flows for S0ix. There is no need to stop rlc or reintialize PMFW in S0ix. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Reviewed-by: Mario Limonciello Reported-by: Antheas Kapenekakis Tested-by: Antheas Kapenekakis Signed-off-by: Alex Deucher (cherry picked from commit fd39b5a5830d8f2553e0c09d4d50bdff28b10080) Cc: # c81f5cebe849: drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() Cc: commit c81f5cebe849a2beeed4c8f2b06a58dfc02d5350 Author: Alex Deucher Date: Sat Oct 25 23:29:36 2025 -0500 drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() For S3 on vangogh, PMFW needs to be notified before the driver powers down RLC. This already happens in smu_disable_dpms() so drop the superfluous call in amdgpu_device_suspend(). Co-developed-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 960e30a61e1a7ca5341a6cf9481e770e1cda24aa) commit fdc93beeadc2439e5e85d056a8fe681dcced09da Author: Alex Hung Date: Wed Oct 22 16:19:34 2025 -0600 drm/amd/display: Fix black screen with HDMI outputs [Why & How] This fixes the black screen issue on certain APUs with HDMI, accompanied by the following messages: amdgpu 0000:c4:00.0: amdgpu: [drm] Failed to setup vendor info frame on connector DP-1: -22 amdgpu 0000:c4:00.0: [drm] Cannot find any crtc or sizes [drm] Cannot find any crtc or sizes Fixes: 489f0f600ce2 ("drm/amd/display: Fix DVI-D/HDMI adapters") Suggested-by: Timur Kristóf Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 678c901443a6d2e909e3b51331a20f9d8f84ce82) commit 3362692fea915ce56345366364a501c629c9ff17 Author: Mario Limonciello (AMD) Date: Thu Oct 30 14:39:43 2025 -0500 drm/amd/display: Don't stretch non-native images by default in eDP commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") started using the GPU scaler hardware to scale when a non-native resolution was picked on eDP. This scaling was done to fill the screen instead of maintain aspect ratio. The idea was supposed to be that if a different scaling behavior is preferred then the compositor would request it. The not following aspect ratio behavior however isn't desirable, so adjust it to follow aspect ratio and still try to fill screen. Note: This will lead to black bars in some cases for non-native resolutions. Compositors can request the previous behavior if desired. Fixes: 978fa2f6d0b1 ("drm/amd/display: Use scaling for non-native resolutions on eDP") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 825df7ff4bb1a383ad4827545e09aec60d230770) commit 37e3567dee273f68726373b342b38234bafe4cf9 Author: Yang Wang Date: Thu Oct 30 13:06:24 2025 +0800 drm/amd/pm: fix missing device_attr cleanup in amdgpu_pm_sysfs_init() Use the correct label to complete all cleanup work. Fixes: 4d154b1ca580 ("drm/amd/pm: Add support for DPM policies") Fixes: 25e82f2e2c59 ("drm/amd/pm: Add temperature metrics sysfs entry") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 4c4c138a1c86775c4d47e24f26357a1f8b64d0a3) commit 90b75e12a6e831c8516498f690058d4165d5a5d6 Author: Alex Deucher Date: Tue Oct 14 16:45:17 2025 -0400 drm/amdgpu: set default gfx reset masks for gfx6-8 These were not set so soft recovery was inadvertantly disabled. Fixes: 6ac55eab4fc4 ("drm/amdgpu: move reset support type checks into the caller") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 1972763505d728c604b537180727ec8132e619df) commit 789521b4717fd6bd85164ba5c131f621a79c9736 Author: Miguel Ojeda Date: Sat Nov 1 10:40:11 2025 +0100 rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0 Rust 1.93.0 (expected 2026-01-22) is stabilizing `-Zno-jump-tables` [1][2] as `-Cjump-tables=n` [3]. Without this change, one would eventually see: RUSTC L rust/core.o error: unknown unstable option: `no-jump-tables` Thus support the upcoming version. Link: https://github.com/rust-lang/rust/issues/116592 [1] Link: https://github.com/rust-lang/rust/pull/105812 [2] Link: https://github.com/rust-lang/rust/pull/145974 [3] Reviewed-by: Alice Ryhl Reviewed-by: Trevor Gross Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251101094011.1024534-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 Author: Eric Biggers Date: Mon Nov 3 21:49:06 2025 -0800 lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN On big endian arm kernels, the arm optimized Curve25519 code produces incorrect outputs and fails the Curve25519 test. This has been true ever since this code was added. It seems that hardly anyone (or even no one?) actually uses big endian arm kernels. But as long as they're ostensibly supported, we should disable this code on them so that it's not accidentally used. Note: for future-proofing, use !CPU_BIG_ENDIAN instead of CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could get removed in the future if big endian support gets dropped. Fixes: d8f1308a025f ("crypto: arm/curve25519 - wire up NEON implementation") Cc: stable@vger.kernel.org Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251104054906.716914-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2b81082ad37cc3f28355fb73a6a69b91ff7dbf20 Author: Nathan Chancellor Date: Mon Nov 3 12:11:24 2025 -0700 lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Commit 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older") inadvertently disabled KASAN in curve25519-hacl64.o for GCC unconditionally because clang-min-version will always evaluate to nothing for GCC. Add a check for CONFIG_CC_IS_CLANG to avoid applying the workaround for GCC, which is only needed for clang-17 and older. Cc: stable@vger.kernel.org Fixes: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older") Signed-off-by: Nathan Chancellor Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251103-curve25519-hacl64-fix-kasan-workaround-v2-1-ab581cbd8035@kernel.org Signed-off-by: Eric Biggers commit ae431059e75d36170a5ae6b44cc4d06d43613215 Author: Sean Christopherson Date: Mon Nov 3 17:12:05 2025 -0800 KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying When unbinding a memslot from a guest_memfd instance, remove the bindings even if the guest_memfd file is dying, i.e. even if its file refcount has gone to zero. If the memslot is freed before the file is fully released, nullifying the memslot side of the binding in kvm_gmem_release() will write to freed memory, as detected by syzbot+KASAN: ================================================================== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353 Write of size 8 at addr ffff88807befa508 by task syz.0.17/6022 CPU: 0 UID: 0 PID: 6022 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbeeff8efc9 Allocated by task 6023: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x3e2/0x700 mm/slub.c:5758 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] kvm_set_memory_region+0x747/0xb90 virt/kvm/kvm_main.c:2104 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6023: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2533 [inline] slab_free mm/slub.c:6622 [inline] kfree+0x19a/0x6d0 mm/slub.c:6829 kvm_set_memory_region+0x9c4/0xb90 virt/kvm/kvm_main.c:2130 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Deliberately don't acquire filemap invalid lock when the file is dying as the lifecycle of f_mapping is outside the purview of KVM. Dereferencing the mapping is *probably* fine, but there's no need to invalidate anything as memslot deletion is responsible for zapping SPTEs, and the only code that can access the dying file is kvm_gmem_release(), whose core code is mutually exclusive with unbinding. Note, the mutual exclusivity is also what makes it safe to access the bindings on a dying gmem instance. Unbinding either runs with slots_lock held, or after the last reference to the owning "struct kvm" is put, and kvm_gmem_release() nullifies the slot pointer under slots_lock, and puts its reference to the VM after that is done. Reported-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68fa7a22.a70a0220.3bf6c6.008b.GAE@google.com Tested-by: syzbot+2479e53d0db9b32ae2aa@syzkaller.appspotmail.com Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Cc: stable@vger.kernel.org Cc: Hillf Danton Reviewed-By: Vishal Annapurve Link: https://patch.msgid.link/20251104011205.3853541-1-seanjc@google.com Signed-off-by: Sean Christopherson commit fd92bd3b4445342e55f2c541c577796e0c3f1b8a Author: Maxim Levitsky Date: Thu Oct 30 15:41:30 2025 -0400 KVM: SVM: switch to raw spinlock for svm->ir_list_lock Use a raw spinlock for vcpu_svm.ir_list_lock as the lock can be taken during schedule() via kvm_sched_out() => __avic_vcpu_put(), and "normal" spinlocks are sleepable locks when PREEMPT_RT=y. This fixes the following lockdep warning: ============================= [ BUG: Invalid wait context ] 6.12.0-146.1640_2124176644.el10.x86_64+debug #1 Not tainted ----------------------------- qemu-kvm/38299 is trying to lock: ff11000239725600 (&svm->ir_list_lock){....}-{3:3}, at: __avic_vcpu_put+0xfd/0x300 [kvm_amd] other info that might help us debug this: context-{5:5} 2 locks held by qemu-kvm/38299: #0: ff11000239723ba8 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x240/0xe00 [kvm] #1: ff11000b906056d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2e/0x130 stack backtrace: CPU: 1 UID: 0 PID: 38299 Comm: qemu-kvm Kdump: loaded Not tainted 6.12.0-146.1640_2124176644.el10.x86_64+debug #1 PREEMPT(voluntary) Hardware name: AMD Corporation QUARTZ/QUARTZ, BIOS RQZ100AB 09/14/2023 Call Trace: dump_stack_lvl+0x6f/0xb0 __lock_acquire+0x921/0xb80 lock_acquire.part.0+0xbe/0x270 _raw_spin_lock_irqsave+0x46/0x90 __avic_vcpu_put+0xfd/0x300 [kvm_amd] svm_vcpu_put+0xfa/0x130 [kvm_amd] kvm_arch_vcpu_put+0x48c/0x790 [kvm] kvm_sched_out+0x161/0x1c0 [kvm] prepare_task_switch+0x36b/0xf60 __schedule+0x4f7/0x1890 schedule+0xd4/0x260 xfer_to_guest_mode_handle_work+0x54/0xc0 vcpu_run+0x69a/0xa70 [kvm] kvm_arch_vcpu_ioctl_run+0xdc0/0x17e0 [kvm] kvm_vcpu_ioctl+0x39f/0xe00 [kvm] Signed-off-by: Maxim Levitsky Link: https://patch.msgid.link/20251030194130.307900-1-mlevitsk@redhat.com [sean: massage changelog] Signed-off-by: Sean Christopherson commit aaac099459f932b9dbaf85ca2a7251633cc213d0 Author: Sean Christopherson Date: Thu Oct 16 12:06:43 2025 -0700 KVM: SVM: Make avic_ga_log_notifier() local to avic.c Make amd_iommu_register_ga_log_notifier() a local symbol now that it's defined and used purely within avic.c. No functional change intended. Fixes: 4bdec12aa8d6 ("KVM: SVM: Detect X2APIC virtualization (x2AVIC) support") Link: https://patch.msgid.link/20251016190643.80529-4-seanjc@google.com Signed-off-by: Sean Christopherson commit adc6ae9729719be5e74219aaafb95e60a9e9950e Author: Sean Christopherson Date: Thu Oct 16 12:06:42 2025 -0700 KVM: SVM: Unregister KVM's GALog notifier on kvm-amd.ko exit Unregister the GALog notifier (used to get notified of wake events for blocking vCPUs) on kvm-amd.ko exit so that a KVM or IOMMU driver bug that results in a spurious GALog event "only" results in a spurious IRQ, and doesn't trigger a use-after-free due to executing unloaded module code. Fixes: 5881f73757cc ("svm: Introduce AMD IOMMU avic_ga_log_notifier") Reported-by: Hou Wenlong Closes: https://lore.kernel.org/all/20250918130320.GA119526@k08j02272.eu95sqa Link: https://patch.msgid.link/20251016190643.80529-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 59a217ced3e7af849cc84fce36d8bfe225976e27 Author: Sean Christopherson Date: Thu Oct 16 12:06:41 2025 -0700 KVM: SVM: Initialize per-CPU svm_data at the end of hardware setup Setup the per-CPU SVM data structures at the very end of hardware setup so that svm_hardware_unsetup() can be used in svm_hardware_setup() to unwind AVIC setup (for the GALog notifier). Alternatively, the error path could do an explicit, manual unwind, e.g. by adding a helper to free the per-CPU structures. But the per-CPU allocations have no interactions or dependencies, i.e. can comfortably live at the end, and so converting to a manual unwind would introduce churn and code without providing any immediate advantage. Link: https://patch.msgid.link/20251016190643.80529-2-seanjc@google.com Signed-off-by: Sean Christopherson commit cab4098be41826a91b55cdc851196d73d7057f9c Author: Chao Gao Date: Mon Oct 27 23:01:41 2025 -0700 KVM: x86: Call out MSR_IA32_S_CET is not handled by XSAVES Update the comment above is_xstate_managed_msr() to note that MSR_IA32_S_CET isn't saved/restored by XSAVES/XRSTORS. MSR_IA32_S_CET isn't part of CET_U/S state as the SDM states: The register state used by Control-Flow Enforcement Technology (CET) comprises the two 64-bit MSRs (IA32_U_CET and IA32_PL3_SSP) that manage CET when CPL = 3 (CET_U state); and the three 64-bit MSRs (IA32_PL0_SSP–IA32_PL2_SSP) that manage CET when CPL < 3 (CET_S state). Opportunistically shift the snippet about the safety of loading certain MSRs to the function comment for kvm_access_xstate_msr(), which is where the MSRs are actually loaded into hardware. Fixes: e44eb58334bb ("KVM: x86: Load guest FPU state when access XSAVE-managed MSRs") Signed-off-by: Chao Gao Link: https://patch.msgid.link/20251028060142.29830-1-chao.gao@intel.com [sean: shift snippet about safety to kvm_access_xstate_msr()] Signed-off-by: Sean Christopherson commit 9bc610b6a2a71d1a6acac27e82a0bc8ca861c7ac Author: Sean Christopherson Date: Thu Oct 30 11:58:02 2025 -0700 KVM: x86: Harden KVM against imbalanced load/put of guest FPU state Assert, via KVM_BUG_ON(), that guest FPU state isn't/is in use when loading/putting the FPU to help detect KVM bugs without needing an assist from KASAN. If an imbalanced load/put is detected, skip the redundant load/put to avoid clobbering guest state and/or crashing the host. Note, kvm_access_xstate_msr() already provides a similar assertion. Reviewed-by: Yao Yuan Reviewed-by: Chao Gao Link: https://patch.msgid.link/20251030185802.3375059-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 8819a49f9ff8953475ba09d978d66b50368c095b Author: Sean Christopherson Date: Thu Oct 30 11:58:01 2025 -0700 KVM: x86: Unload "FPU" state on INIT if and only if its currently in-use Replace the hack added by commit f958bd2314d1 ("KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform") with a more robust approach of unloading+reloading guest FPU state based on whether or not the vCPU's FPU is currently in-use, i.e. currently loaded. This fixes a bug on hosts that support CET but not MPX, where kvm_arch_vcpu_ioctl_get_mpstate() neglects to load FPU state (it only checks for MPX support) and leads to KVM attempting to put FPU state due to kvm_apic_accept_events() triggering INIT emulation. E.g. on a host with CET but not MPX, syzkaller+KASAN generates: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 211 UID: 0 PID: 20451 Comm: syz.9.26 Tainted: G S 6.18.0-smp-DEV #7 NONE Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Google Izumi/izumi, BIOS 0.20250729.1-0 07/29/2025 RIP: 0010:fpu_swap_kvm_fpstate+0x3ce/0x610 ../arch/x86/kernel/fpu/core.c:377 RSP: 0018:ff1100410c167cc0 EFLAGS: 00010202 RAX: 0000000000000004 RBX: 0000000000000020 RCX: 00000000000001aa RDX: 00000000000001ab RSI: ffffffff817bb960 RDI: 0000000022600000 RBP: dffffc0000000000 R08: ff110040d23c8007 R09: 1fe220081a479000 R10: dffffc0000000000 R11: ffe21c081a479001 R12: ff110040d23c8d98 R13: 00000000fffdc578 R14: 0000000000000000 R15: ff110040d23c8d90 FS: 00007f86dd1876c0(0000) GS:ff11007fc969b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f86dd186fa8 CR3: 00000040d1dfa003 CR4: 0000000000f73ef0 PKRU: 80000000 Call Trace: kvm_vcpu_reset+0x80d/0x12c0 ../arch/x86/kvm/x86.c:11818 kvm_apic_accept_events+0x1cb/0x500 ../arch/x86/kvm/lapic.c:3489 kvm_arch_vcpu_ioctl_get_mpstate+0xd0/0x4e0 ../arch/x86/kvm/x86.c:12145 kvm_vcpu_ioctl+0x5e2/0xed0 ../virt/kvm/kvm_main.c:4539 __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:51 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x6e/0x940 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f86de71d9c9 with a very simple reproducer: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, ...) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f00000000c0)) Alternatively, the MPX hack in GET_MP_STATE could be extended to cover CET, but from a "don't break existing functionality" perspective, that isn't any less risky than peeking at the state of in_use, and it's far less robust for a long term solution (as evidenced by this bug). Reported-by: Alexander Potapenko Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER") Reviewed-by: Yao Yuan Reviewed-by: Chao Gao Link: https://patch.msgid.link/20251030185802.3375059-2-seanjc@google.com Signed-off-by: Sean Christopherson commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 Author: Miaoqian Lin Date: Tue Oct 28 11:16:20 2025 +0800 pmdomain: imx: Fix reference count leak in imx_gpc_remove of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add the missing of_node_put() to avoid refcount leak. Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Ulf Hansson commit f1fdffe0afea02ba783acfe815b6a60e7180df40 Author: Mario Limonciello Date: Tue Nov 4 10:10:06 2025 -0600 x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode Running x86_match_min_microcode_rev() on a Zen5 CPU trips up KASAN for an out of bounds access. Fixes: 607b9fb2ce248 ("x86/CPU/AMD: Add RDSEED fix for Zen5") Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251104161007.269885-1-mario.limonciello@amd.com commit fccac54b0d3d0602f177bb79f203ae6fbea0e32a Author: Marek Szyprowski Date: Mon Oct 27 13:55:15 2025 +0100 pmdomain: samsung: Rework legacy splash-screen handover workaround Limit the workaround for the lack of the proper splash-screen handover handling to the legacy ARM 32bit systems and replace forcing a sync_state by explicite power domain shutdown. This approach lets compiler to optimize it out on newer ARM 64bit systems. Suggested-by: Ulf Hansson Fixes: 0745658aebbe ("pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state") Signed-off-by: Marek Szyprowski Acked-by: Krzysztof Kozlowski Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 4d3dbc2386fe051e44efad663e0ec828b98ab53f Author: Olga Kornievskaia Date: Thu Oct 9 16:37:59 2025 -0400 nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes RFC 7862 Section 4.1.2 says that if the server supports CLONE it MUST support clone_blksize attribute. Fixes: d6ca7d2643ee ("NFSD: Implement FATTR4_CLONE_BLKSIZE attribute") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c Author: NeilBrown Date: Wed Oct 8 09:52:25 2025 -0400 nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected. Reported-and-tested-by: tianshuo han Fixes: ef7f6c4904d0 ("nfsd: move V4ROOT version check to nfsd_set_fh_dentry()") Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever commit 734e99623c5b65bf2c03e35978a0b980ebc3c2f8 Author: Henrique Carvalho Date: Mon Nov 3 19:52:55 2025 -0300 smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2_close_cached_fid(), leading to use-after-free. Switch to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap. Fixes: ebe98f1447bb ("cifs: enable caching of directories for which a lease is held") Cc: stable@vger.kernel.org Reported-by: Jay Shin Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit e6187655acfa2dd566ea2aed4522083f0bb940c3 Author: Namjae Jeon Date: Mon Oct 27 15:46:39 2025 +0900 ksmbd: detect RDMA capable netdevs include IPoIB Current ksmbd_rdma_capable_netdev fails to mark certain RDMA-capable inerfaces such as IPoIB as RDMA capable after reverting GUID matching code due to layer violation. This patch check the ARPHRD_INFINIBAND type safely identifies an IPoIB interface without introducing a layer violation, ensuring RDMA functionality is correctly enabled for these interfaces. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d24822e1471d68a6eceee67809b5956d59482cb5 Author: Namjae Jeon Date: Mon Oct 27 15:24:17 2025 +0900 ksmbd: detect RDMA capable lower devices when bridge and vlan netdev is used If user set bridge interface as actual RDMA-capable NICs are lower devices, ksmbd can not detect as RDMA capable. This patch can detect the RDMA capable lower devices from bridge master or VLAN. With this change, ksmbd can accept both TCP and RDMA connections through the same bridge IP address, allowing mixed transport operation without requiring separate interfaces. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 249d96b492efb7a773296ab2c62179918301c146 Author: Claudiu Beznea Date: Tue Nov 4 13:49:14 2025 +0200 ASoC: da7213: Use component driver suspend/resume Since snd_soc_suspend() is invoked through snd_soc_pm_ops->suspend(), and snd_soc_pm_ops is associated with the soc_driver (defined in sound/soc/soc-core.c), and there is no parent-child relationship between the soc_driver and the DA7213 codec driver, the power management subsystem does not enforce a specific suspend/resume order between the DA7213 driver and the soc_driver. Because of this, the different codec component functionalities, called from snd_soc_resume() to reconfigure various functions, can race with the DA7213 struct dev_pm_ops::resume function, leading to misapplied configuration. This occasionally results in clipped sound. Fix this by dropping the struct dev_pm_ops::{suspend, resume} and use instead struct snd_soc_component_driver::{suspend, resume}. This ensures the proper configuration sequence is handled by the ASoC subsystem. Cc: stable@vger.kernel.org Fixes: 431e040065c8 ("ASoC: da7213: Add suspend to RAM support") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251104114914.2060603-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit fd9f30d1038ee1624baa17a6ff11effe5f7617cb Author: Helge Deller Date: Mon Nov 3 22:38:26 2025 +0100 parisc: Avoid crash due to unaligned access in unwinder Guenter Roeck reported this kernel crash on his emulated B160L machine: Starting network: udhcpc: started, v1.36.1 Backtrace: [<104320d4>] unwind_once+0x1c/0x5c [<10434a00>] walk_stackframe.isra.0+0x74/0xb8 [<10434a6c>] arch_stack_walk+0x28/0x38 [<104e5efc>] stack_trace_save+0x48/0x5c [<105d1bdc>] set_track_prepare+0x44/0x6c [<105d9c80>] ___slab_alloc+0xfc4/0x1024 [<105d9d38>] __slab_alloc.isra.0+0x58/0x90 [<105dc80c>] kmem_cache_alloc_noprof+0x2ac/0x4a0 [<105b8e54>] __anon_vma_prepare+0x60/0x280 [<105a823c>] __vmf_anon_prepare+0x68/0x94 [<105a8b34>] do_wp_page+0x8cc/0xf10 [<105aad88>] handle_mm_fault+0x6c0/0xf08 [<10425568>] do_page_fault+0x110/0x440 [<10427938>] handle_interruption+0x184/0x748 [<11178398>] schedule+0x4c/0x190 BUG: spinlock recursion on CPU#0, ifconfig/2420 lock: terminate_lock.2+0x0/0x1c, .magic: dead4ead, .owner: ifconfig/2420, .owner_cpu: 0 While creating the stack trace, the unwinder uses the stack pointer to guess the previous frame to read the previous stack pointer from memory. The crash happens, because the unwinder tries to read from unaligned memory and as such triggers the unalignment trap handler which then leads to the spinlock recursion and finally to a deadlock. Fix it by checking the alignment before accessing the memory. Reported-by: Guenter Roeck Signed-off-by: Helge Deller Tested-by: Guenter Roeck Cc: stable@vger.kernel.org # v6.12+ commit b98b69c38512c3a8277c83b2d07674fd1ff59625 Author: Pauli Virtanen Date: Sun Nov 2 21:10:15 2025 +0200 ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis ID 1038:1294 SteelSeries ApS Arctis Pro Wireless is reported to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4229#note_3174448 Signed-off-by: Pauli Virtanen Link: https://patch.msgid.link/a83f2694b1f8c37e4667a3cf057ffdc408b0f70d.1762108507.git.pav@iki.fi Signed-off-by: Takashi Iwai commit c9cfc122f03711a5124b4aafab3211cf4d35a2ac Merge: 8bb886cb8f3a28 3b1a4a59a2086b Author: Linus Torvalds Date: Tue Nov 4 14:25:38 2025 +0900 Merge tag 'for-6.18-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix memory leak in qgroup relation ioctl when qgroup levels are invalid - don't write back dirty metadata on filesystem with errors - properly log renamed links - properly mark prealloc extent range beyond inode size as dirty (when no-noles is not enabled) * tag 'for-6.18-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: mark dirty extent range for out of bound prealloc extents btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation btrfs: ensure no dirty metadata is written back for an fs with errors commit 156c75f596c98852c30981baea6c2cc8a7a411fc Merge: 6146a0f1dfae5d 62d2d0a33839c2 Author: Alexei Starovoitov Date: Mon Nov 3 17:22:06 2025 -0800 Merge branch 'fix-ftrace-for-livepatch-bpf-fexit-programs' Song Liu says: ==================== Fix ftrace for livepatch + BPF fexit programs livepatch and BPF trampoline are two special users of ftrace. livepatch uses ftrace with IPMODIFY flag and BPF trampoline uses ftrace direct functions. When livepatch and BPF trampoline with fexit programs attach to the same kernel function, BPF trampoline needs to call into the patched version of the kernel function. 1/3 and 2/3 of this patchset fix two issues with livepatch + fexit cases, one in the register_ftrace_direct path, the other in the modify_ftrace_direct path. 3/3 adds selftests for both cases. Acked-by: Steven Rostedt (Google) --- v4: https://patch.msgid.link/20251027175023.1521602-1-song@kernel.org Changes v3 => v4: 1. Add helper reset_direct. (Steven) 2. Add Reviewed-by from Jiri. 3. Fix minor typo in comments. v3: https://lore.kernel.org/bpf/20251026205445.1639632-1-song@kernel.org/ Changes v2 => v3: 1. Incorporate feedback by AI, which also fixes build error reported by Steven and kernel test robot. v2: https://lore.kernel.org/bpf/20251024182901.3247573-1-song@kernel.org/ Changes v1 => v2: 1. Target bpf tree. (Alexei) 2. Bring back the FTRACE_WARN_ON in __ftrace_hash_update_ipmodify for valid code paths. (Steven) 3. Update selftests with cleaner way to find livepatch-sample.ko. (offlline discussion with Ihor) v1: https://lore.kernel.org/bpf/20251024071257.3956031-1-song@kernel.org/ ==================== Signed-off-by: Alexei Starovoitov commit e120f46768d98151ece8756ebd688b0e43dc8b29 Author: Qendrim Maxhuni Date: Wed Oct 29 08:57:44 2025 +0100 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks. Initialize the MAC header to prevent such crashes. This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface. Example trace: Internal error: Oops: 000000009600004f [#1] SMP CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1 Hardware name: LS1028A RDB Board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : xfrm_input+0xde8/0x1318 lr : xfrm_input+0x61c/0x1318 sp : ffff800080003b20 Call trace: xfrm_input+0xde8/0x1318 xfrm6_rcv+0x38/0x44 xfrm6_esp_rcv+0x48/0xa8 ip6_protocol_deliver_rcu+0x94/0x4b0 ip6_input_finish+0x44/0x70 ip6_input+0x44/0xc0 ipv6_rcv+0x6c/0x114 __netif_receive_skb_one_core+0x5c/0x8c __netif_receive_skb+0x18/0x60 process_backlog+0x78/0x17c __napi_poll+0x38/0x180 net_rx_action+0x168/0x2f0 Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support") Signed-off-by: Qendrim Maxhuni Link: https://patch.msgid.link/20251029075744.105113-1-qendrim.maxhuni@garderos.com Signed-off-by: Jakub Kicinski commit 59b20b15c112867f28a12a24aa25f14549db02e4 Author: Huiwen He Date: Mon Nov 3 10:36:19 2025 +0800 sctp: make sctp_transport_init() void sctp_transport_init() is static and never returns NULL. It is only called by sctp_transport_new(), so change it to void and remove the redundant return value check. Signed-off-by: Huiwen He Acked-by: Xin Long Link: https://patch.msgid.link/20251103023619.1025622-1-hehuiwen@kylinos.cn Signed-off-by: Jakub Kicinski commit 5556f23478e6eb5d6a0321d4135e2c37a3c78a1e Author: Vivian Wang Date: Mon Nov 3 10:02:49 2025 +0800 net: spacemit: Check netif_running() in emac_set_pauseparam() Currently, emac_set_pauseparam() will oops if userspace calls it while the interface is not up, because phydev is NULL, but it is still accessed in emac_set_fc() and emac_set_fc_autoneg(). Check for netif_running(dev) in emac_set_pauseparam() before proceeding. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Signed-off-by: Vivian Wang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251103-k1-ethernet-remove-fc-v3-1-2083770cd282@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 2e25935ed24daee37c4c2e8e29e478ce6e1f72c7 Author: Dan Carpenter Date: Sat Nov 1 16:26:42 2025 +0300 octeontx2-pf: Fix devm_kcalloc() error checking The devm_kcalloc() function never return error pointers, it returns NULL on failure. Also delete the netdev_err() printk. These allocation functions already have debug output built-in some the extra error message is not required. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQYKkrGA12REb2sj@stanley.mountain Signed-off-by: Jakub Kicinski commit 62d2d0a33839c28173909616db2ef16e1a4a5071 Author: Song Liu Date: Mon Oct 27 10:50:23 2025 -0700 selftests/bpf: Add tests for livepatch + bpf trampoline Both livepatch and BPF trampoline use ftrace. Special attention is needed when livepatch and fexit program touch the same function at the same time, because livepatch updates a kernel function and the BPF trampoline need to call into the right version of the kernel function. Use samples/livepatch/livepatch-sample.ko for the test. The test covers two cases: 1) When a fentry program is loaded first. This exercises the modify_ftrace_direct code path. 2) When a fentry program is loaded first. This exercises the register_ftrace_direct code path. Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-4-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 Author: Song Liu Date: Mon Oct 27 10:50:22 2025 -0700 ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on the same kernel function. When needed, ftrace_hash_ipmodify_enable() calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to share the same function as the IPMODIFY ftrace (livepatch). ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, but not called in modify_ftrace_direct() path. As a result, the following operations will break livepatch: 1. Load livepatch to a kernel function; 2. Attach fentry program to the kernel function; 3. Attach fexit program to the kernel function. After 3, the kernel function being used will not be the livepatched version, but the original version. Fix this by adding __ftrace_hash_update_ipmodify() to __modify_ftrace_direct() and adjust some logic around the call. Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit 56b3c85e153b84f27e6cff39623ba40a1ad299d3 Author: Song Liu Date: Mon Oct 27 10:50:21 2025 -0700 ftrace: Fix BPF fexit with livepatch When livepatch is attached to the same function as bpf trampoline with a fexit program, bpf trampoline code calls register_ftrace_direct() twice. The first time will fail with -EAGAIN, and the second time it will succeed. This requires register_ftrace_direct() to unregister the address on the first attempt. Otherwise, the bpf trampoline cannot attach. Here is an easy way to reproduce this issue: insmod samples/livepatch/livepatch-sample.ko bpftrace -e 'fexit:cmdline_proc_show {}' ERROR: Unable to attach probe: fexit:vmlinux:cmdline_proc_show... Fix this by cleaning up the hash when register_ftrace_function_nolock hits errors. Also, move the code that resets ops->func and ops->trampoline to the error path of register_ftrace_direct(); and add a helper function reset_direct() in register_ftrace_direct() and unregister_ftrace_direct(). Fixes: d05cb470663a ("ftrace: Fix modification of direct_function hash while in use") Cc: stable@vger.kernel.org # v6.6+ Reported-by: Andrey Grodzovsky Closes: https://lore.kernel.org/live-patching/c5058315a39d4615b333e485893345be@crowdstrike.com/ Cc: Steven Rostedt (Google) Cc: Masami Hiramatsu (Google) Acked-and-tested-by: Andrey Grodzovsky Signed-off-by: Song Liu Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251027175023.1521602-2-song@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Steven Rostedt (Google) commit de0337d641bfa5b6d6b489e479792f1039274e84 Author: Mohammad Heib Date: Fri Oct 31 17:52:03 2025 +0200 net: ionic: map SKB after pseudo-header checksum prep The TSO path called ionic_tx_map_skb() before preparing the TCP pseudo checksum (ionic_tx_tcp_[inner_]pseudo_csum()), which may perform skb_cow_head() and might modifies bytes in the linear header area. Mapping first and then mutating the header risks: - Using a stale DMA address if skb_cow_head() relocates the head, and/or - Device reading stale header bytes on weakly-ordered systems (CPU writes after mapping are not guaranteed visible without an explicit dma_sync_single_for_device()). Reorder the TX path to perform all header mutations (including skb_cow_head()) *before* DMA mapping. Mapping is now done only after the skb layout and header contents are final. This removes the need for any post-mapping dma_sync and prevents on-wire corruption observed under VLAN+TSO load after repeated runs. This change is purely an ordering fix; no functional behavior change otherwise. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Mohammad Heib Reviewed-by: Brett Creeley Link: https://patch.msgid.link/20251031155203.203031-2-mheib@redhat.com Signed-off-by: Jakub Kicinski commit d261f5b09c28850dc63ca1d3018596f829f402d5 Author: Mohammad Heib Date: Fri Oct 31 17:52:02 2025 +0200 net: ionic: add dma_wmb() before ringing TX doorbell The TX path currently writes descriptors and then immediately writes to the MMIO doorbell register to notify the NIC. On weakly ordered architectures, descriptor writes may still be pending in CPU or DMA write buffers when the doorbell is issued, leading to the device fetching stale or incomplete descriptors. Add a dma_wmb() in ionic_txq_post() to ensure all descriptor writes are visible to the device before the doorbell MMIO write. Fixes: 0f3154e6bcb3 ("ionic: Add Tx and Rx handling") Signed-off-by: Mohammad Heib Link: https://patch.msgid.link/20251031155203.203031-1-mheib@redhat.com Signed-off-by: Jakub Kicinski commit 7172c8cd65a09915a8bc4b8dc3f8719f0ca20e71 Merge: 99ae0675d73bd8 f1fc201148c7e6 Author: Jakub Kicinski Date: Mon Nov 3 17:09:38 2025 -0800 Merge branch 'fix-sctp-diag-locking-issues' Stefan Wiehler says: ==================== Fix SCTP diag locking issues - Hold RCU read lock while iterating over address list in inet_diag_msg_sctpaddrs_fill() - Prevent TOCTOU out-of-bounds write - Hold sock lock while iterating over address list in sctp_sock_dump_one() ==================== Link: https://patch.msgid.link/20251028161506.3294376-1-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit f1fc201148c7e684c10a72b6a3375597f28d1ef6 Author: Stefan Wiehler Date: Tue Oct 28 17:12:28 2025 +0100 sctp: Hold sock lock while iterating over address list Move address list traversal in inet_assoc_attr_size() under the sock lock to avoid holding the RCU read lock. Suggested-by: Xin Long Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-4-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 95aef86ab231f047bb8085c70666059b58f53c09 Author: Stefan Wiehler Date: Tue Oct 28 17:12:27 2025 +0100 sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use). Suggested-by: Kuniyuki Iwashima Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Reviewed-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 38f50242bf0f237cdc262308d624d333286ec3c5 Author: Stefan Wiehler Date: Tue Oct 28 17:12:26 2025 +0100 sctp: Hold RCU read lock while iterating over address list With CONFIG_PROVE_RCU_LIST=y and by executing $ netcat -l --sctp & $ netcat --sctp localhost & $ ss --sctp one can trigger the following Lockdep-RCU splat(s): WARNING: suspicious RCU usage 6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted ----------------------------- net/sctp/diag.c:76 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by ss/215: #0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0 #1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200 stack backtrace: CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5d/0x90 lockdep_rcu_suspicious.cold+0x4e/0xa3 inet_sctp_diag_fill.isra.0+0x4b1/0x5d0 sctp_sock_dump+0x131/0x200 sctp_transport_traverse_process+0x170/0x1b0 ? __pfx_sctp_sock_filter+0x10/0x10 ? __pfx_sctp_sock_dump+0x10/0x10 sctp_diag_dump+0x103/0x140 __inet_diag_dump+0x70/0xb0 netlink_dump+0x148/0x490 __netlink_dump_start+0x1f3/0x2b0 inet_diag_handler_cmd+0xcd/0x100 ? __pfx_inet_diag_dump_start+0x10/0x10 ? __pfx_inet_diag_dump+0x10/0x10 ? __pfx_inet_diag_dump_done+0x10/0x10 sock_diag_rcv_msg+0x18e/0x320 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x4d/0x100 netlink_unicast+0x1d7/0x2b0 netlink_sendmsg+0x203/0x450 ____sys_sendmsg+0x30c/0x340 ___sys_sendmsg+0x94/0xf0 __sys_sendmsg+0x83/0xf0 do_syscall_64+0xbb/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Stefan Wiehler Reviewed-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20251028161506.3294376-2-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski commit 99ae0675d73bd88c8ff4d15a6b0f310d49cad84c Merge: 7942602b09497f 65bd9a262644b6 Author: Jakub Kicinski Date: Mon Nov 3 16:48:53 2025 -0800 Merge branch 'net-phy-micrel-lan8842-erratas' Horatiu Vultur says: ==================== net: phy: micrel: lan8842 erratas Add two erratas to the lan8842. The errata document can be found here [1] The two erratas are: - module 2 ("Analog front-end not optimized for PHY-side shorted center taps"). - module 7 ("1000BASE-T PMA EEE TX wake timer is non-compliant") ==================== Link: https://patch.msgid.link/20251031121629.814935-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 65bd9a262644b67490dddd93a2b842ac94ccbe36 Author: Horatiu Vultur Date: Fri Oct 31 13:16:29 2025 +0100 net: phy: micrel: lan8842 errata Add errata for lan8842. The errata document can be found here [1]. This is fixing the module 7 ("1000BASE-T PMA EEE TX wake timer is non-compliant") [1] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/LAN8842-Errata-DS80001172.pdf Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Reviewed-by: Andrew Lunn Signed-off-by: Horatiu Vultur Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit c8732e933925e188cbb1d9bc3a5e1ae9affe6869 Author: Horatiu Vultur Date: Fri Oct 31 13:16:28 2025 +0100 net: phy: micrel: lan8842 errata Add errata for lan8842. The errata document can be found here [1]. This is fixing the module 2 ("Analog front-end not optimized for PHY-side shorted center taps"). [1] https://ww1.microchip.com/downloads/aemDocuments/documents/UNG/ProductDocuments/Errata/LAN8842-Errata-DS80001172.pdf Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Reviewed-by: Andrew Lunn Signed-off-by: Horatiu Vultur Reviewed-by: Russell King (Oracle) Signed-off-by: Jakub Kicinski commit 7942602b09497ff1505c9385aefd38c69e16235e Merge: c7321193bcd7dd e57723fe536f04 Author: Jakub Kicinski Date: Mon Nov 3 16:42:45 2025 -0800 Merge branch 'net-dsa-b53-minor-fdb-related-fixes' Jonas Gorski says: ==================== net: dsa: b53: minor fdb related fixes While investigating and fixing/implenting proper ARL support for bcm63xx, I encountered multiple minor issues in the current ARL implementation: * The ARL multicast support was not properly enabled for older chips, and instead a potentially reserved bit was toggled. * While traversing the ARL table, "Search done" triggered one final entry which will be invalid for 4 ARL bin chips, and failed to stop the search on chips with only one result register. * For chips where we have only one result register, we only traversed at most half the maximum entries. I also had a fix for IVL_SVL_SELECT which is only valid for some chips, but since this would only have an effect for !vlan_enabled, and we always have that enabled, it isn't really worth fixing (and rather drop the !vlan_enabled paths). ==================== Link: https://patch.msgid.link/20251102100758.28352-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit e57723fe536f040cc2635ec1545dd0a7919a321e Author: Jonas Gorski Date: Sun Nov 2 11:07:58 2025 +0100 net: dsa: b53: properly bound ARL searches for < 4 ARL bin chips When iterating over the ARL table we stop at max ARL entries / 2, but this is only valid if the chip actually returns 2 results at once. For chips with only one result register we will stop before reaching the end of the table if it is more than half full. Fix this by only dividing the maximum results by two if we have a chip with more than one result register (i.e. those with 4 ARL bins). Fixes: cd169d799bee ("net: dsa: b53: Bound check ARL searches") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-4-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da Author: Jonas Gorski Date: Sun Nov 2 11:07:57 2025 +0100 net: dsa: b53: stop reading ARL entries if search is done The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it finished traversing the ARL table. This means that there will be no valid result, so we should not attempt to read and process any further entries. We only ever check the validity of the entries for 4 ARL bin chips, and only after having passed the first entry to the b53_fdb_copy(). This means that we always pass an invalid entry at the end to the b53_fdb_copy(). b53_fdb_copy() does check the validity though before passing on the entry, so it never gets passed on. On < 4 ARL bin chips, we will even continue reading invalid entries until we reach the result limit. Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit c264294624e956a967a9e2e5fa41e3273340b089 Author: Jonas Gorski Date: Sun Nov 2 11:07:56 2025 +0100 net: dsa: b53: fix enabling ip multicast In the New Control register bit 1 is either reserved, or has a different function: Out of Range Error Discard When enabled, the ingress port discards any frames if the Length field is between 1500 and 1536 (excluding 1500 and 1536) and with good CRC. The actual bit for enabling IP multicast is bit 0, which was only explicitly enabled for BCM5325 so far. For older switch chips, this bit defaults to 0, so we want to enable it as well, while newer switch chips default to 1, and their documentation says "It is illegal to set this bit to zero." So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit also for other switch chips. While at it, rename it to (B53_)IP_MC as that is how it is called in Broadcom code. Fixes: 63cc54a6f073 ("net: dsa: b53: Fix egress flooding settings") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251102100758.28352-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit c7321193bcd7ddb22fdd9ae26516c8963e31e134 Merge: 7ed8b63ddc9a95 3e4ebdc1606adf Author: Jakub Kicinski Date: Mon Nov 3 16:40:37 2025 -0800 Merge branch 'net-dsa-b53-fix-bcm63xx-rgmii-user-ports-with-speed-1g' Jonas Gorski says: ==================== net: dsa: b53: fix bcm63xx rgmii user ports with speed < 1g It seems that the integrated switch in bcm63xx does not support polling external PHYs for link configuration. While the appropriate registers seem to exist with expected content, changing them does nothing. This results in user ports with external PHYs only working in 1000/fd, and not in other modes, despite linking up. Fix this by writing the link result into the port state override register, like we already do for fixed links. With this, ports with lower speeds can successfully transmit and receive packets. This also aligns the behaviour with the old bcm63xx_enetsw driver for those ports. ==================== Link: https://patch.msgid.link/20251101132807.50419-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 3e4ebdc1606adf77744cf8ed7a433d279fdc57ba Author: Jonas Gorski Date: Sat Nov 1 14:28:07 2025 +0100 net: dsa: b53: fix bcm63xx RGMII port link adjustment BCM63XX's switch does not support MDIO scanning of external phys, so its MACs needs to be manually configured for autonegotiated link speeds. So b53_force_port_config() and b53_force_link() accordingly also when mode is MLO_AN_PHY for those ports. Fixes lower speeds than 1000/full on rgmii ports 4 - 7. This aligns the behaviour with the old bcm63xx_enetsw driver for those ports. Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101132807.50419-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 Author: Jonas Gorski Date: Sat Nov 1 14:28:06 2025 +0100 net: dsa: b53: fix resetting speed and pause on forced link There is no guarantee that the port state override registers have their default values, as not all switches support being reset via register or have a reset GPIO. So when forcing port config, we need to make sure to clear all fields, which we currently do not do for the speed and flow control configuration. This can cause flow control stay enabled, or in the case of speed becoming an illegal value, e.g. configured for 1G (0x2), then setting 100M (0x1), results in 0x3 which is invalid. For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on supported chips, as the bit can have different meanings on other chips, e.g. for BCM5389 this controls scanning PHYs for link/speed configuration. Fixes: 5e004460f874 ("net: dsa: b53: Add helper to set link parameters") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101132807.50419-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 7ed8b63ddc9a9578eae81f4da32761568a25efad Author: Jonas Gorski Date: Sat Nov 1 11:39:54 2025 +0100 MAINTAINERS: add brcm tag driver to b53 The b53 entry was missing the brcm tag driver, so add it. Reported-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20251029181216.3f35f8ba@kernel.org/ Signed-off-by: Jonas Gorski Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251101103954.29816-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit b2b526c2cf57d14ee269e012ed179081871f45a1 Author: Alok Tiwari Date: Fri Oct 31 09:15:53 2025 -0700 net: mdio: Check regmap pointer returned by device_node_to_regmap() The call to device_node_to_regmap() in airoha_mdio_probe() can return an ERR_PTR() if regmap initialization fails. Currently, the driver stores the pointer without validation, which could lead to a crash if it is later dereferenced. Add an IS_ERR() check and return the corresponding error code to make the probe path more robust. Fixes: 67e3ba978361 ("net: mdio: Add MDIO bus controller for Airoha AN7583") Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251031161607.58581-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 8bb886cb8f3a2811430ddb7d9838e245c57e7f7c Merge: 6146a0f1dfae5d 79c0a2b7abc906 Author: Linus Torvalds Date: Tue Nov 4 08:05:05 2025 +0900 Merge tag 'edac_urgent_for_v6.18_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix an off-by-one error in versalnet_edac * tag 'edac_urgent_for_v6.18_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versalnet: Fix off by one in handle_error() commit fad472efab0a805dd939f017c5b8669a786a4bcf Author: Miguel Ojeda Date: Sun Nov 2 22:28:53 2025 +0100 rust: kbuild: workaround `rustdoc` doctests modifier bug The `rustdoc` modifiers bug [1] was fixed in Rust 1.90.0 [2], for which we added a workaround in commit abbf9a449441 ("rust: workaround `rustdoc` target modifiers bug"). However, `rustdoc`'s doctest generation still has a similar issue [3], being fixed at [4], which does not affect us because we apply the workaround to both, and now, starting with Rust 1.91.0 (released 2025-10-30), `-Zsanitizer` is a target modifier too [5], which means we fail with: RUSTDOC TK rust/kernel/lib.rs error: mixing `-Zsanitizer` will cause an ABI mismatch in crate `kernel` --> rust/kernel/lib.rs:3:1 | 3 | //! The `kernel` crate. | ^ | = help: the `-Zsanitizer` flag modifies the ABI so Rust crates compiled with different values of this flag cannot be used together safely = note: unset `-Zsanitizer` in this crate is incompatible with `-Zsanitizer=kernel-address` in dependency `core` = help: set `-Zsanitizer=kernel-address` in this crate or unset `-Zsanitizer` in `core` = help: if you are sure this will not cause problems, you may use `-Cunsafe-allow-abi-mismatch=sanitizer` to silence this error A simple way around is to add the sanitizer to the list in the existing workaround (especially if we had not started to pass the sanitizer flags in the previous commit, since in that case that would not be necessary). However, that still applies the workaround in more cases than necessary. Instead, only modify the doctests flags to ignore the check for sanitizers, so that it is more local (and thus the compiler keeps checking it for us in the normal `rustdoc` calls). Since the previous commit already treated the `rustdoc` calls as kernel objects, this should allow us in the future to easily remove this workaround when the time comes. By the way, the `-Cunsafe-allow-abi-mismatch` flag overwrites previous ones rather than appending, so it needs to be all done in the same flag. Moreover, unknown modifiers are rejected, and thus we have to gate based on the version too. Finally, `-Zsanitizer-cfi-normalize-integers` is not affected (in Rust 1.91.0), so it is not needed in the workaround for the moment. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/issues/144521 [1] Link: https://github.com/rust-lang/rust/pull/144523 [2] Link: https://github.com/rust-lang/rust/issues/146465 [3] Link: https://github.com/rust-lang/rust/pull/148068 [4] Link: https://github.com/rust-lang/rust/pull/138736 [5] Reviewed-by: Alice Ryhl Tested-by: Justin M. Forbes Link: https://patch.msgid.link/20251102212853.1505384-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 16c43a56b79e2c3220b043236369a129d508c65a Author: Miguel Ojeda Date: Sun Nov 2 22:28:52 2025 +0100 rust: kbuild: treat `build_error` and `rustdoc` as kernel objects Even if normally `build_error` isn't a kernel object, it should still be treated as such so that we pass the same flags. Similarly, `rustdoc` targets are never kernel objects, but we need to treat them as such. Otherwise, starting with Rust 1.91.0 (released 2025-10-30), `rustc` will complain about missing sanitizer flags since `-Zsanitizer` is a target modifier too [1]: error: mixing `-Zsanitizer` will cause an ABI mismatch in crate `build_error` --> rust/build_error.rs:3:1 | 3 | //! Build-time error. | ^ | = help: the `-Zsanitizer` flag modifies the ABI so Rust crates compiled with different values of this flag cannot be used together safely = note: unset `-Zsanitizer` in this crate is incompatible with `-Zsanitizer=kernel-address` in dependency `core` = help: set `-Zsanitizer=kernel-address` in this crate or unset `-Zsanitizer` in `core` = help: if you are sure this will not cause problems, you may use `-Cunsafe-allow-abi-mismatch=sanitizer` to silence this error Thus explicitly mark them as kernel objects. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Link: https://github.com/rust-lang/rust/pull/138736 [1] Reviewed-by: Alice Ryhl Tested-by: Justin M. Forbes Link: https://patch.msgid.link/20251102212853.1505384-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 7f17ef0d47b9aa01b89a92b2514fbfe800d8aeca Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 14:54:31 2025 -0300 perf symbols: Handle '1' symbols in /proc/kallsyms I started seeing this in recent Fedora 42 kernels: root@x1:~# uname -a Linux x1 6.17.4-200.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Oct 19 18:47:49 UTC 2025 x86_64 GNU/Linux root@x1:~# root@x1:~# perf test 1 1: vmlinux symtab matches kallsyms : FAILED! root@x1:~# Related to: root@x1:~# grep ' 1 ' /proc/kallsyms ffffffffb098bc00 1 __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ ffffffffb098bc10 1 _RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ root@x1:~# That is found in: root@x1:~# pahole --running_kernel_vmlinux /usr/lib/debug/lib/modules/6.17.4-200.fc42.x86_64/vmlinux root@x1:~# root@x1:~# readelf -sW /usr/lib/debug/lib/modules/6.17.4-200.fc42.x86_64/vmlinux | grep __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ 150649: ffffffff81f8bc00 16 FUNC LOCAL DEFAULT 1 __pfx__RNCINvNtNtNtCsfwaGRd4cjqE_4core4iter8adapters3map12map_try_foldjNtCskFudTml27HW_12drm_panic_qr7VersionuINtNtNtBa_3ops12control_flow11ControlFlowB10_ENcB10_0NCINvNvNtNtNtB8_6traits8iterator8Iterator4find5checkB10_NCNvMB12_B10_13from_segments0E0E0B12_ root@x1:~# But was being filtered out when reading /proc/kallsyms, as the '1' symbol type was not being handled, do it, there are just two of them at this point. Cc: Alex Gaynor Cc: Alice Ryhl Cc: Andreas Hindborg Cc: Benno Lossin Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: Miguel Ojeda Cc: Trevor Gross Signed-off-by: Arnaldo Carvalho de Melo commit 6a0dddc53f6f04281b27254a7d940fb9bb2d5a3b Author: Krzysztof Kozlowski Date: Mon Nov 3 16:19:06 2025 +0100 i2c: muxes: pca954x: Fix broken reset-gpio usage Revert commit 690de2902dca ("i2c: muxes: pca954x: Use reset controller only") and its dependent commit 94c296776403 ("i2c: muxes: pca954x: Reset if (de)select fails") because the first breaks all users of the driver, by requiring a completely optional reset-gpio driver. These commits cause that mux driver simply stops working when optional reset-gpio is not included, but that reset-gpio is not pulled anyhow. Driver cannot remove legacy reset-gpios handling. Fixes: 690de2902dca ("i2c: muxes: pca954x: Use reset controller only") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 549042f16716b4c72bfa9813d9e38f352c539dad Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 13:35:06 2025 -0300 tools headers asm: Sync fls headers header with the kernel sources To pick the changes in: 6606c8c7e8188656 ("bitops: Add __attribute_const__ to generic ffs()-family implementations") This addresses these tools build warnings: Warning: Kernel ABI header differences: diff -u tools/include/asm-generic/bitops/__fls.h include/asm-generic/bitops/__fls.h diff -u tools/include/asm-generic/bitops/fls.h include/asm-generic/bitops/fls.h diff -u tools/include/asm-generic/bitops/fls64.h include/asm-generic/bitops/fls64.h Please see tools/include/uapi/README for further details. Cc: Kees Cook Signed-off-by: Arnaldo Carvalho de Melo commit fc9ef9118d8a6c6250273aae14b48dd8f91bee1f Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 13:24:47 2025 -0300 tools headers UAPI: Sync KVM's vmx.h header with the kernel sources to handle new exit reasons To pick the changes in: 885df2d2109a60f8 ("KVM: x86: Add support for RDMSR/WRMSRNS w/ immediate on Intel") c42856af8f70d983 ("KVM: TDX: Add a place holder for handler of TDX hypercalls (TDG.VP.VMCALL)") That makes 'perf kvm-stat' aware of these new TDCALL and MSR_{READ,WRITE}_IMM exit reasons, thus addressing the following perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/vmx.h arch/x86/include/uapi/asm/vmx.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Xin Li Cc: Isaku Yamahata Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit 649a0cc96ed1170cea5686f11229e07014b3d18f Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 12:18:17 2025 -0300 tools headers svm: Sync svm headers with the kernel sources To pick the changes in: b8c3c9f5d0505905 ("x86/apic: Initialize Secure AVIC APIC backing page") That triggers: CC /tmp/build/perf-tools/arch/x86/util/kvm-stat.o LD /tmp/build/perf-tools/arch/x86/util/perf-util-in.o LD /tmp/build/perf-tools/arch/x86/perf-util-in.o LD /tmp/build/perf-tools/arch/perf-util-in.o LD /tmp/build/perf-tools/perf-util-in.o AR /tmp/build/perf-tools/libperf-util.a LINK /tmp/build/perf-tools/perf But this time causes no changes in tooling results, as the introduced SVM_VMGEXIT_SAVIC exit reason wasn't added to SVM_EXIT_REASONS, that is used in kvm-stat.c. And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h Please see tools/include/uapi/README for further details. Cc: Borislav Petkov (AMD) Cc: Neeraj Upadhyay Signed-off-by: Arnaldo Carvalho de Melo commit b1d46bc10ff2e6241f331e2935acd05d3d025816 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 12:10:17 2025 -0300 tools headers UAPI: Sync x86's asm/kvm.h with the kernel sources To pick the changes in: fddd07626baa419c ("KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors") f2f5519aa4e3ec4e ("KVM: x86: Define Control Protection Exception (#CP) vector") 9d6812d415358372 ("KVM: x86: Enable guest SSP read/write interface with new uAPIs") 06f2969c6a1237f0 ("KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support") That just rebuilds kvm-stat.c on x86, no change in functionality. This silences these perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Yang Weijiang Signed-off-by: Arnaldo Carvalho de Melo commit 01e11d18da818eabdb3769081e7123ed8bfe863c Author: Dan Carpenter Date: Fri Oct 31 16:03:43 2025 +0300 ACPI: SBS: Fix present test in acpi_battery_read() The battery->present variable is a 1 bit bitfield in a u8. This means that the "state & (1 << battery->id)" test will only work when "battery->id" is zero, otherwise ->present is zero. Fix this by adding a !!. Fixes: db1c291af7ad ("ACPI: SBS: Make SBS reads table-driven.") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQSzr4NynN2mpEvG@stanley.mountain Signed-off-by: Rafael J. Wysocki commit fde7f626423295eeebcd0305c3ee4b7f2f45b655 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 11:45:29 2025 -0300 MAINTAINERS: Add James Clark as a perf tools reviewer James Clark has been actively reviewing patches and contributing to perf tools. Reflect this by adding him as a reviewer in the MAINTAINERS file. Reviewed-by: James Clark Acked-by: Ian Rogers Acked-by: Ingo Molnar Acked-by: Namhyung Kim Acked-by: Peter Zijlstra (Intel) Signed-off-by: Arnaldo Carvalho de Melo commit 1642fabff19f768e9a8fea85d55a2d6d43ecffe3 Author: Chu Guangqing Date: Fri Oct 31 13:52:40 2025 +0800 ACPI: CPPC: Fix typo in a comment Fix spelling from "pachage" to "package". Signed-off-by: Chu Guangqing [ rjw: Changelog and subject edits ] Link: https://patch.msgid.link/20251031055240.2791-1-chuguangqing@inspur.com Signed-off-by: Rafael J. Wysocki commit 7d44ad6b43d0be43d080180413a1b6c24cfbd266 Author: Umesh Nerlige Ramappa Date: Wed Oct 15 17:03:51 2025 -0700 drm/i915: Fix conversion between clock ticks and nanoseconds When tick values are large, the multiplication by NSEC_PER_SEC is larger than 64 bits and results in bad conversions. The issue is seen in PMU busyness counters that look like they have wrapped around due to bad conversion. i915 PMU implementation returns monotonically increasing counters. If a count is lesser than previous one, it will only return the larger value until the smaller value catches up. The user will see this as zero delta between two measurements even though the engines are busy. Fix it by using mul_u64_u32_div() Fixes: 77cdd054dd2c ("drm/i915/pmu: Connect engine busyness stats from GuC to pmu") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14955 Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Link: https://lore.kernel.org/r/20251016000350.1152382-2-umesh.nerlige.ramappa@intel.com (cherry picked from commit 2ada9cb1df3f5405a01d013b708b1b0914efccfe) Signed-off-by: Rodrigo Vivi [Rodrigo: Added the Fixes tag while cherry-picking to fixes] commit 84bbe327a5cbb060f3321c9d9d4d53936fc1ef9b Author: Janusz Krzysztofik Date: Thu Oct 23 10:25:19 2025 +0200 drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT address space on a Cherry View family processor, or on a Broxton generation SoC with VTD enabled, i.e., when stop_machine() is then called from intel_ggtt_bind_vma(), that can potentially lead to lock inversion among reservation_ww and cpu_hotplug locks. [86.861179] ====================================================== [86.861193] WARNING: possible circular locking dependency detected [86.861209] 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 Tainted: G U [86.861226] ------------------------------------------------------ [86.861238] i915_module_loa/1432 is trying to acquire lock: [86.861252] ffffffff83489090 (cpu_hotplug_lock){++++}-{0:0}, at: stop_machine+0x1c/0x50 [86.861290] but task is already holding lock: [86.861303] ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.862233] which lock already depends on the new lock. [86.862251] the existing dependency chain (in reverse order) is: [86.862265] -> #5 (reservation_ww_class_mutex){+.+.}-{3:3}: [86.862292] dma_resv_lockdep+0x19a/0x390 [86.862315] do_one_initcall+0x60/0x3f0 [86.862334] kernel_init_freeable+0x3cd/0x680 [86.862353] kernel_init+0x1b/0x200 [86.862369] ret_from_fork+0x47/0x70 [86.862383] ret_from_fork_asm+0x1a/0x30 [86.862399] -> #4 (reservation_ww_class_acquire){+.+.}-{0:0}: [86.862425] dma_resv_lockdep+0x178/0x390 [86.862440] do_one_initcall+0x60/0x3f0 [86.862454] kernel_init_freeable+0x3cd/0x680 [86.862470] kernel_init+0x1b/0x200 [86.862482] ret_from_fork+0x47/0x70 [86.862495] ret_from_fork_asm+0x1a/0x30 [86.862509] -> #3 (&mm->mmap_lock){++++}-{3:3}: [86.862531] down_read_killable+0x46/0x1e0 [86.862546] lock_mm_and_find_vma+0xa2/0x280 [86.862561] do_user_addr_fault+0x266/0x8e0 [86.862578] exc_page_fault+0x8a/0x2f0 [86.862593] asm_exc_page_fault+0x27/0x30 [86.862607] filldir64+0xeb/0x180 [86.862620] kernfs_fop_readdir+0x118/0x480 [86.862635] iterate_dir+0xcf/0x2b0 [86.862648] __x64_sys_getdents64+0x84/0x140 [86.862661] x64_sys_call+0x1058/0x2660 [86.862675] do_syscall_64+0x91/0xe90 [86.862689] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.862703] -> #2 (&root->kernfs_rwsem){++++}-{3:3}: [86.862725] down_write+0x3e/0xf0 [86.862738] kernfs_add_one+0x30/0x3c0 [86.862751] kernfs_create_dir_ns+0x53/0xb0 [86.862765] internal_create_group+0x134/0x4c0 [86.862779] sysfs_create_group+0x13/0x20 [86.862792] topology_add_dev+0x1d/0x30 [86.862806] cpuhp_invoke_callback+0x4b5/0x850 [86.862822] cpuhp_issue_call+0xbf/0x1f0 [86.862836] __cpuhp_setup_state_cpuslocked+0x111/0x320 [86.862852] __cpuhp_setup_state+0xb0/0x220 [86.862866] topology_sysfs_init+0x30/0x50 [86.862879] do_one_initcall+0x60/0x3f0 [86.862893] kernel_init_freeable+0x3cd/0x680 [86.862908] kernel_init+0x1b/0x200 [86.862921] ret_from_fork+0x47/0x70 [86.862934] ret_from_fork_asm+0x1a/0x30 [86.862947] -> #1 (cpuhp_state_mutex){+.+.}-{3:3}: [86.862969] __mutex_lock+0xaa/0xed0 [86.862982] mutex_lock_nested+0x1b/0x30 [86.862995] __cpuhp_setup_state_cpuslocked+0x67/0x320 [86.863012] __cpuhp_setup_state+0xb0/0x220 [86.863026] page_alloc_init_cpuhp+0x2d/0x60 [86.863041] mm_core_init+0x22/0x2d0 [86.863054] start_kernel+0x576/0xbd0 [86.863068] x86_64_start_reservations+0x18/0x30 [86.863084] x86_64_start_kernel+0xbf/0x110 [86.863098] common_startup_64+0x13e/0x141 [86.863114] -> #0 (cpu_hotplug_lock){++++}-{0:0}: [86.863135] __lock_acquire+0x1635/0x2810 [86.863152] lock_acquire+0xc4/0x2f0 [86.863166] cpus_read_lock+0x41/0x100 [86.863180] stop_machine+0x1c/0x50 [86.863194] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] [86.863987] intel_ggtt_bind_vma+0x43/0x70 [i915] [86.864735] __vma_bind+0x55/0x70 [i915] [86.865510] fence_work+0x26/0xa0 [i915] [86.866248] fence_notify+0xa1/0x140 [i915] [86.866983] __i915_sw_fence_complete+0x8f/0x270 [i915] [86.867719] i915_sw_fence_commit+0x39/0x60 [i915] [86.868453] i915_vma_pin_ww+0x462/0x1360 [i915] [86.869228] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] [86.870001] initial_plane_vma+0x307/0x840 [i915] [86.870774] intel_initial_plane_config+0x33f/0x670 [i915] [86.871546] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] [86.872330] i915_driver_probe+0x7fa/0xe80 [i915] [86.873057] i915_pci_probe+0xe6/0x220 [i915] [86.873782] local_pci_probe+0x47/0xb0 [86.873802] pci_device_probe+0xf3/0x260 [86.873817] really_probe+0xf1/0x3c0 [86.873833] __driver_probe_device+0x8c/0x180 [86.873848] driver_probe_device+0x24/0xd0 [86.873862] __driver_attach+0x10f/0x220 [86.873876] bus_for_each_dev+0x7f/0xe0 [86.873892] driver_attach+0x1e/0x30 [86.873904] bus_add_driver+0x151/0x290 [86.873917] driver_register+0x5e/0x130 [86.873931] __pci_register_driver+0x7d/0x90 [86.873945] i915_pci_register_driver+0x23/0x30 [i915] [86.874678] i915_init+0x37/0x120 [i915] [86.875347] do_one_initcall+0x60/0x3f0 [86.875369] do_init_module+0x97/0x2a0 [86.875385] load_module+0x2c54/0x2d80 [86.875398] init_module_from_file+0x96/0xe0 [86.875413] idempotent_init_module+0x117/0x330 [86.875426] __x64_sys_finit_module+0x77/0x100 [86.875440] x64_sys_call+0x24de/0x2660 [86.875454] do_syscall_64+0x91/0xe90 [86.875470] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.875486] other info that might help us debug this: [86.875502] Chain exists of: cpu_hotplug_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex [86.875539] Possible unsafe locking scenario: [86.875552] CPU0 CPU1 [86.875563] ---- ---- [86.875573] lock(reservation_ww_class_mutex); [86.875588] lock(reservation_ww_class_acquire); [86.875606] lock(reservation_ww_class_mutex); [86.875624] rlock(cpu_hotplug_lock); [86.875637] *** DEADLOCK *** [86.875650] 3 locks held by i915_module_loa/1432: [86.875663] #0: ffff888101f5c1b0 (&dev->mutex){....}-{3:3}, at: __driver_attach+0x104/0x220 [86.875699] #1: ffffc90002e0b4a0 (reservation_ww_class_acquire){+.+.}-{0:0}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.876512] #2: ffffc90002e0b4c8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: i915_vma_pin.constprop.0+0x39/0x1d0 [i915] [86.877305] stack backtrace: [86.877326] CPU: 0 UID: 0 PID: 1432 Comm: i915_module_loa Tainted: G U 6.15.0-rc5-CI_DRM_16515-gca0305cadc2d+ #1 PREEMPT(voluntary) [86.877334] Tainted: [U]=USER [86.877336] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0079.2020.0420.1316 04/20/2020 [86.877339] Call Trace: [86.877344] [86.877353] dump_stack_lvl+0x91/0xf0 [86.877364] dump_stack+0x10/0x20 [86.877369] print_circular_bug+0x285/0x360 [86.877379] check_noncircular+0x135/0x150 [86.877390] __lock_acquire+0x1635/0x2810 [86.877403] lock_acquire+0xc4/0x2f0 [86.877408] ? stop_machine+0x1c/0x50 [86.877422] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] [86.878173] cpus_read_lock+0x41/0x100 [86.878182] ? stop_machine+0x1c/0x50 [86.878191] ? __pfx_bxt_vtd_ggtt_insert_entries__cb+0x10/0x10 [i915] [86.878916] stop_machine+0x1c/0x50 [86.878927] bxt_vtd_ggtt_insert_entries__BKL+0x3b/0x60 [i915] [86.879652] intel_ggtt_bind_vma+0x43/0x70 [i915] [86.880375] __vma_bind+0x55/0x70 [i915] [86.881133] fence_work+0x26/0xa0 [i915] [86.881851] fence_notify+0xa1/0x140 [i915] [86.882566] __i915_sw_fence_complete+0x8f/0x270 [i915] [86.883286] i915_sw_fence_commit+0x39/0x60 [i915] [86.884003] i915_vma_pin_ww+0x462/0x1360 [i915] [86.884756] ? i915_vma_pin.constprop.0+0x6c/0x1d0 [i915] [86.885513] i915_vma_pin.constprop.0+0x133/0x1d0 [i915] [86.886281] initial_plane_vma+0x307/0x840 [i915] [86.887049] intel_initial_plane_config+0x33f/0x670 [i915] [86.887819] intel_display_driver_probe_nogem+0x1c6/0x260 [i915] [86.888587] i915_driver_probe+0x7fa/0xe80 [i915] [86.889293] ? mutex_unlock+0x12/0x20 [86.889301] ? drm_privacy_screen_get+0x171/0x190 [86.889308] ? acpi_dev_found+0x66/0x80 [86.889321] i915_pci_probe+0xe6/0x220 [i915] [86.890038] local_pci_probe+0x47/0xb0 [86.890049] pci_device_probe+0xf3/0x260 [86.890058] really_probe+0xf1/0x3c0 [86.890067] __driver_probe_device+0x8c/0x180 [86.890072] driver_probe_device+0x24/0xd0 [86.890078] __driver_attach+0x10f/0x220 [86.890083] ? __pfx___driver_attach+0x10/0x10 [86.890088] bus_for_each_dev+0x7f/0xe0 [86.890097] driver_attach+0x1e/0x30 [86.890101] bus_add_driver+0x151/0x290 [86.890107] driver_register+0x5e/0x130 [86.890113] __pci_register_driver+0x7d/0x90 [86.890119] i915_pci_register_driver+0x23/0x30 [i915] [86.890833] i915_init+0x37/0x120 [i915] [86.891482] ? __pfx_i915_init+0x10/0x10 [i915] [86.892135] do_one_initcall+0x60/0x3f0 [86.892145] ? __kmalloc_cache_noprof+0x33f/0x470 [86.892157] do_init_module+0x97/0x2a0 [86.892164] load_module+0x2c54/0x2d80 [86.892168] ? __kernel_read+0x15c/0x300 [86.892185] ? kernel_read_file+0x2b1/0x320 [86.892195] init_module_from_file+0x96/0xe0 [86.892199] ? init_module_from_file+0x96/0xe0 [86.892211] idempotent_init_module+0x117/0x330 [86.892224] __x64_sys_finit_module+0x77/0x100 [86.892230] x64_sys_call+0x24de/0x2660 [86.892236] do_syscall_64+0x91/0xe90 [86.892243] ? irqentry_exit+0x77/0xb0 [86.892249] ? sysvec_apic_timer_interrupt+0x57/0xc0 [86.892256] entry_SYSCALL_64_after_hwframe+0x76/0x7e [86.892261] RIP: 0033:0x7303e1b2725d [86.892271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 [86.892276] RSP: 002b:00007ffddd1fdb38 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [86.892281] RAX: ffffffffffffffda RBX: 00005d771d88fd90 RCX: 00007303e1b2725d [86.892285] RDX: 0000000000000000 RSI: 00005d771d893aa0 RDI: 000000000000000c [86.892287] RBP: 00007ffddd1fdbf0 R08: 0000000000000040 R09: 00007ffddd1fdb80 [86.892289] R10: 00007303e1c03b20 R11: 0000000000000246 R12: 00005d771d893aa0 [86.892292] R13: 0000000000000000 R14: 00005d771d88f0d0 R15: 00005d771d895710 [86.892304] Call asynchronous variant of dma_fence_work_commit() in that case. v3: Provide more verbose in-line comment (Andi), - mention target environments in commit message. Fixes: 7d1c2618eac59 ("drm/i915: Take reservation lock around i915_vma_pin.") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14985 Cc: Andi Shyti Signed-off-by: Janusz Krzysztofik Reviewed-by: Sebastian Brzezinka Reviewed-by: Krzysztof Karas Acked-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251023082925.351307-6-janusz.krzysztofik@linux.intel.com (cherry picked from commit 648ef1324add1c2e2b6041cdf0b28d31fbca5f13) Signed-off-by: Rodrigo Vivi commit 29e4d12a2957e4e7dcad2418c7251f36285d99d8 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 10:53:46 2025 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: fe2bf6234e947bf5 ("KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set") d2042d8f96ddefde ("KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS") 3d3a04fad25a6621 ("KVM: Allow and advertise support for host mmap() on guest_memfd files") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the 'perf trace' ioctl syscall argument beautifiers. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Please see tools/include/uapi/README for further details. Cc: Sean Christopherson Cc: Fuad Tabba Cc: Paolo Bonzini Signed-off-by: Arnaldo Carvalho de Melo commit bd9e119951b527724938ff55fb0ca3daa54f5c18 Author: Jonas Gorski Date: Mon Oct 27 20:26:28 2025 +0100 Documentation: ACPI: i2c-muxes: fix I2C device references When the device references were changed from relative to absolute in commit e65cb011349e ("Documentation: ACPI: Fix parent device references"), the MUX0 device was omitted from the paths. So add it to fix the references. Fixes: e65cb011349e ("Documentation: ACPI: Fix parent device references") Closes: https://lore.kernel.org/all/48d0fb45-096c-4caa-b51c-753c2f17f018@gmail.com/ Signed-off-by: Jonas Gorski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251027192628.130998-1-jonas.gorski@gmail.com Signed-off-by: Rafael J. Wysocki commit 819630bd6f86ac8998c7df9deddb6cee50e9e22d Author: Pavel Begunkov Date: Mon Nov 3 13:53:13 2025 +0000 io_uring/zcrx: remove sync refill uapi There is a better way to handle the problem IORING_REGISTER_ZCRX_REFILL solves. The uapi can also be slightly adjusted to accommodate future extensions. Remove the feature for now, it'll be reworked for the next release. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 8f05967b022d255412640670915475ac4cdc10e9 Author: Jens Axboe Date: Mon Nov 3 08:49:32 2025 -0700 MAINTAINERS: correct git location for block layer tree As part of a recent move go exclusively listing git.kernel.org trees for the block and io_uring development, the "BLOCK LAYER" entry wasn't updated as it already used git.kernel.org. However, outside of just moving from git.kernel.dk to git.kernel.org, the "block" part of the trees was also dropped, as the tree serves both block and io_uring development trees. Fix up the "BLOCK LAYER" entry so they all use the same tree. Reported-by: John Garry Reviewed-by: John Garry Signed-off-by: Jens Axboe commit f8950b47db707565543d6c4a9fdb7e36b3329722 Author: Arnaldo Carvalho de Melo Date: Mon Nov 3 10:33:26 2025 -0300 tools headers UAPI: Update tools's copy of drm.h to pick DRM_IOCTL_GEM_CHANGE_HANDLE Picking the changes from: 0864197382fa7c8c ("drm: Move drm_gem ioctl kerneldoc to uapi file") 53096728b8910c69 ("drm: Add DRM prime interface to reassign GEM handle") Addressing these perf build warnings: Warning: Kernel ABI header differences: Now 'perf trace' and other code that might use the tools/perf/trace/beauty autogenerated tables will be able to translate this new ioctl command into a string: $ tools/perf/trace/beauty/drm_ioctl.sh > before $ cp include/uapi/drm/drm.h tools/include/uapi/drm/drm.h $ tools/perf/trace/beauty/drm_ioctl.sh > after $ diff -u before after --- before 2025-11-03 09:57:34.832553174 -0300 +++ after 2025-11-03 09:57:47.969409428 -0300 @@ -111,6 +111,7 @@ [0xCF] = "SYNCOBJ_EVENTFD", [0xD0] = "MODE_CLOSEFB", [0xD1] = "SET_CLIENT_NAME", + [0xD2] = "GEM_CHANGE_HANDLE", [DRM_COMMAND_BASE + 0x00] = "I915_INIT", [DRM_COMMAND_BASE + 0x01] = "I915_FLUSH", [DRM_COMMAND_BASE + 0x02] = "I915_FLIP", $ Please see tools/include/uapi/README for further details. Cc: Christian König Cc: David Francis Signed-off-by: Arnaldo Carvalho de Melo commit 2f6115ad8864cf3f48598f26c74c7c8e5c391919 Author: Bartosz Golaszewski Date: Mon Nov 3 15:11:32 2025 +0100 gpiolib: fix invalid pointer access in debugfs If the memory allocation in gpiolib_seq_start() fails, the s->private field remains uninitialized and is later dereferenced without checking in gpiolib_seq_stop(). Initialize s->private to NULL before calling kzalloc() and check it before dereferencing it. Fixes: e348544f7994 ("gpio: protect the list of GPIO devices with SRCU") Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251103141132.53471-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit e5d527be7e6984882306b49c067f1fec18920735 Author: Bartosz Golaszewski Date: Mon Nov 3 10:35:24 2025 +0100 gpio: swnode: don't use the swnode's name as the key for GPIO lookup Looking up a GPIO controller by label that is the name of the software node is wonky at best - the GPIO controller driver is free to set a different label than the name of its firmware node. We're already being passed a firmware node handle attached to the GPIO device to swnode_get_gpio_device() so use it instead for a more precise lookup. Acked-by: Linus Walleij Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes") Link: https://lore.kernel.org/r/20251103-reset-gpios-swnodes-v4-4-6461800b6775@linaro.org Signed-off-by: Bartosz Golaszewski commit b4cd8f94ae7e5b0d83041b186258eba0c8f7c5f7 Author: Matt Coster Date: Tue Oct 14 12:57:31 2025 +0100 drm/imagination: Optionally depend on POWER_SEQUENCING When the change using pwrseq was added, I nixed the dependency on POWER_SEQUENCING since we didn't want it pulled in on platforms where it's not needed [1]. I hadn't, however, considered the link-time implications of this for configs with POWER_SEQUENCING=m. [1]: https://lore.kernel.org/r/a265a20e-8908-40d8-b4e0-2c8b8f773742@imgtec.com/ Fixes: e38e8391f30b ("drm/imagination: Use pwrseq for TH1520 GPU power management") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510111806.CMulNMKW-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511011739.SONHjSfR-lkp@intel.com/ Reviewed-by: Alessio Belle Link: https://patch.msgid.link/20251014-pwrseq-dep-v1-1-49aabd9d8fa1@imgtec.com Signed-off-by: Matt Coster commit 8da0efc3da9312b65f5cbf06e57d284f69222b2e Author: Richard Fitzgerald Date: Mon Nov 3 11:58:09 2025 +0000 ASoC: doc: cs35l56: Update firmware filename description for B0 silicon Update the text for firmware file naming to show that the l?u? suffix is supported on CS35L56 B0 silicon and ampN was only used on early firmware. The previous version of this text only said that B0 silicon used the ampN suffix. Since kernel 6.16 the driver supports both the old ampN and new l?u? suffix for B0 silicon. New firmwares will use the l?u? suffix. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251103115809.33953-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 Author: Khairul Anuar Romli Date: Mon Nov 3 07:21:28 2025 +0800 firmware: stratix10-svc: fix bug in saving controller data Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They both are of the same data and overrides each other. This resulted in the rmmod of the svc driver to fail and throw a kernel panic for kthread_stop and fifo free. Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features") Cc: stable@vger.kernel.org # 6.6+ Signed-off-by: Ang Tien Sung Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb Author: Yazen Ghannam Date: Tue Oct 28 21:35:42 2025 +0000 x86/amd_node: Fix AMD root device caching Recent AMD node rework removed the "search and count" method of caching AMD root devices. This depended on the value from a Data Fabric register that was expected to hold the PCI bus of one of the root devices attached to that fabric. However, this expectation is incorrect. The register, when read from PCI config space, returns the bitwise-OR of the buses of all attached root devices. This behavior is benign on AMD reference design boards, since the bus numbers are aligned. This results in a bitwise-OR value matching one of the buses. For example, 0x00 | 0x40 | 0xA0 | 0xE0 = 0xE0. This behavior breaks on boards where the bus numbers are not exactly aligned. For example, 0x00 | 0x07 | 0xE0 | 0x15 = 0x1F. The examples above are for AMD node 0. The first root device on other nodes will not be 0x00. The first root device for other nodes will depend on the total number of root devices, the system topology, and the specific PCI bus number assignment. For example, a system with 2 AMD nodes could have this: Node 0 : 0x00 0x07 0x0e 0x15 Node 1 : 0x1c 0x23 0x2a 0x31 The bus numbering style in the reference boards is not a requirement. The numbering found in other boards is not incorrect. Therefore, the root device caching method needs to be adjusted. Go back to the "search and count" method used before the recent rework. Search for root devices using PCI class code rather than fixed PCI IDs. This keeps the goal of the rework (remove dependency on PCI IDs) while being able to support various board designs. Merge helper functions to reduce code duplication. [ bp: Reflow comment. ] Fixes: 40a5f6ffdfc8 ("x86/amd_nb: Simplify root device search") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/all/20251028-fix-amd-root-v2-1-843e38f8be2c@amd.com commit 4a372798e12cc777918db90c06e11c80e90bd001 Author: Jihed Chaibi Date: Thu Aug 21 21:47:10 2025 +0200 dt-bindings: gpio: ti,twl4030: Correct the schema $id path The $id for a binding should match its file path. The ti,twl4030-gpio binding is located in the gpio/ subdirectory but was missing this from its $id. Correct the path to follow the standard convention. Fixes: 842dcff8e2d6 ("dt-bindings: gpio: Convert ti,twl4030-gpio to DT schema") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jihed Chaibi Fixes: 842dcff8e2d6 ("dt-bindings: gpio: Convert ti,twl4030-gpio to DT schema") Link: https://lore.kernel.org/r/20250821194710.16043-1-jihed.chaibi.dev@gmail.com Signed-off-by: Bartosz Golaszewski commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 Author: Dan Carpenter Date: Sat Nov 1 16:25:48 2025 +0300 mtd: onenand: Pass correct pointer to IRQ handler This was supposed to pass "onenand" instead of "&onenand" with the ampersand. Passing a random stack address which will be gone when the function ends makes no sense. However the good thing is that the pointer is never used, so this doesn't cause a problem at run time. Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method") Signed-off-by: Dan Carpenter Signed-off-by: Miquel Raynal commit a1d3bc606bf5c3b3ea811cc2019df6285d75b00f Author: Mikhail Kshevetskiy Date: Mon Nov 3 04:01:48 2025 +0300 mtd: spinand: fmsh: remove QE bit for FM25S01A flash According to datasheet (http://eng.fmsh.com/nvm/FM25S01A_ds_eng.pdf) there is no QE (Quad Enable) bit for FM25S01A flash, so remove it. Fixes: 5f284dc15ca86 ("mtd: spinand: add support for FudanMicro FM25S01A") Signed-off-by: Mikhail Kshevetskiy Tested-by: Tianling Shen Signed-off-by: Miquel Raynal commit eb3182ef0405ff2f6668fd3e5ff9883f60ce8801 Author: Dapeng Mi Date: Wed Oct 15 13:18:28 2025 +0800 perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue The root cause of the hang is that cpu-clock is a special type of SW event which relies on hrtimers. The __perf_event_overflow() callback is invoked from the hrtimer handler for cpu-clock events, and __perf_event_overflow() tries to call cpu_clock_event_stop() to stop the event, which calls htimer_cancel() to cancel the hrtimer. But that's a recursion into the hrtimer code from a hrtimer handler, which (unsurprisingly) deadlocks. To fix this bug, use hrtimer_try_to_cancel() instead, and set the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer() to stop the event once it sees the PERF_HES_STOPPED flag. [ mingo: Fixed the comments and improved the changelog. ] Closes: https://lore.kernel.org/all/CAHPNGSQpXEopYreir+uDDEbtXTBvBvi8c6fYXJvceqtgTPao3Q@mail.gmail.com/ Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") Reported-by: Octavia Togami Suggested-by: Peter Zijlstra Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Tested-by: Octavia Togami Cc: stable@vger.kernel.org Link: https://github.com/lucko/spark/issues/530 Link: https://patch.msgid.link/20251015051828.12809-1-dapeng1.mi@linux.intel.com commit 083d7af3350e04c428256a3bd10003f63151b6b1 Author: Chunhai Guo Date: Mon Oct 27 10:52:06 2025 +0800 MAINTAINERS: erofs: add myself as reviewer In the past two years, I have focused on EROFS and contributed features including the reserved buffer pool, configurable global buffer pool, and the ongoing direct I/O support for compressed data. I would like to continue contributing to EROFS and help with code reviews. Please CC me on EROFS-related changes. Signed-off-by: Chunhai Guo Acked-by: Gao Xiang Acked-by: Chao Yu Acked-by: Hongbo Li Signed-off-by: Gao Xiang commit 1ebc180d2b9066043226299cecc42c1ea146ac8e Author: Alexander Usyskin Date: Sun Nov 2 20:08:36 2025 +0200 mei: fix error flow in probe Dismantle class device last in probe error flow to avoid accessing freed memory like: [ 87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234 __flush_work+0x340/0x390 ... [ 87.926912] Workqueue: async async_run_entry_fn [ 87.926918] RIP: e030:__flush_work+0x340/0x390 [ 87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b 04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de [ 87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246 [ 87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000 [ 87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60 [ 87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8 [ 87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000 [ 87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000 [ 87.926962] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000 [ 87.926967] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660 [ 87.926977] Call Trace: [ 87.926981] [ 87.926987] ? __call_rcu_common.constprop.0+0x11e/0x310 [ 87.926993] cancel_work_sync+0x5e/0x80 [ 87.926999] mei_cancel_work+0x19/0x40 [mei] [ 87.927051] mei_me_probe+0x273/0x2b0 [mei_me] [ 87.927060] local_pci_probe+0x45/0x90 [ 87.927066] pci_call_probe+0x5b/0x180 [ 87.927070] pci_device_probe+0x95/0x140 [ 87.927074] ? driver_sysfs_add+0x57/0xc0 [ 87.927079] really_probe+0xde/0x340 [ 87.927083] ? pm_runtime_barrier+0x54/0x90 [ 87.927087] __driver_probe_device+0x78/0x110 [ 87.927092] driver_probe_device+0x1f/0xa0 [ 87.927095] __driver_attach_async_helper+0x5e/0xe0 [ 87.927100] async_run_entry_fn+0x34/0x130 [ 87.927104] process_one_work+0x18d/0x340 [ 87.927108] worker_thread+0x256/0x3a0 [ 87.927111] ? __pfx_worker_thread+0x10/0x10 [ 87.927115] kthread+0xfc/0x240 [ 87.927120] ? __pfx_kthread+0x10/0x10 [ 87.927124] ? __pfx_kthread+0x10/0x10 [ 87.927127] ret_from_fork+0xf5/0x110 [ 87.927132] ? __pfx_kthread+0x10/0x10 [ 87.927136] ret_from_fork_asm+0x1a/0x30 [ 87.927141] Tested-by: Guenter Roeck Reported-by: Marek Marczykowski-Górecki Closes: https://lore.kernel.org/lkml/aQbYAXPADqfiXUYO@mail-itl/ Reported-by: Guenter Roeck Closes: https://lore.kernel.org/lkml/8deef7c4-ac75-4db8-91b7-02cf0e39e371@roeck-us.net/ Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Alexander Usyskin Tested-by: Marek Marczykowski-Górecki Link: https://patch.msgid.link/20251102180836.1203314-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 09b1704f5b02c18dd02b21343530463fcfc92c54 Author: Miguel Ojeda Date: Wed Oct 29 08:33:44 2025 +0100 rust: condvar: fix broken intra-doc link The future move of pin-init to `syn` uncovers the following broken intra-doc link: error: unresolved link to `crate::pin_init` --> rust/kernel/sync/condvar.rs:39:40 | 39 | /// instances is with the [`pin_init`](crate::pin_init!) and [`new_condvar`] macros. | ^^^^^^^^^^^^^^^^ no item named `pin_init` in module `kernel` | = note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::broken_intra_doc_links)]` Currently, when rendered, the link points to a literal `crate::pin_init!` URL. Thus fix it. Cc: stable@vger.kernel.org Fixes: 129e97be8e28 ("rust: pin-init: fix documentation links") Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251029073344.349341-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit ff4d2ef3874773c9c6173b0f099372bf62252aaf Author: Miguel Ojeda Date: Wed Oct 29 08:14:06 2025 +0100 rust: devres: fix private intra-doc link The future move of pin-init to `syn` uncovers the following private intra-doc link: error: public documentation for `Devres` links to private item `Self::inner` --> rust/kernel/devres.rs:106:7 | 106 | /// [`Self::inner`] is guaranteed to be initialized and is always accessed read-only. | ^^^^^^^^^^^ this item is private | = note: this link will resolve properly if you pass `--document-private-items` = note: `-D rustdoc::private-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::private_intra_doc_links)]` Currently, when rendered, the link points to "nowhere" (an inexistent anchor for a "method"). Thus fix it. Cc: stable@vger.kernel.org Fixes: f5d3ef25d238 ("rust: devres: get rid of Devres' inner Arc") Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251029071406.324511-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 6146a0f1dfae5d37442a9ddcba012add260bceb0 Author: Linus Torvalds Date: Sun Nov 2 11:28:02 2025 -0800 Linux 6.18-rc4 commit b8126205dbe01e22b0d10c8be132bb53bf3399c1 Author: Krzysztof Czurylo Date: Thu Oct 30 21:17:20 2025 -0500 MAINTAINERS: Update irdma maintainers Adds Krzysztof Czurylo as co-maintainer for irdma driver. Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 320258783765316d2baae99c26e461ee634054fe Author: Jay Bhat Date: Thu Oct 30 21:17:25 2025 -0500 RDMA/irdma: Fix vf_id size to u16 to avoid overflow Correctly size the vf_id to u16 to avoid overflow. Signed-off-by: Jay Bhat Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251031021726.1003-6-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 691d401c7e0e5ea34ac6f8151bc0696db1b2500a Merge: bfeeb4a1bdf5d2 e7dbfe6f15b4df Author: Linus Torvalds Date: Sat Nov 1 10:50:43 2025 -0700 Merge tag 'spi-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One new device ID for an Intel SoC" * tag 'spi-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: intel: Add support for Oak Stream SPI serial flash commit bfeeb4a1bdf5d255ea885f16be80968d1f31281b Merge: 963bf1619472d9 47a0925ee4bd26 Author: Linus Torvalds Date: Sat Nov 1 10:49:12 2025 -0700 Merge tag 'regulator-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A simple fix for a missed part of an API conversion in the bd718x7 driver" * tag 'regulator-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: bd718x7: Fix voltages scaled by resistor divider commit 963bf1619472d954d04ed8851be17df633c6afd6 Merge: e3e0141d3dc55e 48cbf50531d8ec Author: Linus Torvalds Date: Sat Nov 1 10:45:39 2025 -0700 Merge tag 'regmap-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "One documentation fix and a fix for a problem with the slimbus regmap which was uncovered by some changes in one of the drivers" * tag 'regmap-fix-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: irq: Correct documentation of wake_invert flag regmap: slimbus: fix bus_context pointer in regmap init calls commit e3e0141d3dc55eb71792dd703e3f726cc29a6430 Merge: f9bc8e0912b8f6 9b041a4b66b3b6 Author: Linus Torvalds Date: Sat Nov 1 10:20:07 2025 -0700 Merge tag 'x86-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Limit AMD microcode Entrysign sha256 signature checking to known CPU generations - Disable AMD RDSEED32 on certain Zen5 CPUs that have a microcode version before when the microcode-based fix was issued for the AMD-SB-7055 erratum - Fix FPU AMD XFD state synchronization on signal delivery - Fix (work around) a SSE4a-disassembly related build failure on X86_NATIVE_CPU=y builds - Extend the AMD Zen6 model space with a new range of models - Fix CPU model comments - Fix the CONFIG_CFI=y and CONFIG_LTO_CLANG_FULL=y build, which was unhappy due to missing kCFI type annotations of clear_page() variants * tag 'x86-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols x86/cpu: Add/fix core comments for {Panther,Nova} Lake x86/CPU/AMD: Extend Zen6 model range x86/build: Disable SSE4a x86/fpu: Ensure XFD state on signal delivery x86/CPU/AMD: Add RDSEED fix for Zen5 x86/microcode/AMD: Limit Entrysign signature checking to known generations commit f9bc8e0912b8f6b1d60608a715a1da575670e038 Merge: 74131a0f1b9efc f4c12e5cefc8ec Author: Linus Torvalds Date: Sat Nov 1 10:17:40 2025 -0700 Merge tag 'perf-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fixes from Ingo Molnar: "Miscellaneous fixes and CPU model updates: - Fix an out-of-bounds access on non-hybrid platforms in the Intel PMU DS code, reported by KASAN - Add WildcatLake PMU and uncore support: it's identical to the PantherLake version" * tag 'perf-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake perf/x86/intel: Add PMU support for WildcatLake perf/x86/intel: Fix KASAN global-out-of-bounds warning commit 74131a0f1b9efc1364871a04b704e54309861668 Merge: 9db0d7c5a5be25 c44b4b9eeb71f5 Author: Linus Torvalds Date: Sat Nov 1 10:07:35 2025 -0700 Merge tag 'objtool-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Ingo Molnar: "Fix objtool warning when faced with raw STAC/CLAC instructions" * tag 'objtool-urgent-2025-11-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix skip_alt_group() for non-alternative STAC/CLAC commit 9db0d7c5a5be25e56c3eacc1f03d296b7b0b960f Merge: cb7f9fc3725a11 0db22d7ee462c4 Author: Linus Torvalds Date: Sat Nov 1 10:04:35 2025 -0700 Merge tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "Just a single bug fix (and documentation for the issue)" * tag 'xfs-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: document another racy GC case in xfs_zoned_map_extent xfs: prevent gc from picking the same zone twice commit cb7f9fc3725a11447a4af69dfe8d648e4320acdc Merge: ba36dd5ee6fd46 43c2931a95e6b2 Author: Linus Torvalds Date: Sat Nov 1 10:00:53 2025 -0700 Merge tag 'kbuild-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Formally adopt Kconfig in MAINTAINERS - Fix install-extmod-build for more O= paths - Align end of .modinfo to fix Authenticode calculation in EDK2 - Restore dynamic check for '-fsanitize=kernel-memory' in CONFIG_HAVE_KMSAN_COMPILER to ensure backend target has support for it - Initialize locale in menuconfig and nconfig to fix UTF-8 terminals that may not support VT100 ACS by default like PuTTY * tag 'kbuild-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' kbuild: align modinfo section for Secureboot Authenticode EDK2 compat kbuild: install-extmod-build: Fix when given dir outside the build dir MAINTAINERS: Update Kconfig section commit ccaba800e78f2ac1e3a407b623653149bf9c0763 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:16:47 2025 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: e19c06219985f2be ("x86/cpufeatures: Add support for Assignable Bandwidth Monitoring Counters (ABMC)") 7b59c73fd611eae8 ("x86/cpufeatures: Add SNP Secure TSC") 3c7cb84145336721 ("x86/cpufeatures: Add a CPU feature bit for MSR immediate form instructions") 2f8f173413f1cbf5 ("x86/vmscape: Add conditional IBPB mitigation") a508cec6e5215a3f ("x86/vmscape: Enumerate VMSCAPE bug") This causes these perf files to be rebuilt and brings some X86_FEATURE that may be used by: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Please see tools/include/uapi/README for further details. Cc: Babu Moger Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Nikunj A Dadhania Cc: Pawan Gupta Cc: Sean Christopherson Cc: Xin Li Signed-off-by: Arnaldo Carvalho de Melo commit e0acec3369ca7071d14196c33e7bef35f61f9cde Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:04:20 2025 -0300 tools headers x86: Sync table due to introducion of uprobe syscall To pick the changes in this cset: 56101b69c9190667 ("uprobes/x86: Add uprobe syscall to speed up uprobe") That add support for this new 'uprobe' syscall in tools such as 'perf trace'. Now it is possible to do a system wide 'perf trace' to look if this new syscall is being used: root@number:~# perf trace -v -e uprobe event qualifier tracepoint filter: (common_pid != 33989) && (id == 336) ^C root@number# $ grep -w uprobe tools/perf/arch/x86/entry/syscalls/syscall_64.tbl 336 common uprobe sys_uprobe $ This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl Please see tools/include/uapi/README for further details. Cc: Jiri Olsa Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 5466858a70827d6ceaf4a9d292a317bf420593d7 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 13:01:13 2025 -0300 tools headers: Sync uapi/linux/fcntl.h with the kernel sources To pick up the changes in this cset: e83f0b5d10dcf628 ("nsfs: support exhaustive file handles") That doesn't introduce anything of interest for tools/, just addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Please see tools/include/uapi/README for further details. Cc: Christian Brauner Signed-off-by: Arnaldo Carvalho de Melo commit 5be93389f3e5ce552b21f84fb28926f90a0dcd53 Author: Arnaldo Carvalho de Melo Date: Sat Nov 1 12:53:56 2025 -0300 tools headers: Sync uapi/linux/prctl.h with the kernel source To pick up the changes in these csets: 8cdc4d27019356b0 ("mm/huge_memory: respect MADV_COLLAPSE with PR_THP_DISABLE_EXCEPT_ADVISED") 9dc21bbd62edeae6 ("prctl: extend PR_SET_THP_DISABLE to optionally exclude VM_HUGEPAGE") That don't introduce anything of interest for the tools/, just addressing these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Please see tools/include/uapi/README for further details. Cc: Andrew Morton Cc: David Hildenbrand Signed-off-by: Arnaldo Carvalho de Melo commit 76977baa83a747f7b405d61f66775e3f0316f4b5 Author: Arnaldo Carvalho de Melo Date: Thu Oct 30 17:04:47 2025 -0300 tools headers uapi: Update fs.h with the kernel sources To pick up changes from: db2ab24a341ce893 ("Add RWF_NOSIGNAL flag for pwritev2") These are used to beautify fs syscall arguments, albeit the changes in this update are not affecting those beautifiers. This addresses these tools/ build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README for details (it's in the first patch of this series). Cc: Adrian Hunter Cc: Christian Brauner Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Lauri Vasama Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit 3f673559795b2f556b8a9272c2724b79eee7a976 Author: Arnaldo Carvalho de Melo Date: Thu Oct 30 09:37:57 2025 -0300 tools arch x86: Sync msr-index.h to pick AMD64_{PERF_CNTR_GLOBAL_STATUS_SET,SAVIC_CONTROL}, IA32_L3_QOS_{ABMC,EXT}_CFG To pick up the changes in: cdfed9370b96aaba ("KVM: x86/pmu: Move PMU_CAP_{FW_WRITES,LBR_FMT} into msr-index.h header") bc6397cf0bc4f2b7 ("x86/cpu/topology: Define AMD64_CPUID_EXT_FEAT MSR") 84ecefb766748916 ("x86/resctrl: Add data structures and definitions for ABMC assignment") faebbc58cde9d8f6 ("x86/resctrl: Add support to enable/disable AMD ABMC feature") c4074ab87f3483de ("x86/apic: Enable Secure AVIC in the control MSR") 869e36b9660dd72a ("x86/apic: Allow NMI to be injected from hypervisor for Secure AVIC") 30c2b98aa84c76f2 ("x86/apic: Add new driver for Secure AVIC") 0c5caea762de31a8 ("perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag") 68e61f6fd65610e7 ("KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2") a3c4f3396b82849a ("x86/msr-index: Add AMD workload classification MSRs") 65f55a30176662ee ("x86/CPU/AMD: Add CPUID faulting support") 17ec2f965344ee3f ("KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported") Addressing this tools/perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2025-10-30 09:34:49.283533597 -0300 +++ after 2025-10-30 09:35:00.971426811 -0300 @@ -272,6 +272,9 @@ [0xc0000300 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS", [0xc0000301 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_CTL", [0xc0000302 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_CLR", + [0xc0000303 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_SET", + [0xc00003fd - x86_64_specific_MSRs_offset] = "IA32_L3_QOS_ABMC_CFG", + [0xc00003ff - x86_64_specific_MSRs_offset] = "IA32_L3_QOS_EXT_CFG", [0xc0000400 - x86_64_specific_MSRs_offset] = "IA32_EVT_CFG_BASE", [0xc0000500 - x86_64_specific_MSRs_offset] = "AMD_WORKLOAD_CLASS_CONFIG", [0xc0000501 - x86_64_specific_MSRs_offset] = "AMD_WORKLOAD_CLASS_ID", @@ -319,6 +322,7 @@ [0xc0010133 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_RMP_END", [0xc0010134 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_GUEST_TSC_FREQ", [0xc0010136 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_RMP_CFG", + [0xc0010138 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_SAVIC_CONTROL", [0xc0010140 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_OSVW_ID_LENGTH", [0xc0010141 - x86_AMD_V_KVM_MSRs_offset] = "AMD64_OSVW_STATUS", [0xc0010200 - x86_AMD_V_KVM_MSRs_offset] = "F15H_PERF_CTL", $ Now one can trace systemwide asking to see backtraces to where that MSR is being read/written: root@x1:~# perf trace -e msr:*_msr/max-stack=32/ --filter="msr==IA32_L3_QOS_ABMC_CFG" ^Croot@x1:~# If we use -v (verbose mode) we can see what it does behind the scenes: root@x1:~# perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_L3_QOS_ABMC_CFG" 0xc00003fd New filter for msr:write_msr: (msr==0xc00003fd) && (common_pid != 449842 && common_pid != 433756) 0xc00003fd New filter for msr:read_msr: (msr==0xc00003fd) && (common_pid != 449842 && common_pid != 433756) mmap size 528384B ^Croot@x1:~# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Please see tools/include/uapi/README for further details. Cc: Adrian Hunter Cc: Babu Moger Cc: Dapeng Mi Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: K Prateek Nayak Cc: Namhyung Kim Cc: Neeraj Upadhyay Cc: Perry Yuan Cc: Peter Zijlstra Cc: Sean Christopherson Signed-off-by: Arnaldo Carvalho de Melo commit afcfb6c8474d9e750880aaa77952cc588f859613 Author: Jason-JH Lin Date: Fri Aug 29 17:15:59 2025 +0800 drm/mediatek: Add pm_runtime support for GCE power control Call pm_runtime_resume_and_get() before accessing GCE hardware in mbox_send_message(), and invoke pm_runtime_put_autosuspend() in the cmdq callback to release the PM reference and start autosuspend for GCE. This ensures correct power management for the GCE device. Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") Signed-off-by: Jason-JH Lin Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829091727.3745415-3-jason-jh.lin@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit 9882a40640036d5bbc590426a78981526d4f2345 Author: Ariel D'Alessandro Date: Fri Oct 24 17:27:56 2025 -0300 drm/mediatek: Disable AFBC support on Mediatek DRM driver Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") added AFBC support to Mediatek DRM and enabled the 32x8/split/sparse modifier. However, this is currently broken on Mediatek MT8188 (Genio 700 EVK platform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by default since Mesa v25.0. Kernel trace reports vblank timeouts constantly, and the render is garbled: ``` [CRTC:62:crtc-0] vblank wait timed out WARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c [...] Hardware name: MediaTek Genio-700 EVK (DT) Workqueue: events_unbound commit_work pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c lr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c sp : ffff80008337bca0 x29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000 x26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000 x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80 x20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000 x14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b x11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70 x8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70 x5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480 Call trace: drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P) drm_atomic_helper_commit_tail_rpm+0x64/0x80 commit_tail+0xa4/0x1a4 commit_work+0x14/0x20 process_one_work+0x150/0x290 worker_thread+0x2d0/0x3ec kthread+0x12c/0x210 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ``` Until this gets fixed upstream, disable AFBC support on this platform, as it's currently broken with upstream Mesa. Fixes: c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") Cc: stable@vger.kernel.org Signed-off-by: Ariel D'Alessandro Reviewed-by: Daniel Stone Reviewed-by: CK Hu Reviewed-by: Macpaul Lin Link: https://patchwork.kernel.org/project/dri-devel/patch/20251024202756.811425-1-ariel.dalessandro@collabora.com/ Signed-off-by: Chun-Kuang Hu commit c44b4b9eeb71f5b0b617abf6fd66d1ef0aab6200 Author: Josh Poimboeuf Date: Wed Oct 29 12:54:08 2025 -0700 objtool: Fix skip_alt_group() for non-alternative STAC/CLAC If an insn->alt points to a STAC/CLAC instruction, skip_alt_group() assumes it's part of an alternative ("alt group") as opposed to some other kind of "alt" such as an exception fixup. While that assumption may hold true in the current code base, Linus has an out-of-tree patch which breaks that assumption by replacing the STAC/CLAC alternatives with raw STAC/CLAC instructions. Make skip_alt_group() more robust by making sure it's actually an alt group before continuing. Reported-by: Linus Torvalds Fixes: 2d12c6fb7875 ("objtool: Remove ANNOTATE_IGNORE_ALTERNATIVE from CLAC/STAC") Closes: https://lore.kernel.org/CAHk-=wi6goUT36sR8GE47_P-aVrd5g38=VTRHpktWARbyE-0ow@mail.gmail.com Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Tested-by: Linus Torvalds Link: https://patch.msgid.link/3d22415f7b8e06a64e0873b21f48389290eeaa49.1761767616.git.jpoimboe@kernel.org commit 43c2931a95e6b295bfe9e3b90dbe0f7596933e91 Author: Jakub Horký Date: Tue Oct 14 16:44:06 2025 +0200 kconfig/nconf: Initialize the default locale at startup Fix bug where make nconfig doesn't initialize the default locale, which causes ncurses menu borders to be displayed incorrectly (lqqqqk) in UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY. Signed-off-by: Jakub Horký Link: https://patch.msgid.link/20251014144405.3975275-2-jakub.git@horky.net [nathan: Alphabetize locale.h include] Signed-off-by: Nathan Chancellor commit 3927c4a1084c48ef97f11281a0a43ecb2cb4d6f1 Author: Jakub Horký Date: Tue Oct 14 17:49:32 2025 +0200 kconfig/mconf: Initialize the default locale at startup Fix bug where make menuconfig doesn't initialize the default locale, which causes ncurses menu borders to be displayed incorrectly (lqqqqk) in UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY. Signed-off-by: Jakub Horký Link: https://patch.msgid.link/20251014154933.3990990-1-jakub.git@horky.net [nathan: Alphabetize locale.h include] Signed-off-by: Nathan Chancellor commit ba36dd5ee6fd4643ebbf6ee6eefcecf0b07e35c7 Merge: ec0b62ccc986c0 be708ed300e1eb Author: Linus Torvalds Date: Fri Oct 31 18:22:26 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Mark migrate_disable/enable() as always_inline to avoid issues with partial inlining (Yonghong Song) - Fix powerpc stack register definition in libbpf bpf_tracing.h (Andrii Nakryiko) - Reject negative head_room in __bpf_skb_change_head (Daniel Borkmann) - Conditionally include dynptr copy kfuncs (Malin Jonsson) - Sync pending IRQ work before freeing BPF ring buffer (Noorain Eqbal) - Do not audit capability check in x86 do_jit() (Ondrej Mosnacek) - Fix arm64 JIT of BPF_ST insn when it writes into arena memory (Puranjay Mohan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf/arm64: Fix BPF_ST into arena memory bpf: Make migrate_disable always inline to avoid partial inlining bpf: Reject negative head_room in __bpf_skb_change_head bpf: Conditionally include dynptr copy kfuncs libbpf: Fix powerpc's stack register definition in bpf_tracing.h bpf: Do not audit capability check in do_jit() bpf: Sync pending IRQ work before freeing ring buffer commit d7d2fcf7ae31471b4e08b7e448b8fd0ec2e06a1b Author: Gustavo Luiz Duarte Date: Wed Oct 29 13:50:24 2025 -0700 netconsole: Acquire su_mutex before navigating configs hierarchy There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt->userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes. Quoting from Documentation/filesystems/configfs.rst: > A subsystem can navigate the cg_children list and the ci_parent pointer > to see the tree created by the subsystem. This can race with configfs' > management of the hierarchy, so configfs uses the subsystem mutex to > protect modifications. Whenever a subsystem wants to navigate the > hierarchy, it must do so under the protection of the subsystem > mutex. Without proper locking, if a userdata item is added or removed concurrently while these functions are iterating, the list can be accessed in an inconsistent state. For example, the list_for_each() loop can reach a node that is being removed from the list by list_del_init() which sets the nodes' .next pointer to point to itself, so the loop will never end (or reach the WARN_ON_ONCE in update_userdata() ). Fix this by holding the configfs subsystem mutex (su_mutex) during all operations that iterate over cg_children. This includes: - userdatum_value_store() which calls update_userdata() to iterate over cg_children - All sysdata_*_enabled_store() functions which call count_extradata_entries() to iterate over cg_children The su_mutex must be acquired before dynamic_netconsole_mutex to avoid potential lock ordering issues, as configfs operations may already hold su_mutex when calling into our code. Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target") Signed-off-by: Gustavo Luiz Duarte Link: https://patch.msgid.link/20251029-netconsole-fix-warn-v1-1-0d0dd4622f48@gmail.com Signed-off-by: Jakub Kicinski commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee Author: Hangbin Liu Date: Thu Oct 30 07:35:39 2025 +0000 net: vlan: sync VLAN features with lower device After registering a VLAN device and setting its feature flags, we need to synchronize the VLAN features with the lower device. For example, the VLAN device does not have the NETIF_F_LRO flag, it should be synchronized with the lower device based on the NETIF_F_UPPER_DISABLES definition. As the dev->vlan_features has changed, we need to call netdev_update_features(). The caller must run after netdev_upper_dev_link() links the lower devices, so this patch adds the netdev_update_features() call in register_vlan_dev(). Fixes: fd867d51f889 ("net/core: generic support for disabling netdev features down stack") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251030073539.133779-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit d01f8136d46b925798abcf86b35a4021e4cfb8bb Author: Wang Liang Date: Thu Oct 30 12:03:40 2025 +0800 selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh The script "ethtool-common.sh" is not installed in INSTALL_PATH, and triggers some errors when I try to run the test 'drivers/net/netdevsim/ethtool-coalesce.sh': TAP version 13 1..1 # timeout set to 600 # selftests: drivers/net/netdevsim: ethtool-coalesce.sh # ./ethtool-coalesce.sh: line 4: ethtool-common.sh: No such file or directory # ./ethtool-coalesce.sh: line 25: make_netdev: command not found # ethtool: bad command line argument(s) # ./ethtool-coalesce.sh: line 124: check: command not found # ./ethtool-coalesce.sh: line 126: [: -eq: unary operator expected # FAILED /0 checks not ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh # exit=1 Install this file to avoid this error. After this patch: TAP version 13 1..1 # timeout set to 600 # selftests: drivers/net/netdevsim: ethtool-coalesce.sh # PASSED all 22 checks ok 1 selftests: drivers/net/netdevsim: ethtool-coalesce.sh Fixes: fbb8531e58bd ("selftests: extract common functions in ethtool-common.sh") Signed-off-by: Wang Liang Link: https://patch.msgid.link/20251030040340.3258110-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 3f978e3f1570155a1327ffa25f60968bc7b9398f Author: Abdun Nihaal Date: Thu Oct 30 09:55:22 2025 +0530 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when setup_instance() fails with an error code. Fix that by freeing the urb before freeing the hw structure. Also change the error paths to use the goto ladder style. Compile tested only. Issue found using a prototype static analysis tool. Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit f8e8486702abb05b8c734093aab1606af0eac068 Author: Anubhav Singh Date: Thu Oct 30 06:04:36 2025 +0000 selftests/net: use destination options instead of hop-by-hop The GRO self-test, gro.c, currently constructs IPv6 packets containing a Hop-by-Hop Options header (IPPROTO_HOPOPTS) to ensure the GRO path correctly handles IPv6 extension headers. However, network elements may be configured to drop packets with the Hop-by-Hop Options header (HBH). This causes the self-test to fail in environments where such network elements are present. To improve the robustness and reliability of this test in diverse network environments, switch from using IPPROTO_HOPOPTS to IPPROTO_DSTOPTS (Destination Options). The Destination Options header is less likely to be dropped by intermediate routers and still serves the core purpose of the test: validating GRO's handling of an IPv6 extension header. This change ensures the test can execute successfully without being incorrectly failed by network policies outside the kernel's control. Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test") Reviewed-by: Willem de Bruijn Signed-off-by: Anubhav Singh Link: https://patch.msgid.link/20251030060436.1556664-1-anubhavsinggh@google.com Signed-off-by: Jakub Kicinski commit 02d064de05b1fcca769391fa82d205bed8bb9bf0 Author: Anubhav Singh Date: Thu Oct 30 06:28:18 2025 +0000 selftests/net: fix out-of-order delivery of FIN in gro:tcp test Due to the gro_sender sending data packets and FIN packets in very quick succession, these are received almost simultaneously by the gro_receiver. FIN packets are sometimes processed before the data packets leading to intermittent (~1/100) test failures. This change adds a delay of 100ms before sending FIN packets in gro:tcp test to avoid the out-of-order delivery. The same mitigation already exists for the gro:ip test. Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test") Reviewed-by: Willem de Bruijn Signed-off-by: Anubhav Singh Link: https://patch.msgid.link/20251030062818.1562228-1-anubhavsinggh@google.com Signed-off-by: Jakub Kicinski commit 3d18a84eddde169d6dbf3c72cc5358b988c347d0 Author: Jonas Gorski Date: Mon Oct 27 20:46:21 2025 +0100 net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx The internal switch on BCM63XX SoCs will unconditionally add 802.1Q VLAN tags on egress to CPU when 802.1Q mode is enabled. We do this unconditionally since commit ed409f3bbaa5 ("net: dsa: b53: Configure VLANs while not filtering"). This is fine for VLAN aware bridges, but for standalone ports and vlan unaware bridges this means all packets are tagged with the default VID, which is 0. While the kernel will treat that like untagged, this can break userspace applications processing raw packets, expecting untagged traffic, like STP daemons. This also breaks several bridge tests, where the tcpdump output then does not match the expected output anymore. Since 0 isn't a valid VID, just strip out the VLAN tag if we encounter it, unless the priority field is set, since that would be a valid tag again. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Signed-off-by: Jonas Gorski Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251027194621.133301-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 5a89b27afd3d010680f9355f7ff5b048cfe89333 Author: Carolina Jubran Date: Wed Oct 29 10:38:13 2025 +0200 ptp: Allow exposing cycles only for clocks with free-running counter The PTP core falls back to gettimex64 and getcrosststamp when getcycles64 or getcyclesx64 are not implemented. This causes the CYCLES ioctls to retrieve PHC real time instead of free-running cycles. Reject PTP_SYS_OFFSET_{PRECISE,EXTENDED}_CYCLES for clocks without free-running counter support since the result would represent PHC real time and system time rather than cycles and system time. Fixes: faf23f54d366 ("ptp: Add ioctl commands to expose raw cycle counter values") Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Pavan Chebbi Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251029083813.2276997-1-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 01534d73c58b3d03ae487836958fa8cb25fb77bb Merge: 284987ab6c974c 329d050bbe63c2 Author: Jakub Kicinski Date: Fri Oct 31 15:55:34 2025 -0700 Merge branch 'gve-fix-null-dereferencing-with-ptp-clock' Tim Hostetler says: ==================== gve: Fix NULL dereferencing with PTP clock This patch series fixes NULL dereferences that are possible with gve's PTP clock due to not stubbing certain ptp_clock_info callbacks. ==================== Link: https://patch.msgid.link/20251029184555.3852952-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit 329d050bbe63c2999f657cf2d3855be11a473745 Author: Tim Hostetler Date: Wed Oct 29 11:45:40 2025 -0700 gve: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. Fixes: acd16380523b ("gve: Add initial PTP device support") Reported-by: syzbot+a546141ca6d53b90aba3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a546141ca6d53b90aba3 Signed-off-by: Tim Hostetler Reviewed-by: Kuniyuki Iwashima Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251029184555.3852952-3-joshwash@google.com Signed-off-by: Jakub Kicinski commit 6ab753b5d8e521616cd9bd10b09891cbeb7e0235 Author: Tim Hostetler Date: Wed Oct 29 11:45:39 2025 -0700 gve: Implement gettimex64 with -EOPNOTSUPP gve implemented a ptp_clock for sole use of do_aux_work at this time. ptp_clock_gettime() and ptp_sys_offset() assume every ptp_clock has implemented either gettimex64 or gettime64. Stub gettimex64 and return -EOPNOTSUPP to prevent NULL dereferencing. Fixes: acd16380523b ("gve: Add initial PTP device support") Reported-by: syzbot+c8c0e7ccabd456541612@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c8c0e7ccabd456541612 Signed-off-by: Tim Hostetler Reviewed-by: Harshitha Ramamurthy Reviewed-by: Kuniyuki Iwashima Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251029184555.3852952-2-joshwash@google.com Signed-off-by: Jakub Kicinski commit 03c7e964a02e388ee168c804add7404eda23908c Author: Diederik de Haas Date: Mon Oct 27 16:54:28 2025 +0100 arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2 Page 13 of the PineTab2 v2 schematic dd 20230417 shows VCCIO4's power source is VCCIO_WL. Page 19 shows that VCCIO_WL is connected to VCCA1V8_PMU, so fix the PineTab2 dtsi to reflect that. Fixes: 1b7e19448f8f ("arm64: dts: rockchip: Add devicetree for Pine64 PineTab2") Cc: stable@vger.kernel.org Reviewed-by: Dragan Simic Signed-off-by: Diederik de Haas Link: https://patch.msgid.link/20251027155724.138096-1-diederik@cknow-tech.com Signed-off-by: Heiko Stuebner commit 08d70143e3033d267507deb98a5fd187df3e6640 Author: Quentin Schulz Date: Wed Oct 29 14:50:59 2025 +0100 arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1 In commit 296602b8e5f7 ("arm64: dts: rockchip: Move RK3399 OPPs to dtsi files for SoC variants"), everything shared between variants of RK3399 was put into rk3399-base.dtsi and the rest in variant-specific DTSI, such as rk3399-t, rk3399-op1, rk3399, etc. Therefore, the variant-specific DTSI should include rk3399-base.dtsi and not another variant's DTSI. rk3399-op1 wrongly includes rk3399 (a variant) DTSI instead of rk3399-base DTSI, let's fix this oversight by including the intended DTSI. Fortunately, this had no impact on the resulting DTB since all nodes were named the same and all node properties were overridden in rk3399-op1.dtsi. This was checked by doing a checksum of rk3399-op1 DTBs before and after this commit. No intended change in behavior. Fixes: 296602b8e5f7 ("arm64: dts: rockchip: Move RK3399 OPPs to dtsi files for SoC variants") Cc: stable@vger.kernel.org Signed-off-by: Quentin Schulz Reviewed-by: Dragan Simic Link: https://patch.msgid.link/20251029-rk3399-op1-include-v1-1-2472ee60e7f8@cherry.de Signed-off-by: Heiko Stuebner commit 9b041a4b66b3b62c30251e700b5688324cf66625 Author: Nathan Chancellor Date: Mon Oct 13 14:27:36 2025 -0700 x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols When building with CONFIG_CFI=y and CONFIG_LTO_CLANG_FULL=y, there is a series of errors from the various versions of clear_page() not having __kcfi_typeid_ symbols. $ cat kernel/configs/repro.config CONFIG_CFI=y # CONFIG_LTO_NONE is not set CONFIG_LTO_CLANG_FULL=y $ make -skj"$(nproc)" ARCH=x86_64 LLVM=1 clean defconfig repro.config bzImage ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_rep >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_rep) ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_orig >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_orig) ld.lld: error: undefined symbol: __kcfi_typeid_clear_page_erms >>> referenced by ld-temp.o >>> vmlinux.o:(__cfi_clear_page_erms) With full LTO, it is possible for LLVM to realize that these functions never have their address taken (as they are only used within an alternative, which will make them a direct call) across the whole kernel and either drop or skip generating their kCFI type identification symbols. clear_page_{rep,orig,erms}() are defined in clear_page_64.S with SYM_TYPED_FUNC_START as a result of 2981557cb040 ("x86,kcfi: Fix EXPORT_SYMBOL vs kCFI"), as exported functions are free to be called indirectly thus need kCFI type identifiers. Use KCFI_REFERENCE with these clear_page() functions to force LLVM to see these functions as address-taken and generate then keep the kCFI type identifiers. Fixes: 2981557cb040 ("x86,kcfi: Fix EXPORT_SYMBOL vs kCFI") Closes: https://github.com/ClangBuiltLinux/linux/issues/2128 Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sami Tolvanen Link: https://patch.msgid.link/20251013-x86-fix-clear_page-cfi-full-lto-errors-v1-1-d69534c0be61@kernel.org commit ec0b62ccc986c06552c57f54116171cfd186ef92 Merge: f414f9fd687971 41dacb39fe79cd Author: Linus Torvalds Date: Fri Oct 31 14:47:02 2025 -0700 Merge tag 'drm-fixes-2025-10-31' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "Looks like stochastics conspired to make this one a bit bigger, but nothing scary at all. Also first examples of the new Link: tags, yay! Next week Dave should be back. Drivers: - mediatek: uaf in unbind, fixes -rc2 boot regression - radeon: devm conversion fixes - amdgpu: VPE idle handler, re-enable DM idle optimization, DCN3, SMU, vblank, HDP eDP, powerplay fixes for fiji/iceland - msm: bunch of gem error path fixes, gmu fw parsing fix, dpu fixes - intel: fix dmc/dc6 asserts on ADL-S - xe: fix xe_validation_guard(), wake device handling around gt reset - ast: fix display output on AST2300 - etnaviv: fix gpu flush - imx: fix parallel bridge handling - nouveau: scheduler locking fix - panel: fixes for kingdisplay-kd097d04 and sitronix-st7789v Core Changes: - CI: disable broken sanity job - sysfb: fix NULL pointer access - sched: fix SIGKILL handling, locking for race condition - dma_fence: better timeline name for signalled fences" * tag 'drm-fixes-2025-10-31' of https://gitlab.freedesktop.org/drm/kernel: (44 commits) drm/ast: Clear preserved bits from register output value drm/imx: parallel-display: add the bridge before attaching it drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API drm/panel: kingdisplay-kd097d04: Disable EoTp drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 drm/xe: Do not wake device during a GT reset drm/xe: Fix uninitialized return value from xe_validation_guard() drm/msm/dpu: Fix adjusted mode clock check for 3d merge drm/msm/dpu: Disable broken YUV on QSEED2 hardware drm/msm/dpu: Require linear modifier for writeback framebuffers drm/msm/dpu: Fix pixel extension sub-sampling drm/msm/dpu: Disable scaling for unsupported scaler types drm/msm/dpu: Propagate error from dpu_assign_plane_resources drm/msm/dpu: Fix allocation of RGB SSPPs without scaling drm/msm: dsi: fix PLL init in bonded mode drm/i915/dmc: Clear HRR EVT_CTL/HTP to zero on ADL-S drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc drm/amd/display: Add HDR workaround for a specific eDP drm/amdgpu: fix SPDX header on cyan_skillfish_reg_init.c drm/amdgpu: fix SPDX header on irqsrcs_vcn_5_0.h ... commit f414f9fd68797182f8de4e1cd9855b6b28abde99 Merge: 39bcf0f7d415fe 437aa64c8e32b7 Author: Linus Torvalds Date: Fri Oct 31 14:24:32 2025 -0700 Merge tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Restore custom qcom ASPM enablement code so L1 PM Substates are enabled as they were in v6.17 even though the PCI core now enables just L0s and L1 by default (Bjorn Helgaas) - Size prefetchable bridge windows only when they actually exist, to avoid a WARN_ON() regression (Ilpo Järvinen) * tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Do not size non-existing prefetchable window Revert "PCI: qcom: Remove custom ASPM enablement code" commit 39bcf0f7d415fee440d2eba877b9b618cbd6d824 Merge: a5beb58e53092f de8d1f2fd5a510 Author: Linus Torvalds Date: Fri Oct 31 14:20:09 2025 -0700 Merge tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Fix overflows in vfio type1 backend for mappings at the end of the 64-bit address space, resulting in leaked pinned memory. New selftest support included to avoid such issues in the future (Alex Mastro) * tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio: vfio: selftests: add end of address space DMA map/unmap tests vfio: selftests: update DMA map/unmap helpers to support more test kinds vfio/type1: handle DMA map/unmap up to the addressable limit vfio/type1: move iova increment to unmap_unpin_*() caller vfio/type1: sanitize for overflow using check_*_overflow() commit 437aa64c8e32b724fc6d60100ef0eb313d32c88f Author: Ilpo Järvinen Date: Mon Oct 27 15:24:23 2025 +0200 PCI: Do not size non-existing prefetchable window pbus_size_mem() should only be called for bridge windows that exist but __pci_bus_size_bridges() may point 'pref' to a resource that does not exist (has zero flags) in case of non-root buses. When prefetchable bridge window does not exist, the same non-prefetchable bridge window is sized more than once which may result in duplicating entries into the realloc_head list. Duplicated entries are shown in this log and trigger a WARN_ON() because realloc_head had residual entries after the resource assignment algorithm: pci 0000:00:03.0: [11ab:6820] type 01 class 0x060400 PCIe Root Port pci 0000:00:03.0: PCI bridge to [bus 00] pci 0000:00:03.0: bridge window [io 0x0000-0x0fff] pci 0000:00:03.0: bridge window [mem 0x00000000-0x000fffff] pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000 pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000 pci 0000:00:03.0: bridge window [mem 0xe0000000-0xe03fffff]: assigned pci 0000:00:03.0: PCI bridge to [bus 02] pci 0000:00:03.0: bridge window [mem 0xe0000000-0xe03fffff] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1 at drivers/pci/setup-bus.c:2373 pci_assign_unassigned_root_bus_resources+0x1bc/0x234 Check resource flags of 'pref' and only size the prefetchable window if the resource has the IORESOURCE_PREFETCH flag. Fixes: ae88d0b9c57f ("PCI: Use pbus_select_window_for_type() during mem window sizing") Reported-by: Klaus Kudielka Closes: https://lore.kernel.org/r/51e8cf1c62b8318882257d6b5a9de7fdaaecc343.camel@gmail.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Klaus Kudielka Link: https://patch.msgid.link/20251027132423.8841-1-ilpo.jarvinen@linux.intel.com commit 057f1652feb9be78587dae53866371e7fcce81e9 Author: Bjorn Helgaas Date: Fri Oct 24 14:41:40 2025 -0500 Revert "PCI: qcom: Remove custom ASPM enablement code" This reverts commit a729c16646198872e345bf6c48dbe540ad8a9753. Prior to a729c1664619 ("PCI: qcom: Remove custom ASPM enablement code"), the qcom controller driver enabled ASPM, including L0s, L1, and L1 PM Substates, for all devices powered on at the time the controller driver enumerates them. ASPM was *not* enabled for devices powered on later by pwrctrl (unless the kernel was built with PCIEASPM_POWERSAVE or PCIEASPM_POWER_SUPERSAVE, or the user enabled ASPM via module parameter or sysfs). After f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms"), the PCI core enabled all ASPM states for all devices whether powered on initially or by pwrctrl, so a729c1664619 was unnecessary and reverted. But f3ac2ff14834 was too aggressive and broke platforms that didn't support CLKREQ# or required device-specific configuration for L1 Substates, so df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") enabled only L0s and L1. On Qualcomm platforms, this left L1 Substates disabled, which was a regression. Revert a729c1664619 so L1 Substates will be enabled on devices that are initially powered on. Devices powered on by pwrctrl will be addressed later. Fixes: df5192d9bb0e ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms") Reported-by: Johan Hovold Closes: https://lore.kernel.org/lkml/aPuXZlaawFmmsLmX@hovoldconsulting.com/ Signed-off-by: Bjorn Helgaas Tested-by: Johan Hovold Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251024210514.1365996-1-helgaas@kernel.org commit a5beb58e53092f77b89181bec9d30c8bdced3103 Merge: b4f7f01ea14fe3 0d92a3eaa6726e Author: Linus Torvalds Date: Fri Oct 31 12:57:19 2025 -0700 Merge tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix blk-crypto reporting EIO when EINVAL is the correct error code - Two bug fixes for the block zone support - NVME pull request via Keith: - Target side authentication fixup - Peer-to-peer metadata fixup - null_blk DMA alignment fix * tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: null_blk: set dma alignment to logical block size blk-crypto: use BLK_STS_INVAL for alignment errors block: make REQ_OP_ZONE_OPEN a write operation block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL nvme-pci: use blk_map_iter for p2p metadata nvmet-auth: update sc_c in host response commit b4f7f01ea14fe3654a0f7b7152ded7c15acd5e5f Merge: b909d77359b828 64e2f60f355e55 Author: Linus Torvalds Date: Fri Oct 31 12:50:35 2025 -0700 Merge tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Use correct locking in zPCI event code to avoid deadlock - Get rid of irqs_registered flag in zpci_dev structure and restore IRQ unconditionally for zPCI devices. This fixes sit uations where the flag was not correctly updated - Fix potential memory leak kernel page table dumper code - Disable (revert) ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP for s390 again. The optimized hugetlb vmemmap code modifies kernel page tables in a way which does not work on s390 and leads to reproducible kernel crashes due to stale TLB entries. This needs to be addressed with some larger changes. For now simply disable the feature - Update defconfigs * tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP s390/mm: Fix memory leak in add_marker() when kvrealloc() fails s390/pci: Restore IRQ unconditionally for the zPCI device s390: Update defconfigs s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump commit 284987ab6c974c338e54852abcfaf2ed69b852d3 Merge: b7904323e76b07 8d59fba49362c6 Author: Jakub Kicinski Date: Fri Oct 31 12:33:07 2025 -0700 Merge tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - MGMT: Fix OOB access in parse_adv_monitor_pattern() - hci_event: validate skb length for unknown CC opcode * tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() Bluetooth: hci_event: validate skb length for unknown CC opcode ==================== Link: https://patch.msgid.link/20251031170959.590470-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit b7904323e76b074c59f113ca423e76d90da26875 Merge: e5763491237ffe 70e8335485966d Author: Jakub Kicinski Date: Fri Oct 31 12:30:32 2025 -0700 Merge tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of new fixes: - ath10k: revert a patch that had caused issues on some devices - cfg80211/mac80211: use hrtimers for some things where the precise timing matters - zd1211rw: fix a long-standing potential leak * tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work wifi: mac80211: use wiphy_hrtimer_work for ttlm_work wifi: cfg80211: add an hrtimer based delayed work item Revert "wifi: ath10k: avoid unnecessary wait for service ready message" ==================== Link: https://patch.msgid.link/20251030104919.12871-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit be708ed300e1ebd32978b4092b909f0d9be0958f Author: Puranjay Mohan Date: Thu Oct 30 12:17:14 2025 +0000 bpf/arm64: Fix BPF_ST into arena memory The arm64 JIT supports BPF_ST with BPF_PROBE_MEM32 (arena) by using the tmp2 register to hold the dst + arena_vm_base value and using tmp2 as the new dst register. But this is broken because in case is_lsi_offset() returns false the tmp2 will be clobbered by emit_a64_mov_i(1, tmp2, off, ctx); and hence the emitted store instruction will be of the form: strb w10, [x11, x11] Fix this by using the third temporary register to hold the dst + arena_vm_base. Fixes: 339af577ec05 ("bpf: Add arm64 JIT support for PROBE_MEM32 pseudo instructions.") Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20251030121715.55214-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 14a7f2392f42bbb71c1a5ea68930006221fcd80a Author: Yonghong Song Date: Wed Oct 29 11:36:46 2025 -0700 bpf: Make migrate_disable always inline to avoid partial inlining The build fails with llvm 21/22: $ make LLVM=1 -j ... LD vmlinux.o GEN .vmlinux.objs ... BTF .tmp_vmlinux1.btf.o ... AS .tmp_vmlinux2.kallsyms.o LD vmlinux.unstripped BTFIDS vmlinux.unstripped WARN: resolve_btfids: unresolved symbol migrate_enable WARN: resolve_btfids: unresolved symbol migrate_disable make[2]: *** [vmlinux.unstripped] Error 255 make[2]: *** Deleting file 'vmlinux.unstripped' make[1]: *** [Makefile:1242: vmlinux] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Two functions with identical names but different addresses are considered ambiguous and removed by "pahole" from vmlinux BTF. Later resolve_btfids warns since it cannot find them. Commit 378b7708194f ("sched: Make migrate_{en,dis}able() inline") made them inlineable in most places, but in vmlinux built with llvm 21 and 22 there are four symbols for migrate_{enable,disable}: three static functions and one global function. Fix the issue by marking migrate_{enable,disable} as always inline. The alternative is to mark them as notrace/nokprobe which is more drastic. Only bpf programs are prevented from attaching to these functions. The rest of the tracing shouldn't be affected. [note: Peter ok-ed the patch, Alexei rewrote commit log] Fixes: 378b7708194f ("sched: Make migrate_{en,dis}able() inline") Signed-off-by: Yonghong Song Acked-by: Menglong Dong Link: https://lore.kernel.org/r/20251029183646.3811774-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 41dacb39fe79cd2fce42d31fa6658d926489a548 Merge: b0953985861810 b3fbda1a630a94 Author: Simona Vetter Date: Fri Oct 31 19:11:16 2025 +0100 Merge tag 'drm-xe-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix xe_validation_guard() not guarding (Thomas Hellström) - Do not wake device during a GT reset (Matthew Brost) Signed-off-by: Simona Vetter From: Lucas De Marchi Link: https://patch.msgid.link/o2b3lucyitafbbcd5bewpfqnslavtnnpc6ck4qatnou2wwukix@rz6seyfw75uy commit b095398586181010d3cfad4ec2cea723f2c1d582 Merge: e28e383da32a63 a9fb41b5def8e1 Author: Simona Vetter Date: Fri Oct 31 19:10:04 2025 +0100 Merge tag 'drm-misc-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: ast: - Preserve correct bits on register I/O dma-fence: - Use correct timeline name etnaviv: - Use correct GPU adress space for flush imx: - parallel-display: Fix bridge handling nouveau: - Fix locking in scheduler panel: - kingdisplay-kd097d04: Disable EOT packet - sitronix-st7789v: Use correct SYNC flags sched: - Fix locking to avoid race condition - Fix SIGKILL handling sysfb: - Avoid NULL-pointer access Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://patch.msgid.link/20251030195644.GA188441@localhost.localdomain commit e28e383da32a6396e37c3f68964dc92eb9b6f0ed Merge: 3d8d35bf8dc889 dc8aa0cb87a783 Author: Simona Vetter Date: Fri Oct 31 19:08:36 2025 +0100 Merge tag 'drm-intel-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix DMC/DC6 asserts on ADL-S (Ville) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://patch.msgid.link/aQNtTV75vPaDhnXh@intel.com commit 3d8d35bf8dc8893e34d92212d413d7cfd89c560e Merge: 3a9f6bd54e20d0 f5d079564c44ba Author: Simona Vetter Date: Fri Oct 31 19:07:39 2025 +0100 Merge tag 'drm-msm-fixes-2025-10-29' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.18-rc4 CI - Disable broken sanity job GEM - Fix vm_bind prealloc error path - Fix dma-buf import free - Fix last-fence update - Reject MAP_NULL if PRR is unsupported - Ensure vm is created in VM_BIND ioctl GPU - GMU fw parsing fix DPU: - Fixed mode_valid callback - Fixed planes on DPU 1.x devices. Signed-off-by: Simona Vetter From: Rob Clark Link: https://patch.msgid.link/CACSVV03kUm1ms7FBg0m9U4ZcyickSWbnayAWqYqs0XH4UjWf+A@mail.gmail.com commit 3a9f6bd54e20d0eaf89ca3ec6d82e5263cac93e8 Merge: ef54548455190f b3656b355b5522 Author: Simona Vetter Date: Fri Oct 31 19:00:01 2025 +0100 Merge tag 'amd-drm-fixes-6.18-2025-10-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-29: amdgpu: - VPE idle handler fix - Re-enable DM idle optimizations - DCN3.0 fix - SMU fix - Powerplay fixes for fiji/iceland - License fixes - HDP eDP panel fix - Vblank fix radeon: - devm migration fixes Signed-off-by: Simona Vetter From: Alex Deucher Link: https://patch.msgid.link/20251029201342.8813-1-alexander.deucher@amd.com commit ef54548455190f3d28462787eb33d08c3cfadc4e Merge: dcb6fa37fd7bc9 926d002e6d7e2f Author: Simona Vetter Date: Fri Oct 31 18:54:21 2025 +0100 Merge tag 'mediatek-drm-fixes-20251028' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20251028 1. Fix device use-after-free on unbind Signed-off-by: Simona Vetter From: Chun-Kuang Hu Link: https://patch.msgid.link/20251028151548.3944-1-chunkuang.hu@kernel.org commit 8d59fba49362c65332395789fd82771f1028d87e Author: Ilia Gavrilov Date: Mon Oct 20 15:12:55 2025 +0000 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the 'value' array in the mgmt_adv_pattern structure is 31. If the value of 'pattern[i].length' is set in the user space and exceeds 31, the 'patterns[i].value' array can be accessed out of bound when copied. Increasing the size of the 'value' array in the 'mgmt_adv_pattern' structure will break the userspace. Considering this, and to avoid OOB access revert the limits for 'offset' and 'length' back to the value of HCI_MAX_AD_LENGTH. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: db08722fc7d4 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH") Cc: stable@vger.kernel.org Signed-off-by: Ilia Gavrilov Signed-off-by: Luiz Augusto von Dentz commit 1c21cf89a66413eb04b2d22c955b7a50edc14dfa Author: Abdun Nihaal Date: Tue Oct 28 23:26:30 2025 +0530 Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() The memory allocated for ptr using kvmalloc() is not freed on the last error path. Fix that by freeing it on that error path. Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support") Signed-off-by: Abdun Nihaal Signed-off-by: Luiz Augusto von Dentz commit 5c5f1f64681cc889d9b13e4a61285e9e029d6ab5 Author: Raphael Pinsonneault-Thibeault Date: Fri Oct 24 12:29:10 2025 -0400 Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memory. The fix is to check skb->len before using skb->data. Reported-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a9a4bedfca6aa9d7fa24 Tested-by: syzbot+a9a4bedfca6aa9d7fa24@syzkaller.appspotmail.com Fixes: afcb3369f46ed ("Bluetooth: hci_event: Fix vendor (unknown) opcode status handling") Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Luiz Augusto von Dentz commit b909d77359b82821e1c6b6a3a8a51b355b06fdb5 Merge: 58fdd8484c05a1 895ad6f7083b0c Author: Linus Torvalds Date: Fri Oct 31 09:34:21 2025 -0700 Merge tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - fix potential UAF in statfs - DFS fix for expired referrals - fix minor modinfo typo - small improvement to reconnect for smbdirect * tag '6.18-rc3-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release() smb: client: handle lack of IPC in dfs_cache_refresh() smb: client: fix potential cfid UAF in smb2_query_info_compound cifs: fix typo in enable_gcm_256 module parameter commit 0d92a3eaa6726e64a18db74ece806c2c021aaac3 Author: Hans Holmberg Date: Fri Oct 31 10:48:26 2025 +0100 null_blk: set dma alignment to logical block size This driver assumes that bio vectors are memory aligned to the logical block size, so set the queue limit to reflect that. Unless we set up the limit based on the logical block size, we will go out of page bounds in copy_to_nullb / copy_from_nullb. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since commit 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr") xfstests generates unaligned I/O, which now lead to memory corruption when using null_blk devices with 4k block size. Fixes: bf8d08532bc1 ("iomap: add support for dma aligned direct-io") Fixes: b1a000d3b8ec ("block: relax direct io memory alignment") Reviewed-by: Christoph Hellwig Reviewed-by: Keith Busch Signed-off-by: Hans Holmberg Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 58fdd8484c05a19942690008304228ad784771e9 Merge: 3ad81aa52085a7 390db60f8e2bd2 Author: Linus Torvalds Date: Fri Oct 31 07:29:09 2025 -0700 Merge tag 'sound-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. It became slightly bigger than usual due to timing issues (holidays, etc), but all changes are rather device-specific fixes, so not really worrisome. - ASoC Cirrus codec fixes for AMD - Various fixes for ASoC Intel AVS, Qualcomm, SoundWire, FSL, Mediatek, Renesas - A few HD-audio quirks, and USB-audio regression fixes for Presonus" * tag 'sound-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits) ALSA: hda/realtek: Enable mic on Vaio RPL ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports ASoC: renesas: rz-ssi: Use proper dma_buffer_pos after resume ASoC: soc_sdw_utils: remove cs42l43 component_name ASoC: fsl_sai: Fix sync error in consumer mode ASoC: Fix build for sdw_utils ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) ASoC: rt721: fix prepare clock stop failed ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c ASoC: mediatek: Fix double pm_runtime_disable in remove functions ASoC: fsl_micfil: correct the endian format for DSD ASoC: fsl_sai: fix bit order for DSD format ASoC: Intel: avs: Use snd_codec format when initializing probe ASoC: Intel: avs: Disable periods-elapsed work when closing PCM ASoC: Intel: avs: Unprepare a stream when XRUN occurs ASoC: sdw_utils: add name_prefix for rt1321 part id ASoC: qdsp6: q6asm: do not sleep while atomic ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 ... commit 3ad81aa52085a7e67edfa4bc8f518e5962196bb3 Merge: 2d51cb1792c7b1 3c9bf72cc1ced1 Author: Linus Torvalds Date: Fri Oct 31 07:25:10 2025 -0700 Merge tag 'v6.18-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix double free in aspeed - Fix req->nbytes clobbering in s390/phmac * tag 'v6.18-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: aspeed - fix double free caused by devm crypto: s390/phmac - Do not modify the req->nbytes value commit 2d51cb1792c7b1d8d5daf55cc3eecf19ddc4500c Merge: d127176862a93c d54c676d4fe054 Author: Linus Torvalds Date: Fri Oct 31 07:08:47 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "ufs driver plus two core fixes. One core fix makes the unit attention counters atomic (just in case multiple commands detect them) and the other is fixing a merge window regression caused by changes in the block tree" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: core: Fix the unit attention counter implementation scsi: ufs: core: Declare tx_lanes witout initialization scsi: ufs: core: Initialize value of an attribute returned by uic cmd scsi: ufs: core: Fix error handler host_sem issue scsi: core: Fix a regression triggered by scsi_host_busy() commit 0d510778c2f4913b5ca062b8a538929bff94e0be Author: Jon Hunter Date: Fri Oct 31 10:37:41 2025 +0000 Revert "rtc: cpcap: Fix initial enable_irq/disable_irq balance" Commit e0762fd26ad6 ("rtc: cpcap: Fix initial enable_irq/disable_irq balance") set 'alarm_enabled' prior to calling the function devm_request_threaded_irq() because this enables the IRQ. However, right after calling devm_request_threaded_irq(), the driver calls disable_irq() to disable the IRQ and so now 'alarm_enabled' will be true but the IRQ is actually disabled. Revert this commit to fix the 'alarm_enabled' state. Fixes: e0762fd26ad6 ("rtc: cpcap: Fix initial enable_irq/disable_irq balance") Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20251031103741.945460-2-jonathanh@nvidia.com Signed-off-by: Alexandre Belloni commit b1c9390f0a44566f7cbd2db979e2ca5393767d49 Author: Jon Hunter Date: Fri Oct 31 10:37:40 2025 +0000 Revert "rtc: tps6586x: Fix initial enable_irq/disable_irq balance" Commit 1502fe0e97be ("rtc: tps6586x: Fix initial enable_irq/disable_irq balance") breaks the wake-up alarm for the tps6586x. After this commit was added RTC wake ups from suspend stopped working on the Tegra20 Ventana platform. The problem is that this change set the 'irq_en' variable to true prior to calling devm_request_threaded_irq() to indicate that the IRQ is enabled, however, it was over looked that the flag IRQ_NOAUTOEN is already set meaning that the IRQ is not enabled by default. This prevents the IRQ from being enabled as expected. Revert this change to fix this. Fixes: 1502fe0e97be ("rtc: tps6586x: Fix initial enable_irq/disable_irq balance") Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20251031103741.945460-1-jonathanh@nvidia.com Signed-off-by: Alexandre Belloni commit 0db22d7ee462c42c1284e98d47840932792c1adb Author: Christoph Hellwig Date: Thu Oct 23 17:17:03 2025 +0200 xfs: document another racy GC case in xfs_zoned_map_extent Besides blocks being invalidated, there is another case when the original mapping could have changed between querying the rmap for GC and calling xfs_zoned_map_extent. Document it there as it took us quite some time to figure out what is going on while developing the multiple-GC protection fix. Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 83bac569c762651ac6dff9a86f54ecc13d911f7d Author: Christoph Hellwig Date: Thu Oct 23 17:17:02 2025 +0200 xfs: prevent gc from picking the same zone twice When we are picking a zone for gc it might already be in the pipeline which can lead to us moving the same data twice resulting in in write amplification and a very unfortunate case where we keep on garbage collecting the zone we just filled with migrated data stopping all forward progress. Fix this by introducing a count of on-going GC operations on a zone, and skip any zone with ongoing GC when picking a new victim. Fixes: 080d01c41 ("xfs: implement zoned garbage collection") Signed-off-by: Hans Holmberg Co-developed-by: Hans Holmberg Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Tested-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a Author: Mario Limonciello (AMD) Date: Thu Oct 30 11:06:25 2025 -0500 HID: hid-input: Extend Elan ignore battery quirk to USB USB Elan devices have the same problem as the I2C ones with a fake battery device showing up. Reviewed-by: Hans de Goede Reported-by: André Barata Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722 Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e Author: Masami Ichikawa Date: Sun Sep 21 14:31:02 2025 +0900 HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Use a scope-based cleanup helper for the buffer allocated with kmalloc() in ntrig_report_version() to simplify the cleanup logic and prevent memory leaks (specifically the !hid_is_usb()-case one). [jkosina@suse.com: elaborate on the actual existing leak] Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()") Signed-off-by: Masami Ichikawa Signed-off-by: Jiri Kosina commit d127176862a93c4b3216bda533d2bee170af5e71 Merge: 1806838686ef74 920aa3a7705a06 Author: Linus Torvalds Date: Thu Oct 30 19:48:13 2025 -0700 Merge tag 'linux_kselftest-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Fix build warning in cachestat found during clang build and add tmpshmcstat to .gitignore" * tag 'linux_kselftest-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: cachestat: Fix warning on declaration under label selftests/cachestat: add tmpshmcstat file to .gitignore commit 1806838686ef74cde74e590d13984dec7c0233d6 Merge: a5355e98accb20 f3903ec76ae6af Author: Linus Torvalds Date: Thu Oct 30 19:11:27 2025 -0700 Merge tag 'linux_kselftest-kunit-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fixes from Shuah Khan: "Fix log overwrite in param_tests and fixes incorrect cast of priv pointer in test_dev_action(). Update email address for Rae Moar in MAINTAINERS KUnit entry" * tag 'linux_kselftest-kunit-fixes-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: MAINTAINERS: Update KUnit email address for Rae Moar kunit: prevent log overwrite in param_tests kunit: test_dev_action: Correctly cast 'priv' pointer to long* commit a5355e98accb20d8ea06008fd8fb5755cc52e8c0 Merge: a5dbbb39e11d50 8907226bed1ebd Author: Linus Torvalds Date: Thu Oct 30 19:05:46 2025 -0700 Merge tag 'acpi-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix three ACPI driver issues and add version checks to two ACPI table parsers: - Call input_free_device() on failing input device registration as necessary (and mentioned in the input subsystem documentation) in the ACPI button driver (Kaushlendra Kumar) - Fix use-after-free in acpi_video_switch_brightness() by canceling a delayed work during tear-down (Yuhao Jiang) - Use platform device for devres-related actions in the ACPI fan driver to allow device-managed resources to be cleaned up properly (Armin Wolf) - Add version checks to the MRRM and SPCR table parsers (Tony Luck and Punit Agrawal)" * tag 'acpi-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: SPCR: Check for table version when using precise baudrate ACPI: MRRM: Check revision of MRRM table ACPI: fan: Use platform device for devres-related actions ACPI: fan: Use ACPI handle when retrieving _FST ACPI: video: Fix use-after-free in acpi_video_switch_brightness() ACPI: button: Call input_free_device() on failing input device registration commit a5dbbb39e11d50a8c426b8d88f5b12031fee49f3 Merge: a4819ac1913e78 590c5cd10675a6 Author: Linus Torvalds Date: Thu Oct 30 19:02:16 2025 -0700 Merge tag 'pm-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix three regressions, two recent ones and one introduced during the 6.17 development cycle: - Add an exit latency check to the menu cpuidle governor in the case when it considers using a real idle state instead of a polling one to address a performance regression (Rafael Wysocki) - Revert an attempted cleanup of a system suspend code path that introduced a regression elsewhere (Samuel Wu) - Allow pm_restrict_gfp_mask() to be called multiple times in a row and adjust pm_restore_gfp_mask() accordingly to avoid having to play nasty games with these calls during hibernation (Rafael Wysocki)" * tag 'pm-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Allow pm_restrict_gfp_mask() stacking cpuidle: governors: menu: Select polling state in some more cases Revert "PM: sleep: Make pm_wakeup_clear() call more clear" commit a4819ac1913e78e41c8406df481a661d9469c350 Merge: e5763491237ffe 7073c7fc8d8ba4 Author: Linus Torvalds Date: Thu Oct 30 18:58:49 2025 -0700 Merge tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - atyfb: Avoid hard lock up when PLL not initialized (Daniel Palmer) - pvr2fb: Fix build error when CONFIG_PVR2_DMA enabled (Florian Fuchs) - bitblit: Fix out-of-bounds read in bit_putcs* (Junjie Cao) - valkyriefb: Fix reference count leak (Miaoqian Lin) - fbcon: Fix slab-use-after-free in fb_mode_is_equal (Quanmin Yan) - fb.h: Fix typo in "vertical" (Piyush Choudhary) * tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: atyfb: Check if pll_ops->init_pll failed fbcon: Set fb_display[i]->mode to NULL when the mode is released fbdev: bitblit: bound-check glyph index in bit_putcs* fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: valkyriefb: Fix reference count leak in valkyriefb_init video: fb: Fix typo in comment in fb.h commit e5763491237ffee22d9b554febc2d00669f81dee Merge: e53642b87a4f4b 51e5ad549c43b5 Author: Linus Torvalds Date: Thu Oct 30 18:35:35 2025 -0700 Merge tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wireless, Bluetooth and netfilter. Current release - regressions: - tcp: fix too slow tcp_rcvbuf_grow() action - bluetooth: fix corruption in h4_recv_buf() after cleanup Previous releases - regressions: - mptcp: restore window probe - bluetooth: - fix connection cleanup with BIG with 2 or more BIS - fix crash in set_mesh_sync and set_mesh_complete - batman-adv: release references to inactive interfaces - nic: - ice: fix usage of logical PF id - sfc: fix potential memory leak in efx_mae_process_mport() Previous releases - always broken: - devmem: refresh devmem TX dst in case of route invalidation - netfilter: add seqadj extension for natted connections - wifi: - iwlwifi: fix potential use after free in iwl_mld_remove_link() - brcmfmac: fix crash while sending action frames in standalone AP Mode - eth: - mlx5e: cancel tls RX async resync request in error flows - ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() - hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue - cxgb4: fix potential use-after-free in ipsec callback - nfp: fix memory leak in nfp_net_alloc()" * tag 'net-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (75 commits) net: sctp: fix KMSAN uninit-value in sctp_inq_pop net: devmem: refresh devmem TX dst in case of route invalidation net: stmmac: est: Fix GCL bounds checks net: stmmac: Consider Tx VLAN offload tag length for maxSDU net: stmmac: vlan: Disable 802.1AD tag insertion offload net/mlx5e: kTLS, Cancel RX async resync request in error flows net: tls: Cancel RX async resync request on rcd_delta overflow net: tls: Change async resync helpers argument net: phy: dp83869: fix STRAP_OPMODE bitmask selftests: net: use BASH for bareudp testing net: mctp: Fix tx queue stall net/mlx5: Don't zero user_count when destroying FDB tables net: usb: asix_devices: Check return value of usbnet_get_endpoints mptcp: zero window probe mib mptcp: restore window probe mptcp: fix MSG_PEEK stream corruption mptcp: drop bogus optimization in __mptcp_check_push() netconsole: Fix race condition in between reader and writer of userdata Documentation: netconsole: Remove obsolete contact people nfp: xsk: fix memory leak in nfp_net_alloc() ... commit 08d33390248f9e248bca970afc731a16aad4e348 Merge: 0b39ca457241ae 0194b65ab57143 Author: Jens Axboe Date: Thu Oct 30 19:26:19 2025 -0600 Merge tag 'nvme-6.18-2025-10-30' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "- Target side authentication fixup (Hannes) - Peer-to-peer metadata fixup (Keith)" * tag 'nvme-6.18-2025-10-30' of git://git.infradead.org/nvme: nvme-pci: use blk_map_iter for p2p metadata nvmet-auth: update sc_c in host response commit a9fb41b5def8e1e0103d5fd1453787993587281e Author: Thomas Zimmermann Date: Fri Oct 24 09:35:53 2025 +0200 drm/ast: Clear preserved bits from register output value Preserve the I/O register bits in __ast_write8_i_masked() as specified by preserve_mask. Accidentally OR-ing the output value into these will overwrite the register's previous settings. Fixes display output on the AST2300, where the screen can go blank at boot. The driver's original commit 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") already added the broken code. Commit 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") triggered the bug. Signed-off-by: Thomas Zimmermann Reported-by: Peter Schneider Closes: https://lore.kernel.org/dri-devel/a40caf8e-58ad-4f9c-af7f-54f6f69c29bb@googlemail.com/ Tested-by: Peter Schneider Reviewed-by: Jocelyn Falempe Fixes: 6f719373b943 ("drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off") Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)") Cc: Thomas Zimmermann Cc: Nick Bowler Cc: Douglas Anderson Cc: Dave Airlie Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v3.5+ Link: https://patch.msgid.link/20251024073626.129032-1-tzimmermann@suse.de commit 8907226bed1ebd10d069f6f70ff0aaa8840f3267 Merge: 543d35004007a0 20594cd104abaa 8f067aa5943026 d91a1d129b6361 Author: Rafael J. Wysocki Date: Thu Oct 30 20:40:49 2025 +0100 Merge branches 'acpi-button', 'acpi-video' and 'acpi-fan' Merge ACPI button, ACPI backlight (video), and ACPI fan driver fixes for 6.18-rc4: - Call input_free_device() on failing input device registration as necessary (and mentioned in the input subsystem documentation) in the ACPI button driver (Kaushlendra Kumar) - Fix use-after-free in acpi_video_switch_brightness() by canceling a delayed work during tear-down (Yuhao Jiang) - Use platform device for devres-related actions in the ACPI fan driver to allow device-managed resources to be cleaned up properly (Armin Wolf) * acpi-button: ACPI: button: Call input_free_device() on failing input device registration * acpi-video: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() * acpi-fan: ACPI: fan: Use platform device for devres-related actions ACPI: fan: Use ACPI handle when retrieving _FST commit 590c5cd10675a6ae49f6019502dec5c87aba07e4 Merge: db86f55bf81a3a 35e4a69b2003f2 Author: Rafael J. Wysocki Date: Thu Oct 30 20:25:18 2025 +0100 Merge branches 'pm-cpuidle' and 'pm-sleep' Merge a cpuidle fix and two fixes related to system sleep for 6.18-rc4: - Add an exit latency check to the menu cpuidle governor in the case when it considers using a real idle state instead of a polling one to address a performance regression (Rafael Wysocki) - Revert an attempted cleanup of a system suspend code path that introduced a regression elsewhere (Samuel Wu) - Allow pm_restrict_gfp_mask() to be called multiple times in a row and adjust pm_restore_gfp_mask() accordingly to avoid having to play nasty games with these calls during hibernation (Rafael Wysocki) * pm-cpuidle: cpuidle: governors: menu: Select polling state in some more cases * pm-sleep: PM: sleep: Allow pm_restrict_gfp_mask() stacking Revert "PM: sleep: Make pm_wakeup_clear() call more clear" commit 3b1a4a59a2086badab391687a6a0b86e03048393 Author: austinchang Date: Wed Oct 29 09:35:27 2025 +0000 btrfs: mark dirty extent range for out of bound prealloc extents In btrfs_fallocate(), when the allocated range overlaps with a prealloc extent and the extent starts after i_size, the range doesn't get marked dirty in file_extent_tree. This results in persisting an incorrect disk_i_size for the inode when not using the no-holes feature. This is reproducible since commit 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree"), then became hidden since commit 3d7db6e8bd22 ("btrfs: don't allocate file extent tree for non regular files") and then visible again after commit 8679d2687c35 ("btrfs: initialize inode::file_extent_tree after i_mode has been set"), which fixes the previous commit. The following reproducer triggers the problem: $ cat test.sh MNT=/mnt/test DEV=/dev/vdb mkdir -p $MNT mkfs.btrfs -f -O ^no-holes $DEV mount $DEV $MNT touch $MNT/file1 fallocate -n -o 1M -l 2M $MNT/file1 umount $MNT mount $DEV $MNT len=$((1 * 1024 * 1024)) fallocate -o 1M -l $len $MNT/file1 du --bytes $MNT/file1 umount $MNT mount $DEV $MNT du --bytes $MNT/file1 umount $MNT Running the reproducer gives the following result: $ ./test.sh (...) 2097152 /mnt/test/file1 1048576 /mnt/test/file1 The difference is exactly 1048576 as we assigned. Fix by adding a call to btrfs_inode_set_file_extent_range() in btrfs_fallocate_update_isize(). Fixes: 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree") Signed-off-by: austinchang Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 953902e4fb4c373c81a977f78e40f9f93a79e20f Author: Filipe Manana Date: Fri Oct 24 12:30:56 2025 +0100 btrfs: set inode flag BTRFS_INODE_COPY_EVERYTHING when logging new name If we are logging a new name make sure our inode has the runtime flag BTRFS_INODE_COPY_EVERYTHING set so that at btrfs_log_inode() we will find new inode refs/extrefs in the subvolume tree and copy them into the log tree. We are currently doing it when adding a new link but we are missing it when renaming. An example where this makes a new name not persisted: 1) create symlink with name foo in directory A 2) fsync directory A, which persists the symlink 3) rename the symlink from foo to bar 4) fsync directory A to persist the new symlink name Step 4 isn't working correctly as it's not logging the new name and also leaving the old inode ref in the log tree, so after a power failure the symlink still has the old name of "foo". This is because when we first fsync directoy A we log the symlink's inode (as it's a new entry) and at btrfs_log_inode() we set the log mode to LOG_INODE_ALL and then because we are using that mode and the inode has the runtime flag BTRFS_INODE_NEEDS_FULL_SYNC set, we clear that flag as well as the flag BTRFS_INODE_COPY_EVERYTHING. That means the next time we log the inode, during the rename through the call to btrfs_log_new_name() (calling btrfs_log_inode_parent() and then btrfs_log_inode()), we will not search the subvolume tree for new refs/extrefs and jump directory to the 'log_extents' label. Fix this by making sure we set BTRFS_INODE_COPY_EVERYTHING on an inode when we are about to log a new name. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/ac949c74-90c2-4b9a-b7fd-1ffc5c3175c7@gmail.com/ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f260c6aff0b8af236084012d14f9f1bf792ea883 Author: Shardul Bankar Date: Sun Oct 26 01:30:21 2025 +0530 btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because the level validation check happens before the mutex is acquired and before any error handling path that would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all error paths. Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation") Reviewed-by: Qu Wenruo Signed-off-by: Shardul Bankar Signed-off-by: David Sterba commit 2618849f31e7cf51fadd4a5242458501a6d5b315 Author: Qu Wenruo Date: Thu Oct 23 19:44:04 2025 +1030 btrfs: ensure no dirty metadata is written back for an fs with errors [BUG] During development of a minor feature (make sure all btrfs_bio::end_io() is called in task context), I noticed a crash in generic/388, where metadata writes triggered new works after btrfs_stop_all_workers(). It turns out that it can even happen without any code modification, just using RAID5 for metadata and the same workload from generic/388 is going to trigger the use-after-free. [CAUSE] If btrfs hits an error, the fs is marked as error, no new transaction is allowed thus metadata is in a frozen state. But there are some metadata modifications before that error, and they are still in the btree inode page cache. Since there will be no real transaction commit, all those dirty folios are just kept as is in the page cache, and they can not be invalidated by invalidate_inode_pages2() call inside close_ctree(), because they are dirty. And finally after btrfs_stop_all_workers(), we call iput() on btree inode, which triggers writeback of those dirty metadata. And if the fs is using RAID56 metadata, this will trigger RMW and queue new works into rmw_workers, which is already stopped, causing warning from queue_work() and use-after-free. [FIX] Add a special handling for write_one_eb(), that if the fs is already in an error state, immediately mark the bbio as failure, instead of really submitting them. Then during close_ctree(), iput() will just discard all those dirty tree blocks without really writing them back, thus no more new jobs for already stopped-and-freed workqueues. The extra discard in write_one_eb() also acts as an extra safenet. E.g. the transaction abort is triggered by some extent/free space tree corruptions, and since extent/free space tree is already corrupted some tree blocks may be allocated where they shouldn't be (overwriting existing tree blocks). In that case writing them back will further corrupting the fs. CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b Author: Oleksandr Suvorov Date: Thu Oct 30 17:42:54 2025 +0200 USB: serial: ftdi_sio: add support for u-blox EVK-M101 The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces: - EVK-M101 current sensors - EVK-M101 I2C - EVK-M101 UART - EVK-M101 port D Only the third USB interface is a UART. This change lets ftdi_sio probe the VID/PID and registers only interface #3 as a TTY, leaving the rest available for other drivers. [1] usb 5-1.3: new high-speed USB device number 11 using xhci_hcd usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00 usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 5-1.3: Product: EVK-M101 usb 5-1.3: Manufacturer: u-blox AG Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf Signed-off-by: Oleksandr Suvorov Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/ Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 103e17aac09cdd358133f9e00998b75d6c1f1518 Author: Sebastian Ene Date: Fri Oct 17 07:57:10 2025 +0000 KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. Signed-off-by: Sebastian Ene Acked-by: Will Deacon Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com Signed-off-by: Marc Zyngier commit f71f7afd0a0cd3f044cd2f8aba71a1a7229df762 Author: Vincent Donnefort Date: Thu Oct 16 17:45:41 2025 +0100 KVM: arm64: Check range args for pKVM mem transitions There's currently no verification for host issued ranges in most of the pKVM memory transitions. The end boundary might therefore be subject to overflow and later checks could be evaded. Close this loophole with an additional pfn_range_is_valid() check on a per public function basis. Once this check has passed, it is safe to convert pfn and nr_pages into a phys_addr_t and a size. host_unshare_guest transition is already protected via __check_host_shared_guest(), while assert_host_shared_guest() callers are already ignoring host checks. Signed-off-by: Vincent Donnefort Link: https://patch.msgid.link/20251016164541.3771235-1-vdonnefort@google.com Signed-off-by: Marc Zyngier commit a186fbcfd845699d51809f7c7e54cf997fe32820 Author: Mark Brown Date: Fri Oct 24 00:43:39 2025 +0100 KVM: arm64: selftests: Filter ZCR_EL2 in get-reg-list get-reg-list includes ZCR_EL2 in the list of EL2 registers that it looks for when NV is enabled but does not have any feature gate for this register, meaning that testing any combination of features that includes EL2 but does not include SVE will result in a test failure due to a missing register being reported: | The following lines are missing registers: | | ARM64_SYS_REG(3, 4, 1, 2, 0), Add ZCR_EL2 to feat_id_regs so that the test knows not to expect to see it without SVE being enabled. Fixes: 3a90b6f27964 ("KVM: arm64: selftests: get-reg-list: Add base EL2 registers") Signed-off-by: Mark Brown Link: https://patch.msgid.link/20251024-kvm-arm64-get-reg-list-zcr-el2-v1-1-0cd0ff75e22f@kernel.org Signed-off-by: Marc Zyngier commit 92e781c93ebe75e39ecdf78fb8ef1fdf1b63a9f8 Author: Mark Brown Date: Thu Oct 23 22:19:29 2025 +0100 KVM: arm64: selftests: Add SCTLR2_EL2 to get-reg-list We recently added support for SCTLR2_EL2 to the kernel but did not add it to get-reg-list, resulting in it reporting the missing register when it is available. Add it. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20251023-b4-kvm-arm64-get-reg-list-sctlr-el2-v1-1-088f88ff992a@kernel.org Signed-off-by: Marc Zyngier commit a24f7afce048e724be072bd063ed864f124daf81 Author: Maximilian Dittgen Date: Mon Oct 20 16:59:46 2025 +0200 KVM: selftests: fix MAPC RDbase target formatting in vgic_lpi_stress Since GITS_TYPER.PTA == 0, the ITS MAPC command demands a CPU ID, rather than a physical redistributor address, for its RDbase command argument. As such, when MAPC-ing guest ITS collections, vgic_lpi_stress iterates over CPU IDs in the range [0, nr_cpus), passing them as the RDbase vcpu_id argument to its_send_mapc_cmd(). However, its_encode_target() in the its_send_mapc_cmd() selftest handler expects RDbase arguments to be formatted with a 16 bit offset, as shown by the 16-bit target_addr right shift its implementation: its_mask_encode(&cmd->raw_cmd[2], target_addr >> 16, 51, 16) At the moment, all CPU IDs passed into its_send_mapc_cmd() have no offset, therefore becoming 0x0 after the bit shift. Thus, when vgic_its_cmd_handle_mapc() receives the ITS command in vgic-its.c, it always interprets the RDbase target CPU as CPU 0. All interrupts sent to collections will be processed by vCPU 0, which defeats the purpose of this multi-vCPU test. Fix by creating procnum_to_rdbase() helper function, which left-shifts the vCPU parameter received by its_send_mapc_cmd 16 bits before passing it to its_encode_target for encoding. Signed-off-by: Maximilian Dittgen Link: https://patch.msgid.link/20251020145946.48288-1-mdittgen@amazon.de Signed-off-by: Marc Zyngier commit da888524c393b4a14727e1a821bdd51313d0a2d3 Author: Sascha Bischoff Date: Tue Oct 21 09:44:09 2025 +0000 KVM: arm64: vgic-v3: Trap all if no in-kernel irqchip If there is no in-kernel irqchip for a GICv3 host set all of the trap bits to block all accesses. This fixes the no-vgic-v3 selftest again. Fixes: 3193287ddffb ("KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests") Reported-by: Mark Brown Closes: https://lore.kernel.org/all/23072856-6b8c-41e2-93d1-ea8a240a7079@sirena.org.uk Signed-off-by: Sascha Bischoff Reviewed-by: Sebastian Ott Tested-by: Mark Brown Link: https://patch.msgid.link/20251021094358.1963807-1-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier commit 64e2f60f355e556337fcffe80b9bcff1b22c9c42 Author: Heiko Carstens Date: Thu Oct 30 15:55:05 2025 +0100 s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes. The problem is that kernel page tables are modified without flushing corresponding TLB entries. Even if it looks like the empty flush_tlb_all() implementation on s390 is the problem, it is actually a different problem: on s390 it is not allowed to replace an active/valid page table entry with another valid page table entry without the detour over an invalid entry. A direct replacement may lead to random crashes and/or data corruption. In order to invalidate an entry special instructions have to be used (e.g. ipte or idte). Alternatively there are also special instructions available which allow to replace a valid entry with a different valid entry (e.g. crdte or cspg). Given that the HVO code currently does not provide the hooks to allow for an implementation which is compliant with the s390 architecture requirements, disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP again, which is basically a revert of the original patch which enabled it. Reported-by: Luiz Capitulino Closes: https://lore.kernel.org/all/20251028153930.37107-1-luizcap@redhat.com/ Fixes: 00a34d5a99c0 ("s390: select ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Cc: stable@vger.kernel.org Tested-by: Luiz Capitulino Reviewed-by: Gerald Schaefer Reviewed-by: David Hildenbrand Signed-off-by: Heiko Carstens commit bf7e97910b9f4d9679e075a39be371a4ed65dbd4 Author: Luca Ceresoli Date: Tue Oct 14 13:30:52 2025 +0200 drm/imx: parallel-display: add the bridge before attaching it Invoking drm_bridge_add() is good practice, so add it to this driver. Link: https://lore.kernel.org/all/DDHZ5GO9MPF0.CGYTVBI74FOZ@bootlin.com Signed-off-by: Luca Ceresoli Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-2-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel commit 3257bd193fa1702791978d8418c9a96e3def082c Author: Luca Ceresoli Date: Tue Oct 14 13:30:51 2025 +0200 drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. This conversion was missed during the initial conversion of all bridges to the new API. Thus all kernels with commit 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") and using this driver now warn due to drm_bridge_attach() incrementing the refcount, which is not initialized without using devm_drm_bridge_alloc() for allocation. To make the conversion simple and straightforward without messing up with the drmm_simple_encoder_alloc(), move the struct drm_bridge from struct imx_parallel_display_encoder to struct imx_parallel_display. Also remove the 'struct imx_parallel_display *pd' from struct imx_parallel_display_encoder, not needed anymore. Fixes: 94d50c1a2ca3 ("drm/bridge: get/put the bridge reference in drm_bridge_attach/detach()") Reported-by: Ernest Van Hoecke Closes: https://lore.kernel.org/all/hlf4wdopapxnh4rekl5s3kvoi6egaga3lrjfbx6r223ar3txri@3ik53xw5idyh/ Signed-off-by: Luca Ceresoli Reviewed-by: Louis Chauvet Tested-by: Ernest Van Hoecke Link: https://patch.msgid.link/20251014-drm-bridge-alloc-imx-ipuv3-v1-1-a1bb1dcbff50@bootlin.com Signed-off-by: Philipp Zabel commit 0b39ca457241aeca07a613002512573e8804f93a Author: Carlos Llamas Date: Thu Oct 30 04:39:18 2025 +0000 blk-crypto: use BLK_STS_INVAL for alignment errors Make __blk_crypto_bio_prep() propagate BLK_STS_INVAL when IO segments fail the data unit alignment check. This was flagged by an LTP test that expects EINVAL when performing an O_DIRECT read with a misaligned buffer [1]. Cc: Eric Biggers Cc: Christoph Hellwig Link: https://lore.kernel.org/all/aP-c5gPjrpsn0vJA@google.com/ [1] Signed-off-by: Carlos Llamas Reviewed-by: Eric Biggers Signed-off-by: Jens Axboe commit 390db60f8e2bd21fae544917eb3a8618265c058c Merge: 4f4c654f5a0f65 5e5c8aa73d99f1 Author: Takashi Iwai Date: Thu Oct 30 13:08:08 2025 +0100 Merge tag 'asoc-fix-v6.18-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A bigger batch of fixes than I'd like, things built up due to holidays and some last minute issues which caused me to hold off on sending a pul request. None of these are super remarkable, and there's a few new device IDs in here too including a relatively big block of AMD devices. The Cirrus Logic CS530x support subject line is actually a fix that was on the start of that series and got pulled in here, I forgot to fix the subject up when merging. commit 47a0925ee4bd2689f0aef4dbd67dd46442fe1ca2 Author: Maud Spierings Date: Thu Oct 30 07:35:38 2025 +0100 regulator: bd718x7: Fix voltages scaled by resistor divider The .min_sel and .max_sel fields remained uninitialized in the new linear_range, causing an error further down the line. Copy the old values of these fields to the new one as they represent the range of register values, which does not change. Fixes: d2ad981151b3a ("regulator: bd718x7: Support external connection to scale voltages") Signed-off-by: Maud Spierings Reviewed-by: Matti Vaittinen Link: https://patch.msgid.link/20251030-mini_iv-v3-2-ef56c4d9f219@gocontroll.com Signed-off-by: Mark Brown commit 4d3a13afa8b64dc49293b3eab3e7beac11072c12 Author: Mario Limonciello (AMD) Date: Mon Oct 20 10:50:42 2025 -0500 HID: amd_sfh: Stop sensor before starting Titas reports that the accelerometer sensor on their laptop only works after a warm boot or unloading/reloading the amd-sfh kernel module. Presumably the sensor is in a bad state on cold boot and failing to start, so explicitly stop it before starting. Cc: stable@vger.kernel.org Fixes: 93ce5e0231d79 ("HID: amd_sfh: Implement SFH1.1 functionality") Reported-by: Titas Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220670 Tested-by: Titas Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 Author: April Grimoire Date: Thu Oct 23 00:37:26 2025 +0800 HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, rendering function keys not treated properly. Despite being a SONiX USB DEVICE, it uses a different name, so adding it to the list. Signed-off-by: April Grimoire Signed-off-by: Jiri Kosina commit 59630e2ccd728703cc826e3a3515d70f8c7a766c Author: Jianbo Liu Date: Wed Oct 29 11:50:25 2025 +0200 xfrm: Prevent locally generated packets from direct output in tunnel mode Add a check to ensure locally generated packets (skb->sk != NULL) do not use direct output in tunnel mode, as these packets require proper L2 header setup that is handled by the normal XFRM processing path. Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 61fafbee6cfed283c02a320896089f658fa67e56 Author: Jianbo Liu Date: Tue Oct 28 04:22:48 2025 +0200 xfrm: Determine inner GSO type from packet inner protocol The GSO segmentation functions for ESP tunnel mode (xfrm4_tunnel_gso_segment and xfrm6_tunnel_gso_segment) were determining the inner packet's L2 protocol type by checking the static x->inner_mode.family field from the xfrm state. This is unreliable. In tunnel mode, the state's actual inner family could be defined by x->inner_mode.family or by x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed, causing GSO to create segments with the wrong L2 header type. This patch fixes the bug by deriving the inner mode directly from the packet's inner protocol stored in XFRM_MODE_SKB_CB(skb)->protocol. Instead of replicating the code, this patch modifies the xfrm_ip2inner_mode helper function. It now correctly returns &x->inner_mode if the selector family (x->sel.family) is already specified, thereby handling both specific and AF_UNSPEC cases appropriately. With this change, ESP GSO can use xfrm_ip2inner_mode to get the correct inner mode. It doesn't affect existing callers, as the updated logic now mirrors the checks they were already performing externally. Fixes: 26dbd66eab80 ("esp: choose the correct inner protocol for GSO on inter address family tunnels") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 082ef944e55da8a9a8df92e3842ca82a626d359a Author: Jianbo Liu Date: Tue Oct 28 04:22:47 2025 +0200 xfrm: Check inner packet family directly from skb_dst In the output path, xfrm_dev_offload_ok and xfrm_get_inner_ipproto need to determine the protocol family of the inner packet (skb) before it gets encapsulated. In xfrm_dev_offload_ok, the code checked x->inner_mode.family. This is unreliable because, for states handling both IPv4 and IPv6, the relevant inner family could be either x->inner_mode.family or x->inner_mode_iaf.family. Checking only the former can lead to a mismatch with the actual packet being processed. In xfrm_get_inner_ipproto, the code checked x->outer_mode.family. This is also incorrect for tunnel mode, as the inner packet's family can be different from the outer header's family. At both of these call sites, the skb variable holds the original inner packet. The most direct and reliable source of truth for its protocol family is its destination entry. This patch fixes the issue by using skb_dst(skb)->ops->family to ensure protocol-specific headers are only accessed for the correct packet type. Fixes: 91d8a53db219 ("xfrm: fix offloading of cross-family tunnels") Fixes: 45a98ef4922d ("net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Zhu Yanjun Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit a45f15808fb753a14c6041fd1e5bef5d552bd2e3 Author: Lauri Tirkkonen Date: Sat Oct 18 15:35:15 2025 +0900 HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc The keyboard of this device has the following in its report description for Usage (Keyboard) in Collection (Application): # 0x15, 0x00, // Logical Minimum (0) 52 # 0x25, 0x65, // Logical Maximum (101) 54 # 0x05, 0x07, // Usage Page (Keyboard) 56 # 0x19, 0x00, // Usage Minimum (0) 58 # 0x29, 0xdd, // Usage Maximum (221) 60 # 0x81, 0x00, // Input (Data,Arr,Abs) 62 Since the Usage Min/Max range exceeds the Logical Min/Max range, keypresses outside the Logical range are not recognized. This includes, for example, the Japanese language keyboard variant's keys for |, _ and \. Fixup the report description to make the Logical range match the Usage range, fixing the interpretation of keypresses above 101 on this device. Signed-off-by: Lauri Tirkkonen Signed-off-by: Jiri Kosina commit 89216c9051ef6635f1514f8e0d2f9cd63b37a3b6 Author: Tony Luck Date: Tue Oct 28 10:29:48 2025 -0700 x86/cpu: Add/fix core comments for {Panther,Nova} Lake The E-core in Panther Lake is Darkmont, not Crestmont. Nova Lake is built from Coyote Cove (P-core) and Arctic Wolf (E-core). Fixes: 43bb700cff6b ("x86/cpu: Update Intel Family comments") Signed-off-by: Tony Luck Signed-off-by: Ingo Molnar Acked-by: Dave Hansen Cc: Peter Zijlstra Link: https://patch.msgid.link/20251028172948.6721-1-tony.luck@intel.com commit 847ebc4476714f81d7dea73e5ea69448d7fe9d3a Author: Borislav Petkov (AMD) Date: Wed Oct 29 12:34:31 2025 +0100 x86/CPU/AMD: Extend Zen6 model range Add some more Zen6 models. Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251029123056.19987-1-bp@kernel.org commit beab067dbcff642243291fd528355d64c41dc3b2 Author: Zhang Heng Date: Fri Sep 12 20:38:18 2025 +0800 HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Based on available evidence, the USB ID 4c4a:4155 used by multiple devices has been attributed to Jieli. The commit 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen functionality. Added checks for manufacturer and serial number to maintain microphone compatibility, enabling both devices to function properly. [jkosina@suse.com: edit shortlog] Fixes: 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") Cc: stable@vger.kernel.org Tested-by: staffan.melin@oscillator.se Reviewed-by: Terry Junge Signed-off-by: Zhang Heng Signed-off-by: Jiri Kosina commit 51e5ad549c43b557c7da1e4d1a1dcf061b4a5f6c Author: Ranganath V N Date: Sun Oct 26 22:03:12 2025 +0530 net: sctp: fix KMSAN uninit-value in sctp_inq_pop Fix an issue detected by syzbot: KMSAN reported an uninitialized-value access in sctp_inq_pop BUG: KMSAN: uninit-value in sctp_inq_pop The issue is actually caused by skb trimming via sk_filter() in sctp_rcv(). In the reproducer, skb->len becomes 1 after sk_filter(), which bypassed the original check: if (skb->len < sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr) + skb_transport_offset(skb)) To handle this safely, a new check should be performed after sk_filter(). Reported-by: syzbot+d101e12bccd4095460e7@syzkaller.appspotmail.com Tested-by: syzbot+d101e12bccd4095460e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d101e12bccd4095460e7 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Xin Long Signed-off-by: Ranganath V N Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251026-kmsan_fix-v3-1-2634a409fa5f@gmail.com Signed-off-by: Paolo Abeni commit ad8415a85703a0cc415aef5682c99ed2d9facaf5 Merge: 1ec39d2cd88dac 3575254546a272 Author: Greg Kroah-Hartman Date: Thu Oct 30 10:06:36 2025 +0100 Merge tag 'thunderbolt-for-v6.18-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.18-rc4 This adds PCI ID for Intel Wildcat Lake Thunderbolt/USB4 host controller. This has been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.18-rc4' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Add support for Intel Wildcat Lake commit 70e8335485966d7d4ed85976dceab52803b151a2 Author: Abdun Nihaal Date: Tue Oct 28 23:13:39 2025 +0530 wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx() The memory allocated for urbs with kcalloc() is not freed on any error path. Fix that by freeing it in the error path. Fixes: e85d0918b54f ("[PATCH] ZyDAS ZD1211 USB-WLAN driver") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251028174341.139134-1-nihaal@cse.iitm.ac.in Signed-off-by: Johannes Berg commit 4f4c654f5a0f6560b938a5ab05ec5940aa6c1c29 Author: Edson Juliano Drosdeck Date: Wed Oct 29 15:11:52 2025 -0300 ALSA: hda/realtek: Enable mic on Vaio RPL Vaio RPL is equipped with ACL256, and needs a fix to make the internal mic and headphone mic to work. Also must to limits the internal microphone boost. Signed-off-by: Edson Juliano Drosdeck Link: https://patch.msgid.link/20251029181152.389302-1-edson.drosdeck@gmail.com Signed-off-by: Takashi Iwai commit a2b32bc1d9e359a9f90d0de6af16699facb10935 Author: Adrian Hunter Date: Fri Oct 24 11:59:18 2025 +0300 scsi: ufs: core: Fix invalid probe error return value After DME Link Startup, the error return value is set to the MIPI UniPro GenericErrorCode which can be 0 (SUCCESS) or 1 (FAILURE). Upon failure during driver probe, the error code 1 is propagated back to the driver probe function which must return a negative value to indicate an error, but 1 is not negative, so the probe is considered to be successful even though it failed. Subsequently, removing the driver results in an oops because it is not in a valid state. This happens because none of the callers of ufshcd_init() expect a non-negative error code. Fix the return value and documentation to match actual usage. Fixes: 69f5eb78d4b0 ("scsi: ufs: core: Move the ufshcd_device_init(hba, true) call") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-5-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit d968e99488c4b08259a324a89e4ed17bf36561a4 Author: Adrian Hunter Date: Fri Oct 24 11:59:17 2025 +0300 scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL Link startup becomes unreliable for Intel Alder Lake based host controllers when a 2nd DME_LINKSTARTUP is issued unnecessarily. Employ UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress that from happening. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-4-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit d34caa89a132cd69efc48361d4772251546fdb88 Author: Adrian Hunter Date: Fri Oct 24 11:59:16 2025 +0300 scsi: ufs: core: Add a quirk to suppress link_startup_again ufshcd_link_startup() has a facility (link_startup_again) to issue DME_LINKSTARTUP a 2nd time even though the 1st time was successful. Some older hardware benefits from that, however the behaviour is non-standard, and has been found to cause link startup to be unreliable for some Intel Alder Lake based host controllers. Add UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE to suppress link_startup_again, in preparation for setting the quirk for affected controllers. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-3-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit bb44826c3bdbf1fa3957008a04908f45e5666463 Author: Adrian Hunter Date: Fri Oct 24 11:59:15 2025 +0300 scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers Intel platforms with UFS, can support Suspend-to-Idle (S0ix) and Suspend-to-RAM (S3). For S0ix the link state should be HIBERNATE. For S3, state is lost, so the link state must be OFF. Driver policy, expressed by spm_lvl, can be 3 (link HIBERNATE, device SLEEP) for S0ix but must be changed to 5 (link OFF, device POWEROFF) for S3. Fix support for S0ix/S3 by switching spm_lvl as needed. During suspend ->prepare(), if the suspend target state is not Suspend-to-Idle, ensure the spm_lvl is at least 5 to ensure that resume will be possible from deep sleep states. During suspend ->complete(), restore the spm_lvl to its original value that is suitable for S0ix. This fix is first needed in Intel Alder Lake based controllers. Fixes: 7dc9fb47bc9a ("scsi: ufs: ufs-pci: Add support for Intel ADL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251024085918.31825-2-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit f838d624fd1183e07db86f3138bcd05fd7630a1e Author: Bart Van Assche Date: Tue Oct 28 15:24:24 2025 -0700 scsi: ufs: core: Revert "Make HID attributes visible" Patch "Make HID attributes visible" is needed for older kernel versions (e.g. 6.12) where ufs_get_device_desc() is called from ufshcd_probe_hba(). In these older kernel versions ufshcd_get_device_desc() may be called after the sysfs attributes have been added. In the upstream kernel however ufshcd_get_device_desc() is called before ufs_sysfs_add_nodes(). See also the ufshcd_device_params_init() call from ufshcd_init(). Hence, calling sysfs_update_group() is not necessary. See also commit 69f5eb78d4b0 ("scsi: ufs: core: Move the ufshcd_device_init(hba, true) call") in kernel v6.13. This patch fixes the following kernel warning: sysfs: cannot create duplicate filename '/devices/platform/3c2d0000.ufs/hid' Workqueue: async async_run_entry_fn Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0x104 dump_stack+0x18/0x3c sysfs_warn_dup+0x6c/0xc8 internal_create_group+0x1c8/0x504 sysfs_create_groups+0x38/0x9c ufs_sysfs_add_nodes+0x20/0x58 ufshcd_init+0x1114/0x134c ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __device_attach_driver+0x15c/0x1f4 bus_for_each_drv+0x10c/0x168 __device_attach_async_helper+0x80/0xf8 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 ufshcd 3c2d0000.ufs: ufs_sysfs_add_nodes: sysfs groups creation failed (err = -17) Cc: Daniel Lee Cc: Peter Wang Cc: Bjorn Andersson Cc: Neil Armstrong Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Signed-off-by: Bart Van Assche Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Acked-by: Neil Armstrong Reviewed-by: Peter Wang Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251028222433.1108299-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit c57f5fee54dfc83ee1d7f70f7beb9410b8466e9e Author: Nathan Chancellor Date: Sat Oct 25 21:53:20 2025 +0100 libeth: xdp: Disable generic kCFI pass for libeth_xdp_tx_xmit_bulk() When building drivers/net/ethernet/intel/idpf/xsk.c for ARCH=arm with CONFIG_CFI=y using a version of LLVM prior to 22.0.0, there is a BUILD_BUG_ON failure: $ cat arch/arm/configs/repro.config CONFIG_BPF_SYSCALL=y CONFIG_CFI=y CONFIG_IDPF=y CONFIG_XDP_SOCKETS=y $ make -skj"$(nproc)" ARCH=arm LLVM=1 clean defconfig repro.config drivers/net/ethernet/intel/idpf/xsk.o In file included from drivers/net/ethernet/intel/idpf/xsk.c:4: include/net/libeth/xsk.h:205:2: error: call to '__compiletime_assert_728' declared with 'error' attribute: BUILD_BUG_ON failed: !__builtin_constant_p(tmo == libeth_xsktmo) 205 | BUILD_BUG_ON(!__builtin_constant_p(tmo == libeth_xsktmo)); | ^ ... libeth_xdp_tx_xmit_bulk() indirectly calls libeth_xsk_xmit_fill_buf() but these functions are marked as __always_inline so that the compiler can turn these indirect calls into direct ones and see that the tmo parameter to __libeth_xsk_xmit_fill_buf_md() is ultimately libeth_xsktmo from idpf_xsk_xmit(). Unfortunately, the generic kCFI pass in LLVM expands the kCFI bundles from the indirect calls in libeth_xdp_tx_xmit_bulk() in such a way that later optimizations cannot turn these calls into direct ones, making the BUILD_BUG_ON fail because it cannot be proved at compile time that tmo is libeth_xsktmo. Disable the generic kCFI pass for libeth_xdp_tx_xmit_bulk() to ensure these indirect calls can always be turned into direct calls to avoid this error. Closes: https://github.com/ClangBuiltLinux/linux/issues/2124 Fixes: 9705d6552f58 ("idpf: implement Rx path for AF_XDP") Signed-off-by: Nathan Chancellor Reviewed-by: Aleksandr Loktionov Acked-by: Alexander Lobakin Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-3-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 1ed9e6b1004f786d036eaabffb4ee6db9405e117 Author: Nathan Chancellor Date: Sat Oct 25 21:53:19 2025 +0100 ARM: Select ARCH_USES_CFI_GENERIC_LLVM_PASS Prior to clang 22.0.0 [1], ARM did not have an architecture specific kCFI bundle lowering in the backend, which may cause issues. Select CONFIG_ARCH_USES_CFI_GENERIC_LLVM_PASS to enable use of __nocfi_generic. Link: https://github.com/llvm/llvm-project/commit/d130f402642fba3d065aacb506cb061c899558de [1] Link: https://github.com/ClangBuiltLinux/linux/issues/2124 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-2-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 39c89ee6e9c4464eb366f4e594379454a6c4db39 Author: Nathan Chancellor Date: Sat Oct 25 21:53:18 2025 +0100 compiler_types: Introduce __nocfi_generic There are two different ways that LLVM can expand kCFI operand bundles in LLVM IR: generically in the middle end or using an architecture specific sequence when lowering LLVM IR to machine code in the backend. The generic pass allows any architecture to take advantage of kCFI but the expansion of these bundles in the middle end can mess with optimizations that may turn indirect calls into direct calls when the call target is known at compile time, such as after inlining. Add __nocfi_generic, dependent on an architecture selecting CONFIG_ARCH_USES_CFI_GENERIC_LLVM_PASS, to disable kCFI bundle generation in functions where only the generic kCFI pass may cause problems. Link: https://github.com/ClangBuiltLinux/linux/issues/2124 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251025-idpf-fix-arm-kcfi-build-error-v1-1-ec57221153ae@kernel.org Signed-off-by: Kees Cook commit 6a2108c78069fda000729b88c97b1eba0405e6d7 Author: Shivaji Kant Date: Wed Oct 29 06:54:19 2025 +0000 net: devmem: refresh devmem TX dst in case of route invalidation The zero-copy Device Memory (Devmem) transmit path relies on the socket's route cache (`dst_entry`) to validate that the packet is being sent via the network device to which the DMA buffer was bound. However, this check incorrectly fails and returns `-ENODEV` if the socket's route cache entry (`dst`) is merely missing or expired (`dst == NULL`). This scenario is observed during network events, such as when flow steering rules are deleted, leading to a temporary route cache invalidation. This patch fixes -ENODEV error for `net_devmem_get_binding()` by doing the following: 1. It attempts to rebuild the route via `rebuild_header()` if the route is initially missing (`dst == NULL`). This allows the TCP/IP stack to recover from transient route cache misses. 2. It uses `rcu_read_lock()` and `dst_dev_rcu()` to safely access the network device pointer (`dst_dev`) from the route, preventing use-after-free conditions if the device is concurrently removed. 3. It maintains the critical safety check by validating that the retrieved destination device (`dst_dev`) is exactly the device registered in the Devmem binding (`binding->dev`). These changes prevent unnecessary ENODEV failures while maintaining the critical safety requirement that the Devmem resources are only used on the bound network device. Reviewed-by: Bobby Eshleman Reported-by: Eric Dumazet Reported-by: Vedant Mathur Suggested-by: Eric Dumazet Fixes: bd61848900bf ("net: devmem: Implement TX path") Signed-off-by: Shivaji Kant Link: https://patch.msgid.link/20251029065420.3489943-1-shivajikant@google.com Signed-off-by: Jakub Kicinski commit a38eeecfe3232283c0ae34d0f4302e5a3e60f3ee Merge: 0dd1be4fe06a1f 48b2e323c018c4 Author: Jakub Kicinski Date: Wed Oct 29 18:49:26 2025 -0700 Merge branch 'net-stmmac-fixes-for-stmmac-tx-vlan-insert-and-est' Rohan G Thomas says: ==================== net: stmmac: Fixes for stmmac Tx VLAN insert and EST This patchset includes following fixes for stmmac Tx VLAN insert and EST implementations: 1. Disable STAG insertion offloading, as DWMAC IPs doesn't support offload of STAG for double VLAN packets and CTAG for single VLAN packets when using the same register configuration. The current configuration in the driver is undocumented and is adding an additional 802.1Q tag with VLAN ID 0 for double VLAN packets. 2. Consider Tx VLAN offload tag length for maxSDU estimation. 3. Fix GCL bounds check ==================== Link: https://patch.msgid.link/20251028-qbv-fixes-v4-0-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit 48b2e323c018c4c908ae5acabff326647bab5240 Author: Rohan G Thomas Date: Tue Oct 28 11:18:45 2025 +0800 net: stmmac: est: Fix GCL bounds checks Fix the bounds checks for the hw supported maximum GCL entry count and gate interval time. Fixes: b60189e0392f ("net: stmmac: Integrate EST with TAPRIO scheduler API") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20251028-qbv-fixes-v4-3-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit ded9813d17d3dd50a08e7a2ca1495769ef9c6673 Author: Rohan G Thomas Date: Tue Oct 28 11:18:44 2025 +0800 net: stmmac: Consider Tx VLAN offload tag length for maxSDU Queue maxSDU requirement of 802.1 Qbv standard requires mac to drop packets that exceeds maxSDU length and maxSDU doesn't include preamble, destination and source address, or FCS but includes ethernet type and VLAN header. On hardware with Tx VLAN offload enabled, VLAN header length is not included in the skb->len, when Tx VLAN offload is requested. This leads to incorrect length checks and allows transmission of oversized packets. Add the VLAN_HLEN to the skb->len before checking the Qbv maxSDU if Tx VLAN offload is requested for the packet. Fixes: c5c3e1bfc9e0 ("net: stmmac: Offload queueMaxSDU from tc-taprio") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20251028-qbv-fixes-v4-2-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit c657f86106c8729240e1f50a62c6606b578ecf20 Author: Rohan G Thomas Date: Tue Oct 28 11:18:43 2025 +0800 net: stmmac: vlan: Disable 802.1AD tag insertion offload The DWMAC IP's VLAN tag insertion offload does not support inserting STAG (802.1AD) and CTAG (802.1Q) types in bytes 13 and 14 using the same MAC_VLAN_Incl and MAC_VLAN_Inner_Incl register configurations. Currently, MAC_VLAN_Incl is configured to offload only STAG type insertion. However, the DWMAC IP inserts a CTAG type when the inner VLAN ID field of the descriptor is not configured, and a STAG type when it is configured. This behavior is not documented and leads to inconsistent double VLAN tagging. Additionally, an unexpected CTAG with VLAN ID 0 is inserted, resulting in frames like: Frame 1: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) Ethernet II, Src: (), Dst: () IEEE 802.1ad, ID: 100 802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 0 (unexpected) 802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 200 Internet Protocol Version 4, Src: 192.168.4.10, Dst: 192.168.4.11 Internet Control Message Protocol To avoid this undocumented and incorrect behavior, disable 802.1AD tag insertion offload. Also, don't set CSVL bit. As per the data book, when this bit is set, S-VLAN type (0x88A8) is inserted in the 13th and 14th bytes of transmitted packets and when this bit is reset, C-VLAN type (0x8100) is inserted in the 13th and 14th bytes of transmitted packets. Fixes: 30d932279dc2 ("net: stmmac: Add support for VLAN Insertion Offload") Fixes: e94e3f3b51ce ("net: stmmac: Add support for VLAN Insertion Offload in GMAC4+") Fixes: 1d2c7a5fee31 ("net: stmmac: Refactor VLAN implementation") Signed-off-by: Rohan G Thomas Reviewed-by: Boon Khai Ng Link: https://patch.msgid.link/20251028-qbv-fixes-v4-1-26481c7634e3@altera.com Signed-off-by: Jakub Kicinski commit 0dd1be4fe06a1f3a14a517446b49afaa6ac5fa94 Merge: e98cda764aa9c2 426e9da3b28404 Author: Jakub Kicinski Date: Wed Oct 29 18:32:23 2025 -0700 Merge branch 'tls-introduce-and-use-rx-async-resync-request-cancel-function' Tariq Toukan says: ==================== tls: Introduce and use RX async resync request cancel function This series by Shahar introduces RX async resync request cancel function in tls module, and uses it in mlx5e driver. For a device-offloaded TLS RX connection, the TLS module increments rcd_delta each time a new TLS record is received, tracking the distance from the original resync request. In the meanwhile, the device is queried and is expected to respond, asynchronously. However, if the device response is delayed or fails (e.g due to unstable connection and device getting out of tracking, hardware errors, resource exhaustion etc.), the TLS module keeps logging and incrementing rcd_delta, which can lead to a WARN() when rcd_delta exceeds the threshold. This series improves this code area by canceling the resync request when spotting an issue with the device response. ==================== Link: https://patch.msgid.link/1761508983-937977-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 426e9da3b28404b1edcbae401231fb378150d99d Author: Shahar Shitrit Date: Sun Oct 26 22:03:03 2025 +0200 net/mlx5e: kTLS, Cancel RX async resync request in error flows When device loses track of TLS records, it attempts to resync by monitoring records and requests an asynchronous resynchronization from software for this TLS connection. The TLS module handles such device RX resync requests by logging record headers and comparing them with the record tcp_sn when provided by the device. It also increments rcd_delta to track how far the current record tcp_sn is from the tcp_sn of the original resync request. If the device later responds with a matching tcp_sn, the TLS module approves the tcp_sn for resync. However, the device response may be delayed or never arrive, particularly due to traffic-related issues such as packet drops or reordering. In such cases, the TLS module remains unaware that resync will not complete, and continues performing unnecessary work by logging headers and incrementing rcd_delta, which can eventually exceed the threshold and trigger a WARN(). For example, this was observed when the device got out of tracking, causing mlx5e_ktls_handle_get_psv_completion() to fail and ultimately leading to the rcd_delta warning. To address this, call tls_offload_rx_resync_async_request_cancel() to cancel the resync request and stop resync tracking in such error cases. Also, increment the tls_resync_req_skip counter to track these cancellations. Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support") Signed-off-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c15d5c62ab313c19121f10e25d4fec852bd1c40c Author: Shahar Shitrit Date: Sun Oct 26 22:03:02 2025 +0200 net: tls: Cancel RX async resync request on rcd_delta overflow When a netdev issues a RX async resync request for a TLS connection, the TLS module handles it by logging record headers and attempting to match them to the tcp_sn provided by the device. If a match is found, the TLS module approves the tcp_sn for resynchronization. While waiting for a device response, the TLS module also increments rcd_delta each time a new TLS record is received, tracking the distance from the original resync request. However, if the device response is delayed or fails (e.g due to unstable connection and device getting out of tracking, hardware errors, resource exhaustion etc.), the TLS module keeps logging and incrementing, which can lead to a WARN() when rcd_delta exceeds the threshold. To address this, introduce tls_offload_rx_resync_async_request_cancel() to explicitly cancel resync requests when a device response failure is detected. Call this helper also as a final safeguard when rcd_delta crosses its threshold, as reaching this point implies that earlier cancellation did not occur. Signed-off-by: Shahar Shitrit Reviewed-by: Sabrina Dubroca Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 34892cfec0c2d96787c4be7bda0d5f18d7dacf85 Author: Shahar Shitrit Date: Sun Oct 26 22:03:01 2025 +0200 net: tls: Change async resync helpers argument Update tls_offload_rx_resync_async_request_start() and tls_offload_rx_resync_async_request_end() to get a struct tls_offload_resync_async parameter directly, rather than extracting it from struct sock. This change aligns the function signatures with the upcoming tls_offload_rx_resync_async_request_cancel() helper, which will be introduced in a subsequent patch. Signed-off-by: Shahar Shitrit Reviewed-by: Sabrina Dubroca Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761508983-937977-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e98cda764aa9c27f6810d08bd7bf2e8071535990 Merge: 298574936a6c4e 90918e3b6404c2 Author: Jakub Kicinski Date: Wed Oct 29 18:25:12 2025 -0700 Merge tag 'nf-25-10-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net 1) its not possible to attach conntrack labels via ctnetlink unless one creates a dummy 'ct labels set' rule in nftables. This is an oversight, the 'ruleset tests presence, userspace (netlink) sets' use-case is valid and should 'just work'. Always broken since this got added in Linux 4.7. 2) nft_connlimit reads count value without holding the relevant lock, add a READ_ONCE annotation. From Fernando Fernandez Mancera. 3) There is a long-standing bug (since 4.12) in nftables helper infra when NAT is in use: if the helper gets assigned after the nat binding was set up, we fail to initialise the 'seqadj' extension, which is needed in case NAT payload rewrites need to add (or remove) from the packet payload. Fix from Andrii Melnychenko. * tag 'nf-25-10-29' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_ct: add seqadj extension for natted connections netfilter: nft_connlimit: fix possible data race on connection count netfilter: nft_ct: enable labels for get case too ==================== Link: https://patch.msgid.link/20251029135617.18274-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 895ad6f7083b0c9f1902b23b84136298a492cbeb Author: Stefan Metzmacher Date: Tue Oct 28 18:43:46 2025 +0100 smb: client: call smbd_destroy() in the same splace as kernel_sock_shutdown()/sock_release() With commit b0432201a11b ("smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered") the changes from commit 214bab448476 ("cifs: Call MID callback before destroying transport") and commit 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called") are no longer needed. And it's better to use the same logic flow, so that the chance of smbdirect related problems is smaller. Fixes: 214bab448476 ("cifs: Call MID callback before destroying transport") Fixes: 1d2a4f57cebd ("cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit fac56c4651ae95f3f2b468c2cf1884cf0e6d18c1 Author: Paulo Alcantara Date: Thu Oct 23 18:59:47 2025 -0300 smb: client: handle lack of IPC in dfs_cache_refresh() In very rare cases, DFS mounts could end up with SMB sessions without any IPC connections. These mounts are only possible when having unexpired cached DFS referrals, hence not requiring any IPC connections during the mount process. Try to establish those missing IPC connections when refreshing DFS referrals. If the server is still rejecting it, then simply ignore and leave expired cached DFS referral for any potential DFS failovers. Reported-by: Jay Shin Signed-off-by: Paulo Alcantara (Red Hat) Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 298574936a6c4ebbe655e15d971ddb1a96c7dc0b Author: Thanh Quan Date: Mon Oct 27 15:02:43 2025 +0100 net: phy: dp83869: fix STRAP_OPMODE bitmask According to the TI DP83869HM datasheet Revision D (June 2025), section 7.6.1.41 STRAP_STS Register, the STRAP_OPMODE bitmask is bit [11:9]. Fix this. In case the PHY is auto-detected via PHY ID registers, or not described in DT, or, in case the PHY is described in DT but the optional DT property "ti,op-mode" is not present, then the driver reads out the PHY functional mode (RGMII, SGMII, ...) from hardware straps. Currently, all upstream users of this PHY specify both DT compatible string "ethernet-phy-id2000.a0f1" and ti,op-mode = property, therefore it seems no upstream users are affected by this bug. The driver currently interprets bits [2:0] of STRAP_STS register as PHY functional mode. Those bits are controlled by ANEG_DIS, ANEGSEL_0 straps and an always-zero reserved bit. Systems that use RGMII-to-Copper functional mode are unlikely to disable auto-negotiation via ANEG_DIS strap, or change auto-negotiation behavior via ANEGSEL_0 strap. Therefore, even with this bug in place, the STRAP_STS register content is likely going to be interpreted by the driver as RGMII-to-Copper mode. However, for a system with PHY functional mode strapping set to other mode than RGMII-to-Copper, the driver is likely to misinterpret the strapping as RGMII-to-Copper and misconfigure the PHY. For example, on a system with SGMII-to-Copper strapping, the STRAP_STS register reads as 0x0c20, but the PHY ends up being configured for incompatible RGMII-to-Copper mode. Fixes: 0eaf8ccf2047 ("net: phy: dp83869: Set opmode from straps") Reviewed-by: Andrew Lunn Signed-off-by: Thanh Quan Signed-off-by: Hai Pham Signed-off-by: Marek Vasut # Port from U-Boot to Linux Link: https://patch.msgid.link/20251027140320.8996-1-marek.vasut+renesas@mailbox.org Signed-off-by: Jakub Kicinski commit 9311e9540a8b406d9f028aa87fb072a3819d4c82 Author: Po-Hsu Lin Date: Mon Oct 27 17:57:10 2025 +0800 selftests: net: use BASH for bareudp testing In bareudp.sh, this script uses /bin/sh and it will load another lib.sh BASH script at the very beginning. But on some operating systems like Ubuntu, /bin/sh is actually pointed to DASH, thus it will try to run BASH commands with DASH and consequently leads to syntax issues: # ./bareudp.sh: 4: ./lib.sh: Bad substitution # ./bareudp.sh: 5: ./lib.sh: source: not found # ./bareudp.sh: 24: ./lib.sh: Syntax error: "(" unexpected Fix this by explicitly using BASH for bareudp.sh. This fixes test execution failures on systems where /bin/sh is not BASH. Reported-by: Edoardo Canepa Link: https://bugs.launchpad.net/bugs/2129812 Signed-off-by: Po-Hsu Lin Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20251027095710.2036108-2-po-hsu.lin@canonical.com Signed-off-by: Jakub Kicinski commit da2522df3fcc6f57068470cbdcd6516d9eb76b37 Author: Jinliang Wang Date: Sun Oct 26 23:55:30 2025 -0700 net: mctp: Fix tx queue stall The tx queue can become permanently stuck in a stopped state due to a race condition between the URB submission path and its completion callback. The URB completion callback can run immediately after usb_submit_urb() returns, before the submitting function calls netif_stop_queue(). If this occurs, the queue state management becomes desynchronized, leading to a stall where the queue is never woken. Fix this by moving the netif_stop_queue() call to before submitting the URB. This closes the race window by ensuring the network stack is aware the queue is stopped before the URB completion can possibly run. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jinliang Wang Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20251027065530.2045724-1-jinliangw@google.com Signed-off-by: Jakub Kicinski commit 53110232c95ff56067fd96c75a1a1c53d10dcd98 Author: Cosmin Ratiu Date: Sun Oct 26 22:20:19 2025 +0200 net/mlx5: Don't zero user_count when destroying FDB tables esw->user_count tracks how many TC rules are added on an esw via mlx5e_configure_flower -> mlx5_esw_get -> atomic64_inc(&esw->user_count) esw.user_count was unconditionally set to 0 in esw_destroy_legacy_fdb_table and esw_destroy_offloads_fdb_tables. These two together can lead to the following sequence of events: 1. echo 1 > /sys/class/net/eth2/device/sriov_numvfs - mlx5_core_sriov_configure -...-> esw_create_legacy_table -> atomic64_set(&esw->user_count, 0) 2. tc qdisc add dev eth2 ingress && \ tc filter replace dev eth2 pref 1 protocol ip chain 0 ingress \ handle 1 flower action ct nat zone 64000 pipe - mlx5e_configure_flower -> mlx5_esw_get -> atomic64_inc(&esw->user_count) 3. echo 0 > /sys/class/net/eth2/device/sriov_numvfs - mlx5_core_sriov_configure -..-> esw_destroy_legacy_fdb_table -> atomic64_set(&esw->user_count, 0) 4. devlink dev eswitch set pci/0000:08:00.0 mode switchdev - mlx5_devlink_eswitch_mode_set -> mlx5_esw_try_lock -> atomic64_read(&esw->user_count) == 0 - then proceed to a WARN_ON in: esw_offloads_start -> mlx5_eswitch_enable_locke -> esw_offloads_enable -> mlx5_esw_offloads_rep_load -> mlx5e_vport_rep_load -> mlx5e_netdev_change_profile -> mlx5e_detach_netdev -> mlx5e_cleanup_nic_rx -> mlx5e_tc_nic_cleanup -> mlx5e_mod_hdr_tbl_destroy Fix this by not clearing out the user_count when destroying FDB tables, so that the check in mlx5_esw_try_lock can prevent the mode change when there are TC rules configured, as originally intended. Fixes: 2318b8bb94a3 ("net/mlx5: E-switch, Destroy legacy fdb table when needed") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761510019-938772-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit dc89548c6926d68dfdda11bebc1a5258bc41d887 Author: Miaoqian Lin Date: Mon Oct 27 00:43:16 2025 +0800 net: usb: asix_devices: Check return value of usbnet_get_endpoints The code did not check the return value of usbnet_get_endpoints. Add checks and return the error if it fails to transfer the error. Found via static anlaysis and this is similar to commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints"). Fixes: 933a27d39e0e ("USB: asix - Add AX88178 support and many other changes") Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://patch.msgid.link/20251026164318.57624-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit ac345c5fff55262a51dad43bf8724c3d5d1fb006 Merge: 00764aa5c9bbb2 fe11dfa10919ce Author: Jakub Kicinski Date: Wed Oct 29 17:44:30 2025 -0700 Merge branch 'mptcp-various-rare-sending-issues' Matthieu Baerts says: ==================== mptcp: various rare sending issues Here are various fixes from Paolo, addressing very occasional issues on the sending side: - Patch 1: drop an optimisation that could lead to timeout in case of race conditions. A fix for up to v5.11. - Patch 2: fix stream corruption under very specific conditions. A fix for up to v5.13. - Patch 3: restore MPTCP-level zero window probe after a recent fix. A fix for up to v5.16. - Patch 4: new MIB counter to track MPTCP-level zero windows probe to help catching issues similar to the one fixed by the previous patch. ==================== Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-0-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit fe11dfa10919ce594682c76f5f648a0840d80a2b Author: Paolo Abeni Date: Tue Oct 28 09:16:55 2025 +0100 mptcp: zero window probe mib Explicitly account for MPTCP-level zero windows probe, to catch hopefully earlier issues alike the one addressed by the previous patch. Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-4-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit a824084b98d8a1dbd6e85d0842a8eb5e73467f59 Author: Paolo Abeni Date: Tue Oct 28 09:16:54 2025 +0100 mptcp: restore window probe Since commit 72377ab2d671 ("mptcp: more conservative check for zero probes") the MPTCP-level zero window probe check is always disabled, as the TCP-level write queue always contains at least the newly allocated skb. Refine the relevant check tacking in account that the above condition and that such skb can have zero length. Fixes: 72377ab2d671 ("mptcp: more conservative check for zero probes") Cc: stable@vger.kernel.org Reported-by: Geliang Tang Closes: https://lore.kernel.org/d0a814c364e744ca6b836ccd5b6e9146882e8d42.camel@kernel.org Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-3-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 8e04ce45a8db7a080220e86e249198fa676b83dc Author: Paolo Abeni Date: Tue Oct 28 09:16:53 2025 +0100 mptcp: fix MSG_PEEK stream corruption If a MSG_PEEK | MSG_WAITALL read operation consumes all the bytes in the receive queue and recvmsg() need to waits for more data - i.e. it's a blocking one - upon arrival of the next packet the MPTCP protocol will start again copying the oldest data present in the receive queue, corrupting the data stream. Address the issue explicitly tracking the peeked sequence number, restarting from the last peeked byte. Fixes: ca4fb892579f ("mptcp: add MSG_PEEK support") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-2-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 27b0e701d3872ba59c5b579a9e8a02ea49ad3d3b Author: Paolo Abeni Date: Tue Oct 28 09:16:52 2025 +0100 mptcp: drop bogus optimization in __mptcp_check_push() Accessing the transmit queue without owning the msk socket lock is inherently racy, hence __mptcp_check_push() could actually quit early even when there is pending data. That in turn could cause unexpected tx lock and timeout. Dropping the early check avoids the race, implicitly relaying on later tests under the relevant lock. With such change, all the other mptcp_send_head() call sites are now under the msk socket lock and we can additionally drop the now unneeded annotation on the transmit head pointer accesses. Fixes: 6e628cd3a8f7 ("mptcp: use mptcp release_cb for delayed tasks") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-mptcp-send-timeout-v1-1-38ffff5a9ec8@kernel.org Signed-off-by: Jakub Kicinski commit 00764aa5c9bbb2044eb04d6d78584a436666b231 Author: Gustavo Luiz Duarte Date: Tue Oct 28 15:06:32 2025 -0700 netconsole: Fix race condition in between reader and writer of userdata The update_userdata() function constructs the complete userdata string in nt->extradata_complete and updates nt->userdata_length. This data is then read by write_msg() and write_ext_msg() when sending netconsole messages. However, update_userdata() was not holding target_list_lock during this process, allowing concurrent message transmission to read partially updated userdata. This race condition could result in netconsole messages containing incomplete or inconsistent userdata - for example, reading the old userdata_length with new extradata_complete content, or vice versa, leading to truncated or corrupted output. Fix this by acquiring target_list_lock with spin_lock_irqsave() before updating extradata_complete and userdata_length, and releasing it after both fields are fully updated. This ensures that readers see a consistent view of the userdata, preventing corruption during concurrent access. The fix aligns with the existing locking pattern used throughout the netconsole code, where target_list_lock protects access to target fields including buf[] and msgcounter that are accessed during message transmission. Also get rid of the unnecessary variable complete_idx, which makes it easier to bail out of update_userdata(). Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target") Signed-off-by: Gustavo Luiz Duarte Link: https://patch.msgid.link/20251028-netconsole-fix-race-v4-1-63560b0ae1a0@meta.com Signed-off-by: Jakub Kicinski commit a43303809868b22bd1303739ba334e982b234d45 Author: Bagas Sanjaya Date: Tue Oct 28 20:20:27 2025 +0700 Documentation: netconsole: Remove obsolete contact people Breno Leitao has been listed in MAINTAINERS as netconsole maintainer since 7c938e438c56db ("MAINTAINERS: make Breno the netconsole maintainer"), but the documentation says otherwise that bug reports should be sent to original netconsole authors. Remove obsolate contact info. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20251028132027.48102-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit a4384d786e38d5ff172f0908aae01c2c30719245 Author: Abdun Nihaal Date: Tue Oct 28 21:38:41 2025 +0530 nfp: xsk: fix memory leak in nfp_net_alloc() In nfp_net_alloc(), the memory allocated for xsk_pools is not freed in the subsequent error paths, leading to a memory leak. Fix that by freeing it in the error path. Fixes: 6402528b7a0b ("nfp: xsk: add AF_XDP zero-copy Rx and Tx support") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251028160845.126919-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit bcc843bb0e7468de7f2de8bc2e3fa5a54dd1f3d0 Merge: f99c579211f5c7 aa251c84636c32 Author: Jakub Kicinski Date: Wed Oct 29 17:30:45 2025 -0700 Merge branch 'tcp-fix-receive-autotune-again' Matthieu Baerts says: ==================== tcp: fix receive autotune again Neal Cardwell found that recent kernels were having RWIN limited issues, even when net.ipv4.tcp_rmem[2] was set to a very big value like 512MB. He suspected that tcp_stream default buffer size (64KB) was triggering heuristic added in ea33537d8292 ("tcp: add receive queue awareness in tcp_rcv_space_adjust()"). After more testing, it turns out the bug was added earlier with commit 65c5287892e9 ("tcp: fix sk_rcvbuf overshoot"). I forgot once again that DRS has one RTT latency. MPTCP also got the same issue. This series : - Prevents calling tcp_rcvbuf_grow() on some MPTCP subflows. - adds rcv_ssthresh, window_clamp and rcv_wnd to trace_tcp_rcvbuf_grow(). - Refactors code in a patch with no functional changes. - Fixes the issue in the final patch. ==================== Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-0-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit aa251c84636c326471ca9d53723816ba8fffe2bf Author: Eric Dumazet Date: Tue Oct 28 12:58:02 2025 +0100 tcp: fix too slow tcp_rcvbuf_grow() action While the blamed commits apparently avoided an overshoot, they also limited how fast a sender can increase BDP at each RTT. This is not exactly a revert, we do not add the 16 * tp->advmss cushion we had, and we are keeping the out_of_order_queue contribution. Do the same in mptcp_rcvbuf_grow(). Tested: emulated 50ms rtt (tcp_stream --tcp-tx-delay 50000), cubic 20 second flow. net.ipv4.tcp_rmem set to "4096 131072 67000000" perf record -a -e tcp:tcp_rcvbuf_grow sleep 20 perf script Before: We can see we fail to roughly double RWIN at each RTT. Sender is RWIN limited while CWND is ramping up (before getting tcp_wmem limited). tcp_stream 33793 [010] 825.717525: tcp:tcp_rcvbuf_grow: time=100869 rtt_us=50428 copied=49152 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=103970 window_clamp=112128 rcv_wnd=106496 tcp_stream 33793 [010] 825.768966: tcp:tcp_rcvbuf_grow: time=51447 rtt_us=50362 copied=86016 inq=0 space=49152 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=107474 window_clamp=112128 rcv_wnd=106496 tcp_stream 33793 [010] 825.821539: tcp:tcp_rcvbuf_grow: time=52577 rtt_us=50243 copied=114688 inq=0 space=86016 ooo=0 scaling_ratio=219 rcvbuf=201096 rcv_ssthresh=167377 window_clamp=172031 rcv_wnd=167936 tcp_stream 33793 [010] 825.871781: tcp:tcp_rcvbuf_grow: time=50248 rtt_us=50237 copied=167936 inq=0 space=114688 ooo=0 scaling_ratio=219 rcvbuf=268129 rcv_ssthresh=224722 window_clamp=229375 rcv_wnd=225280 tcp_stream 33793 [010] 825.922475: tcp:tcp_rcvbuf_grow: time=50698 rtt_us=50183 copied=241664 inq=0 space=167936 ooo=0 scaling_ratio=219 rcvbuf=392617 rcv_ssthresh=331217 window_clamp=335871 rcv_wnd=323584 tcp_stream 33793 [010] 825.973326: tcp:tcp_rcvbuf_grow: time=50855 rtt_us=50213 copied=339968 inq=0 space=241664 ooo=0 scaling_ratio=219 rcvbuf=564986 rcv_ssthresh=478674 window_clamp=483327 rcv_wnd=462848 tcp_stream 33793 [010] 826.023970: tcp:tcp_rcvbuf_grow: time=50647 rtt_us=50248 copied=491520 inq=0 space=339968 ooo=0 scaling_ratio=219 rcvbuf=794811 rcv_ssthresh=671778 window_clamp=679935 rcv_wnd=651264 tcp_stream 33793 [010] 826.074612: tcp:tcp_rcvbuf_grow: time=50648 rtt_us=50227 copied=700416 inq=0 space=491520 ooo=0 scaling_ratio=219 rcvbuf=1149124 rcv_ssthresh=974881 window_clamp=983039 rcv_wnd=942080 tcp_stream 33793 [010] 826.125452: tcp:tcp_rcvbuf_grow: time=50845 rtt_us=50225 copied=987136 inq=8192 space=700416 ooo=0 scaling_ratio=219 rcvbuf=1637502 rcv_ssthresh=1392674 window_clamp=1400831 rcv_wnd=1339392 tcp_stream 33793 [010] 826.175698: tcp:tcp_rcvbuf_grow: time=50250 rtt_us=50198 copied=1347584 inq=0 space=978944 ooo=0 scaling_ratio=219 rcvbuf=2288672 rcv_ssthresh=1949729 window_clamp=1957887 rcv_wnd=1945600 tcp_stream 33793 [010] 826.225947: tcp:tcp_rcvbuf_grow: time=50252 rtt_us=50240 copied=1945600 inq=0 space=1347584 ooo=0 scaling_ratio=219 rcvbuf=3150516 rcv_ssthresh=2687010 window_clamp=2695167 rcv_wnd=2691072 tcp_stream 33793 [010] 826.276175: tcp:tcp_rcvbuf_grow: time=50233 rtt_us=50224 copied=2691072 inq=0 space=1945600 ooo=0 scaling_ratio=219 rcvbuf=4548617 rcv_ssthresh=3883041 window_clamp=3891199 rcv_wnd=3887104 tcp_stream 33793 [010] 826.326403: tcp:tcp_rcvbuf_grow: time=50233 rtt_us=50229 copied=3887104 inq=0 space=2691072 ooo=0 scaling_ratio=219 rcvbuf=6291456 rcv_ssthresh=5370482 window_clamp=5382144 rcv_wnd=5373952 tcp_stream 33793 [010] 826.376723: tcp:tcp_rcvbuf_grow: time=50323 rtt_us=50218 copied=5373952 inq=0 space=3887104 ooo=0 scaling_ratio=219 rcvbuf=9087658 rcv_ssthresh=7755537 window_clamp=7774207 rcv_wnd=7757824 tcp_stream 33793 [010] 826.426991: tcp:tcp_rcvbuf_grow: time=50274 rtt_us=50196 copied=7757824 inq=180224 space=5373952 ooo=0 scaling_ratio=219 rcvbuf=12563759 rcv_ssthresh=10729233 window_clamp=10747903 rcv_wnd=10575872 tcp_stream 33793 [010] 826.477229: tcp:tcp_rcvbuf_grow: time=50241 rtt_us=50078 copied=10731520 inq=180224 space=7577600 ooo=0 scaling_ratio=219 rcvbuf=17715667 rcv_ssthresh=15136529 window_clamp=15155199 rcv_wnd=14983168 tcp_stream 33793 [010] 826.527482: tcp:tcp_rcvbuf_grow: time=50258 rtt_us=50153 copied=15138816 inq=360448 space=10551296 ooo=0 scaling_ratio=219 rcvbuf=24667870 rcv_ssthresh=21073410 window_clamp=21102591 rcv_wnd=20766720 tcp_stream 33793 [010] 826.577712: tcp:tcp_rcvbuf_grow: time=50234 rtt_us=50228 copied=21073920 inq=0 space=14778368 ooo=0 scaling_ratio=219 rcvbuf=34550339 rcv_ssthresh=29517041 window_clamp=29556735 rcv_wnd=29519872 tcp_stream 33793 [010] 826.627982: tcp:tcp_rcvbuf_grow: time=50275 rtt_us=50220 copied=29519872 inq=540672 space=21073920 ooo=0 scaling_ratio=219 rcvbuf=49268707 rcv_ssthresh=42090625 window_clamp=42147839 rcv_wnd=41627648 tcp_stream 33793 [010] 826.678274: tcp:tcp_rcvbuf_grow: time=50296 rtt_us=50185 copied=42053632 inq=761856 space=28979200 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57238168 window_clamp=57316406 rcv_wnd=56606720 tcp_stream 33793 [010] 826.728627: tcp:tcp_rcvbuf_grow: time=50357 rtt_us=50128 copied=43913216 inq=851968 space=41291776 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56524800 tcp_stream 33793 [010] 827.131364: tcp:tcp_rcvbuf_grow: time=50239 rtt_us=50127 copied=43843584 inq=655360 space=43061248 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56696832 tcp_stream 33793 [010] 827.181613: tcp:tcp_rcvbuf_grow: time=50254 rtt_us=50115 copied=43843584 inq=524288 space=43188224 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56807424 tcp_stream 33793 [010] 828.339635: tcp:tcp_rcvbuf_grow: time=50283 rtt_us=50110 copied=43843584 inq=458752 space=43319296 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56864768 tcp_stream 33793 [010] 828.440350: tcp:tcp_rcvbuf_grow: time=50404 rtt_us=50099 copied=43843584 inq=393216 space=43384832 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=56922112 tcp_stream 33793 [010] 829.195106: tcp:tcp_rcvbuf_grow: time=50154 rtt_us=50077 copied=43843584 inq=196608 space=43450368 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57290728 window_clamp=57316406 rcv_wnd=57090048 After: It takes few steps to increase RWIN. Sender is no longer RWIN limited. tcp_stream 50826 [010] 935.634212: tcp:tcp_rcvbuf_grow: time=100788 rtt_us=50315 copied=49152 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=103970 window_clamp=112128 rcv_wnd=106496 tcp_stream 50826 [010] 935.685642: tcp:tcp_rcvbuf_grow: time=51437 rtt_us=50361 copied=86016 inq=0 space=49152 ooo=0 scaling_ratio=219 rcvbuf=160875 rcv_ssthresh=132969 window_clamp=137623 rcv_wnd=131072 tcp_stream 50826 [010] 935.738299: tcp:tcp_rcvbuf_grow: time=52660 rtt_us=50256 copied=139264 inq=0 space=86016 ooo=0 scaling_ratio=219 rcvbuf=502741 rcv_ssthresh=411497 window_clamp=430079 rcv_wnd=413696 tcp_stream 50826 [010] 935.788544: tcp:tcp_rcvbuf_grow: time=50249 rtt_us=50233 copied=307200 inq=0 space=139264 ooo=0 scaling_ratio=219 rcvbuf=728690 rcv_ssthresh=618717 window_clamp=623371 rcv_wnd=618496 tcp_stream 50826 [010] 935.838796: tcp:tcp_rcvbuf_grow: time=50258 rtt_us=50202 copied=618496 inq=0 space=307200 ooo=0 scaling_ratio=219 rcvbuf=2450338 rcv_ssthresh=1855709 window_clamp=2096187 rcv_wnd=1859584 tcp_stream 50826 [010] 935.889140: tcp:tcp_rcvbuf_grow: time=50347 rtt_us=50166 copied=1261568 inq=0 space=618496 ooo=0 scaling_ratio=219 rcvbuf=4376503 rcv_ssthresh=3725291 window_clamp=3743961 rcv_wnd=3706880 tcp_stream 50826 [010] 935.939435: tcp:tcp_rcvbuf_grow: time=50300 rtt_us=50185 copied=2478080 inq=24576 space=1261568 ooo=0 scaling_ratio=219 rcvbuf=9082648 rcv_ssthresh=7733731 window_clamp=7769921 rcv_wnd=7692288 tcp_stream 50826 [010] 935.989681: tcp:tcp_rcvbuf_grow: time=50251 rtt_us=50221 copied=4915200 inq=114688 space=2453504 ooo=0 scaling_ratio=219 rcvbuf=16574936 rcv_ssthresh=14108110 window_clamp=14179339 rcv_wnd=14024704 tcp_stream 50826 [010] 936.039967: tcp:tcp_rcvbuf_grow: time=50289 rtt_us=50279 copied=9830400 inq=114688 space=4800512 ooo=0 scaling_ratio=219 rcvbuf=32695050 rcv_ssthresh=27896187 window_clamp=27969593 rcv_wnd=27815936 tcp_stream 50826 [010] 936.090172: tcp:tcp_rcvbuf_grow: time=50211 rtt_us=50200 copied=19841024 inq=114688 space=9715712 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57245176 window_clamp=57316406 rcv_wnd=57163776 tcp_stream 50826 [010] 936.140430: tcp:tcp_rcvbuf_grow: time=50262 rtt_us=50197 copied=39501824 inq=114688 space=19726336 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57245176 window_clamp=57316406 rcv_wnd=57163776 tcp_stream 50826 [010] 936.190527: tcp:tcp_rcvbuf_grow: time=50101 rtt_us=50071 copied=43655168 inq=262144 space=39387136 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57032704 tcp_stream 50826 [010] 936.240719: tcp:tcp_rcvbuf_grow: time=50197 rtt_us=50057 copied=43843584 inq=262144 space=43393024 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57032704 tcp_stream 50826 [010] 936.341271: tcp:tcp_rcvbuf_grow: time=50297 rtt_us=50123 copied=43843584 inq=131072 space=43581440 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57147392 tcp_stream 50826 [010] 936.642503: tcp:tcp_rcvbuf_grow: time=50131 rtt_us=50084 copied=43843584 inq=0 space=43712512 ooo=0 scaling_ratio=219 rcvbuf=67000000 rcv_ssthresh=57259192 window_clamp=57316406 rcv_wnd=57262080 Fixes: 65c5287892e9 ("tcp: fix sk_rcvbuf overshoot") Fixes: e118cdc34dd1 ("mptcp: rcvbuf auto-tuning improvement") Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/589 Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-4-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit b1e014a1f3275a6f3d0f2b30b8117447fc3915f5 Author: Eric Dumazet Date: Tue Oct 28 12:58:01 2025 +0100 tcp: add newval parameter to tcp_rcvbuf_grow() This patch has no functional change, and prepares the following one. tcp_rcvbuf_grow() will need to have access to tp->rcvq_space.space old and new values. Change mptcp_rcvbuf_grow() in a similar way. Signed-off-by: Eric Dumazet [ Moved 'oldval' declaration to the next patch to avoid warnings at build time. ] Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-3-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit 24990d89c23de4dbef6b0b3d58383cafefdd6983 Author: Eric Dumazet Date: Tue Oct 28 12:58:00 2025 +0100 trace: tcp: add three metrics to trace_tcp_rcvbuf_grow() While chasing yet another receive autotuning bug, I found useful to add rcv_ssthresh, window_clamp and rcv_wnd. tcp_stream 40597 [068] 2172.978198: tcp:tcp_rcvbuf_grow: time=50307 rtt_us=50179 copied=77824 inq=0 space=40960 ooo=0 scaling_ratio=219 rcvbuf=131072 rcv_ssthresh=107474 window_clamp=112128 rcv_wnd=110592 tcp_stream 40597 [068] 2173.028528: tcp:tcp_rcvbuf_grow: time=50336 rtt_us=50206 copied=110592 inq=0 space=77824 ooo=0 scaling_ratio=219 rcvbuf=509444 rcv_ssthresh=328658 window_clamp=435813 rcv_wnd=331776 tcp_stream 40597 [068] 2173.078830: tcp:tcp_rcvbuf_grow: time=50305 rtt_us=50070 copied=270336 inq=0 space=110592 ooo=0 scaling_ratio=219 rcvbuf=509444 rcv_ssthresh=431159 window_clamp=435813 rcv_wnd=434176 tcp_stream 40597 [068] 2173.129137: tcp:tcp_rcvbuf_grow: time=50313 rtt_us=50118 copied=434176 inq=0 space=270336 ooo=0 scaling_ratio=219 rcvbuf=2457847 rcv_ssthresh=1299511 window_clamp=2102611 rcv_wnd=1302528 tcp_stream 40597 [068] 2173.179451: tcp:tcp_rcvbuf_grow: time=50318 rtt_us=50041 copied=1019904 inq=0 space=434176 ooo=0 scaling_ratio=219 rcvbuf=2457847 rcv_ssthresh=2087445 window_clamp=2102611 rcv_wnd=2088960 Signed-off-by: Eric Dumazet Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-2-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit a6f0459aadf1b41a9b9fae02006b1db024d60856 Author: Paolo Abeni Date: Tue Oct 28 12:57:59 2025 +0100 mptcp: fix subflow rcvbuf adjust The mptcp PM can add subflow to the conn_list before tcp_init_transfer(). Calling tcp_rcvbuf_grow() on such subflow is not correct as later init will overwrite the update. Fix the issue calling tcp_rcvbuf_grow() only after init buffer initialization. Fixes: e118cdc34dd1 ("mptcp: rcvbuf auto-tuning improvement") Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251028-net-tcp-recv-autotune-v3-1-74b43ba4c84c@kernel.org Signed-off-by: Jakub Kicinski commit f99c579211f5c77da6750b90c6bec9b264188120 Merge: 8df206f7b63611 f82acf6fb42115 Author: Jakub Kicinski Date: Wed Oct 29 17:23:11 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-10-28 (ice, ixgbe, igb, igc) For ice, Grzegorz fixes setting of PHY lane number and logical PF ID for E82x devices. He also corrects access of CGU (Clock Generation Unit) on dual complex devices. Kohei Enju resolves issues with error path cleanup for probe when in recovery mode on ixgbe and ensures PHY is powered on for link testing on igc. Lastly, he converts incorrect use of -ENOTSUPP to -EOPNOTSUPP on igb, igc, and ixgbe. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: use EOPNOTSUPP instead of ENOTSUPP in ixgbe_ptp_feature_enable() igc: use EOPNOTSUPP instead of ENOTSUPP in igc_ethtool_get_sset_count() igb: use EOPNOTSUPP instead of ENOTSUPP in igb_get_sset_count() igc: power up the PHY before the link test ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() ice: fix usage of logical PF id ice: fix destination CGU for dual complex E825 ice: fix lane number calculation ==================== Link: https://patch.msgid.link/20251028202515.675129-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f3903ec76ae6afcdba0347681d1dda005fb145cd Author: Rae Moar Date: Tue Oct 28 19:40:10 2025 +0000 MAINTAINERS: Update KUnit email address for Rae Moar Update Rae's email address for the KUnit entry. Also add an entry to .mailmap to map former google email to current gmail address. Signed-off-by: Rae Moar Reviewed-by: David Gow Signed-off-by: Shuah Khan commit d8eb00bbc628c8916ab0da2bb80059d48aa4512e Author: Sebastian Fleer Date: Wed Oct 29 13:35:28 2025 +0100 drm/panel: kingdisplay-kd097d04: Disable EoTp Since commit d97e71e44937 ("drm/bridge: synopsys: dw-mipi-dsi: enable EoTp by default") panel output on an Acer Chromebook Tab 10 (google-dru) is corrupted. The tablet I use is equipped with a kingdisplay-kd097d04 panel, disabling EoTp restores the correct functionality. Fixes: 2a994cbed6b2 ("drm/panel: Add Kingdisplay KD097D04 panel driver") Suggested-by: Jens Reidel Signed-off-by: Sebastian Fleer Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20251029124007.232333-1-dev@dwurp.de commit 056d76f7cb9fa68c8bbf85b4055aeb84af6139d5 Author: Sebastian Reichel Date: Wed Oct 1 01:59:42 2025 +0200 drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 I planned to set the polarity of horizontal and vertical sync, but accidentally described vertical sync twice with different polarity instead. Note, that there is no functional change, because the driver only makes use of DRM_MODE_FLAG_P[HV]SYNC to divert from the default active-low polarity. Reported-by: Laurent Pinchart Closes: https://lore.kernel.org/all/20250923132616.GH20765@pendragon.ideasonboard.com/ Fixes: a411558cc143 ("drm/panel: sitronix-st7789v: add Inanbo T28CP45TN89 support") Reviewed-by: Laurent Pinchart Reviewed-by: Marek Vasut Signed-off-by: Sebastian Reichel Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20251001-t28cp45tn89-fix-v2-1-67fe8e3046ca@collabora.com commit b3fbda1a630a9439c885b2a5dc5230cc49a87e9e Author: Matthew Brost Date: Tue Oct 21 17:55:37 2025 -0700 drm/xe: Do not wake device during a GT reset Waking the device during a GT reset can lead to unintended memory allocation, which is not allowed since GT resets occur in the reclaim path. Prevent this by holding a PM reference while a reset is in flight. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20251022005538.828980-3-matthew.brost@intel.com (cherry picked from commit 480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4) Signed-off-by: Lucas De Marchi commit 35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d Author: Rafael J. Wysocki Date: Tue Oct 28 21:52:31 2025 +0100 PM: sleep: Allow pm_restrict_gfp_mask() stacking Allow pm_restrict_gfp_mask() to be called many times in a row to avoid issues with calling dpm_suspend_start() when the GFP mask has been already restricted. Only the first invocation of pm_restrict_gfp_mask() will actually restrict the GFP mask and the subsequent calls will warn if there is a mismatch between the expected allowed GFP mask and the actual one. Moreover, if pm_restrict_gfp_mask() is called many times in a row, pm_restore_gfp_mask() needs to be called matching number of times in a row to actually restore the GFP mask. Calling it when the GFP mask has not been restricted will cause it to warn. This is necessary for the GFP mask restriction starting in hibernation_snapshot() to continue throughout the entire hibernation flow until it completes or it is aborted (either by a wakeup event or by an error). Fixes: 449c9c02537a1 ("PM: hibernate: Restrict GFP mask in hibernation_snapshot()") Fixes: 469d80a3712c ("PM: hibernate: Fix hybrid-sleep") Reported-by: Askar Safin Closes: https://lore.kernel.org/linux-pm/20251025050812.421905-1-safinaskar@gmail.com/ Link: https://lore.kernel.org/linux-pm/20251028111730.2261404-1-safinaskar@gmail.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Tested-by: Mario Limonciello (AMD) Cc: 6.16+ # 6.16+ Link: https://patch.msgid.link/5935682.DvuYhMxLoT@rafael.j.wysocki commit edce042da7984586ea5c7ed18ea5f58002afb969 Author: Thomas Hellström Date: Mon Oct 27 14:12:28 2025 +0100 drm/xe: Fix uninitialized return value from xe_validation_guard() the DEFINE_CLASS() macro creates an inline function and the init args are passed down to it; since _ret is passed as an int, whatever value is set inside the function is not visible to the caller. Pass _ret as a pointer so its value propagates to the caller. Fixes: c460bc2311df ("drm/xe: Introduce an xe_validation wrapper around drm_exec") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6220 Cc: Maarten Lankhorst Cc: Matthew Brost Cc: intel-xe@lists.freedesktop.org Signed-off-by: Thomas Hellström Reviewed-by: Lucas De Marchi Reviewed-by: Maarten Lankhorst Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251027131228.12098-1-thomas.hellstrom@linux.intel.com (cherry picked from commit fcb8c304f4673747d535c74b340b5b8a4823727b) Signed-off-by: Lucas De Marchi commit f4fa7c25f632cd925352b4d46f245653a23b1d1a Author: Andrea Righi Date: Wed Oct 29 14:08:43 2025 +0100 sched_ext: Fix use of uninitialized variable in scx_bpf_cpuperf_set() scx_bpf_cpuperf_set() has a typo where it dereferences the local variable @sch, instead of the global @scx_root pointer. Fix by dereferencing the correct variable. Fixes: 956f2b11a8a4f ("sched_ext: Drop kf_cpu_valid()") Signed-off-by: Andrea Righi Reviewed-by: Christian Loehle Signed-off-by: Tejun Heo commit 9222582ec524707fbb9d076febead5b6a07611ed Author: Miaoqing Pan Date: Tue Oct 28 14:07:44 2025 +0800 Revert "wifi: ath12k: Fix missing station power save configuration" This reverts commit 4b66d18918f8e4d85e51974a9e3ce9abad5c7c3d. In [1], Ross Brown reports poor performance of WCN7850 after enabling power save. Temporarily revert the fix; it will be re-enabled once the issue is resolved. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: 4b66d18918f8 ("wifi: ath12k: Fix missing station power save configuration") Reported-by: Ross Brown Closes: https://lore.kernel.org/all/CAMn66qZENLhDOcVJuwUZ3ir89PVtVnQRq9DkV5xjJn1p6BKB9w@mail.gmail.com/ # [1] Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251028060744.897198-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 9db8d46712d274a27d1d22c38e70211f20d508c2 Author: Andy Shevchenko Date: Fri Oct 24 15:23:36 2025 +0200 mnt: Remove dead code which might prevent from building Clang, in particular, is not happy about dead code: fs/namespace.c:135:37: error: unused function 'node_to_mnt_ns' [-Werror,-Wunused-function] 135 | static inline struct mnt_namespace *node_to_mnt_ns(const struct rb_node *node) | ^~~~~~~~~~~~~~ 1 error generated. Remove a leftover from the previous cleanup. Fixes: 7d7d16498958 ("mnt: support ns lookup") Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251024132336.1666382-1-andriy.shevchenko@linux.intel.com Signed-off-by: Christian Brauner commit 5e5c8aa73d99f1daa9f2ec1474b7fc1a6952764b Author: Srinivas Kandagatla Date: Wed Oct 29 14:46:36 2025 +0000 ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports For some reason we ended up limiting the number of soundwire ports to 2 in the bindings, the actual codec supports 4 rx and 5 tx ports. Fixes: 88d0d17192c5 ("ASoC: dt-bindings: add bindings for pm4125 audio codec") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251029144636.357203-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 22897e568646de5907d4981eae6cc895be2978d1 Author: Claudiu Beznea Date: Wed Oct 29 16:11:34 2025 +0200 ASoC: renesas: rz-ssi: Use proper dma_buffer_pos after resume When the driver supports DMA, it enqueues four DMA descriptors per substream before the substream is started. New descriptors are enqueued in the DMA completion callback, and each time a new descriptor is queued, the dma_buffer_pos is incremented. During suspend, the DMA transactions are terminated. There might be cases where the four extra enqueued DMA descriptors are not completed and are instead canceled on suspend. However, the cancel operation does not take into account that the dma_buffer_pos was already incremented. Previously, the suspend code reinitialized dma_buffer_pos to zero, but this is not always correct. To avoid losing any audio periods during suspend/resume and to prevent clip sound, save the completed DMA buffer position in the DMA callback and reinitialize dma_buffer_pos on resume. Cc: stable@vger.kernel.org Fixes: 1fc778f7c833a ("ASoC: renesas: rz-ssi: Add suspend to RAM support") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251029141134.2556926-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit 90918e3b6404c2a37837b8f11692471b4c512de2 Author: Andrii Melnychenko Date: Fri Oct 24 18:22:16 2025 +0200 netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq. The easiest way to reproduce this issue is with PASV mode. Example ruleset: table inet ftp_nat { ct helper ftp_helper { type "ftp" protocol tcp l3proto inet } chain prerouting { type filter hook prerouting priority 0; policy accept; tcp dport 21 ct state new ct helper set "ftp_helper" } } table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; tcp dport 21 dnat ip prefix to ip daddr map { 192.168.100.1 : 192.168.13.2/32 } } chain postrouting { type nat hook postrouting priority 100 ; policy accept; tcp sport 21 snat ip prefix to ip saddr map { 192.168.13.2 : 192.168.100.1/32 } } } Note that the ftp helper gets assigned *after* the dnat setup. The inverse (nat after helper assign) is handled by an existing check in nf_nat_setup_info() and will not show the problem. Topoloy: +-------------------+ +----------------------------------+ | FTP: 192.168.13.2 | <-> | NAT: 192.168.13.3, 192.168.100.1 | +-------------------+ +----------------------------------+ | +-----------------------+ | Client: 192.168.100.2 | +-----------------------+ ftp nat changes do not work as expected in this case: Connected to 192.168.100.1. [..] ftp> epsv EPSV/EPRT on IPv4 off. ftp> ls 227 Entering passive mode (192,168,100,1,209,129). 421 Service not available, remote server has closed connection. Kernel logs: Missing nfct_seqadj_ext_add() setup call WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41 [..] __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat] nf_nat_ftp+0x142/0x280 [nf_nat_ftp] help+0x4d1/0x880 [nf_conntrack_ftp] nf_confirm+0x122/0x2e0 [nf_conntrack] nf_hook_slow+0x3c/0xb0 .. Fix this by adding the required extension when a conntrack helper is assigned to a connection that has a nat binding. Fixes: 1a64edf54f55 ("netfilter: nft_ct: add helper set support") Signed-off-by: Andrii Melnychenko Signed-off-by: Florian Westphal commit 8d96dfdcabef00e28f0c851b1502adb679dfc6d9 Author: Fernando Fernandez Mancera Date: Fri Oct 24 17:54:39 2025 +0200 netfilter: nft_connlimit: fix possible data race on connection count nft_connlimit_eval() reads priv->list->count to check if the connection limit has been exceeded. This value is being read without a lock and can be modified by a different process. Use READ_ONCE() for correctness. Fixes: df4a90250976 ("netfilter: nf_conncount: merge lookup and add functions") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 514f1dc8f2ca3101e04cdf452e53baca3a76e544 Author: Florian Westphal Date: Wed Oct 22 17:18:10 2025 +0200 netfilter: nft_ct: enable labels for get case too conntrack labels can only be set when the conntrack has been created with the "ctlabel" extension. For older iptables (connlabel match), adding an "-m connlabel" rule turns on the ctlabel extension allocation for all future conntrack entries. For nftables, its only enabled for 'ct label set foo', but not for 'ct label foo' (i.e. check). But users could have a ruleset that only checks for presence, and rely on userspace to set a label bit via ctnetlink infrastructure. This doesn't work without adding a dummy 'ct label set' rule. We could also enable extension infra for the first (failing) ctnetlink request, but unlike ruleset we would not be able to disable the extension again. Therefore turn on ctlabel extension allocation if an nftables ruleset checks for a connlabel too. Fixes: 1ad8f48df6f6 ("netfilter: nftables: add connlabel set support") Reported-by: Antonio Ojea Closes: https://lore.kernel.org/netfilter-devel/aPi_VdZpVjWujZ29@strlen.de/ Signed-off-by: Florian Westphal commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 Author: Tetsuo Handa Date: Thu Oct 23 22:25:49 2025 +0900 bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory). Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Signed-off-by: Tetsuo Handa Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp Reviewed-by: Tigran Aivazian Signed-off-by: Christian Brauner commit 07ad45e06b4039adf96882aefcb1d3299fb7c305 Author: Miaoqian Lin Date: Mon Oct 27 23:08:38 2025 +0800 s390/mm: Fix memory leak in add_marker() when kvrealloc() fails The function has a memory leak when kvrealloc() fails. The function directly assigns NULL to the markers pointer, losing the reference to the previously allocated memory. This causes kvfree() in pt_dump_init() to free NULL instead of the leaked memory. Fix by: 1. Using kvrealloc() uniformly for all allocations 2. Using a temporary variable to preserve the original pointer until allocation succeeds 3. Removing the error path that sets markers_cnt=0 to keep consistency between markers and markers_cnt Found via static analysis and this is similar to commit 42378a9ca553 ("bpf, verifier: Fix memory leak in array reallocation for stack state") Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Heiko Carstens commit e7dbfe6f15b4df34bb169d180bd10f1a3c043814 Author: Heikki Krogerus Date: Wed Oct 29 07:50:20 2025 +0100 spi: intel: Add support for Oak Stream SPI serial flash Add Oak Stream PCI ID to the driver list of supported devices. This patch was originally written by Zeng Guang. Signed-off-by: Heikki Krogerus Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251029065020.2920213-1-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 330e2c514823008b22e6afd2055715bc46dd8d55 Author: David Howells Date: Wed Oct 22 19:48:32 2025 +0100 afs: Fix dynamic lookup to fail on cell lookup failure When a process tries to access an entry in /afs, normally what happens is that an automount dentry is created by ->lookup() and then triggered, which jumps through the ->d_automount() op. Currently, afs_dynroot_lookup() does not do cell DNS lookup, leaving that to afs_d_automount() to perform - however, it is possible to use access() or stat() on the automount point, which will always return successfully, have briefly created an afs_cell record if one did not already exist. This means that something like: test -d "/afs/.west" && echo Directory exists will print "Directory exists" even though no such cell is configured. This breaks the "west" python module available on PIP as it expects this access to fail. Now, it could be possible to make afs_dynroot_lookup() perform the DNS[*] lookup, but that would make "ls --color /afs" do this for each cell in /afs that is listed but not yet probed. kafs-client, probably wrongly, preloads the entire cell database and all the known cells are then listed in /afs - and doing ls /afs would be very, very slow, especially if any cell supplied addresses but was wholly inaccessible. [*] When I say "DNS", actually read getaddrinfo(), which could use any one of a host of mechanisms. Could also use static configuration. To fix this, make the following changes: (1) Create an enum to specify the origination point of a call to afs_lookup_cell() and pass this value into that function in place of the "excl" parameter (which can be derived from it). There are six points of origination: - Cell preload through /proc/net/afs/cells - Root cell config through /proc/net/afs/rootcell - Lookup in dynamic root - Automount trigger - Direct mount with mount() syscall - Alias check where YFS tells us the cell name is different (2) Add an extra state into the afs_cell state machine to indicate a cell that's been initialised, but not yet looked up. This is separate from one that can be considered active and has been looked up at least once. (3) Make afs_lookup_cell() vary its behaviour more, depending on where it was called from: If called from preload or root cell config, DNS lookup will not happen until we definitely want to use the cell (dynroot mount, automount, direct mount or alias check). The cell will appear in /afs but stat() won't trigger DNS lookup. If the cell already exists, dynroot will not wait for the DNS lookup to complete. If the cell did not already exist, dynroot will wait. If called from automount, direct mount or alias check, it will wait for the DNS lookup to complete. (4) Make afs_lookup_cell() return an error if lookup failed in one way or another. We try to return -ENOENT if the DNS says the cell does not exist and -EDESTADDRREQ if we couldn't access the DNS. Reported-by: Markus Suvanto Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220685 Signed-off-by: David Howells Link: https://patch.msgid.link/1784747.1761158912@warthog.procyon.org.uk Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand") Tested-by: Markus Suvanto cc: Marc Dionne cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner commit f4c12e5cefc8ec2eda93bc17ea734407228449ab Author: dongsheng Date: Mon Sep 8 14:16:39 2025 +0800 perf/x86/intel/uncore: Add uncore PMU support for Wildcat Lake WildcatLake (WCL) is a variant of PantherLake (PTL) and shares the same uncore PMU features with PTL. Therefore, directly reuse Pantherlake's uncore PMU enabling code for WildcatLake. Signed-off-by: dongsheng Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20250908061639.938105-2-dapeng1.mi@linux.intel.com commit b796a8feb7cb094ee998931a96cd6152a9d3022e Author: Dapeng Mi Date: Mon Sep 8 14:16:38 2025 +0800 perf/x86/intel: Add PMU support for WildcatLake WildcatLake is a variant of PantherLake and shares same PMU features, so directly reuse Pantherlake's code to enable PMU features for WildcatLake. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zide Chen Link: https://patch.msgid.link/20250908061639.938105-1-dapeng1.mi@linux.intel.com commit 0ba6502ce167fc3d598c08c2cc3b4ed7ca5aa251 Author: Dapeng Mi Date: Tue Oct 28 14:42:14 2025 +0800 perf/x86/intel: Fix KASAN global-out-of-bounds warning When running "perf mem record" command on CWF, the below KASAN global-out-of-bounds warning is seen. ================================================================== BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 Call Trace: kasan_report+0xb8/0xf0 cmt_latency_data+0x176/0x1b0 setup_arch_pebs_sample_data+0xf49/0x2560 intel_pmu_drain_arch_pebs+0x577/0xb00 handle_pmi_common+0x6c4/0xc80 The issue is caused by below code in __grt_latency_data(). The code tries to access x86_hybrid_pmu structure which doesn't exist on non-hybrid platform like CWF. WARN_ON_ONCE(hybrid_pmu(event->pmu)->pmu_type == hybrid_big) So add is_hybrid() check before calling this WARN_ON_ONCE to fix the global-out-of-bounds access issue. Fixes: 090262439f66 ("perf/x86/intel: Rename model-specific pebs_latency_data functions") Reported-by: Xudong Hao Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zide Chen Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251028064214.1451968-1-dapeng1.mi@linux.intel.com commit 23ee8a2563a0f24cf4964685ced23c32be444ab8 Author: Qinxin Xia Date: Tue Oct 28 20:08:59 2025 +0800 dma-mapping: benchmark: Restore padding to ensure uABI remained consistent The padding field in the structure was previously reserved to maintain a stable interface for potential new fields, ensuring compatibility with user-space shared data structures. However,it was accidentally removed by tiantao in a prior commit, which may lead to incompatibility between user space and the kernel. This patch reinstates the padding to restore the original structure layout and preserve compatibility. Fixes: 8ddde07a3d28 ("dma-mapping: benchmark: extract a common header file for map_benchmark definition") Cc: stable@vger.kernel.org Acked-by: Barry Song Signed-off-by: Qinxin Xia Reported-by: Barry Song Closes: https://lore.kernel.org/lkml/CAGsJ_4waiZ2+NBJG+SCnbNk+nQ_ZF13_Q5FHJqZyxyJTcEop2A@mail.gmail.com/ Reviewed-by: Jonathan Cameron Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251028120900.2265511-2-xiaqinxin@huawei.com commit 8df206f7b63611dbaeb8628661d87fe994dcdf71 Merge: 40c17a02de41f1 7e2958aee59ceb Author: Jakub Kicinski Date: Tue Oct 28 19:11:07 2025 -0700 Merge branch 'bug-fixes-for-the-hibmcge-ethernet-driver' Jijie Shao says: ==================== bug fixes for the hibmcge ethernet driver This patch set is intended to fix several issues for hibmcge driver: 1. Patch1 fixes the issue where buf avl irq is disabled after irq_handle. 2. Patch2 eliminates the error logs in scenarios without phy. 3. Patch3 fixes the issue where the network port becomes unusable after a PCIe RAS event. ==================== Link: https://patch.msgid.link/20251025014642.265259-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 7e2958aee59ceb30ef153387741d12385b712250 Author: Jijie Shao Date: Sat Oct 25 09:46:42 2025 +0800 net: hibmcge: fix the inappropriate netif_device_detach() current, driver will call netif_device_detach() in pci_error_handlers.error_detected() and do reset in pci_error_handlers.slot_reset(). However, if pci_error_handlers.slot_reset() is not called after pci_error_handlers.error_detected(), driver will be detached and unable to recover. drivers/pci/pcie/err.c/report_error_detected() says: If any device in the subtree does not have an error_detected callback, PCI_ERS_RESULT_NO_AER_DRIVER prevents subsequent error callbacks of any device in the subtree, and will exit in the disconnected error state. Therefore, when the hibmcge device and other devices that do not support the error_detected callback are under the same subtree, hibmcge will be unable to do slot_reset even for non-fatal errors. This path move netif_device_detach() from error_detected() to slot_reset(), ensuring that detach and reset are always executed together. Fixes: fd394a334b1c ("net: hibmcge: Add support for abnormal irq handling feature") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251025014642.265259-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 71eb8d1e07562b43bebc0c2721699814b43fd83d Author: Jijie Shao Date: Sat Oct 25 09:46:41 2025 +0800 net: hibmcge: remove unnecessary check for np_link_fail in scenarios without phy. hibmcge driver uses fixed_phy to configure scenarios without PHY, where the driver is always in a linked state. However, there might be no link in hardware, so the np_link error is detected in hbg_hw_adjust_link(), which can cause abnormal logs. Therefore, in scenarios without a PHY, the driver no longer checks the np_link status. Fixes: 1d7cd7a9c69c ("net: hibmcge: support scenario without PHY") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251025014642.265259-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 12d2303db892d397373e2af40758cbd97309ec37 Author: Jijie Shao Date: Sat Oct 25 09:46:40 2025 +0800 net: hibmcge: fix rx buf avl irq is not re-enabled in irq_handle issue irq initialized with the macro HBG_ERR_IRQ_I will automatically be re-enabled, whereas those initialized with the macro HBG_IRQ_I will not be re-enabled. Since the rx buf avl irq is initialized using the macro HBG_IRQ_I, it needs to be actively re-enabled; otherwise priv->stats.rx_fifo_less_empty_thrsld_cnt cannot be correctly incremented. Fixes: fd394a334b1c ("net: hibmcge: Add support for abnormal irq handling feature") Signed-off-by: Jijie Shao Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251025014642.265259-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 40c17a02de41f12dd713309c7d2546117c577d29 Author: Ivan Vecera Date: Mon Oct 27 15:09:12 2025 +0100 dpll: zl3073x: Fix output pin registration Currently, the signal format of an associated output is not considered during output pin registration. As a result, the driver registers output pins that are disabled by the signal format configuration. Fix this by calling zl3073x_output_pin_is_enabled() to check whether a given output pin should be registered or not. Fixes: 75a71ecc2412 ("dpll: zl3073x: Register DPLL devices and pins") Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251027140912.233152-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit d8d2b1f81530988abe2e2bfaceec1c5d30b9a0b4 Author: Pavel Zhigulin Date: Fri Oct 24 19:13:02 2025 +0300 net: cxgb4/ch_ipsec: fix potential use-after-free in ch_ipsec_xfrm_add_state() callback In ch_ipsec_xfrm_add_state() there is not check of try_module_get return value. It is very unlikely, but try_module_get() could return false value, which could cause use-after-free error. Conditions: The module count must be zero, and a module unload in progress. The thread doing the unload is blocked somewhere. Another thread makes a callback into the module for some request that (for instance) would need to create a kernel thread. It tries to get a reference for the thread. So try_module_get(THIS_MODULE) is the right call - and will fail here. This fix adds checking the result of try_module_get call Fixes: 6dad4e8ab3ec ("chcr: Add support for Inline IPSec") Signed-off-by: Pavel Zhigulin Link: https://patch.msgid.link/20251024161304.724436-1-Pavel.Zhigulin@kaspersky.com Signed-off-by: Jakub Kicinski commit e53642b87a4f4b03a8d7e5f8507fc3cd0c595ea6 Merge: 8eefed8f65cc17 f574069c5c55eb Author: Linus Torvalds Date: Tue Oct 28 18:00:40 2025 -0700 Merge tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Improve check for malformed payload - Fix free transport smbdirect potential race - Fix potential race in credit allocation during smbdirect negotiation * tag 'v6.18-rc3-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work() smb: server: call smb_direct_post_recv_credits() when the negotiation is done ksmbd: transport_ipc: validate payload size before reading handle commit 36fedc44e37e811f25666c600bce4bc027290226 Author: Petr Oros Date: Fri Oct 24 21:07:33 2025 +0200 dpll: fix device-id-get and pin-id-get to return errors properly The device-id-get and pin-id-get handlers were ignoring errors from the find functions and sending empty replies instead of returning error codes to userspace. When dpll_device_find_from_nlattr() or dpll_pin_find_from_nlattr() returned an error (e.g., -EINVAL for "multiple matches" or -ENODEV for "not found"), the handlers checked `if (!IS_ERR(ptr))` and skipped adding the device/pin handle to the message, but then still sent the empty message as a successful reply. This caused userspace tools to receive empty responses with id=0 instead of proper netlink errors with extack messages like "multiple matches". The bug is visible via strace, which shows the kernel sending TWO netlink messages in response to a single request: 1. Empty reply (20 bytes, just header, no attributes): recvfrom(3, [{nlmsg_len=20, nlmsg_type=dpll, nlmsg_flags=0, ...}, {cmd=0x7, version=1}], ...) 2. NLMSG_ERROR ACK with extack (because of NLM_F_ACK flag): recvfrom(3, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED|NLM_F_ACK_TLVS, ...}, [{error=0, msg={...}}, [{nla_type=NLMSGERR_ATTR_MSG}, "multiple matches"]]], ...) The C YNL library parses the first message, sees an empty response, and creates a result object with calloc() which zero-initializes all fields, resulting in id=0. The Python YNL library parses both messages and displays the extack from the second NLMSG_ERROR message. Fix by checking `if (IS_ERR(ptr))` first and returning the error code immediately, so that netlink properly sends only NLMSG_ERROR with the extack message to userspace. After this fix, both C and Python YNL tools receive only the NLMSG_ERROR and behave consistently. This affects: - DPLL_CMD_DEVICE_ID_GET: now properly returns error when multiple devices match the criteria (e.g., same module-name + clock-id) - DPLL_CMD_PIN_ID_GET: now properly returns error when multiple pins match the criteria (e.g., same module-name) Before fix: $ dpll pin id-get module-name ice 0 (wrong - should be error, there are 17 pins with module-name "ice") After fix: $ dpll pin id-get module-name ice Error: multiple matches (correct - kernel reports the ambiguity via extack) Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Link: https://patch.msgid.link/20251024190733.364101-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit f5d079564c44baaeedf5e25f4b943aa042ea0eb1 Author: Jessica Zhang Date: Tue Sep 23 16:03:50 2025 -0700 drm/msm/dpu: Fix adjusted mode clock check for 3d merge Since 3D merge allows for larger modes to be supported across 2 layer mixers, filter modes based on adjusted mode clock / 2 when 3d merge is supported. Reported-by: Abel Vesa Fixes: 62b7d6835288 ("drm/msm/dpu: Filter modes based on adjusted mode clock") Signed-off-by: Jessica Zhang Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Tested-by: Abel Vesa Tested-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/676353/ Link: https://lore.kernel.org/r/20250923-modeclk-fix-v2-1-01fcd0b2465a@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit bbc65d1bde821750c48ac075057be548e38d77cc Author: Vladimir Lypak Date: Sat Oct 18 14:33:43 2025 +0000 drm/msm/dpu: Disable broken YUV on QSEED2 hardware YUV formats on this hardware needs scaling for chroma planes. However it is not implemented for QSEED2 which breaks display pipeline if YUV format is used (causing partial and corrupted output with PPDONE timeouts). This patch temporarily disables YUV by switching affected sub-block to RGB only format list. Fixes: daf9a92daeb8 ("drm/msm/dpu: Add support for MSM8996") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/682061/ Link: https://lore.kernel.org/r/20251018-b4-dpu-fixes-v1-6-1852278064d0@gmail.com Signed-off-by: Dmitry Baryshkov commit 5e0656b125346d9a1ef65e72c6d3196b8ea6b1e1 Author: Vladimir Lypak Date: Fri Oct 17 19:58:39 2025 +0000 drm/msm/dpu: Require linear modifier for writeback framebuffers UBWC-related register configuration for writeback is not implemented in the driver yet but there aren't any checks for non-linear modifiers in atomic_check. Thus when compressed framebuffer is attached to writeback connector it will be filled with linear image data. This patch forbids non-linear modifiers for writeback framebuffers until UBWC support for writeback is properly implemented. Fixes: 71174f362d67 ("drm/msm/dpu: move writeback's atomic_check to dpu_writeback.c") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681922/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-5-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 2f8bed9175429294860276b897de53d49ed647d8 Author: Vladimir Lypak Date: Fri Oct 17 19:58:38 2025 +0000 drm/msm/dpu: Fix pixel extension sub-sampling In _dpu_plane_setup_pixel_ext function instead of dividing just chroma source resolution once (component 1 and 2), second component is divided once more because src_w and src_h variable is reused between iterations. Third component receives wrong source resolution too (from component 2). To fix this introduce temporary variables for each iteration. Fixes: dabfdd89eaa9 ("drm/msm/disp/dpu1: add inline rotation support for sc7280") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681921/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-4-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 425da3305972a7bab9812770d44e2f7f97f8bfd6 Author: Vladimir Lypak Date: Fri Oct 17 19:58:37 2025 +0000 drm/msm/dpu: Disable scaling for unsupported scaler types Scaling is not implemented for some type of scalers (QSEED2 and RGB) but it was unintentionally re-enabled with change below. The remaining condition in dpu_plane_atomic_check_pipe is not enough because it only checks for length of scaler block (which is present). This patch adds a additional check for setup_scaler operation. Fixes: 8f15005783b8 ("drm/msm/dpu: move scaling limitations out of the hw_catalog") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681918/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-3-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 23ab0d6228bf9de6cf69db330f95a1938b276693 Author: Vladimir Lypak Date: Fri Oct 17 19:58:36 2025 +0000 drm/msm/dpu: Propagate error from dpu_assign_plane_resources The dpu_plane_virtual_assign_resources function might fail if there is no suitable SSPP(s) for the plane. This leaves sspp field in plane state uninitialized and later leads to NULL dereference during commit: Call trace: _dpu_crtc_blend_setup+0x194/0x620 [msm] (P) dpu_crtc_atomic_begin+0xe4/0x240 [msm] drm_atomic_helper_commit_planes+0x88/0x358 msm_atomic_commit_tail+0x1b4/0x8b8 [msm] commit_tail+0xa8/0x1b0 drm_atomic_helper_commit+0x180/0x1a0 drm_atomic_commit+0x94/0xe0 drm_mode_atomic_ioctl+0xa88/0xd60 drm_ioctl_kernel+0xc4/0x138 drm_ioctl+0x364/0x4f0 __arm64_sys_ioctl+0xac/0x108 invoke_syscall.constprop.0+0x48/0x100 el0_svc_common.constprop.0+0x40/0xe8 do_el0_svc+0x24/0x38 el0_svc+0x30/0xe0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Fixes: 3ed12a3664b3 ("drm/msm/dpu: allow sharing SSPP between planes") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681916/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-2-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 2319551e97f0cd9b4a7b78c1a6970aa4b785000b Author: Vladimir Lypak Date: Fri Oct 17 19:58:35 2025 +0000 drm/msm/dpu: Fix allocation of RGB SSPPs without scaling Due to condition in dpu_rm_reserve_sspp, RGB SSPPs are only tried when scaling is requested, which prevents those SSPPs from being reserved if we don't need scaling at all. Instead we should check if YUV support is requested, since scaling on RGB SSPPs is optional and is not implemented in driver yet. Fixes: 774bcfb73176 ("drm/msm/dpu: add support for virtual planes") Signed-off-by: Vladimir Lypak Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/681914/ Link: https://lore.kernel.org/r/20251017-b4-dpu-fixes-v1-1-40ce5993eeb6@gmail.com Signed-off-by: Dmitry Baryshkov commit 93c97bc8d85d5742d6f000d8bf3eeeb705bc6082 Author: Neil Armstrong Date: Mon Oct 27 14:09:48 2025 +0100 drm/msm: dsi: fix PLL init in bonded mode When in bonded DSI mode, only one PLL in one DSI PHY is used for both DSI PHYs, meaning that parents of the secondary DSI PHY will use the primary DSI PHY PLL as parent. In this case the primary DSI PHY PLL will be set even if the primary DSI PHY is not yet enabled. The DSI PHY code has support for this particular use-case and will handle the fact the PLL was already set when initializing the primary DSI PHY. By introducing a protected variable pll_enable_cnt in the commit cb55f39bf7b1 ("drm/msm/dsi/phy: Fix reading zero as PLL rates when unprepared"), this variable is only initially set to 1 when the DSI PHY is initialized making it impossible to set the PLL before, breaking the bonded DSI use case by returning 0 when setting the PLL from the secondary DSI PHY driver and skipping the correct clocks initialization. But since it was already possible to set the PLL without enabling the DSI PHY, just drop the pll_enable_cnt setting from the PHY enable/disable and simply increment/decrement the pll_enable_cnt variable from the dsi_pll_enable/disable_pll_bias to make sure any PLL operation is done with the PLL BIAS enabled. Fixes: cb55f39bf7b1 ("drm/msm/dsi/phy: Fix reading zero as PLL rates when unprepared") Closes: https://lore.kernel.org/all/50a49d72-2b1e-471d-b0c4-d5a0b38b2a21@linaro.org/ Tested-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/683688/ Link: https://lore.kernel.org/r/20251027-topic-sm8x50-fix-dsi-bonded-v1-1-a477cd3f907d@linaro.org Signed-off-by: Dmitry Baryshkov commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b Author: Daniel Palmer Date: Fri Oct 24 18:37:15 2025 +0900 fbdev: atyfb: Check if pll_ops->init_pll failed Actually check the return value from pll_ops->init_pll() as it can return an error. If the card's BIOS didn't run because it's not the primary VGA card the fact that the xclk source is unsupported is printed as shown below but the driver continues on regardless and on my machine causes a hard lock up. [ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083) [ 61.476191] atyfb: using auxiliary register aperture [ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27] [ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK [ 61.496112] atyfb: Unsupported xclk source: 5. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Daniel Palmer Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 Author: Quanmin Yan Date: Fri Oct 10 16:16:59 2025 +0800 fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL. Signed-off-by: Quanmin Yan Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 18c4ef4e765a798b47980555ed665d78b71aeadf Author: Junjie Cao Date: Mon Oct 20 21:47:01 2025 +0800 fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2 Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Signed-off-by: Junjie Cao Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 Author: Florian Fuchs Date: Sun Oct 26 00:38:50 2025 +0200 fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully with CONFIG_PVR2_DMA enabled. Signed-off-by: Florian Fuchs Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 Author: Miaoqian Lin Date: Mon Oct 27 16:43:37 2025 +0800 fbdev: valkyriefb: Fix reference count leak in valkyriefb_init The of_find_node_by_name() function returns a device tree node with its reference count incremented. The caller is responsible for calling of_node_put() to release this reference when done. Found via static analysis. Fixes: cc5d0189b9ba ("[PATCH] powerpc: Remove device_node addrs/n_addr") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller commit 18cd0a9c7aaf880502e4aff3ea30022f97d6c103 Author: PIYUSH CHOUDHARY Date: Mon Oct 20 00:05:08 2025 +0530 video: fb: Fix typo in comment in fb.h Fix typo: "verical" -> "vertical" in macro description Signed-off-by: PIYUSH CHOUDHARY Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 2cbb259ec4f8e12dade80b388b81d41fa22187d2 Author: Daniel Borkmann Date: Thu Oct 23 14:55:32 2025 +0200 bpf: Reject negative head_room in __bpf_skb_change_head Yinhao et al. recently reported: Our fuzzing tool was able to create a BPF program which triggered the below BUG condition inside pskb_expand_head. [ 23.016047][T10006] kernel BUG at net/core/skbuff.c:2232! [...] [ 23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530 [...] [ 23.021249][T10006] Call Trace: [ 23.021387][T10006] [ 23.021507][T10006] ? __pfx_pskb_expand_head+0x10/0x10 [ 23.021725][T10006] __bpf_skb_change_head+0x22a/0x520 [ 23.021939][T10006] bpf_skb_change_head+0x34/0x1b0 [ 23.022143][T10006] ___bpf_prog_run+0xf70/0xb670 [ 23.022342][T10006] __bpf_prog_run32+0xed/0x140 [...] The problem is that in __bpf_skb_change_head() we need to reject a negative head_room as otherwise this propagates all the way to the pskb_expand_head() from skb_cow(). For example, if the BPF test infra passes a skb with gso_skb:1 to the BPF helper with a negative head_room of -22, then this gets passed into skb_cow(). __skb_cow() in this example calculates a delta of -86 which gets aligned to -64, and then triggers BUG_ON(nhead < 0). Thus, reject malformed negative input. Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: Daniel Borkmann Signed-off-by: Martin KaFai Lau Reviewed-by: Dongliang Mu Link: https://patch.msgid.link/20251023125532.182262-1-daniel@iogearbox.net commit de8d1f2fd5a510bf2c1c25b84e1a718a0f0af105 Author: Alex Mastro Date: Tue Oct 28 09:15:04 2025 -0700 vfio: selftests: add end of address space DMA map/unmap tests Add tests which validate dma map/unmap at the end of address space. Add negative test cases for checking that overflowing ioctl args fail with the expected errno. Reviewed-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-5-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 16950b60c19b9137eb8bfeb298621e803e98dcc7 Author: Alex Mastro Date: Tue Oct 28 09:15:03 2025 -0700 vfio: selftests: update DMA map/unmap helpers to support more test kinds Add __vfio_pci_dma_*() helpers which return -errno from the underlying ioctls. Add __vfio_pci_dma_unmap_all() to test more unmapping code paths. Add an out unmapped arg to report the unmapped byte size. The existing vfio_pci_dma_*() functions, which are intended for happy-path usage (assert on failure) are now thin wrappers on top of the double-underscore helpers. Reviewed-by: David Matlack Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-4-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit ef270ec44637d464126bd4ade483c4a1887e06bc Author: Alex Mastro Date: Tue Oct 28 09:15:02 2025 -0700 vfio/type1: handle DMA map/unmap up to the addressable limit Before this commit, it was possible to create end of address space mappings, but unmapping them via VFIO_IOMMU_UNMAP_DMA, replaying them for newly added iommu domains, and querying their dirty pages via VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP was broken due to bugs caused by comparisons against (iova + size) expressions, which overflow to zero. Additionally, there appears to be a page pinning leak in the vfio_iommu_type1_release() path, since vfio_unmap_unpin()'s loop body where unmap_unpin_*() are called will never be entered due to overflow of (iova + size) to zero. This commit handles DMA map/unmap operations up to the addressable limit by comparing against inclusive end-of-range limits, and changing iteration to perform relative traversals across range sizes, rather than absolute traversals across addresses. vfio_link_dma() inserts a zero-sized vfio_dma into the rb-tree, and is only used for that purpose, so discard the size from consideration for the insertion point. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-3-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 1196f1f897d4ee64d8844e8cfa97c8f93e4d158c Author: Alex Mastro Date: Tue Oct 28 09:15:01 2025 -0700 vfio/type1: move iova increment to unmap_unpin_*() caller Move incrementing iova to the caller of these functions as part of preparing to handle end of address space map/unmap. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-2-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit 6012379ede6aa7477db6276bb9876fe7d67c4312 Author: Alex Mastro Date: Tue Oct 28 09:15:00 2025 -0700 vfio/type1: sanitize for overflow using check_*_overflow() Adopt check_*_overflow() functions to clearly express overflow check intent. Tested-by: Alejandro Jimenez Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Reviewed-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Alex Mastro Link: https://lore.kernel.org/r/20251028-fix-unmap-v6-1-2542b96bcc8e@fb.com Signed-off-by: Alex Williamson commit dc8aa0cb87a7836b59422cc02d969c8df849ee39 Author: Ville Syrjälä Date: Wed Oct 22 13:07:16 2025 +0300 drm/i915/dmc: Clear HRR EVT_CTL/HTP to zero on ADL-S On ADL-S the main DMC HRR event DMC_EVT_CTL/HTP are never restored to their previous values during DC6 exit. This angers assert_dmc_loaded(), and basically makes the HRR handler unusable because we don't rewrite EVT_HTP when enabling DMC events. Let's just clear the HRR EVT_CTL/HTP to zero from the beginnning so that the expected value matches the post-DC6 reality. I suppose if we ever had actual use for HRR we'd have to both, reject HRR+PSR, and reprogram EVT_HTP when enabling the event. But for now we don't care about HRR so keeping both registers zeroed is fine. Cc: stable@vger.kernel.org Tested-by: Petr Vorel Fixes: 43175c92d403 ("drm/i915/dmc: Assert DMC is loaded harder") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15153 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251022100718.24803-2-ville.syrjala@linux.intel.com Reviewed-by: Petr Vorel Reviewed-by: Imre Deak Tested-by: Imre Deak (cherry picked from commit 4df3b340ff6e9f499735d8b52b96a9257fde3918) Signed-off-by: Rodrigo Vivi commit f82acf6fb42115c87d3809968a2e0ab2fedba15b Author: Kohei Enju Date: Mon Oct 6 21:35:23 2025 +0900 ixgbe: use EOPNOTSUPP instead of ENOTSUPP in ixgbe_ptp_feature_enable() When the requested PTP feature is not supported, ixgbe_ptp_feature_enable() returns -ENOTSUPP, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 3a6a4edaa592 ("ixgbe: Hardware Timestamping + PTP Hardware Clock (PHC)") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 21d08d1c4c29f9795fbc678011c85f72931e22c1 Author: Kohei Enju Date: Mon Oct 6 21:35:22 2025 +0900 igc: use EOPNOTSUPP instead of ENOTSUPP in igc_ethtool_get_sset_count() igc_ethtool_get_sset_count() returns -ENOTSUPP when a given stringset is not supported, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 36b9fea60961 ("igc: Add support for statistics") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit bc73c5885c606f5e48dd4222eba0361fa0f146ca Author: Kohei Enju Date: Mon Oct 6 21:35:21 2025 +0900 igb: use EOPNOTSUPP instead of ENOTSUPP in igb_get_sset_count() igb_get_sset_count() returns -ENOTSUPP when a given stringset is not supported, causing userland programs to get "Unknown error 524". Since EOPNOTSUPP should be used when error is propagated to userland, return -EOPNOTSUPP instead of -ENOTSUPP. Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 81fb1fe75c672db905b54f4ab744552121099a24 Author: Kohei Enju Date: Sat Sep 20 15:39:18 2025 +0900 igc: power up the PHY before the link test The current implementation of the igc driver doesn't power up the PHY before the link test in igc_ethtool_diag_test(), causing the link test to always report FAIL when admin state is down and the PHY is consequently powered down. To test the link state regardless of admin state, power up the PHY before the link test in the offline test path. After the link test, the original PHY state is restored by igc_reset(), so additional code which explicitly restores the original state is not necessary. Note that this change is applied only for the offline test path. This is because in the online path we shouldn't interrupt normal networking operation and powering up the PHY and restoring the original state would interrupt that. This implementation also uses igc_power_up_phy_copper() without checking the media type, since igc devices are currently only copper devices and the function is called in other places without checking the media type. Furthermore, the powering up is on a best-effort basis, that is, we don't handle failures of powering up (e.g. bus error) and just let the test report FAIL. Tested on Intel Corporation Ethernet Controller I226-V (rev 04) with cable connected and link available. Set device down and do ethtool test. # ip link set dev enp0s5 down Without patch: # ethtool --test enp0s5 The test result is FAIL The test extra info: Register test (offline) 0 Eeprom test (offline) 0 Interrupt test (offline) 0 Loopback test (offline) 0 Link test (on/offline) 1 With patch: # ethtool --test enp0s5 The test result is PASS The test extra info: Register test (offline) 0 Eeprom test (offline) 0 Interrupt test (offline) 0 Loopback test (offline) 0 Link test (on/offline) 0 Fixes: f026d8ca2904 ("igc: add support to eeprom, registers and link self-tests") Signed-off-by: Kohei Enju Reviewed-by: Vitaly Lifshits Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 85308d999c4b4162a742c9ec5ef954226c3b48d9 Author: Kohei Enju Date: Mon Sep 1 05:33:11 2025 +0900 ixgbe: fix memory leak and use-after-free in ixgbe_recovery_probe() The error path of ixgbe_recovery_probe() has two memory bugs. For non-E610 adapters, the function jumps to clean_up_probe without calling devlink_free(), leaking the devlink instance and its embedded adapter structure. For E610 adapters, devlink_free() is called at shutdown_aci, but clean_up_probe then accesses adapter->state, sometimes triggering use-after-free because adapter is embedded in devlink. This UAF is similar to the one recently reported in ixgbe_remove(). (Link) Fix both issues by moving devlink_free() after adapter->state access, aligning with the cleanup order in ixgbe_probe(). Link: https://lore.kernel.org/intel-wired-lan/20250828020558.1450422-1-den@valinux.co.jp/ Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Jedrzej Jagielski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 9a0f81fc64b2ba80ce768cd6e680c0f440723464 Author: Grzegorz Nitka Date: Wed Oct 8 12:28:53 2025 +0200 ice: fix usage of logical PF id In some devices, the function numbers used are non-contiguous. For example, here is such configuration for E825 device: root@/home/root# lspci -v | grep Eth 0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04) 0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection E825-C for backplane (rev 04) 0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04) 0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection E825-C 10GbE (rev 04) When distributing RSS and FDIR masks, which are global resources across the active devices, it is required to have a contiguous PF id, which can be described as a logical PF id. In the case above, function 0 would have a logical PF id of 0, function 1 would have a logical PF id of 1, and functions 4 and 5 would have a logical PF ids 2 and 3 respectively. Using logical PF id can properly describe which slice of resources can be used by a particular PF. The 'function id' to 'logical id' mapping has been introduced with the commit 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration"). However, the usage of 'logical_pf_id' field was unintentionally skipped for profile mask configuration. Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring masks. Without that patch, wrong indexes, i.e. out of range for given PF, can be used while configuring resources masks, which might lead to memory corruption and undefined driver behavior. The call trace below is one of the examples of such error: [ +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095 devm_kfree+0x70/0xa0 [ +0.000002] RIP: 0010:devm_kfree+0x70/0xa0 [ +0.000001] Call Trace: [ +0.000002] [ +0.000002] ice_free_hw_tbls+0x183/0x710 [ice] [ +0.000106] ice_deinit_hw+0x67/0x90 [ice] [ +0.000091] ice_deinit+0x20d/0x2f0 [ice] [ +0.000076] ice_remove+0x1fa/0x6a0 [ice] [ +0.000075] pci_device_remove+0xa7/0x1d0 [ +0.000010] device_release_driver_internal+0x365/0x530 [ +0.000006] driver_detach+0xbb/0x170 [ +0.000003] bus_remove_driver+0x117/0x290 [ +0.000007] pci_unregister_driver+0x26/0x250 Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration") Suggested-by: Dan Nowlin Signed-off-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 45076413063cf5e0e25fd3f7f89fc90338b161c8 Author: Grzegorz Nitka Date: Mon Sep 29 17:29:05 2025 +0200 ice: fix destination CGU for dual complex E825 On dual complex E825, only complex 0 has functional CGU (Clock Generation Unit), powering all the PHYs. SBQ (Side Band Queue) destination device 'cgu' in current implementation points to CGU on current complex and, in order to access primary CGU from the secondary complex, the driver should use 'cgu_peer' as a destination device in read/write CGU registers operations. Define new 'cgu_peer' (15) as RDA (Remote Device Access) client over SB-IOSF interface and use it as device target when accessing CGU from secondary complex. This problem has been identified when working on recovery clock enablement [1]. In existing implementation for E825 devices, only PF0, which is clock owner, is involved in CGU configuration, thus the problem was not exposed to the user. [1] https://lore.kernel.org/intel-wired-lan/20250905150947.871566-1-grzegorz.nitka@intel.com/ Fixes: e2193f9f9ec9 ("ice: enable timesync operation on 2xNAC E825 devices") Signed-off-by: Grzegorz Nitka Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e9840461317e1bf0628b164de54632754d5f6a44 Author: Grzegorz Nitka Date: Fri Feb 21 10:39:49 2025 +0100 ice: fix lane number calculation E82X adapters do not have sequential IDs, lane number is PF ID. Add check for ICE_MAC_GENERIC and skip checking port options. Also, adjust logical port number for specific E825 device with external PHY support (PCI device id 0x579F). For this particular device, with 2x25G (PHY0) and 2x10G (PHY1) port configuration, modification of pf_id -> lane_number mapping is required. PF IDs on the 2nd PHY start from 4 in such scenario. Otherwise, the lane number cannot be determined correctly, leading to PTP init errors during PF initialization. Fixes: 258f5f9058159 ("ice: Add correct PHY lane assignment") Co-developed-by: Karol Kolacinski Signed-off-by: Karol Kolacinski Signed-off-by: Grzegorz Nitka Reviewed-by: Przemek Kitszel Reviewed-by: Milena Olech Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0d6e9ec80cebf9b378a1d3a01144e576d731c397 Author: Peter Zijlstra Date: Mon Oct 27 12:40:59 2025 +0100 x86/build: Disable SSE4a Leyvi Rose reported that his X86_NATIVE_CPU=y build is failing because our instruction decoder doesn't support SSE4a and the AMDGPU code seems to be generating those with his compiler of choice (CLANG+LTO). Now, our normal build flags disable SSE MMX SSE2 3DNOW AVX, but then CC_FLAGS_FPU re-enable SSE SSE2. Since nothing mentions SSE3 or SSE4, I'm assuming that -msse (or its negative) control all SSE variants -- but why then explicitly enumerate SSE2 ? Anyway, until the instruction decoder gets fixed, explicitly disallow SSE4a (an AMD specific SSE4 extension). Fixes: ea1dcca1de12 ("x86/kbuild/64: Add the CONFIG_X86_NATIVE_CPU option to locally optimize the kernel with '-march=native'") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Acked-by: Borislav Petkov (AMD) Acked-by: Arisu Tachibana Acked-by: Christian König Acked-by: Harry Wentland Cc: commit 8eefed8f65cc17c31fdf4ab32292b794b34893ad Merge: fd57572253bc35 3e7f011c255582 Author: Linus Torvalds Date: Tue Oct 28 12:13:20 2025 -0700 Merge tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Regression fixes: - Revert the patch that removed the cap on MAX_OPS_PER_COMPOUND - Address a kernel build issue Stable fixes: - Fix crash when a client queries new attributes on forechannel - Fix rare NFSD crash when tracing is enabled" * tag 'nfsd-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" nfsd: Avoid strlen conflict in nfsd4_encode_components_esc() NFSD: Fix crash in nfsd4_read_release() NFSD: Define actions for the new time_deleg FATTR4 attributes commit 388eff894d6bc5f921e9bfff0e4b0ab2684a96e9 Author: Chang S. Bae Date: Mon Jun 9 17:16:59 2025 -0700 x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when running KVM tests: WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70 Call Trace: fpu__clear_user_states+0x9c/0x100 arch_do_signal_or_restart+0x142/0x210 exit_to_user_mode_loop+0x55/0x100 do_syscall_64+0x205/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Chao further identified [2] a reproducible scenario involving signal delivery: a non-AMX task is preempted by an AMX-enabled task which modifies the XFD MSR. When the non-AMX task resumes and reloads XSTATE with init values, a warning is triggered due to a mismatch between fpstate::xfd and the CPU's current XFD state. fpu__clear_user_states() does not currently re-synchronize the XFD state after such preemption. Invoke xfd_update_state() which detects and corrects the mismatch if there is a dynamic feature. This also benefits the sigreturn path, as fpu__restore_sig() may call fpu__clear_user_states() when the sigframe is inaccessible. [ dhansen: minor changelog munging ] Closes: https://lore.kernel.org/lkml/aDCo_SczQOUaB2rS@google.com [1] Fixes: 672365477ae8a ("x86/fpu: Update XFD state where required") Reported-by: Sean Christopherson Signed-off-by: Chang S. Bae Signed-off-by: Dave Hansen Reviewed-by: Chao Gao Tested-by: Chao Gao Link: https://lore.kernel.org/all/aDWbctO%2FRfTGiCg3@intel.com [2] Cc:stable@vger.kernel.org Link: https://patch.msgid.link/20250610001700.4097-1-chang.seok.bae%40intel.com commit bd34bf518a5ffeb8eb7c8b9907ba97b606166f7b Author: Lazar Aleksic Date: Tue Oct 28 19:09:05 2025 +0100 platform: x86: Kconfig: fix minor typo in help for WIRELESS_HOTKEY Fixed a misspelling of Xiaomi. Signed-off-by: Lazar Aleksic Link: https://patch.msgid.link/20251028180956.10753-1-kripticni.dev@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 48cbf50531d8eca15b8a811717afdebb8677de9b Author: Shawn Guo Date: Fri Oct 24 16:23:44 2025 +0800 regmap: irq: Correct documentation of wake_invert flag Per commit 9442490a0286 ("regmap: irq: Support wake IRQ mask inversion") the wake_invert flag is to support enable register, so cleared bits are wake disabled. Fixes: 68622bdfefb9 ("regmap: irq: document mask/wake_invert flags") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo Link: https://patch.msgid.link/20251024082344.2188895-1-shawnguo2@yeah.net Signed-off-by: Mark Brown commit 4173edb076b3ae30d734d55fce0ebac63139b656 Author: Hans de Goede Date: Mon Oct 20 17:23:31 2025 +0200 platform/x86: dell-wmi-base: Handle electronic privacy screen on/off events Add handling for events for the electronic privacy screen found on some models (e.g. Dell Latitude 7300) being toggled on/off. Emit KEY_EPRIVACY_SCREEN_OFF / KEY_EPRIVACY_SCREEN_ON events for this so that userspace can show the usual on-screen-display (OSD) notification for eprivacy screen on/off to the user. Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20251020152331.52870-3-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8f3eaad9812f62e7006ad08602444b32c3101824 Author: Hans de Goede Date: Mon Oct 20 17:23:30 2025 +0200 Input: Add keycodes for electronic privacy screen on/off hotkeys Add keycodes for hotkeys toggling the electronic privacy screen found on some laptops on/off. There already is an API for eprivacy screens as kernel-mode-setting drm connector object properties: https://www.kernel.org/doc/html/latest/gpu/drm-kms.html#standard-connector-properties this API also supports reporting when the eprivacy screen is turned on/off by the embedded-controller (EC) in response to hotkey presses. But on some laptops (e.g. the Dell Latitude 7300) the firmware does not allow querying the presence nor the status of the eprivacy screen at boot. This makes it impossible to implement the drm connector properties API since drm objects do not allow adding new properties after creation and the presence of the eprivacy cannot be detected at boot. The first notice of the presence of an eprivacy screen on these laptops is an EC generated (WMI) event when the eprivacy screen hotkeys are pressed. In this case the new keycodes this change adds can be generated to notify userspace of the eprivacy screen on/off hotkeys being pressed, so that userspace can show the usual on-screen-display (OSD) notification for eprivacy screen on/off to the user. This is similar to how e.g. touchpad on/off keycodes are used to show the touchpad on/off OSD. Signed-off-by: Hans de Goede Acked-by: Dmitry Torokhov Link: https://patch.msgid.link/20251020152331.52870-2-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7f7d28c69eda3692bcf102b7096b93fd45c75b1d Author: Sakari Ailus Date: Tue Oct 28 10:49:59 2025 +0200 MAINTAINERS: Update int3472 maintainers Add myself as the maintainer of the int3472 driver. Also update Daniel's e-mail address while at it. Signed-off-by: Sakari Ailus Acked-by: Daniel Scally Link: https://patch.msgid.link/20251028084959.394795-1-sakari.ailus@linux.intel.com Signed-off-by: Ilpo Järvinen commit f0f7a3f542c1698edb69075f25a3f846207facba Author: Qiu Wenbo Date: Tue Oct 28 14:30:09 2025 +0800 platform/x86: int3472: Fix double free of GPIO device during unregister regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration. Cc: stable@vger.kernel.org Fixes: 1e5d088a52c2 ("platform/x86: int3472: Stop using devm_gpiod_get()") Signed-off-by: Qiu Wenbo Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Reviewed-by: Hans de Goede Reviewed-by: Daniel Scally Link: https://patch.msgid.link/20251028063009.289414-1-qiuwenbo@gnome.org Signed-off-by: Ilpo Järvinen commit b3656b355b5522cef1b52a7469010009c98156db Author: Ivan Lipski Date: Wed Sep 17 11:00:02 2025 -0400 drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc [Why&How] Return -EINVAL when userspace asks us to enable vblank on a crtc that is not yet enabled. Suggested-by: Aurabindo Pillai Reviewed-by: Aurabindo Pillai Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1856 Signed-off-by: Ivan Lipski Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit cb57b8cdb072dc37723b6906da1c37ff9cbc2da4) Cc: stable@vger.kernel.org commit 7d08c3b1731014dd1cfd0bf8b0cb1cef9dfd191e Author: Alex Hung Date: Thu Oct 16 20:08:10 2025 -0600 drm/amd/display: Add HDR workaround for a specific eDP [WHY & HOW] Some eDP panels suffer from flicking when HDR is enabled in KDE or Gnome. This add another quirk to worksaround to skip VSC that is incompatible with an eDP panel. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4452 Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 99441824bec63549a076cd86631d138ec9a0c71c) Cc: stable@vger.kernel.org commit 4f2cd64510e7ae0b3a6ec1c10826cb6baf04edfa Author: Alex Deucher Date: Wed Oct 22 09:19:55 2025 -0400 drm/amdgpu: fix SPDX header on cyan_skillfish_reg_init.c This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: e8529dbc75ca ("drm/amdgpu: add ip offset support for cyan skillfish") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 102c4f7c554ac5a5ecf0023fa0612beb58e3b0bd) commit 8284a9e91722d3214aac5d54b4e0d2c91af0fdfc Author: Alex Deucher Date: Wed Oct 22 09:17:37 2025 -0400 drm/amdgpu: fix SPDX header on irqsrcs_vcn_5_0.h This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: d1bb64651095 ("drm/amdgpu: add irq source ids for VCN5_0/JPEG5_0") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 68c20d7b1779f97d600e61b9e95726c0cd609e2a) commit 964f8ff276a54ad7fb09168141fb6a8d891d548a Author: Alex Deucher Date: Wed Oct 22 09:14:55 2025 -0400 drm/amdgpu: fix SPDX header on amd_cper.h This should be MIT. The driver in general is MIT and the license text at the top of the file is MIT so fix it. Fixes: 523b69c65445 ("drm/amd/include: Add amd cper header") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 72c5482cb0f3d3c772c9de50e5a4265258a53f81) commit f3b37ebf2c94e3a3d7bbf5e3788ad86cf30fc7be Author: Alex Deucher Date: Wed Oct 22 09:12:54 2025 -0400 drm/amdgpu: fix SPDX headers on amdgpu_cper.c/h These should be MIT. The driver in general is MIT and the license text at the top of the files is MIT so fix it. Fixes: 92d5d2a09de1 ("drm/amdgpu: Introduce funcs for populating CPER") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4654 Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit abd3f876404cafb107cb34bacb74706bfee11cbe) commit 501672e3c1576aa9a8364144213c77b98a31a42c Author: John Smith Date: Tue Oct 21 11:09:09 2025 +0200 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the maximum value from the speed table which is the behaviour of all other smumgr implementations. Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.") Signed-off-by: John Smith Signed-off-by: Alex Deucher (cherry picked from commit 92b0a6ae6672857ddeabf892223943d2f0e06c97) commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 Author: John Smith Date: Tue Oct 21 11:08:13 2025 +0200 drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Previously this was initialized with zero which represented PCIe Gen 1.0 instead of using the maximum value from the speed table which is the behaviour of all other smumgr implementations. Fixes: 18edef19ea44 ("drm/amd/powerplay: implement fw image related smu interface for Fiji.") Signed-off-by: John Smith Signed-off-by: Alex Deucher (cherry picked from commit c52238c9fb414555c68340cd80e487d982c1921c) commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 Author: Yang Wang Date: Wed Oct 22 14:12:21 2025 +0800 drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() 'table_index' is a variable defined by the smu driver (kmd) 'table_id' is a variable defined by the hw smu (pmfw) This code should use table_index as a bounds check. Fixes: caad2613dc4bd ("drm/amd/powerplay: move table setting common code to smu_cmn.c") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit fca0c66b22303de0d1d6313059baf4dc960a4753) commit 382bd6a792836875da555fe9a2b51222b813fed1 Author: Matthew Schwartz Date: Mon Oct 20 16:09:34 2025 -0700 drm/amd/display: Don't program BLNDGAM_MEM_PWR_FORCE when CM low-power is disabled on DCN30 Before commit 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`"), dpp3_program_blnd_lut(NULL) checked the low-power debug flag before calling dpp3_power_on_blnd_lut(false). After commit 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`"), dpp3_program_blnd_lut(NULL) unconditionally calls dpp3_power_on_blnd_lut(false). The BLNDGAM power helper writes BLNDGAM_MEM_PWR_FORCE when CM low-power is disabled, causing immediate SRAM power toggles instead of deferring at vupdate. This can disrupt atomic color/LUT sequencing during transitions between direct scanout and composition within gamescope's DRM backend on Steam Deck OLED. To fix this, leave the BLNDGAM power state unchanged when low-power is disabled, matching dpp3_power_on_hdr3dlut and dpp3_power_on_shaper. Fixes: 33056a97ae5e ("drm/amd/display: Remove double checks for `debug.enable_mem_low_power.bits.cm`") Signed-off-by: Matthew Schwartz Reviewed-by: Harry Wentland Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 13ff4f63fcddfc84ec8632f1443936b00aa26725) Cc: stable@vger.kernel.org commit 5d7b36d1bffce8340b37cbba95ef743ed3adaefd Author: Kenneth Feng Date: Fri Mar 28 10:34:57 2025 +0800 drm/amd/display: pause the workload setting in dm v1: Pause the workload setting in dm when doinn idle optimization v2: Rebase patch to latest kernel code base (kernel 6.16) Reviewed-by: Alex Deucher Signed-off-by: Kenneth Feng Signed-off-by: Alex Deucher Signed-off-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit bc6d54ac7e7436721a19443265f971f890c13cc5) commit 745bae76acdd71709773c129a69deca01036250b Author: Daniel Palmer Date: Sat Oct 18 14:44:51 2025 +0900 drm/radeon: Remove calls to drm_put_dev() Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd should be done by devres. However, drm_put_dev() is still in the probe error and device remove paths. When the driver fails to probe warnings like the following are shown because devres is trying to drm_put_dev() after the driver already did it. [ 5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22 [ 5.649605] ------------[ cut here ]------------ [ 5.649607] refcount_t: underflow; use-after-free. [ 5.649620] WARNING: CPU: 0 PID: 357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 Fixes: a9ed2f052c5c ("drm/radeon: change drm_dev_alloc to devm_drm_dev_alloc") Signed-off-by: Daniel Palmer Signed-off-by: Alex Deucher (cherry picked from commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4) commit 3328443363a0895fd9c096edfe8ecd372ca9145e Author: Daniel Palmer Date: Sat Oct 18 14:44:50 2025 +0900 drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it. Fixes: a9ed2f052c5c ("drm/radeon: change drm_dev_alloc to devm_drm_dev_alloc") Signed-off-by: Daniel Palmer Signed-off-by: Alex Deucher (cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b) commit ba10f8d92a2c026b1052b4c0fa2cd7538838c965 Author: Mario Limonciello Date: Thu Oct 16 13:55:27 2025 -0500 drm/amd: Check that VPE has reached DPM0 in idle handler [Why] Newer VPE microcode has functionality that will decrease DPM level only when a workload has run for 2 or more seconds. If VPE is turned off before this DPM decrease and the PMFW doesn't reset it when power gating VPE, the SOC can get stuck with a higher DPM level. This can happen from amdgpu's ring buffer test because it's a short quick workload for VPE and VPE is turned off after 1s. [How] In idle handler besides checking fences are drained check PMFW version to determine if it will reset DPM when power gating VPE. If PMFW will not do this, then check VPE DPM level. If it is not DPM0 reschedule delayed work again until it is. v2: squash in return fix (Alex) Cc: Peyton.Lee@amd.com Reported-by: Sultan Alsawaf Reviewed-by: Sultan Alsawaf Tested-by: Sultan Alsawaf Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4615 Reviewed-by: Lijo Lazar Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 3ac635367eb589bee8edcc722f812a89970e14b7) Cc: stable@vger.kernel.org commit 926d002e6d7e2f1fd5c1b53cf6208153ee7d380d Author: Johan Hovold Date: Mon Oct 6 11:39:37 2025 +0200 drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers"). This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free. Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv") Reported-by: Sjoerd Simons Closes: https://lore.kernel.org/r/20251003-mtk-drm-refcount-v1-1-3b3f2813b0db@collabora.com Cc: stable@vger.kernel.org Cc: Ma Ke Cc: AngeloGioacchino Del Regno Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Sjoerd Simons Tested-by: Sjoerd Simons Tested-by: Ritesh Raj Sarraf Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20251006093937.27869-1-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d Author: Miaoqian Lin Date: Sun Oct 26 17:08:59 2025 +0800 usb: cdns3: Fix double resource release in cdns3_pci_probe The driver uses pcim_enable_device() to enable the PCI device, the device will be automatically disabled on driver detach through the managed device framework. The manual pci_disable_device() calls in the error paths are therefore redundant and should be removed. Found via static anlaysis and this is similar to commit 99ca0b57e49f ("thermal: intel: int340x: processor: Fix warning during module unload"). Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Cc: stable Signed-off-by: Miaoqian Lin Acked-by: Peter Chen Link: https://patch.msgid.link/20251026090859.33107-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit baeb66fbd4201d1c4325074e78b1f557dff89b5b Author: Jimmy Hu Date: Thu Oct 23 05:49:45 2025 +0000 usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window. Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue") Cc: stable Signed-off-by: Jimmy Hu Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman commit eb9ac779830b2235847b72cb15cf07c7e3333c5e Author: Claudiu Beznea Date: Mon Oct 27 16:07:41 2025 +0200 usb: renesas_usbhs: Fix synchronous external abort on unbind A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is executed after the configuration sequence described above: modprobe usb_f_ecm modprobe libcomposite modprobe configfs cd /sys/kernel/config/usb_gadget mkdir -p g1 cd g1 echo "0x1d6b" > idVendor echo "0x0104" > idProduct mkdir -p strings/0x409 echo "0123456789" > strings/0x409/serialnumber echo "Renesas." > strings/0x409/manufacturer echo "Ethernet Gadget" > strings/0x409/product mkdir -p functions/ecm.usb0 mkdir -p configs/c.1 mkdir -p configs/c.1/strings/0x409 echo "ECM" > configs/c.1/strings/0x409/configuration if [ ! -L configs/c.1/ecm.usb0 ]; then ln -s functions/ecm.usb0 configs/c.1 fi echo 11e20000.usb > UDC echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind The displayed trace is as follows: Internal error: synchronous external abort: 0000000096000010 [#1] SMP CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs] sp : ffff8000838b3920 x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810 x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000 x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020 x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344 x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000 x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80 Call trace: usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P) usbhsg_pullup+0x4c/0x7c [renesas_usbhs] usb_gadget_disconnect_locked+0x48/0xd4 gadget_unbind_driver+0x44/0x114 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_release_driver+0x18/0x24 bus_remove_device+0xcc/0x10c device_del+0x14c/0x404 usb_del_gadget+0x88/0xc0 usb_del_gadget_udc+0x18/0x30 usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs] usbhs_mod_remove+0x20/0x30 [renesas_usbhs] usbhs_remove+0x98/0xdc [renesas_usbhs] platform_remove+0x20/0x30 device_remove+0x4c/0x80 device_release_driver_internal+0x1c8/0x224 device_driver_detach+0x18/0x24 unbind_store+0xb4/0xb8 drv_attr_store+0x24/0x38 sysfs_kf_write+0x7c/0x94 kernfs_fop_write_iter+0x128/0x1b8 vfs_write+0x2ac/0x350 ksys_write+0x68/0xfc __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021) ---[ end trace 0000000000000000 ]--- note: sh[188] exited with irqs disabled note: sh[188] exited with preempt_count 1 The issue occurs because usbhs_sys_function_pullup(), which accesses the IP registers, is executed after the USBHS clocks have been disabled. The problem is reproducible on the Renesas RZ/G3S SoC starting with the addition of module stop in the clock enable/disable APIs. With module stop functionality enabled, a bus error is expected if a master accesses a module whose clock has been stopped and module stop activated. Disable the IP clocks at the end of remove. Cc: stable Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251027140741.557198-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a Author: Miaoqian Lin Date: Mon Oct 27 17:20:50 2025 +0800 serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Check for returned DMA addresses using specialized dma_mapping_error() helper which is generally recommended for this purpose by Documentation/core-api/dma-api.rst: "In some circumstances dma_map_single(), ... will fail to create a mapping. A driver can check for these errors by testing the returned DMA address with dma_mapping_error()." Found via static analysis and this is similar to commit fa0308134d26 ("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking") Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support") Cc: stable Signed-off-by: Miaoqian Lin Reviewed-by: Gregory CLEMENT Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit fbc1cc6973099f45e4c30b86f12b4435c7cb7d24 Author: Benjamin Berg Date: Tue Oct 28 12:58:40 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. To make this work, use the same clock to store the timestamp. CC: stable@vger.kernel.org Fixes: ec3252bff7b6 ("wifi: mac80211: use wiphy work for channel switch") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.68258c7e4ac4.I4ff2b2cdffbbf858bf5f08baccc7a88c4f9efe6f@changeid Signed-off-by: Johannes Berg commit 3f654d53dff565095d83a84e3b6187526dadf4c8 Author: Benjamin Berg Date: Tue Oct 28 12:58:39 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. CC: stable@vger.kernel.org Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.24a7b54e9e37.I063c5c15bf7672f94cea75f83e486a3ca52d098f@changeid Signed-off-by: Johannes Berg commit dfa865d490b1bd252045463588a91a4d3c82f3c8 Author: Benjamin Berg Date: Tue Oct 28 12:58:38 2025 +0200 wifi: mac80211: use wiphy_hrtimer_work for ttlm_work The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. CC: stable@vger.kernel.org Fixes: 702e80470a33 ("wifi: mac80211: support handling of advertised TID-to-link mapping") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.83c2c611545e.I35498a6d883ea24b0dc4910cf521aa768d2a0e90@changeid Signed-off-by: Johannes Berg commit 7ceba45a6658ce637da334cd0ebf27f4ede6c0fe Author: Benjamin Berg Date: Tue Oct 28 12:58:37 2025 +0200 wifi: cfg80211: add an hrtimer based delayed work item The normal timer mechanism assume that timeout further in the future need a lower accuracy. As an example, the granularity for a timer scheduled 4096 ms in the future on a 1000 Hz system is already 512 ms. This granularity is perfectly sufficient for e.g. timeouts, but there are other types of events that will happen at a future point in time and require a higher accuracy. Add a new wiphy_hrtimer_work type that uses an hrtimer internally. The API is almost identical to the existing wiphy_delayed_work and it can be used as a drop-in replacement after minor adjustments. The work will be scheduled relative to the current time with a slack of 1 millisecond. CC: stable@vger.kernel.org # 6.4+ Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.7f13a2adc5eb.I01b5af0363869864b0580d9c2a1770bafab69566@changeid Signed-off-by: Johannes Berg commit 3b8694e56f6b69aaba1cffdf0c0760cd76712422 Merge: a83155cc4ec5dd 2469bb6a6af944 Author: Johannes Berg Date: Tue Oct 28 14:54:09 2025 +0100 Merge tag 'ath-current-20251027' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc4 Revert an ath10k change which improved QCA6174 but completely broke QCA988x and QCA9984. ================== Link: https://patch.msgid.link/e7e3ab9f-f477-4e84-8a5c-609fa1834624@oss.qualcomm.com Signed-off-by: Johannes Berg commit 19de03b312d69a7e9bacb51c806c6e3f4207376c Author: Damien Le Moal Date: Mon Oct 27 09:27:33 2025 +0900 block: make REQ_OP_ZONE_OPEN a write operation A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of a zoned block device to the explicitly open condition (BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write operation. Change this operation code to be an odd number to reflect this. The following operation numbers are changed to keep the numbering compact. No problems were reported without this change as this operation has no data. However, this unifies the zone operation to reflect that they modify the device state and also allows strengthening checks in the block layer, e.g. checking if this operation is not issued against a read-only device. Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 Author: Damien Le Moal Date: Mon Oct 27 09:27:32 2025 +0900 block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL REQ_OP_ZONE_RESET_ALL is a zone management request. Fix op_is_zone_mgmt() to return true for that operation, like it already does for REQ_OP_ZONE_RESET. While no problems were reported without this fix, this change allows strengthening checks in various block device drivers (scsi sd, virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone management command is not being issued to a regular block device. Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 76992675d7bca5560d3708488529924eb1743a03 Merge: dcb6fa37fd7bc9 109ff654934a47 Author: Greg Kroah-Hartman Date: Tue Oct 28 14:41:55 2025 +0100 Merge tag 'counter-fixes-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-next William writes: Counter fixes for 6.18 A fix to permit multiple counter channels to share the same TCB IRQ line for microchip-tcb-cpature. * tag 'counter-fixes-for-6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: microchip-tcb-capture: Allow shared IRQ for multi-channel TCBs commit 5c76f9961c170552c1d07c830b5e145475151600 Author: Henrique Carvalho Date: Mon Oct 27 18:29:19 2025 -0300 smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay, later cleanup could act on a stale pointer, leading to a potential use-after-free. Reinitialize cfid to NULL under the replay label. Example trace (trimmed): refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110 [...] RIP: 0010:refcount_warn_saturate+0x9c/0x110 [...] Call Trace: smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? step_into+0x10d/0x690 ? __legitimize_path+0x28/0x60 smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f] ? kmem_cache_alloc+0x18a/0x340 ? getname_flags+0x46/0x1e0 cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f] statfs_by_dentry+0x67/0x90 vfs_statfs+0x16/0xd0 user_statfs+0x54/0xa0 __do_sys_statfs+0x20/0x50 do_syscall_64+0x58/0x80 Cc: stable@kernel.org Fixes: 4f1fffa237692 ("cifs: commands that are retried should have replay flag set") Reviewed-by: Paulo Alcantara (Red Hat) Acked-by: Shyam Prasad N Reviewed-by: Enzo Matsumiya Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 9e8b3201c7302d5b522ba3535630bed21cc03c27 Author: David Rosca Date: Wed Oct 15 16:01:28 2025 +0200 drm/sched: avoid killing parent entity on child SIGKILL The DRM scheduler tracks who last uses an entity and when that process is killed blocks all further submissions to that entity. The problem is that we didn't track who initially created an entity, so when a process accidently leaked its file descriptor to a child and that child got killed, we killed the parent's entities. Avoid that and instead initialize the entities last user on entity creation. This also allows to drop the extra NULL check. Signed-off-by: David Rosca Signed-off-by: Christian König Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4568 Reviewed-by: Alex Deucher CC: stable@vger.kernel.org Acked-by: Philipp Stanner Link: https://lore.kernel.org/r/20251015140128.1470-1-christian.koenig@amd.com Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251015140128.1470-1-christian.koenig@amd.com commit 607b9fb2ce248cc5b633c5949e0153838992c152 Author: Gregory Price Date: Mon Oct 20 11:13:55 2025 +0200 x86/CPU/AMD: Add RDSEED fix for Zen5 There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable@vger.kernel.org Signed-off-by: Gregory Price Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net commit 45f5c9eec43a9bf448f46562f146810831916cc9 Author: Bard Liao Date: Mon Oct 27 22:00:12 2025 +0800 ASoC: soc_sdw_utils: remove cs42l43 component_name "spk:cs42l43-spk" component string will be added conditionally by asoc_sdw_cs42l43_spk_rtd_init(). We should not add "spk:cs42l43" unconditionally. Fixes: c61da55412a0 ("ASoC: sdw_utils: Add missed component_name strings for speaker amps") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251027140012.966306-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit b2dd1d0d322dce5f331961c927e775b84014d5ab Author: Maarten Zanders Date: Fri Oct 24 15:57:15 2025 +0200 ASoC: fsl_sai: Fix sync error in consumer mode When configured for default synchronisation (Rx syncs to Tx) and the SAI operates in consumer mode (clocks provided externally to Tx), a synchronisation error occurs on Tx on the first attempt after device initialisation when the playback stream is started while a capture stream is already active. This results in channel shift/swap on the playback stream. Subsequent streams (ie after that first failing one) always work correctly, no matter the order, with or without the other stream active. This issue was observed (and fix tested) on an i.MX6UL board connected to an ADAU1761 codec, where the codec provides both frame and bit clock (connected to TX pins). To fix this, always initialize the 'other' xCR4 and xCR5 registers when we're starting a stream which is synced to the opposite one, irregardless of the producer/consumer status. Fixes: 51659ca069ce ("ASoC: fsl-sai: set xCR4/xCR5/xMR for SAI master mode") Signed-off-by: Maarten Zanders Reviewed-by: Shengjiu Wang Link: https://patch.msgid.link/20251024135716.584265-1-maarten@zanders.be Signed-off-by: Mark Brown commit c8b8804760eb0c4c0c7c2b500380ab3fa9f92b5a Author: Mark Brown Date: Tue Oct 28 10:20:30 2025 +0000 ASoC: Fix build for sdw_utils Revert 3293d3d7b0 ("ASoC: sdw_utils: add name_prefix for rt1321 part id") due to dependencies on -next which for some reason don't show up in my builds. Signed-off-by: Mark Brown commit 6504297872c7a5d0d06247970d32940eba26b8b3 Author: Frieder Schrempf Date: Mon Oct 20 15:21:51 2025 +0200 arm64: dts: imx8mp-kontron: Fix USB OTG role switching The VBUS supply regulator is currently assigned to the PHY node. This causes the VBUS to be always on, even when the controller needs to be switched to peripheral mode. Fix the OTG role switching by adding a connector node and moving the VBUS supply regulator to that node. This way the VBUS gets correctly switched according to the current role. Fixes: 946ab10e3f40 ("arm64: dts: Add support for Kontron OSM-S i.MX8MP SoM and BL carrier board") Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 2e448567839c65768486d56612c88cb327d26050 Author: Thorsten Blum Date: Tue Oct 21 15:51:54 2025 +0200 cpuidle: riscv-sbi: Replace deprecated strcpy in sbi_cpuidle_init_cpu strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20251021135155.1409-2-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley commit 5228ed2c624449d1a53d1c84ba01c021d2df95c0 Author: Thorsten Blum Date: Sat Oct 11 02:47:47 2025 +0200 riscv: KGDB: Replace deprecated strcpy in kgdb_arch_handle_qxfer_pkt strcpy() is deprecated because it can cause a buffer overflow when the sizes of the source and the destination are not known at compile time. Use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20251011004750.461954-1-thorsten.blum@linux.dev Signed-off-by: Paul Walmsley commit 210b35d6a7ea415494ce75490c4b43b4e717d935 Author: Krzysztof Kozlowski Date: Sun Oct 26 11:17:42 2025 +0100 dt-bindings: net: sparx5: Narrow properly LAN969x register space windows Commit 267bca002c50 ("dt-bindings: net: sparx5: correct LAN969x register space windows") said that LAN969x has exactly two address spaces ("reg" property) but implemented it as 2 or more. Narrow the constraint to properly express that only two items are allowed, which also matches Linux driver. Fixes: 267bca002c50 ("dt-bindings: net: sparx5: correct LAN969x register space windows") Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251026101741.20507-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 520ad9e96937e825a117e9f00dd35a3e199d67b5 Author: Petr Oros Date: Fri Oct 24 20:55:12 2025 +0200 dpll: spec: add missing module-name and clock-id to pin-get reply The dpll.yaml spec incorrectly omitted module-name and clock-id from the pin-get operation reply specification, even though the kernel DPLL implementation has always included these attributes in pin-get responses since the initial implementation. This spec inconsistency caused issues with the C YNL code generator. The generated dpll_pin_get_rsp structure was missing these fields. Fix the spec by adding module-name and clock-id to the pin-attrs reply specification to match the actual kernel behavior. Fixes: 3badff3a25d8 ("dpll: spec: Add Netlink spec in YAML") Signed-off-by: Petr Oros Reviewed-by: Ivan Vecera Link: https://patch.msgid.link/20251024185512.363376-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit e3966940559d52aa1800a008dcfeec218dd31f88 Author: Hangbin Liu Date: Fri Oct 24 12:58:53 2025 +0000 tools: ynl: avoid print_field when there is no reply When request a none support device operation, there will be no reply. In this case, the len(desc) check will always be true, causing print_field to enter an infinite loop and crash the program. Example reproducer: # ethtool.py -c veth0 To fix this, return immediately if there is no reply. Fixes: f3d07b02b2b8 ("tools: ynl: ethtool testing tool") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251024125853.102916-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 855e43164e95bf6559ab2b53b28e0f95887ff099 Merge: 46a499aaf8c274 f12b69d8f22824 Author: Jakub Kicinski Date: Mon Oct 27 18:00:53 2025 -0700 Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - release references to inactive interfaces, by Sven Eckelmann * tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge: batman-adv: Release references to inactive interfaces ==================== Link: https://patch.msgid.link/20251024091150.231141-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 44aa25c000b41d7afcb030ac1b8a38f06dabef0a Author: Ben Dooks Date: Fri Oct 24 18:16:40 2025 +0100 riscv: asm: use .insn for making custom instructions The assembler has .insn for building custom instructions now, so change the .4byte to .insn. This ensures the output is marked as an instruction and not as data which may confuse both debuggers and anything else that relies on this sort of marking. Add an ASM_INSN_I() wrapper in asm.h to allow the selecting of how this is output so older assemblers are still good. Reviewed-by: Andrew Jones Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20251024171640.65232-1-ben.dooks@codethink.co.uk Signed-off-by: Paul Walmsley commit 46a499aaf8c27476fd05e800f3e947bfd71aa724 Author: Abdun Nihaal Date: Thu Oct 23 19:48:42 2025 +0530 sfc: fix potential memory leak in efx_mae_process_mport() In efx_mae_enumerate_mports(), memory allocated for mae_mport_desc is passed as a argument to efx_mae_process_mport(), but when the error path in efx_mae_process_mport() gets executed, the memory allocated for desc gets leaked. Fix that by freeing the memory allocation before returning error. Fixes: a6a15aca4207 ("sfc: enumerate mports in ef100") Acked-by: Edward Cree Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251023141844.25847-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski commit 03ca7c8c42be913529eb9f188278114430c6abbd Author: Jijie Shao Date: Thu Oct 23 21:13:37 2025 +0800 net: hns3: return error code when function fails Currently, in hclge_mii_ioctl(), the operation to read the PHY register (SIOCGMIIREG) always returns 0. This patch changes the return type of hclge_read_phy_reg(), returning an error code when the function fails. Fixes: 024712f51e57 ("net: hns3: add ioctl support for imp-controlled PHYs") Signed-off-by: Jijie Shao Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251023131338.2642520-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit e3a0ca09acbe697245f944ee92b956db58a0ed09 Author: Bagas Sanjaya Date: Thu Oct 23 16:24:06 2025 +0700 MAINTAINERS: mark ISDN subsystem as orphan We have not heard any activities from Karsten in years: - Last review tag was nine years ago in commit a921e9bd4e22a7 ("isdn: i4l: move active-isdn drivers to staging") - Last message on lore was in October 2020 [1]. Furthermore, messages to isdn mailing list bounce. Mark the subsystem as orphan to reflect these. [1]: https://lore.kernel.org/all/0ee243a9-9937-ad26-0684-44b18e772662@linux-pingi.de/ Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251023092406.56699-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 5fada1605733a427feff45147cef9455ce29620f Author: Vivian Wang Date: Mon Oct 20 20:23:56 2025 +0800 riscv: tests: Make RISCV_KPROBES_KUNIT tristate This disallows KUNIT=m and RISCV_KPROBES_KUNIT=y, which produces these relocs_check.sh warnings when RELOCATABLE=y: WARNING: 3 bad relocations ffffffff81e24118 R_RISCV_64 kunit_unary_assert_format ffffffff81e24a60 R_RISCV_64 kunit_binary_assert_format ffffffff81e269d0 R_RISCV_JUMP_SLOT __kunit_do_failed_assertion This fixes allmodconfig build. Reported-by: Inochi Amaoto Fixes: f2fab612824f ("riscv: Add kprobes KUnit test") Signed-off-by: Vivian Wang Tested-by: Inochi Amaoto Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20251020-riscv-kunit-kconfig-fix-6-18-v1-2-d773b5d5ce48@iscas.ac.cn Signed-off-by: Paul Walmsley commit 217660325580d51c350726159703b2fcec2b95e3 Author: Vivian Wang Date: Mon Oct 20 20:23:55 2025 +0800 riscv: tests: Rename kprobes_test_riscv to kprobes_riscv According to Documentation/dev-tools/kunit/style.rst a KUnit test suite normally should not have "test" in the name. Rename it to follow the style guide. Signed-off-by: Vivian Wang Tested-by: Inochi Amaoto Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20251020-riscv-kunit-kconfig-fix-6-18-v1-1-d773b5d5ce48@iscas.ac.cn Signed-off-by: Paul Walmsley commit b3cf2d14cff5587a250f3b65ee0d36f556d23074 Merge: 65f9c4c5888913 91d35ec9b3956d Author: Jakub Kicinski Date: Mon Oct 27 17:44:35 2025 -0700 Merge tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - fix corruption in h4_recv_buf() after cleanupCen Zhang (1): - hci_sync: fix race in hci_cmd_sync_dequeue_once - btmtksdio: Add pmctrl handling for BT closed state during reset - Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" - rfcomm: fix modem control handling - btintel_pcie: Fix event packet loss issue - ISO: Fix BIS connection dst_type handling - HCI: Fix tracking of advertisement set/instance 0x00 - ISO: Fix another instance of dst_type handling - hci_conn: Fix connection cleanup with BIG with 2 or more BIS - hci_core: Fix tracking of periodic advertisement - MGMT: fix crash in set_mesh_sync and set_mesh_complete * tag 'for-net-2025-10-24' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: rfcomm: fix modem control handling Bluetooth: hci_core: Fix tracking of periodic advertisement Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS Bluetooth: fix corruption in h4_recv_buf() after cleanup Bluetooth: btintel_pcie: Fix event packet loss issue Bluetooth: ISO: Fix another instance of dst_type handling Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset Bluetooth: ISO: Fix BIS connection dst_type handling Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once ==================== Link: https://patch.msgid.link/20251024144033.355820-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 65f9c4c5888913c2cf5d2fc9454c83f9930d537d Author: Petr Oros Date: Fri Oct 24 15:24:38 2025 +0200 tools: ynl: fix string attribute length to include null terminator The ynl_attr_put_str() function was not including the null terminator in the attribute length calculation. This caused kernel to reject CTRL_CMD_GETFAMILY requests with EINVAL: "Attribute failed policy validation". For a 4-character family name like "dpll": - Sent: nla_len=8 (4 byte header + 4 byte string without null) - Expected: nla_len=9 (4 byte header + 5 byte string with null) The bug was introduced in commit 15d2540e0d62 ("tools: ynl: check for overflow of constructed messages") when refactoring from stpcpy() to strlen(). The original code correctly included the null terminator: end = stpcpy(ynl_attr_data(attr), str); attr->nla_len = NLA_HDRLEN + NLA_ALIGN(end - (char *)ynl_attr_data(attr)); Since stpcpy() returns a pointer past the null terminator, the length included it. The refactored version using strlen() omitted the +1. The fix also removes NLA_ALIGN() from nla_len calculation, since nla_len should contain actual attribute length, not aligned length. Alignment is only for calculating next attribute position. This makes the code consistent with ynl_attr_put(). CTRL_ATTR_FAMILY_NAME uses NLA_NUL_STRING policy which requires null terminator. Kernel validates with memchr() and rejects if not found. Fixes: 15d2540e0d62 ("tools: ynl: check for overflow of constructed messages") Signed-off-by: Petr Oros Tested-by: Ivan Vecera Reviewed-by: Ivan Vecera Link: https://lore.kernel.org/20251018151737.365485-3-zahari.doychev@linux.com Link: https://patch.msgid.link/20251024132438.351290-1-poros@redhat.com Signed-off-by: Jakub Kicinski commit cf20852500d2895d1db22b69d87281aca2e7b5d0 Author: Nathan Chancellor Date: Thu Oct 23 21:01:29 2025 +0200 KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' Commit 5ff8c11775c7 ("KMSAN: Remove tautological checks") changed CONFIG_HAVE_KMSAN_COMPILER from a dynamic check for '-fsanitize=kernel-memory' to just being true for CONFIG_CC_IS_CLANG. This missed the fact that not all architectures supported '-fsanitize=kernel-memory' at the same time. For example, SystemZ / s390 gained support for KMSAN in clang-18 [1], so builds with clang-15 through clang-17 can select KMSAN but they error with: clang-16: error: unsupported option '-fsanitize=kernel-memory' for target 's390x-unknown-linux-gnu' Restore the cc-option check for '-fsanitize=kernel-memory' to make sure the compiler target properly supports '-fsanitize=kernel-memory'. The check for '-msan-disable-checks=1' does not need to be restored because all supported clang versions for building the kernel support it. Fixes: 5ff8c11775c7 ("KMSAN: Remove tautological checks") Link: https://github.com/llvm/llvm-project/commit/a3e56a8792ffaf3a3d3538736e1042b8db45ab89 [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202510220236.AVuXXCYy-lkp@intel.com/ Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251023-fix-kmsan-check-s390-clang-v1-1-4e6df477a4cc@kernel.org Signed-off-by: Nathan Chancellor commit d50f21091358b2b29dc06c2061106cdb0f030d03 Author: Dimitri John Ledkov Date: Sun Oct 26 20:21:00 2025 +0000 kbuild: align modinfo section for Secureboot Authenticode EDK2 compat Previously linker scripts would always generate vmlinuz that has sections aligned. And thus padded (correct Authenticode calculation) and unpadded calculation would be same. As in https://github.com/rhboot/pesign userspace tool would produce the same authenticode digest for both of the following commands: pesign --padding --hash --in ./arch/x86_64/boot/bzImage pesign --nopadding --hash --in ./arch/x86_64/boot/bzImage The commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") added .modinfo section of variable length. Depending on kernel configuration it may or may not be aligned. All userspace signing tooling correctly pads such section to calculation spec compliant authenticode digest. However, if bzImage is not further processed and is attempted to be loaded directly by EDK2 firmware, it calculates unpadded Authenticode digest and fails to correct accept/reject such kernel builds even when propoer Authenticode values are enrolled in db/dbx. One can say EDK2 requires aligned/padded kernels in Secureboot. Thus add ALIGN(8) to the .modinfo section, to esure kernels irrespective of modinfo contents can be loaded by all existing EDK2 firmware builds. Fixes: 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") Cc: stable@vger.kernel.org Signed-off-by: Dimitri John Ledkov Link: https://patch.msgid.link/20251026202100.679989-1-dimitri.ledkov@surgut.co.uk Signed-off-by: Nathan Chancellor commit a042beac6e6f8ac1e923784cfff98b47cbabb185 Author: Tomeu Vizoso Date: Tue Oct 21 11:37:23 2025 +0200 drm/etnaviv: fix flush sequence logic The current logic uses the flush sequence from the current address space. This is harmless when deducing the flush requirements for the current submit, as either the incoming address space is the same one as the currently active one or we switch context, in which case the flush is unconditional. However, this sequence is also stored as the current flush sequence of the GPU. If we switch context the stored flush sequence will no longer belong to the currently active address space. This incoherency can then cause missed flushes, resulting in translation errors. Fixes: 27b67278e007 ("drm/etnaviv: rework MMU handling") Signed-off-by: Tomeu Vizoso Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner Link: https://lore.kernel.org/r/20251021093723.3887980-1-l.stach@pengutronix.de commit 543d35004007a06ef247acf2fc55efa8388aa741 Author: Punit Agrawal Date: Fri Oct 24 13:31:25 2025 +0100 ACPI: SPCR: Check for table version when using precise baudrate Commit 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field") added support to use the precise baud rate available since SPCR 1.09 (revision 4) but failed to check the version of the table provided by the firmware. Accessing an older version of SPCR table causes accesses beyond the end of the table and can lead to garbage data to be used for the baud rate. Check the version of the firmware provided SPCR to ensure that the precise baudrate is vaild before using it. Fixes: 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field") Signed-off-by: Punit Agrawal Link: https://patch.msgid.link/20251024123125.1081612-1-punit.agrawal@oss.qualcomm.com Signed-off-by: Rafael J. Wysocki commit dc131bcd8d9219f7da533918abcb0d32951b7702 Author: Tony Luck Date: Wed Oct 22 13:45:23 2025 -0700 ACPI: MRRM: Check revision of MRRM table Before trying to parse the MRRM table, check that the table revision is the one that is expected. Fixes: b9020bdb9f76 ("ACPI: MRRM: Minimal parse of ACPI MRRM table") Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251022204523.10752-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit fd57572253bc356330dbe5b233c2e1d8426c66fd Merge: dcb6fa37fd7bc9 a3c4a0a42e61aa Author: Linus Torvalds Date: Mon Oct 27 10:52:18 2025 -0700 Merge tag 'sched_ext-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix scx_kick_pseqs corruption when multiple schedulers are loaded concurrently - Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() to handle systems with large CPU counts - Defer queue_balance_callback() until after ops.dispatch to fix callback ordering issues - Sync error_irq_work before freeing scx_sched to prevent use-after-free - Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU for proper RCU protection - Fix flag check for deferred callbacks * tag 'sched_ext-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: fix flag check for deferred callbacks sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() sched_ext: defer queue_balance_callback() until after ops.dispatch sched_ext: Sync error_irq_work before freeing scx_sched sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU commit c42458fcf54b3d0bc2ac06667c98dceb43831889 Author: Miaoqian Lin Date: Mon Oct 27 11:40:44 2025 -0600 riscv: Fix memory leak in module_frob_arch_sections() The current code directly overwrites the scratch pointer with the return value of kvrealloc(). If kvrealloc() fails and returns NULL, the original buffer becomes unreachable, causing a memory leak. Fix this by using a temporary variable to store kvrealloc()'s return value and only update the scratch pointer on success. Found via static anlaysis and this is similar to commit 42378a9ca553 ("bpf, verifier: Fix memory leak in array reallocation for stack state") Fixes: be17c0df6795 ("riscv: module: Optimize PLT/GOT entry counting") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20251026091912.39727-1-linmq006@gmail.com Signed-off-by: Paul Walmsley commit a74f038fa50e0d33b740f44f862fe856f16de6a8 Author: Josephine Pfeiffer Date: Mon Oct 27 11:40:43 2025 -0600 riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro The pt_dump_seq_puts() macro incorrectly uses seq_printf() instead of seq_puts(). This is both a performance issue and conceptually wrong, as the macro name suggests plain string output (puts) but the implementation uses formatted output (printf). The macro is used in ptdump.c:301 to output a newline character. Using seq_printf() adds unnecessary overhead for format string parsing when outputting this constant string. This bug was introduced in commit 59c4da8640cc ("riscv: Add support to dump the kernel page tables") in 2020, which copied the implementation pattern from other architectures that had the same bug. Fixes: 59c4da8640cc ("riscv: Add support to dump the kernel page tables") Signed-off-by: Josephine Pfeiffer Link: https://lore.kernel.org/r/20251018170451.3355496-1-hi@josie.lol Signed-off-by: Paul Walmsley commit 060ea84a484e852b52b938f234bf9b5503a6c910 Author: Chunyan Zhang Date: Mon Oct 27 11:40:43 2025 -0600 riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a task other than current, KASAN would report "BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460" There is a same issue on x86 and has been resolved by the commit 84936118bdf3 ("x86/unwind: Disable KASAN checks for non-current tasks") The solution could be applied to RISC-V too. This patch also can solve the issue: https://seclists.org/oss-sec/2025/q4/23 Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") Co-developed-by: Jiakai Xu Signed-off-by: Jiakai Xu Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20251022072608.743484-1-zhangchunyan@iscas.ac.cn [pjw@kernel.org: clean up checkpatch issues] Signed-off-by: Paul Walmsley commit 8080c67dd57cb968150b668ecbd4a4e4afd56ad4 Author: Carlos Llamas Date: Fri Oct 24 19:01:00 2025 +0000 kunit: prevent log overwrite in param_tests When running parameterized tests, each test case is initialized with kunit_init_test(). This function takes the test_case->log as a parameter but it clears it via string_stream_clear() on each iteration. This results in only the log from the last parameter being preserved in the test_case->log and the results from the previous parameters are lost from the debugfs entry. Fix this by manually setting the param_test.log to the test_case->log after it has been initialized. This prevents kunit_init_test() from clearing the log on each iteration. Link: https://lore.kernel.org/r/20251024190101.2091549-1-cmllamas@google.com Fixes: 4b59300ba4d2 ("kunit: Add parent kunit for parameterized test context") Signed-off-by: Carlos Llamas Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 8a9fb5129e8e64d24543ebc70de941a2d77a9e77 Author: Borislav Petkov (AMD) Date: Thu Oct 23 14:46:29 2025 +0200 x86/microcode/AMD: Limit Entrysign signature checking to known generations Limit Entrysign sha256 signature checking to CPUs in the range Zen1-Zen5. X86_BUG cannot be used here because the loading on the BSP happens way too early, before the cpufeatures machinery has been set up. Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/all/20251023124629.5385-1-bp@kernel.org commit 2469bb6a6af944755a7d7daf66be90f3b8decbf9 Author: Baochen Qiang Date: Mon Oct 27 09:49:12 2025 +0800 Revert "wifi: ath10k: avoid unnecessary wait for service ready message" This reverts commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a. Although this commit benefits QCA6174, it breaks QCA988x and QCA9984 [1][2]. Since it is not likely to root cause/fix this issue in a short time, revert it to get those chips back. Compile tested only. Fixes: 51a73f1b2e56 ("wifi: ath10k: avoid unnecessary wait for service ready message") Link: https://lore.kernel.org/ath10k/6d41bc00602c33ffbf68781f563ff2e6c6915a3e.camel@gmail.com # [1] Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220671 # [2] Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251027-ath10k-revert-polling-first-change-v1-1-89aaf3bcbfa1@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 28935ee5e4789ad86c08ba9f2426edd6203d13fa Author: Eren Demir Date: Mon Oct 27 13:58:10 2025 +0300 ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) The quirk for Victus 15-fa1xxx wasn't working on Victus 15-fa1031nt due to a different board id. This patch enables the existing quirk for the board id 8BC8. Tested on HP Victus 15-fa1031nt (MB 8C2D). The LED behaviour works as intended. Signed-off-by: Eren Demir Link: https://patch.msgid.link/20251027110208.6481-1-eren.demir2479090@gmail.com Signed-off-by: Takashi Iwai commit db86f55bf81a3a297be05ee8775ae9a8c6e3a599 Author: Rafael J. Wysocki Date: Thu Oct 23 19:12:57 2025 +0200 cpuidle: governors: menu: Select polling state in some more cases A throughput regression of 11% introduced by commit 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency") has been reported and it is related to the case when the menu governor checks if selecting a proper idle state instead of a polling one makes sense. In particular, it is questionable to do so if the exit latency of the idle state in question exceeds the predicted idle duration, so add a check for that, which is sufficient to make the reported regression go away, and update the related code comment accordingly. Fixes: 779b1a1cb13a ("cpuidle: governors: menu: Avoid selecting states with too much latency") Closes: https://lore.kernel.org/linux-pm/004501dc43c9$ec8aa930$c59ffb90$@telus.net/ Reported-by: Doug Smythies Tested-by: Doug Smythies Cc: All applicable Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/12786727.O9o76ZdvQC@rafael.j.wysocki commit 8abbf45fcda028c2c05ba38eb14ede9fa9e7341b Author: Mario Tesi Date: Wed Oct 15 18:16:19 2025 +0200 iio: st_lsm6dsx: Fixed calibrated timestamp calculation The calibrated timestamp is calculated from the nominal value using the formula: ts_gain[ns] ≈ ts_sensitivity - (ts_trim_coeff * val) / 1000. The values of ts_sensitivity and ts_trim_coeff are not the same for all devices, so it is necessary to differentiate them based on the part name. For the correct values please consult the relevant AN. Fixes: cb3b6b8e1bc0 ("iio: imu: st_lsm6dsx: add odr calibration feature") Signed-off-by: Mario Tesi Acked-by: Lorenzo Bianconi Signed-off-by: Jonathan Cameron commit e0023c8a74028739643aa14bd201c41a99866ca4 Author: Philipp Stanner Date: Fri Oct 24 18:12:22 2025 +0200 drm/nouveau: Fix race in nouveau_sched_fini() nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check. Replace the barrier with a function which takes the spinlock. Cc: stable@vger.kernel.org # v6.8+ Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship") Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251024161221.196155-2-phasta@kernel.org commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 Author: Philipp Stanner Date: Wed Oct 22 08:34:03 2025 +0200 drm/sched: Fix race in drm_sched_entity_select_rq() In a past bug fix it was forgotten that entity access must be protected by the entity lock. That's a data race and potentially UB. Move the spin_unlock() to the appropriate position. Cc: stable@vger.kernel.org # v5.13+ Fixes: ac4eb83ab255 ("drm/sched: select new rq even if there is only one v3") Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251022063402.87318-2-phasta@kernel.org commit d914ec6f07548f7c13a231a4f526e043e736e82e Author: Shuming Fan Date: Mon Oct 27 18:33:33 2025 +0800 ASoC: rt721: fix prepare clock stop failed This patch adds settings to prevent the 'prepare clock stop failed' error. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251027103333.38353-1-shumingf@realtek.com Signed-off-by: Mark Brown commit b8c9aab4c738e5e9814915768ac6c184fe36ab93 Author: Guofeng Yue Date: Thu Oct 16 19:40:51 2025 +0800 RDMA/hns: Remove an extra blank line Remove an extra blank line. Signed-off-by: Guofeng Yue Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-5-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit fe9622011f955e35ba84d3af7b2f2fed31cf8ca1 Author: Junxian Huang Date: Thu Oct 16 19:40:50 2025 +0800 RDMA/hns: Fix wrong WQE data when QP wraps around When QP wraps around, WQE data from the previous use at the same position still remains as driver does not clear it. The WQE field layout differs across different opcodes, causing that the fields that are not explicitly assigned for the current opcode retain stale values, and are issued to HW by mistake. Such fields are as follows: * MSG_START_SGE_IDX field in ATOMIC WQE * BLOCK_SIZE and ZBVA fields in FRMR WQE * DirectWQE fields when DirectWQE not used For ATOMIC WQE, always set the latest sge index in MSG_START_SGE_IDX as required by HW. For FRMR WQE and DirectWQE, clear only those unassigned fields instead of the entire WQE to avoid performance penalty. Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit f5a7cbea5411668d429eb4ffe96c4063fe8dac9e Author: wenglianfa Date: Thu Oct 16 19:40:49 2025 +0800 RDMA/hns: Fix the modification of max_send_sge The actual sge number may exceed the value specified in init_attr->cap when HW needs extra sge to enable inline feature. Since these extra sges are not expected by ULP, return the user-specified value to ULP instead of the expanded sge number. Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation") Signed-off-by: wenglianfa Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit c4b67b514af8c2d73c64b36e0cd99e9b26b9ac82 Author: Chengchang Tang Date: Thu Oct 16 19:40:48 2025 +0800 RDMA/hns: Fix recv CQ and QP cache affinity Currently driver enforces affinity between QP cache and send CQ cache, which helps improve the performance of sending, but doesn't set affinity with recv CQ cache, resulting in suboptimal performance of receiving. Use one CQ bank per context to ensure the affinity among QP, send CQ and recv CQ. For kernel ULP, CQ bank is fixed to 0. Fixes: 9e03dbea2b06 ("RDMA/hns: Fix CQ and QP cache affinity") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251016114051.1963197-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 75cdae446ddffe0a6a991bbb146dee51d9d4c865 Author: Roy Vegard Ovesen Date: Mon Oct 20 22:15:08 2025 +0200 ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c The log messages for the PreSonus STUDIO 1810c about device_setup are not applicable to the 1824c, and should not be logged when 1824c initializes. Refactor from if statement to switch statement as there might be more STUDIO series devices added later. Fixes: 080564558eb1 ("ALSA: usb-audio: enable support for Presonus Studio 1824c within 1810c file") Signed-off-by: Roy Vegard Ovesen Link: https://patch.msgid.link/aPaYTP7ceuABf8c7@ark Signed-off-by: Takashi Iwai commit 1eb42bacd7cebede5d317569e4b874b54e5c41d6 Author: Frank Li Date: Fri Oct 17 16:39:46 2025 -0400 arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes The msi-map property was incorrectly applied to pcie0-ep instead of pcie1-ep. Correct the msi-map for both pcie0-ep and pcie1-ep nodes. Fixes: bbe4b2f7d6533 ("arm64: dts: imx95: Add msi-map for pci-ep device") Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit ec4daace64a44b53df76f0629e82684ef09ce869 Author: João Paulo Gonçalves Date: Tue Oct 14 09:56:43 2025 -0300 arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred The gpio0_mipi_csi DT nodes are enabled by default, but they are dependent on the irqsteer_csi nodes, which are not enabled. This causes the gpio0_mipi_csi GPIOs to be probe deferred. Since these GPIOs can be used independently of the CSI controller, enable irqsteer_csi by default too to prevent them from being deferred and to ensure they work out of the box. Fixes: 2217f8243714 ("arm64: dts: imx8: add capture controller for i.MX8's img subsystem") Signed-off-by: João Paulo Gonçalves Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ff7b5a27438275e4fd8c4809d815638c829fe520 Author: Andreas Kemnade Date: Mon Oct 13 14:17:09 2025 +0200 arm: imx_v6_v7_defconfig: enable ext4 directly In former times, ext4 was enabled implicitely by enabling ext3 but with the ext3 fs gone, it does not get enabled, which lets devices fail to mount root on non-initrd based boots with an ext4 root. Fixes: d6ace46c82fd ("ext4: remove obsolete EXT3 config options") Signed-off-by: Andreas Kemnade Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit f574069c5c55ebe642f899a01c8f127d845fd562 Author: Stefan Metzmacher Date: Mon Oct 20 16:07:53 2025 +0200 smb: server: let smb_direct_cm_handler() call ib_drain_qp() after smb_direct_disconnect_rdma_work() All handlers triggered by ib_drain_qp() should already see the broken connection. smb_direct_cm_handler() is called under a mutex of the rdma_cm, we should make sure ib_drain_qp() and all rdma layer logic completes and unlocks the mutex. It means free_transport() will also already see the connection as SMBDIRECT_SOCKET_DISCONNECTED, so we need to call crdma_[un]lock_handler(sc->rdma.cm_id) around ib_drain_qp(), rdma_destroy_qp(), ib_free_cq() and ib_dealloc_pd(). Otherwise we free resources while the ib_drain_qp() within smb_direct_cm_handler() is still running. We have to unlock before rdma_destroy_id() as it locks again. Fixes: 141fa9824c0f ("ksmbd: call ib_drain_qp when disconnected") Fixes: 4c564f03e23b ("smb: server: make use of common smbdirect_socket") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 975f05a7647720b6a82dac73463eaeca3067de71 Author: Stefan Metzmacher Date: Mon Oct 20 16:07:13 2025 +0200 smb: server: call smb_direct_post_recv_credits() when the negotiation is done We now activate sc->recv_io.posted.refill_work and sc->idle.immediate_work only after a successful negotiation, before sending the negotiation response. It means the queue_work(sc->workqueue, &sc->recv_io.posted.refill_work) in put_recvmsg() of the negotiate request, is a no-op now. It also means our explicit smb_direct_post_recv_credits() will have queue_work(sc->workqueue, &sc->idle.immediate_work) as no-op. This should make sure we don't have races and post any immediate data_transfer message that tries to grant credits to the peer, before we send the negotiation response, as that will grant the initial credits to the peer. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Fixes: 1cde0a74a7a8 ("smb: server: don't use delayed_work for post_recv_credits_work") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6f40e50ceb99fc8ef37e5c56e2ec1d162733fef0 Author: Qianchang Zhao Date: Wed Oct 22 15:27:47 2025 +0900 ksmbd: transport_ipc: validate payload size before reading handle handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing. This is a minimal fix to guard the initial handle read. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reported-by: Qianchang Zhao Signed-off-by: Qianchang Zhao Acked-by: Namjae Jeon Signed-off-by: Steve French commit f765fdfcd8b5bce92c6aa1a517ff549529ddf590 Author: Steve French Date: Fri Oct 24 21:17:01 2025 -0500 cifs: fix typo in enable_gcm_256 module parameter Fix typo in description of enable_gcm_256 module parameter Suggested-by: Thomas Spear Signed-off-by: Steve French commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa Author: Linus Torvalds Date: Sun Oct 26 15:59:49 2025 -0700 Linux 6.18-rc3 commit 4bb1f7e19c4a1d6eeb52b80acff5ac63edd1b91d Merge: 40282418e17e19 a8cc9e5fcb0e2e Author: Linus Torvalds Date: Sun Oct 26 10:33:46 2025 -0700 Merge tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc/android driver fixes for 6.18-rc3 for reported issues. Included in here are: - rust binder fixes for reported issues - mei device id addition - mei driver fixes - comedi bugfix - most usb driver bugfixes - fastrpc memory leak fix All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: most: usb: hdm_probe: Fix calling put_device() before device initialization most: usb: Fix use-after-free in hdm_disconnect binder: remove "invalid inc weak" check mei: txe: fix initialization order comedi: fix divide-by-zero in comedi_buf_munge() mei: late_bind: Fix -Wincompatible-function-pointer-types-strict misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup mei: me: add wildcat lake P DID misc: amd-sbi: Clarify that this is a BMC driver nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE binder: Fix missing kernel-doc entries in binder.c rust_binder: report freeze notification only when fully frozen rust_binder: don't delete FreezeListener if there are pending duplicates rust_binder: freeze_notif_done should resend if wrong state rust_binder: remove warning about orphan mappings rust_binder: clean `clippy::mem_replace_with_default` warning commit 40282418e17e194fe70478025387cf89f8cfaf8e Merge: aa6085a06716db b1aabb8ef09b4c Author: Linus Torvalds Date: Sun Oct 26 10:29:45 2025 -0700 Merge tag 'staging-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for the gpib subsystem to resolve some reported issues. Included in here are: - memory leak fixes - error code fixes - proper protocol fixes All of these have been in linux-next for almost 2 weeks now with no reported issues" * tag 'staging-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: gpib: Fix device reference leak in fmh_gpib driver staging: gpib: Return -EINTR on device clear staging: gpib: Fix sending clear and trigger events staging: gpib: Fix no EOI on 1 and 2 byte writes commit aa6085a06716dbfa9b01c0235cc36f1e9b3e1e3e Merge: 6190d0fa18995b d518314a1fa4e9 Author: Linus Torvalds Date: Sun Oct 26 10:24:39 2025 -0700 Merge tag 'tty-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for reported issues. Included in here are: - sh-sci serial driver fixes - 8250_dw and _mtk driver fixes - sc16is7xx driver bugfix - new 8250_exar device ids added All of these have been in linux-next this past week with no reported issues" * tag 'tty-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250_mtk: Enable baud clock and manage in runtime PM serial: 8250_dw: handle reset control deassert error dt-bindings: serial: sh-sci: Fix r8a78000 interrupts serial: sc16is7xx: remove useless enable of enhanced features serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 tty: serial: sh-sci: fix RSCI FIFO overrun handling commit 6190d0fa18995b8bcc6b9a26913bb8390bda8396 Merge: dbfc6422a34d6c a1b866f2018748 Author: Linus Torvalds Date: Sun Oct 26 10:21:13 2025 -0700 Merge tag 'usb-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB driver fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 6.18-rc3. Included in here are: - new option serial driver device ids added - dt bindings fixes for numerous platforms - xhci bugfixes for many reported regressions - usbio dependency bugfix - dwc3 driver fix - raw-gadget bugfix All of these have been in linux-next this week with no reported issues" * tag 'usb-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C tcpm: switch check for role_sw device with fw_node usb/core/quirks: Add Huawei ME906S to wakeup quirk usb: raw-gadget: do not limit transfer length USB: serial: option: add UNISOC UIS7720 xhci: dbc: enable back DbC in resume if it was enabled before suspend xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event usb: xhci-pci: Fix USB2-only root hub registration dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100 usb: misc: Add x86 dependency for Intel USBIO driver dt-bindings: usb: switch: split out ports definition usb: dwc3: Don't call clk_bulk_disable_unprepare() twice dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp commit dbfc6422a34d6cb28e5c0432af309b24f66ef27e Merge: 5fee0dafba0a52 84dfce65a7ae7b Author: Linus Torvalds Date: Sun Oct 26 09:57:18 2025 -0700 Merge tag 'x86_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Remove dead code leftovers after a recent mitigations cleanup which fail a Clang build - Make sure a Retbleed mitigation message is printed only when necessary - Correct the last Zen1 microcode revision for which Entrysign sha256 check is needed - Fix a NULL ptr deref when mounting the resctrl fs on a system which supports assignable counters but where L3 total and local bandwidth monitoring has been disabled at boot * tag 'x86_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Remove dead code which might prevent from building x86/bugs: Qualify RETBLEED_INTEL_MSG x86/microcode: Fix Entrysign revision check for Zen1/Naples x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode commit 5fee0dafba0a5223fa1c1f0dd99af71256449d38 Merge: af8159515fe160 ef3330b99c01bd Author: Linus Torvalds Date: Sun Oct 26 09:54:36 2025 -0700 Merge tag 'irq_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Restore the original buslock locking in a couple of places in the irq core subsystem after a rework * tag 'irq_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/manage: Add buslock back in to enable_irq() genirq/manage: Add buslock back in to __disable_irq_nosync() genirq/chip: Add buslock back in to irq_set_handler() commit af8159515fe16070aefa3ff56a44a5e7fb179dd2 Merge: 1bc9743b6452cb 49c98f30f4021b Author: Linus Torvalds Date: Sun Oct 26 09:44:36 2025 -0700 Merge tag 'objtool_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Borislav Petkov: - Fix x32 build due to wrong format specifier on that sub-arch - Add one more Rust noreturn function to objtool's list * tag 'objtool_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix failure when being compiled on x32 system objtool/rust: add one more `noreturn` Rust function commit 1bc9743b6452cb5a4d09944bd3d6e33b074bb22d Merge: 7ea5092f5208d1 0e4a169d1a2b63 Author: Linus Torvalds Date: Sun Oct 26 09:42:19 2025 -0700 Merge tag 'sched_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Make sure a CFS runqueue on a throttled hierarchy has its PELT clock throttled otherwise task movement and manipulation would lead to dangling cfs_rq references and an eventual crash * tag 'sched_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Start a cfs_rq on throttled hierarchy with PELT clock throttled commit 7ea5092f5208d1758926ca54941f8a8ad49736b5 Merge: 72761a7e312259 39a9ed0fb6dac5 Author: Linus Torvalds Date: Sun Oct 26 09:40:16 2025 -0700 Merge tag 'timers_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Borislav Petkov: - Do not create more than eight (max supported) AUX clocks sysfs hierarchies * tag 'timers_urgent_for_v6.18_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timekeeping: Fix aux clocks sysfs initialization loop bound commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 Author: Thomas Zimmermann Date: Fri Oct 17 11:13:36 2025 +0200 drm/sysfb: Do not dereference NULL pointer in plane reset The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not deref that pointer, but forward NULL to the other plane-reset helpers. Clears plane->state to NULL. v2: - fix typo in commit description (Javier) Signed-off-by: Thomas Zimmermann Fixes: b71565022031 ("drm/gem: Export implementation of shadow-plane helpers") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/aPIDAsHIUHp_qSW4@stanley.mountain/ Cc: Thomas Zimmermann Cc: Melissa Wen Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Simona Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v5.15+ Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20251017091407.58488-1-tzimmermann@suse.de commit 5ff90d427ef841fa48608d0c19a81c48d6126d46 Author: James Le Cuirot Date: Thu Oct 16 10:14:17 2025 +0100 kbuild: install-extmod-build: Fix when given dir outside the build dir Commit b5e395653546 ("kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT") tried to address the "build" variable expecting a relative path by using `realpath --relative-base=.`, but this only works when the given directory is below the current directory. `realpath --relative-to=.` will return a relative path in all cases. Fixes: b5e395653546 ("kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT") Signed-off-by: James Le Cuirot Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251016091417.9985-1-chewi@gentoo.org Signed-off-by: Nathan Chancellor commit 72761a7e31225971d0b29d9195e0ffa986b77867 Merge: 818444a61bd87d 2eead19334516c Author: Linus Torvalds Date: Sat Oct 25 11:03:46 2025 -0700 Merge tag 'driver-core-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - In Device::parent(), do not make any assumptions on the device context of the parent device - Check visibility before changing ownership of a sysfs attribute group - In topology_parse_cpu_capacity(), replace an incorrect usage of PTR_ERR_OR_ZERO() with IS_ERR_OR_NULL() - In devcoredump, fix a circular locking dependency between struct devcd_entry::mutex and kernfs - Do not warn about a pending fw_devlink sync state * tag 'driver-core-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() rust: device: fix device context of Device::parent() sysfs: check visibility before changing group attribute ownership devcoredump: Fix circular locking dependency with devcd->mutex. driver core: fw_devlink: Don't warn about sync_state() pending commit 818444a61bd87d8b72c93448a62be2406b92ec33 Merge: 9bb956508c9d94 73ba88fb040813 Author: Linus Torvalds Date: Sat Oct 25 10:58:32 2025 -0700 Merge tag 'firewire-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "A small collection of FireWire fixes. This includes corrections to sparse and API documentation" * tag 'firewire-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: init_ohci1394_dma: add missing function parameter documentation firewire: core: fix __must_hold() annotation commit 00d5f09719aa6c37545be5c05d25a1eaf8f3da7e Author: Rob Clark Date: Wed Oct 22 15:20:38 2025 -0700 drm/msm: Ensure vm is created in VM_BIND ioctl Since the vm is lazily created, to allow userspace to opt-in to a VM_BIND context, we can't assume it is already created. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/682939/ Message-ID: <20251022222039.9937-1-robin.clark@oss.qualcomm.com> commit 73b7e48a87c79fd6df40aeafcd3994287e31e25f Author: Rob Clark Date: Wed Oct 22 15:20:51 2025 -0700 drm/msm: Reject MAP_NULL op if no PRR We need PRR support in order to implement MAP_NULL. Userspace shouldn't be trying to use this if it is unsupported. Reported-by: Valentine Burley Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37935#note_3153730 Signed-off-by: Rob Clark Tested-by: Valentine Burley Patchwork: https://patchwork.freedesktop.org/patch/682941/ Message-ID: <20251022222051.10030-1-robin.clark@oss.qualcomm.com> commit 9bb956508c9d94935bedba4f13901fb2b7468e91 Merge: 27c0b5c4f67aeb b7776a802f2f80 Author: Linus Torvalds Date: Sat Oct 25 09:35:26 2025 -0700 Merge tag 'riscv-for-linus-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Close a race during boot between userspace vDSO usage and some late-initialized vDSO data - Improve performance on systems with non-CPU-cache-coherent DMA-capable peripherals by enabling write combining on pgprot_dmacoherent() allocations - Add human-readable detail for RISC-V IPI tracing - Provide more information to zsmalloc on 64-bit RISC-V to improve allocation - Silence useless boot messages about CPUs that have been disabled in DT - Resolve some compiler and smatch warnings and remove a redundant macro * tag 'riscv-for-linus-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb() riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot riscv: add a forward declaration for cpuinfo_op RISC-V: Don't print details of CPUs disabled in DT riscv: Remove the PER_CPU_OFFSET_SHIFT macro riscv: mm: Define MAX_POSSIBLE_PHYSMEM_BITS for zsmalloc riscv: Register IPI IRQs with unique names ACPI: RIMT: Fix unused function warnings when CONFIG_IOMMU_API is disabled RISC-V: Define pgprot_dmacoherent() for non-coherent devices commit 27c0b5c4f67aeb73edd515200bd1e0c82a3ee892 Merge: 566771afc7a81e f477af0cfa0487 Author: Linus Torvalds Date: Sat Oct 25 09:31:13 2025 -0700 Merge tag 'xfs-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "The main highlight here is a fix for a bug brought in by the removal of attr2 mount option, where some installations might actually have 'attr2' explicitly configured in fstab preventing system to boot by not being able to remount the rootfs as RW. Besides that there are a couple fix to the zonefs implementation, changing XFS_ONLINE_SCRUB_STATS to depend on DEBUG_FS (was select before), and some other minor changes" * tag 'xfs-fixes-6.18-rc3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix locking in xchk_nlinks_collect_dir xfs: loudly complain about defunct mount options xfs: always warn about deprecated mount options xfs: don't set bt_nr_sectors to a negative number xfs: don't use __GFP_NOFAIL in xfs_init_fs_context xfs: cache open zone in inode->i_private xfs: avoid busy loops in GCD xfs: XFS_ONLINE_SCRUB_STATS should depend on DEBUG_FS xfs: do not tightly pack-write large files xfs: Improve CONFIG_XFS_RT Kconfig help commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f Author: Emanuele Ghidoli Date: Thu Oct 23 16:48:53 2025 +0200 net: phy: dp83867: Disable EEE support as not implemented While the DP83867 PHYs report EEE capability through their feature registers, the actual hardware does not support EEE (see Links). When the connected MAC enables EEE, it causes link instability and communication failures. The issue is reproducible with a iMX8MP and relevant stmmac ethernet port. Since the introduction of phylink-managed EEE support in the stmmac driver, EEE is now enabled by default, leading to issues on systems using the DP83867 PHY. Call phy_disable_eee during phy initialization to prevent EEE from being enabled on DP83867 PHYs. Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") Cc: stable@vger.kernel.org Signed-off-by: Emanuele Ghidoli Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com Signed-off-by: Jakub Kicinski commit 566771afc7a81e343da9939f0bd848d3622e2501 Merge: 53abe3e1c15462 dd6940f5c7dbee Author: Linus Torvalds Date: Fri Oct 24 18:50:15 2025 -0700 Merge tag 'v6.18-rc2-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "smbdirect (RDMA) fixes in order avoid potential submission queue overflows: - free transport teardown fix - credit related fixes (five server related, one client related)" * tag 'v6.18-rc2-smb-server-fixes' of git://git.samba.org/ksmbd: smb: server: let free_transport() wait for SMBDIRECT_SOCKET_DISCONNECTED smb: client: make use of smbdirect_socket.send_io.lcredits.* smb: server: make use of smbdirect_socket.send_io.lcredits.* smb: server: simplify sibling_list handling in smb_direct_flush_send_list/send_done smb: server: smb_direct_disconnect_rdma_connection() already wakes all waiters on error smb: smbdirect: introduce smbdirect_socket.send_io.lcredits.* smb: server: allocate enough space for RW WRs and ib_drain_qp() commit 53abe3e1c154628cc74e33a1bfcd865656e433a5 Author: Andy Shevchenko Date: Wed Oct 15 11:19:34 2025 +0200 sched: Remove never used code in mm_cid_get() Clang is not happy with set but unused variable (this is visible with `make W=1` build: kernel/sched/sched.h:3744:18: error: variable 'cpumask' set but not used [-Werror,-Wunused-but-set-variable] It seems like the variable was never used along with the assignment that does not have side effects as far as I can see. Remove those altogether. Fixes: 223baf9d17f2 ("sched: Fix performance regression introduced by mm_cid") Signed-off-by: Andy Shevchenko Tested-by: Eric Biggers Reviewed-by: Breno Leitao Signed-off-by: Linus Torvalds commit 3d08a425d2f667edf9ab7f9c3d999c218a96ba6f Merge: 31009296f8ff7f 18b1ce0b29c418 Author: Linus Torvalds Date: Fri Oct 24 16:49:16 2025 -0700 Merge tag 'drm-fixes-2025-10-24' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "Very quiet, all just small stuff and nothing scary pending to my knowledge: - drm_panic: bunch of size calculation fixes - pantor: fix kernel panic on partial gpu va unmap - rockchip: hdmi hotplug setup fix - amdgpu: dp mst, dc/display fixes - i915: fix panic structure leak - xe: madvise uapi fix, wq alloc error, vma flag handling fix" * tag 'drm-fixes-2025-10-24' of https://gitlab.freedesktop.org/drm/kernel: drm/xe: Check return value of GGTT workqueue allocation drm/amd/display: use GFP_NOWAIT for allocation in interrupt handler drm/amd/display: increase max link count and fix link->enc NULL pointer access drm/amd/display: Fix NULL pointer dereference drm/panic: Fix 24bit pixel crossing page boundaries drm/panic: Fix divide by 0 if the screen width < font width drm/panic: Fix kmsg text drawing rectangle drm/panic: Fix qr_code, ensure vmargin is positive drm/panic: Fix overlap between qr code and logo drm/panic: Fix drawing the logo on a small narrow screen drm/xe/uapi: Hide the madvise autoreset behind a VM_BIND flag drm/xe: Retain vma flags when recreating and splitting vmas for madvise drm/i915/panic: fix panic structure allocation memory leak drm/panthor: Fix kernel panic on partial unmap of a GPU VA region drm/rockchip: dw_hdmi: use correct SCLIN mask for RK3228 commit 31009296f8ff7f4cc8feec9bc02b87573b2aceeb Merge: 7083bb6060a99a df5192d9bb0e38 Author: Linus Torvalds Date: Fri Oct 24 16:43:08 2025 -0700 Merge tag 'pci-v6.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Add DWC custom pci_ops for the root bus instead of overwriting the DBI base address, which broke drivers that rely on the DBI address for iATU programming; fixes an FU740 probe regression (Krishna Chaitanya Chundru) - Revert qcom ECAM enablement, which is rendered unnecessary by the DWC custom pci_ops (Krishna Chaitanya Chundru) - Fix longstanding MIPS Malta resource registration issues to avoid exposing them when the next commit fixes the boot failure (Maciej W. Rozycki) - Use pcibios_align_resource() on MIPS Malta to fix boot failure caused by using the generic pci_enable_resources() (Ilpo Järvinen) - Enable only ASPM L0s and L1, not L1 PM Substates, for devicetree platforms because we lack information required to configure L1 Substates; fixes regressions on powerpc and rockchip. A qcom regression (L1 Substates no longer enabled) remains and will be addressed next (Bjorn Helgaas) * tag 'pci-v6.18-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/ASPM: Enable only L0s and L1 for devicetree platforms MIPS: Malta: Use pcibios_align_resource() to block io range MIPS: Malta: Fix PCI southbridge legacy resource reservations MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering Revert "PCI: qcom: Prepare for the DWC ECAM enablement" PCI: dwc: Use custom pci_ops for root bus DBI vs ECAM config access commit 73ba88fb04081372a69f0395958ac6b65d53d134 Author: Nirbhay Sharma Date: Sat Oct 25 02:02:19 2025 +0530 firewire: init_ohci1394_dma: add missing function parameter documentation Add missing kernel-doc parameter descriptions for five functions in init_ohci1394_dma.c to fix documentation warnings when building with W=1. This patch addresses the following warnings: - init_ohci1394_wait_for_busresets: missing @ohci description - init_ohci1394_enable_physical_dma: missing @ohci description - init_ohci1394_reset_and_init_dma: missing @ohci description - init_ohci1394_controller: missing @num, @slot, @func descriptions - setup_ohci1394_dma: missing @opt description Tested with GCC 13.2.0 and W=1 flag. All documentation warnings for these functions have been resolved. Signed-off-by: Nirbhay Sharma Link: https://lore.kernel.org/r/20251024203219.101990-2-nirbhay.lkd@gmail.com Signed-off-by: Takashi Sakamoto commit 7083bb6060a99a4c7e60e710b70a2ea8fb2d524c Merge: f2b246572699a6 1af424b15401d2 Author: Linus Torvalds Date: Fri Oct 24 15:51:24 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Avoid some false-positive KMSAN warnings by restoring the dependency of the architecture-optimized Poly1305 code on !KMSAN" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: poly1305: Restore dependency of arch code on !KMSAN commit f2b246572699a66eded2cf7afc46f53837878f14 Merge: d2818517e3486d 64c9471aa9ded2 Author: Linus Torvalds Date: Fri Oct 24 15:48:08 2025 -0700 Merge tag '6.18-rc2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - add missing tracepoints - smbdirect (RDMA) fix - fix potential issue with credits underflow - rename fix - improvement to calc_signature and additional cleanup patch * tag '6.18-rc2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: #include cifsglob.h before trace.h to allow structs in tracepoints cifs: Call the calc_signature functions directly smb: client: get rid of d_drop() in cifs_do_rename() cifs: Fix TCP_Server_Info::credits to be signed cifs: Add a couple of missing smb3_rw_credits tracepoints smb: client: allocate enough space for MR WRs and ib_drain_qp() commit d2818517e3486d11c9bd55aca3e14059e4c69886 Merge: 812e7eb2b0741b 4c8cf6bd28d6fe Author: Linus Torvalds Date: Fri Oct 24 12:48:19 2025 -0700 Merge tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix dma alignment for PI - Fix selinux bogosity with nbd, where sendmsg would get rejected * tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: require LBA dma_alignment when using PI nbd: override creds to kernel when calling sock_{send,recv}msg() commit 812e7eb2b0741bb4a94f2b8c9b789ba5d693eedf Merge: 66cd8e9cb81015 6f1cbf6d6fd13f Author: Linus Torvalds Date: Fri Oct 24 12:44:31 2025 -0700 Merge tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Add MAINTAINERS entry for zcrx, mostly so that netdev gets automatically CC'ed by default on any changes there too. - Fix for the SQPOLL busy vs work time accounting. It was using getrusage(), which was both broken from a thread point of view (we only care about the SQPOLL thread itself), and vastly overkill as only the systime was used. On top of that, also be a bit smarter in when it's queried. It used excessive CPU before this change. Marked for stable as well. - Fix provided ring buffer auto commit for uring_cmd. - Fix a few style issues and sparse annotation for a lock. * tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix buffer auto-commit for multishot uring_cmd io_uring: correct __must_hold annotation in io_install_fixed_file io_uring zcrx: add MAINTAINERS entry io_uring: Fix code indentation error io_uring/sqpoll: be smarter on when to update the stime usage io_uring/sqpoll: switch away from getrusage() for CPU accounting io_uring: fix incorrect unlikely() usage in io_waitid_prep() commit 66cd8e9cb81015a2ec7f9dfb83db7d7915587eef Merge: 2e590d67c2d803 7f434e1d9a17ca Author: Linus Torvalds Date: Fri Oct 24 12:40:51 2025 -0700 Merge tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Two fixes for race conditions in obj_exts allocation (Hao Ge) - Fix for slab accounting imbalance due to deferred slab decativation (Vlastimil Babka) * tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: Fix obj_ext mistakenly considered NULL due to race condition slab: fix slab accounting imbalance due to defer_deactivate_slab() slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts commit 2e590d67c2d803d603ac00b85f2fab235df52a1b Merge: 9b9b6e71ee23da 7209ff31008331 Author: Linus Torvalds Date: Fri Oct 24 11:17:38 2025 -0700 Merge tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix handling of GICv5 ITS MSI properties on platforms with 'msi-parent' as well as a of_node refcounting fix. This is also preparation for further refactoring in 6.19 to use common DT parsing of MSI properties. * tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/irq: Export of_msi_xlate() for module usage of/irq: Fix OF node refcount in of_msi_get_domain() of/irq: Add msi-parent check to of_msi_xlate() commit 9b9b6e71ee23da4ac5191dd9c5ba8dfe778cde36 Merge: 7bd29bf1fda493 b2a578f3127ab9 Author: Linus Torvalds Date: Fri Oct 24 11:15:17 2025 -0700 Merge tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The main change this time is an update to the MAINTAINERS file, listing Krzysztof Kozlowski, Alexandre Belloni, and Linus Walleij as additional maintainers for the SoC tree, in order to go back to a group maintainership. Drew Fustini joins as an additional reviewer for the SoC tree. Thanks to all of you for volunteering to help out. On the actual bugfixes, we have a few correctness changes for firmware drivers (qtee, arm-ffa, scmi) and two devicetree fixes for Raspberry Pi" * tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: soc: officially expand maintainership team firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode firmware: arm_scmi: Skip RAW initialization on failure include: trace: Fix inflight count helper on failed initialization firmware: arm_scmi: Account for failed debug initialization ARM: dts: broadcom: rpi: Switch to V3D firmware clock arm64: dts: broadcom: bcm2712: Define VGIC interrupt firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor tee: QCOMTEE should depend on ARCH_QCOM tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails tee: qcom: prevent potential off by one read commit 7bd29bf1fda493fd122924b158869a3b43e14887 Merge: 58834e2d3ed49d 8dcc66ad379ec0 Author: Linus Torvalds Date: Fri Oct 24 11:11:35 2025 -0700 Merge tag 'hwmon-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - cgbc-hwmon: Add missing NULL check after devm_kzalloc - gpd-fan: Fix error handling - pmbus/isl68137: Fix child node reference leak - pmbus/max34440: Update adpm12160 coefficients to match latest FW - sht3x: Fix error handling * tag 'hwmon-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (sht3x) Fix error handling hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() hwmon: (pmbus/isl68137) Fix child node reference leak on early return hwmon: (gpd-fan) Fix error handling in gpd_fan_probe() hwmon: (gpd-fan) Fix return value when platform_get_resource() fails hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW commit 58834e2d3ed49d4424821d75b7eac90795212acb Merge: c1a1c0d32d5b6d 1b824134261d2d Author: Linus Torvalds Date: Fri Oct 24 11:01:40 2025 -0700 Merge tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A moderately large collection of device specific changes here, mostly fixes but also including a few new quirks and device IDs. This is all fairly routine even for the affected devices" * tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spi-rockchip: Add RK3506 compatible spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash spi: intel-pci: Add support for Arrow Lake-H SPI serial flash spi: intel: Add support for 128M component density spi: airoha: fix reading/writing of flashes with more than one plane per lun spi: airoha: switch back to non-dma mode in the case of error spi: airoha: add support of dual/quad wires spi modes to exec_op() handler spi: airoha: return an error for continuous mode dirmap creation cases spi: amlogic: fix spifc build error spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection spi: spi-nxp-fspi: add extra delay after dll locked spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate spi: dw-mmio: add error handling for reset_control_deassert() spi: rockchip-sfc: Fix DMA-API usage spi: dt-bindings: cadence: add soc-specific compatible strings for zynqmp and versal-net commit c1a1c0d32d5b6dd219f9b9e7c51ed4c69882fe62 Merge: 6fab32bb6508ab 4c4e6ea4a120cc Author: Linus Torvalds Date: Fri Oct 24 10:45:29 2025 -0700 Merge tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix regressions in regmap cache initialization in gpio-104-idio-16 and gpio-pci-idio-16 - configure first 16 GPIO lines of the IDIO-16 as fixed outputs - fix duplicated IRQ mapping that can lead to an RCU stall in gpio-ljca - fix printf formatters passed to dev_err() and make failure to set debounce period non fatal * tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: ljca: Fix duplicated IRQ mapping gpiolib: acpi: Use %pe when passing an error pointer to dev_err() gpiolib: acpi: Make set debounce errors non fatal gpio: idio-16: Define fixed direction of the GPIO lines gpio: regmap: add the .fixed_direction_output configuration parameter gpio: pci-idio-16: Define maximum valid register address offset gpio: 104-idio-16: Define maximum valid register address offset commit b2a578f3127ab9ef80114cef9b20a2b42a8ee77a Author: Arnd Bergmann Date: Fri Oct 17 16:08:24 2025 +0200 soc: officially expand maintainership team Since Olof moved on from the soc tree maintenance, Arnd has mainly taken care of the day-to-day activities around the SoC tree by himself, which is generally not a good setup. Krzysztof, Linus and Alexandre have volunteered to become co-maintainers of the SoC tree, with the plan of taking turns to do merges and reviews to spread the workload. In addition, Drew joins as another reviewer. Acked-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Acked-by: Linus Walleij Acked-by: Drew Fustini Signed-off-by: Arnd Bergmann commit 8ce93aabbf75171470e3d1be56bf1a6937dc5db8 Author: Malin Jonsson Date: Fri Oct 24 17:14:36 2025 +0200 bpf: Conditionally include dynptr copy kfuncs Since commit a498ee7576de ("bpf: Implement dynptr copy kfuncs"), if CONFIG_BPF_EVENTS is not enabled, but BPF_SYSCALL and DEBUG_INFO_BTF are, the build will break like so: BTFIDS vmlinux.unstripped WARN: resolve_btfids: unresolved symbol bpf_probe_read_user_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_user_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_kernel_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_probe_read_kernel_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_task_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_task_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_str_dynptr WARN: resolve_btfids: unresolved symbol bpf_copy_from_user_dynptr make[2]: *** [scripts/Makefile.vmlinux:72: vmlinux.unstripped] Error 255 make[2]: *** Deleting file 'vmlinux.unstripped' make[1]: *** [/repo/malin/upstream/linux/Makefile:1242: vmlinux] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Guard these symbols with #ifdef CONFIG_BPF_EVENTS to resolve the problem. Fixes: a498ee7576de ("bpf: Implement dynptr copy kfuncs") Reported-by: Yong Gu Acked-by: Mykyta Yatsenko Signed-off-by: Malin Jonsson Link: https://lore.kernel.org/r/20251024151436.139131-1-malin.jonsson@est.tech Signed-off-by: Alexei Starovoitov commit 84dfce65a7ae7b11c7b13285a1b23e9a94ad37b7 Author: Andy Shevchenko Date: Fri Oct 24 14:59:59 2025 +0200 x86/bugs: Remove dead code which might prevent from building Clang, in particular, is not happy about dead code: arch/x86/kernel/cpu/bugs.c:1830:20: error: unused function 'match_option' [-Werror,-Wunused-function] 1830 | static inline bool match_option(const char *arg, int arglen, const char *opt) | ^~~~~~~~~~~~ 1 error generated. Remove a leftover from the previous cleanup. Fixes: 02ac6cc8c5a1 ("x86/bugs: Simplify SSB cmdline parsing") Signed-off-by: Andy Shevchenko Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251024125959.1526277-1-andriy.shevchenko%40linux.intel.com commit 033559473dd3b55558b535aa37b8848c207b5cbb Author: Akash Goel Date: Tue Oct 21 17:09:51 2025 +0100 dma-fence: Fix safe access wrapper to call timeline name method This commit fixes the wrapper function dma_fence_timeline_name(), that was added for safe access, to actually call the timeline name method of dma_fence_ops. Cc: # v6.17+ Signed-off-by: Akash Goel Fixes: 506aa8b02a8d ("dma-fence: Add safe access helpers and document the rules") Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251021160951.1415603-1-akash.goel@arm.com commit 8c5fa3764facaad6d38336e90f406c2c11d69733 Author: Fangyu Yu Date: Tue Oct 21 22:21:31 2025 +0800 RISC-V: KVM: Remove automatic I/O mapping for VM_PFNMAP As of commit aac6db75a9fc ("vfio/pci: Use unmap_mapping_range()"), vm_pgoff may no longer guaranteed to hold the PFN for VM_PFNMAP regions. Using vma->vm_pgoff to derive the HPA here may therefore produce incorrect mappings. Instead, I/O mappings for such regions can be established on-demand during g-stage page faults, making the upfront ioremap in this path is unnecessary. Fixes: aac6db75a9fc ("vfio/pci: Use unmap_mapping_range()") Signed-off-by: Fangyu Yu Tested-by: Daniel Henrique Barboza Reviewed-by: Guo Ren Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251021142131.78796-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit 91d35ec9b3956d6b3cf789c1593467e58855b03a Author: Johan Hovold Date: Thu Oct 23 14:05:30 2025 +0200 Bluetooth: rfcomm: fix modem control handling The RFCOMM driver confuses the local and remote modem control signals, which specifically means that the reported DTR and RTS state will instead reflect the remote end (i.e. DSR and CTS). This issue dates back to the original driver (and a follow-on update) merged in 2002, which resulted in a non-standard implementation of TIOCMSET that allowed controlling also the TS07.10 IC and DV signals by mapping them to the RI and DCD input flags, while TIOCMGET failed to return the actual state of DTR and RTS. Note that the bogus control of input signals in tiocmset() is just dead code as those flags will have been masked out by the tty layer since 2003. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz commit 751463ceefc3397566d03c8b64ef4a77f5fd88ac Author: Luiz Augusto von Dentz Date: Wed Oct 22 16:03:19 2025 -0400 Bluetooth: hci_core: Fix tracking of periodic advertisement Periodic advertising enabled flag cannot be tracked by the enabled flag since advertising and periodic advertising each can be enabled/disabled separately from one another causing the states to be inconsistent when for example an advertising set is disabled its enabled flag is set to false which is then used for periodic which has not being disabled. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Luiz Augusto von Dentz commit 857eb0fabc389be5159e0e17d84bc122614b5b98 Author: Luiz Augusto von Dentz Date: Wed Oct 22 16:29:41 2025 -0400 Bluetooth: hci_conn: Fix connection cleanup with BIG with 2 or more BIS This fixes bis_cleanup not considering connections in BT_OPEN state before attempting to remove the BIG causing the following error: btproxy[20110]: < HCI Command: LE Terminate Broadcast Isochronous Group (0x08|0x006a) plen 2 BIG Handle: 0x01 Reason: Connection Terminated By Local Host (0x16) > HCI Event: Command Status (0x0f) plen 4 LE Terminate Broadcast Isochronous Group (0x08|0x006a) ncmd 1 Status: Unknown Advertising Identifier (0x42) Fixes: fa224d0c094a ("Bluetooth: ISO: Reassociate a socket with an active BIS") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit b489556a856d31f1eb73972150f371d2e4ce1de8 Author: Calvin Owens Date: Thu Oct 23 11:47:19 2025 -0700 Bluetooth: fix corruption in h4_recv_buf() after cleanup A different structure is stored in drvdata for the drivers which used that duplicate function, but h4_recv_buf() assumes drvdata is always an hci_uart structure. Consequently, alignment and padding are now randomly corrupted for btmtkuart, btnxpuart, and bpa10x in h4_recv_buf(), causing erratic breakage. Fix this by making the hci_uart structure the explicit argument to h4_recv_buf(). Every caller already has a reference to hci_uart, and already obtains the hci_hdev reference through it, so this actually eliminates a redundant pointer indirection for all existing callers. Fixes: 93f06f8f0daf ("Bluetooth: remove duplicate h4_recv_buf() in header") Reported-by: Francesco Valla Closes: https://lore.kernel.org/lkml/6837167.ZASKD2KPVS@fedora.fritz.box/ Signed-off-by: Calvin Owens Signed-off-by: Luiz Augusto von Dentz commit 057b6ca5961203f16a2a02fb0592661a7a959a84 Author: Kiran K Date: Thu Oct 16 10:00:43 2025 +0530 Bluetooth: btintel_pcie: Fix event packet loss issue In the current btintel_pcie driver implementation, when an interrupt is received, the driver checks for the alive cause before the TX/RX cause. Handling the alive cause involves resetting the TX/RX queue indices. This flow works correctly when the causes are mutually exclusive. However, if both cause bits are set simultaneously, the alive cause resets the queue indices, resulting in an event packet drop and a command timeout. To fix this issue, the driver is modified to handle all other causes before checking for the alive cause. Test case: Issue is seen with stress reboot scenario - 50x run [20.337589] Bluetooth: hci0: Device revision is 0 [20.346750] Bluetooth: hci0: Secure boot is enabled [20.346752] Bluetooth: hci0: OTP lock is disabled [20.346752] Bluetooth: hci0: API lock is enabled [20.346752] Bluetooth: hci0: Debug lock is disabled [20.346753] Bluetooth: hci0: Minimum firmware build 1 week 10 2014 [20.346754] Bluetooth: hci0: Bootloader timestamp 2023.43 buildtype 1 build 11631 [20.359070] Bluetooth: hci0: Found device firmware: intel/ibt-00a0-00a1-iml.sfi [20.371499] Bluetooth: hci0: Boot Address: 0xb02ff800 [20.385769] Bluetooth: hci0: Firmware Version: 166-34.25 [20.538257] Bluetooth: hci0: Waiting for firmware download to complete [20.554424] Bluetooth: hci0: Firmware loaded in 178651 usecs [21.081588] Bluetooth: hci0: Timeout (500 ms) on tx completion [21.096541] Bluetooth: hci0: Failed to send frame (-62) [21.110240] Bluetooth: hci0: sending frame failed (-62) [21.138551] Bluetooth: hci0: Failed to send Intel Reset command [21.170153] Bluetooth: hci0: Intel Soft Reset failed (-62) Signed-off-by: Kiran K Signed-off-by: Sai Teja Aluvala Reviewed-by: Paul Menzel Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") Signed-off-by: Luiz Augusto von Dentz commit c403da5e98b04a2aec9cfb25cbeeb28d7ce29975 Author: Luiz Augusto von Dentz Date: Tue Oct 7 13:29:15 2025 -0400 Bluetooth: ISO: Fix another instance of dst_type handling Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used. Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") Signed-off-by: Luiz Augusto von Dentz commit 76e20da0bd00c556ed0a1e7250bdb6ac3e808ea8 Author: Frédéric Danis Date: Mon Oct 6 10:35:44 2025 +0200 Revert "Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()" This reverts commit c9d84da18d1e0d28a7e16ca6df8e6d47570501d4. It replaces in L2CAP calls to msecs_to_jiffies() to secs_to_jiffies() and updates the constants accordingly. But the constants are also used in LCAP Configure Request and L2CAP Configure Response which expect values in milliseconds. This may prevent correct usage of L2CAP channel. To fix it, keep those constants in milliseconds and so revert this change. Fixes: c9d84da18d1e ("Bluetooth: L2CAP: convert timeouts to secs_to_jiffies()") Signed-off-by: Frédéric Danis Signed-off-by: Luiz Augusto von Dentz commit e8785404de06a69d89dcdd1e9a0b6ea42dc6d327 Author: Pauli Virtanen Date: Fri Oct 3 22:07:32 2025 +0300 Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error. Fixes: 302a1f674c00d ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 0d92808024b4e9868cef68d16f121d509843e80e Author: Luiz Augusto von Dentz Date: Wed Oct 1 10:55:58 2025 -0400 Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 This fixes the state tracking of advertisement set/instance 0x00 which is considered a legacy instance and is not tracked individually by adv_instances list, previously it was assumed that hci_dev itself would track it via HCI_LE_ADV but that is a global state not specifc to instance 0x00, so to fix it a new flag is introduced that only tracks the state of instance 0x00. Fixes: 1488af7b8b5f ("Bluetooth: hci_sync: Fix hci_resume_advertising_sync") Signed-off-by: Luiz Augusto von Dentz commit 77343b8b4f87560f8f03e77b98a81ff3a147b262 Author: Chris Lu Date: Tue Sep 30 13:39:33 2025 +0800 Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset This patch adds logic to handle power management control when the Bluetooth function is closed during the SDIO reset sequence. Specifically, if BT is closed before reset, the driver enables the SDIO function and sets driver pmctrl. After reset, if BT remains closed, the driver sets firmware pmctrl and disables the SDIO function. These changes ensure proper power management and device state consistency across the reset flow. Fixes: 8fafe702253d ("Bluetooth: mt7921s: support bluetooth reset mechanism") Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit f0c200a4a537f8f374584a974518b0ce69eda76c Author: Luiz Augusto von Dentz Date: Fri Sep 26 11:48:50 2025 -0400 Bluetooth: ISO: Fix BIS connection dst_type handling Socket dst_type cannot be directly assigned to hci_conn->type since there domain is different which may lead to the wrong address type being used. Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") Signed-off-by: Luiz Augusto von Dentz commit 09b0cd1297b4dbfe736aeaa0ceeab2265f47f772 Author: Cen Zhang Date: Mon Sep 29 05:30:17 2025 +0000 Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently. Fixes: 505ea2b29592 ("Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue") Reported-by: Cen Zhang Signed-off-by: Cen Zhang Signed-off-by: Luiz Augusto von Dentz commit b45873c3f09153d1ad9b3a7bf9e5c0b0387fd2ea Author: Farhan Ali Date: Wed Oct 22 09:47:26 2025 -0700 s390/pci: Restore IRQ unconditionally for the zPCI device Commit c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()"), introduced the zpci_set_irq() and zpci_clear_irq(), to be used while resetting a zPCI device. Commit da995d538d3a ("s390/pci: implement reset_slot for hotplug slot"), mentions zpci_clear_irq() being called in the path for zpci_hot_reset_device(). But that is not the case anymore and these functions are not called outside of this file. Instead zpci_hot_reset_device() relies on zpci_disable_device() also clearing the IRQs, but misses to reset the zdev->irqs_registered flag. However after a CLP disable/enable reset, the device's IRQ are unregistered, but the flag zdev->irq_registered does not get cleared. It creates an inconsistent state and so arch_restore_msi_irqs() doesn't correctly restore the device's IRQ. This becomes a problem when a PCI driver tries to restore the state of the device through pci_restore_state(). Restore IRQ unconditionally for the device and remove the irq_registered flag as its redundant. Fixes: c1e18c17bda6 ("s390/pci: add zpci_set_irq()/zpci_clear_irq()") Cc: stable@vger.kernnel.org Reviewed-by: Niklas Schnelle Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Signed-off-by: Heiko Carstens commit 840bc67cf01399b756e7714dc2f80eb9d40a0541 Author: Heiko Carstens Date: Wed Oct 22 14:25:58 2025 +0200 s390: Update defconfigs Signed-off-by: Heiko Carstens commit 7209ff310083315386570bf8d001a0845fe7ab8c Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:01 2025 +0200 of/irq: Export of_msi_xlate() for module usage of_msi_xlate() is required by drivers that can be configured as modular, export the symbol. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Rob Herring Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251021124103.198419-4-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit a1b866f2018748282fa026eb4c92d032dfda11a9 Merge: 2d8713f807a49b 622865c73ae30f Author: Greg Kroah-Hartman Date: Fri Oct 24 13:52:58 2025 +0200 Merge tag 'usb-serial-6.18-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 6.18-rc3 Here are some new modem device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C USB: serial: option: add UNISOC UIS7720 commit 18b1ce0b29c41833363b58ad030b76dabf984899 Merge: adb0971a1acd46 ce29214ada6d08 Author: Simona Vetter Date: Fri Oct 24 13:39:21 2025 +0200 Merge tag 'drm-xe-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Make madvise autoreset an explicit behavior requested by userspace (Thomas Hellström) Driver Changes: - Drop XE_VMA flag conversion and ensure GPUVA flags are passed around (homas Hellström) - Fix missing wq allocation error checking (Matthew Brost) Signed-off-by: Simona Vetter From: Lucas De Marchi Link: https://lore.kernel.org/r/4p2glnvgifc6osjlvzv23xhsyqhw4diqlfxz54lmg7robv44bi@nwd37zpqfa2l commit adb0971a1acd462078f159059cc7380338e41cce Merge: 0cdf7f6fa67146 789e46fbfca187 Author: Simona Vetter Date: Fri Oct 24 13:36:47 2025 +0200 Merge tag 'drm-intel-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix panic structure allocation memory leak (Jani) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://lore.kernel.org/r/aPojgsvNYOU0tN4U@intel.com commit 0cdf7f6fa671460004952707bc52715a53dda113 Merge: 6ced10611e9713 23437509a69476 Author: Simona Vetter Date: Fri Oct 24 13:35:26 2025 +0200 Merge tag 'drm-misc-fixes-2025-10-23' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: panic: - Fix several issues in size calculations panthor: - Fix kernel panic on partial unmap of GPU VA region rockchip: - hdmi: Fix HDP setup Signed-off-by: Simona Vetter From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251023083449.GA13190@linux-2.fritz.box commit 6ced10611e971308632335f53772108c9e4976ec Merge: 211ddde0823f14 72a1eb3cf573ab Author: Simona Vetter Date: Fri Oct 24 13:28:44 2025 +0200 Merge tag 'amd-drm-fixes-6.18-2025-10-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-22: amdgpu: - DP MST fix - Fix DC max link count - DC interrupt atomic context fix Signed-off-by: Simona Vetter From: Alex Deucher Link: https://lore.kernel.org/r/20251022222005.1787211-1-alexander.deucher@amd.com commit 7f434e1d9a17ca5f567c9796c9c105a65c18db9a Author: Hao Ge Date: Thu Oct 23 22:33:13 2025 +0800 slab: Fix obj_ext mistakenly considered NULL due to race condition If two competing threads enter alloc_slab_obj_exts(), and the one that allocates the vector wins the cmpxchg(), the other thread that failed allocation mistakenly assumes that slab->obj_exts is still empty due to its own allocation failure. This will then trigger warnings with CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path. Therefore, let's check the result of cmpxchg() to see if marking the allocation as failed was successful. If it wasn't, check whether the winning side has succeeded its allocation (it might have been also marking it as failed) and if yes, return success. Suggested-by: Harry Yoo Fixes: f7381b911640 ("slab: mark slab->obj_exts allocation failures unconditionally") Cc: Signed-off-by: Hao Ge Link: https://patch.msgid.link/20251023143313.1327968-1-hao.ge@linux.dev Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit ad68c0536cfc28c161593ca4c896a6e74435394b Merge: a35551a32d8686 ba3a5e1aeaa01e Author: Mark Brown Date: Fri Oct 24 11:36:32 2025 +0100 ASoC: fsl: correct the bit order issue for DSD Merge series from Shengjiu Wang : The DSD little endian format requires the msb first, the previous understanding is not correct. The issue is found by testing with pipewire. commit a35551a32d8686c0a33a580ebb8c8d6652b7971f Merge: 79a6f2da168543 64007ad3e2a0e0 Author: Mark Brown Date: Fri Oct 24 11:36:28 2025 +0100 ASoC: Intel: avs: Set of streaming fixes Merge series from Cezary Rojewski : Small set of patches two of which fix problems observed during shutdown and XRUN scenarios for PCM streaming. These ensure HDAudio HOST stream is reset and re-setup during XRUNs and synchronize avs_dai_fe_shutdown() and period-elapsed work (thread) so that no slab-use-after-free panics occur. The last change makes the 'format' parameter provided by a compress-application taken into account - currently its ignored. Such approach helps us increase the coverage of data probing (debug) functionality. commit ef3330b99c01bda53f2a189b58bed8f6b7397f28 Author: Charles Keepax Date: Thu Oct 23 16:49:01 2025 +0100 genirq/manage: Add buslock back in to enable_irq() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: bddd10c55407 ("genirq/manage: Rework enable_irq()") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-4-ckeepax@opensource.cirrus.com commit 56363e25f79fe83e63039c5595b8cd9814173d37 Author: Charles Keepax Date: Thu Oct 23 16:49:00 2025 +0100 genirq/manage: Add buslock back in to __disable_irq_nosync() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: 1b7444446724 ("genirq/manage: Rework __disable_irq_nosync()") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-3-ckeepax@opensource.cirrus.com commit 5d7e45dd670e42df4836afeaa9baf9d41ca4b434 Author: Charles Keepax Date: Thu Oct 23 16:48:59 2025 +0100 genirq/chip: Add buslock back in to irq_set_handler() The locking was changed from a buslock to a plain lock, but the patch description states there was no functional change. Assuming this was accidental so reverting to using the buslock. Fixes: 5cd05f3e2315 ("genirq/chip: Rework irq_set_handler() variants") Signed-off-by: Charles Keepax Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251023154901.1333755-2-ckeepax@opensource.cirrus.com commit 27afd6e066cfd80ddbe22a4a11b99174ac89cced Author: Marek Szyprowski Date: Thu Oct 23 16:26:34 2025 +0200 media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls. CC: stable@vger.kernel.org Fixes: a3293a85381e ("media: v4l2: Add REMOVE_BUFS ioctl") Reported-by: Shuangpeng Bai Closes: https://lore.kernel.org/linux-media/5317B590-AAB4-4F17-8EA1-621965886D49@psu.edu/ Signed-off-by: Marek Szyprowski Signed-off-by: Hans Verkuil commit 758dbc756aad429da11c569c0d067f7fd032bcf7 Author: Ricardo Ribalda Date: Tue Oct 21 10:36:17 2025 +0000 media: uvcvideo: Use heuristic to find stream entity Some devices, like the Grandstream GUV3100 webcam, have an invalid UVC descriptor where multiple entities share the same ID, this is invalid and makes it impossible to make a proper entity tree without heuristics. We have recently introduced a change in the way that we handle invalid entities that has caused a regression on broken devices. Implement a new heuristic to handle these devices properly. Reported-by: Angel4005 Closes: https://lore.kernel.org/linux-media/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=DaA@mail.gmail.com/ Fixes: 0e2ee70291e6 ("media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID") Cc: stable@vger.kernel.org Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans Verkuil commit 7df699c2132f36359f8f79e6a163c3b3fe0b0e3d Author: Hans de Goede Date: Wed Sep 10 12:47:02 2025 +0200 media: v4l2-subdev / pdx86: int3472: Use "privacy" as con_id for the privacy LED During DT-binding review for extending the V4L2 camera sensor privacy LED support to systems using devicetree, it has come up that having a "-led" suffix for the LED name / con_id is undesirable since it already is clear that it is a LED. Drop the "-led" suffix from the con_id in both the lookup table in the int3472 code, as well as from the con_id led_get() argument in the v4l2-subdev code. Signed-off-by: Hans de Goede Acked-by: Ilpo Järvinen Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d91a1d129b63614fa4c2e45e60918409ce36db7e Author: Armin Wolf Date: Wed Oct 8 01:41:46 2025 +0200 ACPI: fan: Use platform device for devres-related actions Device-managed resources are cleaned up when the driver unbinds from the underlying device. In our case this is the platform device as this driver is a platform driver. Registering device-managed resources on the associated ACPI device will thus result in a resource leak when this driver unbinds. Ensure that any device-managed resources are only registered on the platform device to ensure that they are cleaned up during removal. Fixes: 35c50d853adc ("ACPI: fan: Add hwmon support") Signed-off-by: Armin Wolf Cc: 6.11+ # 6.11+ Link: https://patch.msgid.link/20251007234149.2769-4-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit 58764259ebe0c9efd569194444629f6b26f86583 Author: Armin Wolf Date: Wed Oct 8 01:41:44 2025 +0200 ACPI: fan: Use ACPI handle when retrieving _FST Usage of the ACPI device should be phased out in the future, as the driver itself is now using the platform bus. Replace any usage of struct acpi_device in acpi_fan_get_fst() to allow users to drop usage of struct acpi_device. Also extend the integer check to all three package elements. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251007234149.2769-2-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki commit ce29214ada6d08dbde1eeb5a69c3b09ddf3da146 Author: Matthew Brost Date: Tue Oct 21 17:55:36 2025 -0700 drm/xe: Check return value of GGTT workqueue allocation Workqueue allocation can fail, so check the return value of the GGTT workqueue allocation and fail driver initialization if the allocation fails. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20251022005538.828980-2-matthew.brost@intel.com (cherry picked from commit 1f1314e8e71385bae319e43082b798c11f6648bc) Signed-off-by: Lucas De Marchi commit c0e37ac6a5d4c4bc33b9c4408d22714fe370a1b0 Author: Bart Van Assche Date: Tue Oct 14 13:00:54 2025 -0700 scsi: ufs: core: Reduce link startup failure logging Some systems, e.g. Rock 4D, have a pluggable UFS module. Link startup fails systematically on these systems. If no UFS module has been plugged in, more than fourty lines are logged after the "link startup failed" message. Avoid this by reducing link startup failure logging. An intended side effect of this patch is that scsi_host_busy() is not called before scsi_add_host() is called. Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") introduced a regression - the warning shown below is triggered during every boot. This patch fixes that regression. Call trace: __srcu_read_lock+0x30/0x80 (P) blk_mq_tagset_busy_iter+0x44/0x300 scsi_host_busy+0x38/0x70 ufshcd_print_host_state+0x34/0x1bc ufshcd_link_startup.constprop.0+0xe4/0x2e0 ufshcd_init+0x944/0xf80 ufshcd_pltfrm_init+0x504/0x820 ufs_rockchip_probe+0x2c/0x88 platform_probe+0x5c/0xa4 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x150 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1e0 bus_for_each_dev+0x7c/0xdc driver_attach+0x24/0x30 bus_add_driver+0x110/0x230 driver_register+0x68/0x130 __platform_driver_register+0x20/0x2c ufs_rockchip_pltform_init+0x1c/0x28 do_one_initcall+0x60/0x1e0 kernel_init_freeable+0x248/0x2c4 kernel_init+0x20/0x140 ret_from_fork+0x10/0x20 Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/ Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251014200118.3390839-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit c74dc8ab47c1ec3927f63ca83b542c363249b3d8 Author: Bart Van Assche Date: Tue Oct 14 13:00:53 2025 -0700 scsi: ufs: core: Fix a race condition related to the "hid" attribute group ufs_sysfs_add_nodes() is called concurrently with ufs_get_device_desc(). This may cause the following code to be called before ufs_sysfs_add_nodes(): sysfs_update_group(&hba->dev->kobj, &ufs_sysfs_hid_group); If this happens, ufs_sysfs_add_nodes() triggers a kernel warning and fails. Fix this by calling ufs_sysfs_add_nodes() before SCSI LUNs are scanned since the sysfs_update_group() call happens from the context of thread that executes ufshcd_async_scan(). This patch fixes the following kernel warning: sysfs: cannot create duplicate filename '/devices/platform/3c2d0000.ufs/hid' Workqueue: async async_run_entry_fn Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0x104 dump_stack+0x18/0x3c sysfs_warn_dup+0x6c/0xc8 internal_create_group+0x1c8/0x504 sysfs_create_groups+0x38/0x9c ufs_sysfs_add_nodes+0x20/0x58 ufshcd_init+0x1114/0x134c ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __device_attach_driver+0x15c/0x1f4 bus_for_each_drv+0x10c/0x168 __device_attach_async_helper+0x80/0xf8 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 ufshcd 3c2d0000.ufs: ufs_sysfs_add_nodes: sysfs groups creation failed (err = -17) Cc: Daniel Lee Fixes: bb7663dec67b ("scsi: ufs: sysfs: Make HID attributes visible") Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251014200118.3390839-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 5127be409c6c3815c4a7d8f6d88043e44f9b9543 Author: Nitin Rawat Date: Sun Oct 12 23:08:28 2025 +0530 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Condition=3 and await a response. - Asserting RST_N low. - Turning off REF_CLK. - Turning off VCC. - Turning off VCCQ/VCCQ2. As part of ufs shutdown, after the SSU command completion, asserting hardware reset (HWRST) triggers the device firmware to wake up and execute its reset routine. This routine initializes hardware blocks and takes a few milliseconds to complete. During this time, the ICCQ draws a large current. This large ICCQ current may cause issues for the regulator which is supplying power to UFS, because the turn off request from UFS driver to the regulator framework will be immediately followed by low power mode(LPM) request by regulator framework. This is done by framework because UFS which is the only client is requesting for disable. So if the rail is still in the process of shutting down while ICCQ exceeds LPM current thresholds, and LPM mode is activated in hardware during this state, it may trigger an overcurrent protection (OCP) fault in the regulator. To prevent this, a 10ms delay is added after asserting HWRST. This allows the reset operation to complete while power rails remain active and in high-power mode. Currently there is no way for Host to query whether the reset is completed or not and hence this the delay is based on experiments with Qualcomm UFS controllers across multiple UFS vendors. Signed-off-by: Nitin Rawat Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251012173828.9880-1-nitin.rawat@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit dd6940f5c7dbee7ae70708f4c8967c3c8cb1d965 Author: Stefan Metzmacher Date: Wed Oct 15 17:05:27 2025 +0200 smb: server: let free_transport() wait for SMBDIRECT_SOCKET_DISCONNECTED We should wait for the rdma_cm to become SMBDIRECT_SOCKET_DISCONNECTED! At least on the client side (with similar code) wait_event_interruptible() often returns with -ERESTARTSYS instead of waiting for SMBDIRECT_SOCKET_DISCONNECTED. We should use wait_event() here too, which makes the code be identical in client and server, which will help when moving to common functions. Fixes: b31606097de8 ("smb: server: move smb_direct_disconnect_rdma_work() into free_transport()") Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6f1cbf6d6fd13fc169dde14e865897924cdc4bbd Author: Ming Lei Date: Fri Oct 24 09:34:59 2025 +0800 io_uring: fix buffer auto-commit for multishot uring_cmd Commit 620a50c92700 ("io_uring: uring_cmd: add multishot support") added multishot uring_cmd support with explicit buffer upfront commit via io_uring_mshot_cmd_post_cqe(). However, the buffer selection path in io_ring_buffer_select() was auto-committing buffers for non-pollable files, which conflicts with uring_cmd's explicit upfront commit model. This way consumes the whole selected buffer immediately, and causes failure on the following buffer selection. Fix this by checking uring_cmd to identify operations that handle buffer commit explicitly, and skip auto-commit for these operations. Cc: Caleb Sander Mateos Fixes: 620a50c92700 ("io_uring: uring_cmd: add multishot support") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit df5192d9bb0e38bf831fb93e8026e346aa017ca8 Author: Bjorn Helgaas Date: Thu Oct 23 13:06:26 2025 -0500 PCI/ASPM: Enable only L0s and L1 for devicetree platforms f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") enabled Clock Power Management and L1 PM Substates, but those features depend on CLKREQ# and possibly other device-specific configuration. We don't know whether CLKREQ# is supported, so we shouldn't blindly enable Clock PM and L1 PM Substates. Enable only ASPM L0s and L1, and only when both ends of the link advertise support for them. Fixes: f3ac2ff14834 ("PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/db5c95a1-cf3e-46f9-8045-a1b04908051a@xenosoft.de/ Reported-by: FUKAUMI Naoki Closes: https://lore.kernel.org/r/22594781424C5C98+22cb5d61-19b1-4353-9818-3bb2b311da0b@radxa.com/ Reported-by: Herve Codina Link: https://lore.kernel.org/r/20251015101304.3ec03e6b@bootlin.com/ Reported-by: Diederik de Haas Closes: https://lore.kernel.org/r/DDJXHRIRGTW9.GYC2ULZ5WQAL@cknow-tech.com/ Signed-off-by: Bjorn Helgaas Tested-by: FUKAUMI Naoki Tested-by: Diederik de Haas Acked-by: Dragan Simic Link: https://patch.msgid.link/20251023180645.1304701-1-helgaas@kernel.org commit 246aca5b2a2c4ad3e75c2eff616f5532019a92d2 Author: Takashi Sakamoto Date: Thu Oct 23 19:43:49 2025 +0900 firewire: core: fix __must_hold() annotation The variable name passed to __must_hold() annotation is invalid. This commit fixes it. Fixes: 420bd7068cbf ("firewire: core: use spin lock specific to transaction") Link: https://lore.kernel.org/r/20251023104349.415310-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 1ab665817448c31f4758dce43c455bd4c5e460aa Author: Bui Quang Minh Date: Wed Oct 22 22:56:30 2025 +0700 virtio-net: drop the multi-buffer XDP packet in zerocopy In virtio-net, we have not yet supported multi-buffer XDP packet in zerocopy mode when there is a binding XDP program. However, in that case, when receiving multi-buffer XDP packet, we skip the XDP program and return XDP_PASS. As a result, the packet is passed to normal network stack which is an incorrect behavior (e.g. a XDP program for packet count is installed, multi-buffer XDP packet arrives and does go through XDP program. As a result, the packet count does not increase but the packet is still received from network stack).This commit instead returns XDP_ABORTED in that case. Fixes: 99c861b44eb1 ("virtio_net: xsk: rx: support recv merge mode") Cc: stable@vger.kernel.org Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20251022155630.49272-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 420c84c330d1688b8c764479e5738bbdbf0a33de Author: Lizhi Xu Date: Wed Oct 22 10:40:07 2025 +0800 usbnet: Prevents free active kevent The root cause of this issue are: 1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0); put the kevent work in global workqueue. However, the kevent has not yet been scheduled when the usbnet device is unregistered. Therefore, executing free_netdev() results in the "free active object (kevent)" error reported here. 2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(), if the usbnet device is up, ndo_stop() is executed to cancel the kevent. However, because the device is not up, ndo_stop() is not executed. The solution to this problem is to cancel the kevent before executing free_netdev(). Fixes: a69e617e533e ("usbnet: Fix linkwatch use-after-free on disconnect") Reported-by: Sam Sun Closes: https://syzkaller.appspot.com/bug?extid=8bfd7bcc98f7300afb84 Signed-off-by: Lizhi Xu Link: https://patch.msgid.link/20251022024007.1831898-1-lizhi.xu@windriver.com Signed-off-by: Jakub Kicinski commit a83155cc4ec5dd8c99edb541dc12d3bd8e97eae9 Merge: ab431bc39741e9 69e4b75a5b90ef Author: Jakub Kicinski Date: Thu Oct 23 17:15:47 2025 -0700 Merge tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== First set of fixes: - brcmfmac: long-standing crash when used w/o P2P - iwlwifi: fix for a use-after-free bug - mac80211: key tailroom accounting bug could leave allocation overhead and cause a warning - ath11k: add a missing platform, fix key flag operations - bcma: skip devices disabled in OF/DT - various (potential) memory leaks * tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: nl80211: call kfree without a NULL check wifi: mac80211: fix key tailroom accounting leak wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode MAINTAINERS: wcn36xx: Add linux-wireless list bcma: don't register devices disabled in OF wifi: mac80211: reset FILS discovery and unsol probe resp intervals wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() wifi: ath11k: avoid bit operation on key flags wifi: ath12k: free skb during idr cleanup callback wifi: ath11k: Add missing platform IDs for quirk table wifi: ath10k: Fix memory leak on unsupported WMI command ==================== Link: https://patch.msgid.link/20251023180604.626946-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 6fab32bb6508abbb8b7b1c5498e44f0c32320ed5 Author: Stephen Rothwell Date: Wed Oct 22 16:36:25 2025 +1100 MAINTAINERS: add Mark Brown as a linux-next maintainer Mark has been kindly helping fill in when I have been unavailable over the past several years. He has also put his hand up to take over linux-next maintenance when I finally decide to stop (which may be some time yet ;-) ). Signed-off-by: Stephen Rothwell Acked-by: Mark Brown Signed-off-by: Linus Torvalds commit 79a6f2da168543c0431ade57428f673c19c5b72f Author: Haotian Zhang Date: Tue Oct 21 01:04:40 2025 +0800 ASoC: mediatek: Fix double pm_runtime_disable in remove functions Both mt8195-afe-pcm and mt8365-afe-pcm drivers use devm_pm_runtime_enable() in probe function, which automatically calls pm_runtime_disable() on device removal via devres mechanism. However, the remove callbacks explicitly call pm_runtime_disable() again, resulting in double pm_runtime_disable() calls. Fix by removing the redundant pm_runtime_disable() calls from remove functions, letting the devres framework handle it automatically. Fixes: 2ca0ec01d49c ("ASoC: mediatek: mt8195-afe-pcm: Simplify runtime PM during probe") Fixes: e1991d102bc2 ("ASoC: mediatek: mt8365: Add the AFE driver support") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251020170440.585-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 5121062e83453221cca7bb1163fe9234757c1697 Merge: 266ee584e55eed 3d62f95bd8450c Author: Linus Torvalds Date: Thu Oct 23 16:50:25 2025 -0700 Merge tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "A couple of fixes for Runtime Verification: - A bug caused a kernel panic when reading enabled_monitors was reported. Change callback functions to always use list_head iterators and by doing so, fix the wrong pointer that was leading to the panic. - The rtapp/pagefault monitor relies on the MMU to be present (pagefaults exist) but that was not enforced via kconfig, leading to potential build errors on systems without an MMU. Add that kconfig dependency" * tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Make rtapp/pagefault monitor depends on CONFIG_MMU rv: Fully convert enabled_monitors to use list_head as iterator commit dfab67879bed6800cc512e320167b969ebc6d5a9 Author: Nathan Chancellor Date: Thu Oct 23 23:56:30 2025 +0100 MAINTAINERS: Update Kconfig section Masahiro Yamada stepped down as Kbuild and Kconfig maintainer in commit 8d6841d5cb20 ("MAINTAINERS: hand over Kbuild maintenance"), leaving Kconfig officially orphaned and handing Kbuild over to Nicolas and myself. Since then, there have been a few simple patches to Kconfig that have ended up on the linux-kbuild mailing list without clear direction on who will take them, as they are not really sent to anybody officially, although the list is obviously watched by the Kbuild maintainers. Make Nicolas and I official maintainers of Kconfig in "Odd Fixes" status, similar to Kbuild, so that the subsystem has clear points of contact for contributors, even if significant contributions may not be accepted. Additionally, add the Kbuild tree to this section. Acked-by: Nicolas Schier Acked-by: Randy Dunlap Link: https://patch.msgid.link/20251023-update-kconfig-maintainers-v1-1-0ebd5b4ecced@kernel.org Signed-off-by: Nathan Chancellor commit e58794dbf7706af931153ef402c03d61de6ba714 Merge: 65627d4a629aaf aa960b597600be Author: Arnd Bergmann Date: Thu Oct 23 22:30:41 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-based SoCs Device Tree fixes for 6.18, please pull the following: - Peter describes the VGIC interrupt line such that KVM can be used on Raspberry Pi 5 systems. * tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: bcm2712: Define VGIC interrupt Signed-off-by: Arnd Bergmann commit 65627d4a629aaf7cfe3b40be468adbb888098960 Merge: 71a5970259c3f2 4adc20ba95d472 Author: Arnd Bergmann Date: Thu Oct 23 22:30:29 2025 +0200 Merge tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 6.18, please pull the following: - Stefan switches the V3D block to use the firmware clock, rather than the bare metal clock. This fixes hangs on boot after recent changes to the V3D driver clocking went in. * tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: broadcom: rpi: Switch to V3D firmware clock Signed-off-by: Arnd Bergmann commit 71a5970259c3f2426e8600aae3e924a00d801ad3 Merge: f4cb02832060ff 20b93a0088a595 Author: Arnd Bergmann Date: Thu Oct 23 22:30:01 2025 +0200 Merge tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI fixes for v6.18 This series contains a set of small, focused fixes that address robustness and lifecycle issues in the Arm SCMI core and debug support, ensuring safer handling of debug initialization failures, correct flag management in raw mode, and consistent inflight counter tracking. Brief summary: - Fix raw xfer flag clearing - Skip RAW debug initialization on failure - Make inflight counter helpers null-safe, preventing crashes if debug initialization fails - Account for failed debug initialization globally There is no functional change for standard SCMI operation, but these fixes improve stability in debug and raw modes, particularly in error paths. * tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode firmware: arm_scmi: Skip RAW initialization on failure include: trace: Fix inflight count helper on failed initialization firmware: arm_scmi: Account for failed debug initialization Signed-off-by: Arnd Bergmann commit f4cb02832060ffece6f2f49133592ce7054ac057 Merge: 1d4e7d9f6b7e4e 11fb1a82aefa6f Author: Arnd Bergmann Date: Thu Oct 23 22:29:39 2025 +0200 Merge tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm FF-A fix for v6.18 The FF-A driver was updated to support specification version 1.2 but omitted support for the 16-byte implementation-defined (IMPDEF) field introduced in FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission breaks all memory interfaces. This change updates the EMAD sizing and offset logic to correctly handle the FF-A v1.2 layout while preserving backward compatibility with older versions. * tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor Signed-off-by: Arnd Bergmann commit 266ee584e55eed108583ab4f45b5de734522502d Merge: ab431bc39741e9 b98c94eed4a975 Author: Linus Torvalds Date: Thu Oct 23 09:26:47 2025 -1000 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Do not make a clean PTE dirty in pte_mkwrite() The Arm architecture, for backwards compatibility reasons (ARMv8.0 before in-hardware dirty bit management - DBM), uses the PTE_RDONLY bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE writable also invoke pte_mkdirty() but do_swap_page() does not and we end up with dirty, freshly swapped in, writeable pages. - Do not warn if the destination page is already MTE-tagged in copy_highpage() In the majority of the cases, a destination page copied into is freshly allocated without the PG_mte_tagged flag set. However, the folio migration may be restarted if __folio_migrate_mapping() failed, triggering the benign WARN_ON_ONCE(). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Do not warn if the page is already tagged in copy_highpage() arm64, mm: avoid always making PTE dirty in pte_mkwrite() commit 8f067aa59430266386b83c18b983ca583faa6a11 Author: Yuhao Jiang Date: Wed Oct 22 15:07:04 2025 -0500 ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable Signed-off-by: Yuhao Jiang Reviewed-by: Hans de Goede [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki commit 7221b9caf84b3294688228a19273d74ea19a2ee4 Author: Andrii Nakryiko Date: Mon Oct 20 13:36:43 2025 -0700 libbpf: Fix powerpc's stack register definition in bpf_tracing.h retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to wrong definition of PT_REGS_SP() macro. Looking at powerpc's implementation of stack unwinding in perf_callchain_user_64() clearly shows that stack pointer register is gpr[1]. Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this. [0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log Fixes: 138d6153a139 ("samples/bpf: Enable powerpc support") Signed-off-by: Andrii Nakryiko Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20251020203643.989467-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit ab431bc39741e9d9bd3102688439e1864c857a74 Merge: a0b12d7b040493 cb68d1e5c51870 Author: Linus Torvalds Date: Thu Oct 23 07:03:18 2025 -1000 Merge tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from can. Slim pickings, I'm guessing people haven't really started testing. Current release - new code bugs: - eth: mlx5e: - psp: avoid 'accel' NULL pointer dereference - skip PPHCR register query for FEC histogram if not supported Previous releases - regressions: - bonding: update the slave array for broadcast mode - rtnetlink: re-allow deleting FDB entries in user namespace - eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path Previous releases - always broken: - can: drop skb on xmit if device is in listen-only mode - gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb() - eth: mlx5e - RX, fix generating skb from non-linear xdp_buff if program trims frags - make devcom init failures non-fatal, fix races with IPSec Misc: - some documentation formatting 'fixes'" * tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) net/mlx5: Fix IPsec cleanup over MPV device net/mlx5: Refactor devcom to return NULL on failure net/mlx5e: Skip PPHCR register query if not supported by the device net/mlx5: Add PPHCR to PCAM supported registers mask virtio-net: zero unused hash fields net: phy: micrel: always set shared->phydev for LAN8814 vsock: fix lock inversion in vsock_assign_transport() ovpn: use datagram_poll_queue for socket readiness in TCP espintcp: use datagram_poll_queue for socket readiness net: datagram: introduce datagram_poll_queue for custom receive queues net: bonding: fix possible peer notify event loss or dup issue net: hsr: prevent creation of HSR device with slaves from another netns sctp: avoid NULL dereference when chunk data buffer is missing ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop net: ravb: Ensure memory write completes before ringing TX doorbell net: ravb: Enforce descriptor type ordering net: hibmcge: select FIXED_PHY net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb Documentation: networking: ax25: update the mailing list info. net: gro_cells: fix lock imbalance in gro_cells_receive() ... commit a0b12d7b04049343d544ac92c8eeb5a2271235c3 Merge: 85db0c0a971f8b 114cbd67db825b Author: Linus Torvalds Date: Thu Oct 23 06:53:12 2025 -1000 Merge tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix a fallout of a recent ACPI properties management update and work around a compiler bug in ACPICA: - Fix a recent coding mistake causing __acpi_node_get_property_reference() arguments to be put in an incorrect order (Sunil V L) - Work around bogus -Wstringop-overread warning on LoongArch since GCC 11 in ACPICA (Xi Ruoyao)" * tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 ACPI: property: Fix argument order in __acpi_node_get_property_reference() commit 85db0c0a971f8bb009452f1dc4267001f2cc7e86 Merge: 942048d46abac0 b62bd2cf7e991e Author: Linus Torvalds Date: Thu Oct 23 06:48:32 2025 -1000 Merge tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These revert a cpuidle menu governor commit leading to a performance regression, fix an amd-pstate driver regression introduced recently, and fix new conditional guard definitions for runtime PM. - Add missing _RET == 0 condition to recently introduced conditional guard definitions for runtime PM (Rafael Wysocki) - Revert a cpuidle menu governor change that introduced a serious performance regression on Chromebooks with Intel Jasper Lake processors (Rafael Wysocki) - Fix an amd-pstate driver regression leading to EPP=0 after hibernation (Mario Limonciello)" * tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: runtime: Fix conditional guard definitions Revert "cpuidle: menu: Avoid discarding useful information" cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit 942048d46abac01e1219c5833701ff5b0cb52e7f Merge: 43e9ad0c55a369 ada7d45b568abe Author: Linus Torvalds Date: Thu Oct 23 06:44:43 2025 -1000 Merge tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - in send, fix duplicated rmdir operations when using extrefs (hardlinks), receive can fail with ENOENT - fixup of error check when reading extent root in ref-verify and damaged roots are allowed by mount option (found by smatch) - fix freeing partially initialized fs info (found by syzkaller) - fix use-after-free when printing ref_tracking status of delayed inodes * tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree() btrfs: fix delayed_node ref_tracker use after free btrfs: send: fix duplicated rmdir operations when using extrefs btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() commit b98c94eed4a975e0c80b7e90a649a46967376f58 Author: Catalin Marinas Date: Wed Oct 22 11:09:14 2025 +0100 arm64: mte: Do not warn if the page is already tagged in copy_highpage() The arm64 copy_highpage() assumes that the destination page is newly allocated and not MTE-tagged (PG_mte_tagged unset) and warns accordingly. However, following commit 060913999d7a ("mm: migrate: support poisoned recover from migrate folio"), folio_mc_copy() is called before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the copy will be done again to the same destination page. Since copy_highpage() already set the PG_mte_tagged flag, this second copy will warn. Replace the WARN_ON_ONCE(page already tagged) in the arm64 copy_highpage() with a comment. Reported-by: syzbot+d1974fc28545a3e6218b@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/68dda1ae.a00a0220.102ee.0065.GAE@google.com Reviewed-by: David Hildenbrand Cc: Will Deacon Cc: Kefeng Wang Cc: stable@vger.kernel.org # 6.12.x Reviewed-by: Yang Shi Signed-off-by: Catalin Marinas commit eecd7cb64178efb35f89aa5134cf6ce36c0c66db Author: Vlastimil Babka Date: Thu Oct 23 14:01:07 2025 +0200 slab: fix slab accounting imbalance due to defer_deactivate_slab() Since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") there's a possibility in alloc_single_from_new_slab() that we discard the newly allocated slab if we can't spin and we fail to trylock. As a result we don't perform inc_slabs_node() later in the function. Instead we perform a deferred deactivate_slab() which can either put the unacounted slab on partial list, or discard it immediately while performing dec_slabs_node(). Either way will cause an accounting imbalance. Fix this by not marking the slab as frozen, and using free_slab() instead of deactivate_slab() for non-frozen slabs in free_deferred_objects(). For CONFIG_SLUB_TINY, that's the only possible case. By not using discard_slab() we avoid dec_slabs_node(). Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Link: https://patch.msgid.link/20251023-fix-slab-accounting-v2-1-0e62d50986ea@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 434f7349a1f00618a620b316f091bd13a12bc8d2 Author: Alexey Klimov Date: Wed Oct 22 21:10:12 2025 +0100 regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board: Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) ... Call trace: slim_xfer_msg+0x24/0x1ac [slimbus] (P) slim_read+0x48/0x74 [slimbus] regmap_slimbus_read+0x18/0x24 [regmap_slimbus] _regmap_raw_read+0xe8/0x174 _regmap_bus_read+0x44/0x80 _regmap_read+0x60/0xd8 _regmap_update_bits+0xf4/0x140 _regmap_select_page+0xa8/0x124 _regmap_raw_write_impl+0x3b8/0x65c _regmap_bus_raw_write+0x60/0x80 _regmap_write+0x58/0xc0 regmap_write+0x4c/0x80 wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x] snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core] __soc_pcm_hw_params+0x22c/0x634 [snd_soc_core] dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core] dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core] snd_pcm_hw_params+0x124/0x464 [snd_pcm] snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm] snd_pcm_ioctl+0x34/0x4c [snd_pcm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xf0 el0t_64_sync+0x198/0x19c The __devm_regmap_init_slimbus() started to be used instead of __regmap_init_slimbus() after the commit mentioned above and turns out the incorrect bus_context pointer (3rd argument) was used in __devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or the first user of devm_regmap_init_slimbus() but we should fix it till the point where __devm_regmap_init_slimbus() was introduced therefore two "Fixes" tags. While at this, also correct the same argument in __regmap_init_slimbus(). Fixes: 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") Fixes: 7d6f7fb053ad ("regmap: add SLIMbus support") Cc: stable@vger.kernel.org Cc: Dmitry Baryshkov Cc: Ma Ke Cc: Steev Klimaszewski Cc: Srinivas Kandagatla Reviewed-by: Abel Vesa Signed-off-by: Alexey Klimov Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251022201013.1740211-1-alexey.klimov@linaro.org Signed-off-by: Mark Brown commit cb68d1e5c51870601be9394fbb5751fc6532c78e Merge: b2284768c6b32a 664f76be38a18c Author: Jakub Kicinski Date: Thu Oct 23 07:14:38 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-10-22' Tariq Toukan says: ==================== mlx5 misc fixes 2025-10-22 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1761136182-918470-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 Author: Patrisious Haddad Date: Wed Oct 22 15:29:42 2025 +0300 net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core. So before disabling those blocking events, make sure to also unregister the devcom device and mark all this device operations as complete, in order to prevent the other device from using invalid netdev during future devcom events which could cause the trace below. BUG: kernel NULL pointer dereference, address: 0000000000000010 PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 7735 Comm: devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 R13: ffff88810d6f0a00 R14: 0000000000000000 R15: ffff8881034bda80 FS: 00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core] mlx5_devcom_send_event+0x8c/0x170 [mlx5_core] blocking_event+0x17b/0x230 [mlx5_core] notifier_call_chain+0x35/0xa0 blocking_notifier_call_chain+0x3d/0x60 mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core] mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib] mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib] ? idr_alloc_cyclic+0x50/0xb0 ? __kmalloc_cache_noprof+0x167/0x340 ? __kmalloc_noprof+0x1a7/0x430 __mlx5_ib_add+0x34/0xd0 [mlx5_ib] mlx5r_probe+0xe9/0x310 [mlx5_ib] ? kernfs_add_one+0x107/0x150 ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] auxiliary_bus_probe+0x3e/0x90 really_probe+0xc5/0x3a0 ? driver_probe_device+0x90/0x90 __driver_probe_device+0x80/0x160 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 bus_for_each_drv+0x80/0xd0 __device_attach+0xbc/0x1f0 bus_probe_device+0x86/0xa0 device_add+0x62d/0x830 __auxiliary_device_add+0x3b/0xa0 ? auxiliary_device_init+0x41/0x90 add_adev+0xd1/0x150 [mlx5_core] mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core] esw_mode_change+0x6c/0xc0 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xe0 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x180/0x2b0 ? devlink_get_from_attrs_lock+0x170/0x170 ? devlink_nl_eswitch_get_doit+0x290/0x290 ? devlink_nl_pre_doit_port_optional+0x50/0x50 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1fc/0x2d0 netlink_sendmsg+0x1e4/0x410 __sock_sendmsg+0x38/0x60 ? sockfd_lookup_light+0x12/0x60 __sys_sendto+0x105/0x160 ? __sys_recvmsg+0x4e/0x90 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f27bc91b13a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 RSP: 002b:00007fff369557e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000009c54b10 RCX: 00007f27bc91b13a RDX: 0000000000000038 RSI: 0000000009c54b10 RDI: 0000000000000006 RBP: 0000000009c54920 R08: 00007f27bd0030e0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi ib_umad scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_fwctl mlx5_ib ib_uverbs ib_core mlx5_core CR2: 0000000000000010 Fixes: 82f9378c443c ("net/mlx5: Handle IPsec steering upon master unbind/bind") Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8f82f89550daafc8ca3ba74c389ae1b4afdd75c8 Author: Patrisious Haddad Date: Wed Oct 22 15:29:41 2025 +0300 net/mlx5: Refactor devcom to return NULL on failure Devcom device and component registration isn't always critical to the functionality of the caller, hence the registration can fail and we can continue working with an ERR_PTR value saved inside a variable. In order to avoid that make sure all devcom failures return NULL. Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d58a9a917aa39b10250ec16cb9c24e942cbc77d3 Author: Alexei Lazar Date: Wed Oct 22 15:29:40 2025 +0300 net/mlx5e: Skip PPHCR register query if not supported by the device Check the PCAM supported registers mask before querying the PPHCR register, as it is not supported in older devices. Fixes: 44907e7c8fd0 ("net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR") Signed-off-by: Alexei Lazar Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bb65e0c141f879cdf54db11ae446ee3605fb54d5 Author: Alexei Lazar Date: Wed Oct 22 15:29:39 2025 +0300 net/mlx5: Add PPHCR to PCAM supported registers mask Add the PPHCR bit to the port_access_reg_cap_mask field of PCAM register to indicate that the device supports the PPHCR register and the RS-FEC histogram feature. Signed-off-by: Alexei Lazar Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1761136182-918470-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b2284768c6b32aa224ca7d0ef0741beb434f03aa Author: Jason Wang Date: Wed Oct 22 11:44:21 2025 +0800 virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by zeroing the unused hash fields. Acked-by: Michael S. Tsirkin Fixes: a2fb4bc4e2a6a ("net: implement virtio helpers to handle UDP GSO tunneling") Cc: Signed-off-by: Jason Wang Reviewed-by: Xuan Zhuo Link: https://patch.msgid.link/20251022034421.70244-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 399d10934740ae8cdaa4e3245f7c5f6c332da844 Author: Robert Marko Date: Tue Oct 21 15:20:26 2025 +0200 net: phy: micrel: always set shared->phydev for LAN8814 Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP clock gets actually set, otherwise the function will return before setting it. This is an issue as shared->phydev is unconditionally being used when IRQ is being handled, especially in lan8814_gpio_process_cap and since it was not set it will cause a NULL pointer exception and crash the kernel. So, simply always set shared->phydev to avoid the NULL pointer exception. Fixes: b3f1a08fcf0d ("net: phy: micrel: Add support for PTP_PF_EXTTS for lan8814") Signed-off-by: Robert Marko Tested-by: Horatiu Vultur Link: https://patch.msgid.link/20251021132034.983936-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 0fd20f65df6aa430454a0deed8f43efa91c54835 Author: Gerd Bayer Date: Thu Oct 16 11:27:03 2025 +0200 s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do. During error recovery testing a pair of tasks was reported to be hung: mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO: task kmcheck:72 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace: [<000000065256f030>] __schedule+0x2a0/0x590 [<000000065256f356>] schedule+0x36/0xe0 [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 [<0000000652513212>] devlink_health_report+0x19a/0x230 [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too: - task: kmcheck mlx5_unload_one() tries to acquire devlink lock while the PCI error recovery code has set pdev->block_cfg_access by way of pci_cfg_access_lock() - task: kworker mlx5_crdump_collect() tries to set block_cfg_access through pci_cfg_access_lock() while devlink_health_report() had acquired the devlink lock. A similar deadlock situation can be reproduced by requesting a crdump with > devlink health dump show pci/ reporter fw_fatal while PCI error recovery is executed on the same physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with > zpcictl --reset-fw Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with "kernel answers: Permission denied" - and we get a kernel log message of: mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 because the config read of VSC_SEMAPHORE is rejected by the underlying hardware. Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space. Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/ Cc: stable@vger.kernel.org Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") Reviewed-by: Niklas Schnelle Signed-off-by: Gerd Bayer Signed-off-by: Heiko Carstens commit f7c877e7535260cc7a21484c994e8ce7e8cb6780 Author: Stefano Garzarella Date: Tue Oct 21 14:17:18 2025 +0200 vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock inversion deadlock between vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called. The issue was introduced by commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU") which added vsock_register_mutex locking in vsock_assign_transport() around the transport->release() call, that can call vsock_linger(). vsock_assign_transport() can be called with sk_lock held. vsock_linger() calls sk_wait_event() that temporarily releases and re-acquires sk_lock. During this window, if another thread hold vsock_register_mutex while trying to acquire sk_lock, a circular dependency is created. Fix this by releasing vsock_register_mutex before calling transport->release() and vsock_deassign_transport(). This is safe because we don't need to hold vsock_register_mutex while releasing the old transport, and we ensure the new transport won't disappear by obtaining a module reference first via try_module_get(). Reported-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com Tested-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com Fixes: 687aa0c5581b ("vsock: Fix transport_* TOCTOU") Cc: mhal@rbox.co Cc: stable@vger.kernel.org Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20251021121718.137668-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit df890ceeb2e51af4c31c7b8c1c4c855dbbeba1e5 Merge: 10843e1492e474 efd729408bc7d5 Author: Paolo Abeni Date: Thu Oct 23 15:46:10 2025 +0200 Merge branch 'fix-poll-behaviour-for-tcp-based-tunnel-protocols' Ralf Lici says: ==================== fix poll behaviour for TCP-based tunnel protocols This patch series introduces a polling function for datagram-style sockets that operates on custom skb queues, and updates ovpn (the OpenVPN data-channel offload module) and espintcp (the TCP Encapsulation of IKE and IPsec Packets implementation) to use it accordingly. Protocols like the aforementioned one decapsulate packets received over TCP and deliver userspace-bound data through a separate skb queue, not the standard sk_receive_queue. Previously, both relied on datagram_poll(), which would signal readiness based on non-userspace packets, leading to misleading poll results and unnecessary recv attempts in userspace. Patch 1 introduces datagram_poll_queue(), a variant of datagram_poll() that accepts an explicit receive queue. This builds on the approach introduced in commit b50b058, which extended other skb-related functions to support custom queues. Patch 2 and 3 update espintcp_poll() and ovpn_tcp_poll() respectively to use this helper, ensuring readiness is only signaled when userspace data is available. Each patch is self-contained and the ovpn one includes rationale and lifecycle enforcement where appropriate. ==================== Link: https://patch.msgid.link/20251021100942.195010-1-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit efd729408bc7d57e0c8d027b9ff514187fc1a05b Author: Ralf Lici Date: Tue Oct 21 12:09:42 2025 +0200 ovpn: use datagram_poll_queue for socket readiness in TCP openvpn TCP encapsulation uses a custom queue to deliver packets to userspace. Currently it relies on datagram_poll, which checks sk_receive_queue, leading to false readiness signals when that queue contains non-userspace packets. Switch ovpn_tcp_poll to use datagram_poll_queue with the peer's user_queue, ensuring poll only signals readiness when userspace data is actually available. Also refactor ovpn_tcp_poll in order to enforce the assumption we can make on the lifetime of ovpn_sock and peer. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Antonio Quartulli Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251021100942.195010-4-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit 0fc3e32c2c069f541f2724d91f5e98480b640326 Author: Ralf Lici Date: Tue Oct 21 12:09:41 2025 +0200 espintcp: use datagram_poll_queue for socket readiness espintcp uses a custom queue (ike_queue) to deliver packets to userspace. The polling logic relies on datagram_poll, which checks sk_receive_queue, which can lead to false readiness signals when that queue contains non-userspace packets. Switch espintcp_poll to use datagram_poll_queue with ike_queue, ensuring poll only signals readiness when userspace data is actually available. Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251021100942.195010-3-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit f6ceec6434b5efff62cecbaa2ff74fc29b96c0c6 Author: Ralf Lici Date: Tue Oct 21 12:09:40 2025 +0200 net: datagram: introduce datagram_poll_queue for custom receive queues Some protocols using TCP encapsulation (e.g., espintcp, openvpn) deliver userspace-bound packets through a custom skb queue rather than the standard sk_receive_queue. Introduce datagram_poll_queue that accepts an explicit receive queue, and convert datagram_poll into a wrapper around datagram_poll_queue. This allows protocols with custom skb queues to reuse the core polling logic without relying on sk_receive_queue. Cc: Sabrina Dubroca Cc: Antonio Quartulli Signed-off-by: Ralf Lici Reviewed-by: Sabrina Dubroca Reviewed-by: Antonio Quartulli Link: https://patch.msgid.link/20251021100942.195010-2-ralf@mandelbit.com Signed-off-by: Paolo Abeni commit 6f37469a933030692741710db809722076f71973 Author: Aaron Kling Date: Tue Oct 21 14:47:06 2025 -0500 memory: tegra210: Fix incorrect client ids The original commit had typos for two of the memory client ids. Fix them to reference the correct bindings. Fixes: 3804cef4c597 ("memory: tegra210: Use bindings for client ids") Signed-off-by: Aaron Kling Link: https://patch.msgid.link/20251021-t210-mem-clientid-fixup-v1-1-5094946faa31@gmail.com Signed-off-by: Krzysztof Kozlowski commit c5efc6a0b3940381d67887302ddb87a5cf623685 Author: Alok Tiwari Date: Thu Oct 23 04:55:24 2025 -0700 io_uring: correct __must_hold annotation in io_install_fixed_file The __must_hold annotation references &req->ctx->uring_lock, but req is not in scope in io_install_fixed_file. This change updates the annotation to reference the correct ctx->uring_lock. improving code clarity. Fixes: f110ed8498af ("io_uring: split out fixed file installation and removal") Signed-off-by: Alok Tiwari Signed-off-by: Jens Axboe commit 316e361b5d2cdeb8d778983794a1c6eadcb26814 Author: Krzysztof Kozlowski Date: Wed Oct 22 15:34:26 2025 +0200 dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups The "groups" property can hold multiple entries (e.g. toshiba/tmpv7708-rm-mbrc.dts file), so allow that by dropping incorrect type (pinmux-node.yaml schema already defines that as string-array) and adding constraints for items. This fixes dtbs_check warnings like: toshiba/tmpv7708-rm-mbrc.dtb: pinctrl@24190000 (toshiba,tmpv7708-pinctrl): pwm-pins:groups: ['pwm0_gpio16_grp', 'pwm1_gpio17_grp', 'pwm2_gpio18_grp', 'pwm3_gpio19_grp'] is too long Fixes: 1825c1fe0057 ("pinctrl: Add DT bindings for Toshiba Visconti TMPV7700 SoC") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Signed-off-by: Linus Walleij commit 369f772299821f93f872bf1b4d7d7ed2fc50243b Author: Yu-Chun Lin Date: Thu Oct 23 15:55:29 2025 +0800 pinctrl: realtek: Select REGMAP_MMIO for RTD driver The pinctrl-rtd driver uses 'devm_regmap_init_mmio', which requires 'REGMAP_MMIO' to be enabled. Without this selection, the build fails with an undefined reference: aarch64-none-linux-gnu-ld: drivers/pinctrl/realtek/pinctrl-rtd.o: in function rtd_pinctrl_probe': pinctrl-rtd.c:(.text+0x5a0): undefined reference to __devm_regmap_init_mmio_clk' Fix this by selecting 'REGMAP_MMIO' in the Kconfig. Fixes: e99ce78030db ("pinctrl: realtek: Add common pinctrl driver for Realtek DHC RTD SoCs") Signed-off-by: Yu-Chun Lin Signed-off-by: Linus Walleij commit ba3a5e1aeaa01ea67067d725710a839114214fc6 Author: Shengjiu Wang Date: Thu Oct 23 14:45:38 2025 +0800 ASoC: fsl_micfil: correct the endian format for DSD The DSD format supported by micfil is that oldest bit is in bit 31, so the format should be DSD little endian format. Fixes: 21aa330fec31 ("ASoC: fsl_micfil: Add decimation filter bypass mode support") Signed-off-by: Shengjiu Wang Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20251023064538.368850-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit d9fbe5b0bf7e2d1e20d53e4e2274f9f61bdcca98 Author: Shengjiu Wang Date: Thu Oct 23 14:45:37 2025 +0800 ASoC: fsl_sai: fix bit order for DSD format The DSD little endian format requires the msb first, because oldest bit is in msb. found this issue by testing with pipewire. Fixes: c111c2ddb3fd ("ASoC: fsl_sai: Add PDM daifmt support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251023064538.368850-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 64007ad3e2a0e0a0ded8b2c6a72c0bb7883d3a33 Author: Cezary Rojewski Date: Thu Oct 23 11:23:48 2025 +0200 ASoC: Intel: avs: Use snd_codec format when initializing probe The data probing is a debug feature. Currently parameters channels and rate specified by the application are read while the format is ignored. More robust approach is to read all of them. Audio format, while not used by the Probe module for PCM streaming, takes part in the gateway initialization on the DSP side. With full parametrization we gain better coverage with the data probing feature. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 845f716dc5f354c719f6fda35048b6c2eca99331 Author: Cezary Rojewski Date: Thu Oct 23 11:23:47 2025 +0200 ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two operations shall be synchronized to avoid slab-use-after-free or worse errors. Fixes: 0dbb186c3510 ("ASoC: Intel: avs: Update stream status in a separate thread") Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit cfca1637bc2b6b1e4f191d2f0b25f12402fbbb26 Author: Cezary Rojewski Date: Thu Oct 23 11:23:46 2025 +0200 ASoC: Intel: avs: Unprepare a stream when XRUN occurs The pcm->prepare() function may be called multiple times in a row by the userspace, as mentioned in the documentation. The driver shall take that into account and prevent redundancy. However, the exact same function is called during XRUNs and in such case, the particular stream shall be reset and setup anew. Fixes: 9114700b496c ("ASoC: Intel: avs: Generic PCM FE operations") Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251023092348.3119313-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 4c4e6ea4a120cc5ab58e437c6ba123cbfc357d45 Author: Haotian Zhang Date: Thu Oct 23 15:02:30 2025 +0800 gpio: ljca: Fix duplicated IRQ mapping The generic_handle_domain_irq() function resolves the hardware IRQ internally. The driver performed a duplicative mapping by calling irq_find_mapping() first, which could lead to an RCU stall. Delete the redundant irq_find_mapping() call and pass the hardware IRQ directly to generic_handle_domain_irq(). Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver") Signed-off-by: Haotian Zhang Link: https://lore.kernel.org/r/20251023070231.1305-1-vulab@iscas.ac.cn [Bartosz: remove unused variable] Signed-off-by: Bartosz Golaszewski commit 622865c73ae30f254abdf182f4b66cccbe3e0f10 Author: LI Qingwu Date: Thu Oct 23 03:44:22 2025 +0000 USB: serial: option: add Telit FN920C04 ECM compositions Add support for the Telit Cinterion FN920C04 module when operating in ECM (Ethernet Control Model) mode. The following USB product IDs are used by the module when AT#USBCFG is set to 3 or 7. 0x10A3: ECM + tty (NMEA) + tty (DUN) [+ tty (DIAG)] T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a3 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10A8: ECM + tty (DUN) + tty (AUX) [+ tty (DIAG)] T: Bus=03 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a8 Rev= 5.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=76e7cb38 C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Adding these IDs allows the option driver to automatically create the corresponding /dev/ttyUSB* ports under ECM mode. Tested with FN920C04 under ECM configuration (USBCFG=3 and 7). Signed-off-by: LI Qingwu Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 114cbd67db825bfa42bc6c34875fc8409e5bba72 Merge: 6e3a4754717a74 f3f313c5114866 Author: Rafael J. Wysocki Date: Thu Oct 23 13:25:02 2025 +0200 Merge branch 'acpi-property' Merge an ACPI device properties handling change fixing the order of __acpi_node_get_property_reference() arguments broken by a recent update (Sunil V L) * 'acpi-property': ACPI: property: Fix argument order in __acpi_node_get_property_reference() commit b62bd2cf7e991efbc823665e54dd7d7d8372c33b Merge: db82b8dbf5f06d 10fad4012234a7 673e75ea55df5f Author: Rafael J. Wysocki Date: Thu Oct 23 13:12:24 2025 +0200 Merge branches 'pm-cpuidle' and 'pm-cpufreq' Merge cpuidle and cpufreq fixes for 6.18-rc3: - Revert a cpuidle menu governor change that introduced a serious performance regression on Chromebooks with Intel Jasper Lake processors (Rafael Wysocki) - Fix an amd-pstate driver regression leading to EPP=0 after hibernation (Mario Limonciello) * pm-cpuidle: Revert "cpuidle: menu: Avoid discarding useful information" * pm-cpufreq: cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit 10843e1492e474c02b91314963161731fa92af91 Author: Tonghao Zhang Date: Tue Oct 21 13:09:33 2025 +0800 net: bonding: fix possible peer notify event loss or dup issue If the send_peer_notif counter and the peer event notify are not synchronized. It may cause problems such as the loss or dup of peer notify event. Before this patch: - If should_notify_peers is true and the lock for send_peer_notif-- fails, peer event may be sent again in next mii_monitor loop, because should_notify_peers is still true. - If should_notify_peers is true and the lock for send_peer_notif-- succeeded, but the lock for peer event fails, the peer event will be lost. This patch locks the RTNL for send_peer_notif, events, and commit simultaneously. Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") Cc: Jay Vosburgh Cc: Andrew Lunn Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Hangbin Liu Cc: Nikolay Aleksandrov Cc: Vincent Bernat Cc: Signed-off-by: Tonghao Zhang Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251021050933.46412-1-tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 79816d4b9e9b9bb03d5d871c04c97b1bce102b14 Author: Samuel Wu Date: Wed Oct 22 22:28:30 2025 +0000 Revert "PM: sleep: Make pm_wakeup_clear() call more clear" This reverts commit 56a232d93cea0ba14da5e3157830330756a45b4c. The above commit changed the position of pm_wakeup_clear() for the suspend call path, but other call paths with references to freeze_processes() were not updated. This means that other call paths, such as hibernate(), will not have pm_wakeup_clear() called. Suggested-by: Saravana Kannan Signed-off-by: Samuel Wu [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251022222830.634086-1-wusamuel@google.com Signed-off-by: Rafael J. Wysocki commit 5f4bfd03bc9deec480bf9f8cb37e63e590fd8212 Merge: 2ba5772e530f73 b1055678a0160b Author: Bartosz Golaszewski Date: Thu Oct 23 10:06:59 2025 +0200 Merge tag 'intel-gpio-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio fixes for v6.18-1 * Make set debounce errors non-fatal in GPIO ACPI case * Use human readable error when printing a message in GPIO ACPI code commit 64c9471aa9ded2440bf182b1c71d3f93f80b2f85 Author: David Howells Date: Mon Oct 20 10:16:07 2025 +0100 cifs: #include cifsglob.h before trace.h to allow structs in tracepoints Make cifs #include cifsglob.h in advance of #including trace.h so that the structures defined in cifsglob.h can be accessed directly by the cifs tracepoints rather than the callers having to manually pass in the bits and pieces. This should allow the tracepoints to be made more efficient to use as well as easier to read in the code. Signed-off-by: David Howells cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 4b1d7f62225a2fd024b2df5675515557169f17e7 Author: David Howells Date: Tue Oct 14 18:10:08 2025 +0100 cifs: Call the calc_signature functions directly As the SMB1 and SMB2/3 calc_signature functions are called from separate sign and verify paths, just call them directly rather than using a function pointer. The SMB3 calc_signature then jumps to the SMB2 variant if necessary. Signed-off-by: David Howells Acked-by: Enzo Matsumiya cc: Paulo Alcantara cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 72ed55b4c335703c203b942972558173e1e5ddee Author: Paulo Alcantara Date: Wed Oct 22 21:11:01 2025 -0300 smb: client: get rid of d_drop() in cifs_do_rename() There is no need to force a lookup by unhashing the moved dentry after successfully renaming the file on server. The file metadata will be re-fetched from server, if necessary, in the next call to ->d_revalidate() anyways. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: stable@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 5c56bf214af85ca042bf97f8584aab2151035840 Author: Niravkumar L Rabara Date: Thu Oct 23 11:32:01 2025 +0800 mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer `dma_dev` was being dereferenced before ensuring that `cdns_ctrl->dmac` is properly initialized. Move the assignment of `dma_dev` after successfully acquiring the DMA channel to ensure the pointer is valid before use. Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address") Cc: stable@vger.kernel.org Signed-off-by: Niravkumar L Rabara Signed-off-by: Miquel Raynal commit b1055678a0160b2952c322ad1b61805562698f99 Author: Andy Shevchenko Date: Thu Oct 23 08:39:58 2025 +0200 gpiolib: acpi: Use %pe when passing an error pointer to dev_err() One of the coccinelle recipe suggests to use %pe when we deal with an error pointer. Do it so. Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510231350.calxvXIm-lkp@intel.com/ Signed-off-by: Andy Shevchenko commit e4a77f9c85a528b3289c1d9570d6d73a7b5f847b Author: Hans de Goede Date: Wed Oct 22 15:37:15 2025 +0200 gpiolib: acpi: Make set debounce errors non fatal Commit 16c07342b542 ("gpiolib: acpi: Program debounce when finding GPIO") adds a gpio_set_debounce_timeout() call to acpi_find_gpio() and makes acpi_find_gpio() fail if this fails. But gpio_set_debounce_timeout() failing is a somewhat normal occurrence, since not all debounce values are supported on all GPIO/pinctrl chips. Making this an error for example break getting the card-detect GPIO for the micro-sd slot found on many Bay Trail tablets, breaking support for the micro-sd slot on these tablets. acpi_request_own_gpiod() already treats gpio_set_debounce_timeout() failures as non-fatal, just warning about them. Add a acpi_gpio_set_debounce_timeout() helper which wraps gpio_set_debounce_timeout() and warns on failures and replace both existing gpio_set_debounce_timeout() calls with the helper. Since the helper only warns on failures this fixes the card-detect issue. Fixes: 16c07342b542 ("gpiolib: acpi: Program debounce when finding GPIO") Cc: stable@vger.kernel.org Cc: Mario Limonciello Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Link: https://lore.kernel.org/stable/20250920201200.20611-1-hansg%40kernel.org Signed-off-by: Andy Shevchenko commit 3c9bf72cc1ced1297b235f9422d62b613a3fdae9 Author: Haotian Zhang Date: Mon Oct 20 18:11:09 2025 +0800 crypto: aspeed - fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove(). Fixes: 2f1cf4e50c95 ("crypto: aspeed - Add ACRY RSA driver") Signed-off-by: Haotian Zhang Signed-off-by: Herbert Xu commit 3ac2939bc4341ac28700a2ed0c345ba7e7bdb6fd Author: Harald Freudenberger Date: Fri Oct 17 14:32:54 2025 +0200 crypto: s390/phmac - Do not modify the req->nbytes value The phmac implementation used the req->nbytes field on combined operations (finup, digest) to track the state: with req->nbytes > 0 the update needs to be processed, while req->nbytes == 0 means to do the final operation. For this purpose the req->nbytes field was set to 0 after successful update operation. However, aead uses the req->nbytes field after a successful hash operation to determine the amount of data to en/decrypt. So an implementation must not modify the nbytes field. Fixed by a slight rework on the phmac implementation. There is now a new field async_op in the request context which tracks the (asynch) operation to process. So the 'state' via req->nbytes is not needed any more and now this field is untouched and may be evaluated even after a request is processed by the phmac implementation. Fixes: cbbc675506cc ("crypto: s390 - New s390 specific protected key hash phmac") Reported-by: Ingo Franzki Signed-off-by: Harald Freudenberger Tested-by: Ingo Franzki Reviewed-by: Ingo Franzki Reviewed-by: Holger Dengler Signed-off-by: Herbert Xu commit 0194b65ab571430130a11f8500894bb88f7af2c0 Author: Keith Busch Date: Tue Oct 21 08:15:05 2025 -0700 nvme-pci: use blk_map_iter for p2p metadata The dma_map_bvec helper doesn't work for p2p data, so use the same blk_map_iter method that sgl uses for this memory type. Reported-by: Leon Romanovsky Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit c0178eec8884231a5ae0592b9fce827bccb77e86 Author: Fernando Fernandez Mancera Date: Mon Oct 20 15:55:33 2025 +0200 net: hsr: prevent creation of HSR device with slaves from another netns HSR/PRP driver does not handle correctly having slaves/interlink devices in a different net namespace. Currently, it is possible to create a HSR link in a different net namespace than the slaves/interlink with the following command: ip link add hsr0 netns hsr-ns type hsr slave1 eth1 slave2 eth2 As there is no use-case on supporting this scenario, enforce that HSR device link matches netns defined by IFLA_LINK_NETNSID. The iproute2 command mentioned above will throw the following error: Error: hsr: HSR slaves/interlink must be on the same net namespace than HSR link. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20251020135533.9373-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 441f0647f7673e0e64d4910ef61a5fb8f16bfb82 Author: Alexey Simakov Date: Tue Oct 21 16:00:36 2025 +0300 sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition. Fixes: 90017accff61 ("sctp: Add GSO support") Signed-off-by: Alexey Simakov Acked-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com Signed-off-by: Jakub Kicinski commit a767957e7a83f9e742be196aa52a48de8ac5a7e4 Author: Jiasheng Jiang Date: Tue Oct 21 18:24:56 2025 +0000 ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop In ptp_ocp_sma_fb_init(), the code mistakenly used bp->sma[1] instead of bp->sma[i] inside a for-loop, which caused only SMA[1] to have its DIRECTION_CAN_CHANGE capability cleared. This led to inconsistent capability flags across SMA pins. Fixes: 09eeb3aecc6c ("ptp_ocp: implement DPLL ops") Signed-off-by: Jiasheng Jiang Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251021182456.9729-1-jiashengjiangcool@gmail.com Signed-off-by: Jakub Kicinski commit 5b2ff4873aeab972f919d5aea11c51393322bf58 Author: David Howells Date: Mon Oct 20 09:40:02 2025 +0100 cifs: Fix TCP_Server_Info::credits to be signed Fix TCP_Server_Info::credits to be signed, just as echo_credits and oplock_credits are. This also fixes what ought to get at least a compilation warning if not an outright error in *get_credits_field() as a pointer to the unsigned server->credits field is passed back as a pointer to a signed int. Signed-off-by: David Howells cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Acked-by: Pavel Shilovskiy Signed-off-by: Steve French commit 4c3aa496a2faac77069ea041e886edff01639610 Merge: d63f0391d6c7b7 706136c5723626 Author: Jakub Kicinski Date: Wed Oct 22 18:08:06 2025 -0700 Merge branch 'net-ravb-fix-soc-specific-configuration-and-descriptor-handling-issues' Lad Prabhakar says: ==================== net: ravb: Fix SoC-specific configuration and descriptor handling issues [part] This series addresses several issues in the Renesas Ethernet AVB (ravb) driver related descriptor ordering. A potential ordering hazard in descriptor setup could cause the DMA engine to start prematurely, leading to TX stalls on some platforms. The series includes the following changes: Enforce descriptor type ordering to prevent early DMA start Ensure proper write ordering of TX descriptor type fields to prevent the DMA engine from observing an incomplete descriptor chain. This fixes observed TX stalls on RZ/G2L platforms running RT kernels. Tested on R/G1x Gen2, RZ/G2x Gen3 and RZ/G2L family hardware. ==================== Link: https://patch.msgid.link/20251017151830.171062-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 706136c5723626fcde8dd8f598a4dcd251e24927 Author: Lad Prabhakar Date: Fri Oct 17 16:18:30 2025 +0100 net: ravb: Ensure memory write completes before ringing TX doorbell Add a final dma_wmb() barrier before triggering the transmit request (TCCR_TSRQ) to ensure all descriptor and buffer writes are visible to the DMA engine. According to the hardware manual, a read-back operation is required before writing to the doorbell register to guarantee completion of previous writes. Instead of performing a dummy read, a dma_wmb() is used to both enforce the same ordering semantics on the CPU side and also to ensure completion of writes. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Cc: stable@vger.kernel.org Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20251017151830.171062-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 5370c31e84b0e0999c7b5ff949f4e104def35584 Author: Lad Prabhakar Date: Fri Oct 17 16:18:29 2025 +0100 net: ravb: Enforce descriptor type ordering Ensure the TX descriptor type fields are published in a safe order so the DMA engine never begins processing a descriptor chain before all descriptor fields are fully initialised. For multi-descriptor transmits the driver writes DT_FEND into the last descriptor and DT_FSTART into the first. The DMA engine begins processing when it observes DT_FSTART. Move the dma_wmb() barrier so it executes immediately after DT_FEND and immediately before writing DT_FSTART (and before DT_FSINGLE in the single-descriptor case). This guarantees that all prior CPU writes to the descriptor memory are visible to the device before DT_FSTART is seen. This avoids a situation where compiler/CPU reordering could publish DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to start on a partially initialised chain and causing corrupted transmissions or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as transmit queue timeouts and device resets. Fixes: 2f45d1902acf ("ravb: minimize TX data copying") Cc: stable@vger.kernel.org Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20251017151830.171062-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 123111ea6226c5302cc192028e7ae923c44e1382 Author: Stefan Metzmacher Date: Mon Oct 20 20:36:02 2025 +0200 smb: client: make use of smbdirect_socket.send_io.lcredits.* This makes the logic to prevent on overflow of the send submission queue with ib_post_send() easier. As we first get a local credit and then a remote credit before we mark us as pending. For now we'll keep the logic around smbdirect_socket.send_io.pending.*, but that will likely change or be removed completely. The server will get a similar logic soon, so we'll be able to share the send code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0158e864cca0c98bdc2866f1eb30c66fa21e250c Author: Stefan Metzmacher Date: Mon Oct 20 20:36:01 2025 +0200 smb: server: make use of smbdirect_socket.send_io.lcredits.* This introduces logic to prevent on overflow of the send submission queue with ib_post_send() easier. As we first get a local credit and then a remote credit before we mark us as pending. From reading the git history of the linux smbdirect implementations in client and server) it was seen that a peer granted more credits than we requested. I guess that only happened because of bugs in our implementation which was active as client and server. I guess Windows won't do that. So the local credits make sure we only use the amount of credits we asked for. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a90227462a14f5bdf7dfd4b73c2b75c54834efce Author: Stefan Metzmacher Date: Mon Oct 20 20:36:00 2025 +0200 smb: server: simplify sibling_list handling in smb_direct_flush_send_list/send_done We have a list handling that is much easier to understand: 1. Before smb_direct_flush_send_list() is called all struct smbdirect_send_io messages are part of send_ctx->msg_list 2. Before smb_direct_flush_send_list() calls smb_direct_post_send() we remove the last element in send_ctx->msg_list and move all others into last->sibling_list. As only last has IB_SEND_SIGNALED and gets a completion vis send_done(). 3. send_done() has an easy way to free all others in sendmsg->sibling_list (if there are any). And use list_for_each_entry_safe() instead of a complex custom logic. This will help us to share send_done() in common code soon, as it will work fine for the client too, where last->sibling_list is currently always an empty list. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8059c64049587dac8af37ad82e2034b64c2d9fee Author: Stefan Metzmacher Date: Mon Oct 20 20:35:59 2025 +0200 smb: server: smb_direct_disconnect_rdma_connection() already wakes all waiters on error There's no need to care about pending or credit counters when we already disconnecting. And all related wait_event conditions already check for broken connections too. This will simplify the code and makes the following changes simpler. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 68335cbcddcd586b59820e6d484652ad62343112 Author: Stefan Metzmacher Date: Mon Oct 20 20:35:58 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.lcredits.* This will be used to implement a logic in order to make sure we don't overflow the send submission queue for ib_post_send(). We will initialize the local credits with the fixed sp->send_credit_target value, which matches the reserved slots in the submission queue for ib_post_send(). We will be a local credit first and then wait for a remote credit, if we managed to get both we are allowed to post an IB_WR_SEND[_WITH_INV]. The local credit is given back to the pool when we get the local ib_post_send() completion, while remote credits are granted by the peer. From reading the git history of the linux smbdirect implementations in client and server) it was seen that a peer granted more credits than we requested. I guess that only happened because of bugs in our implementation which was active as client and server. I guess Windows won't do that. So the local credits make sure we only use the amount of credits we asked for. The client already has some logic for this based on smbdirect_socket.send_io.pending.count, but that counts in the order direction and makes it complex it share common logic for various credits classes. That logic will be replaced soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0bd73ae09ba1b73137d0830b21820d24700e09b1 Author: Stefan Metzmacher Date: Fri Oct 17 11:55:02 2025 +0200 smb: server: allocate enough space for RW WRs and ib_drain_qp() Make use of rdma_rw_mr_factor() to calculate the number of rw credits and the number of pages per RDMA RW operation. We get the same numbers for iWarp connections, tested with siw.ko and irdma.ko (in iWarp mode). siw: CIFS: max_qp_rd_atom=128, max_fast_reg_page_list_len = 256 CIFS: max_sgl_rd=0, max_sge_rd=1 CIFS: responder_resources=32 max_frmr_depth=256 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 3276800 max_qp_wr 32768 ksmbd: max_fast_reg_page_list_len = 256, max_sgl_rd=0, max_sge_rd=1 ksmbd: device reporting max_cqe 3276800 max_qp_wr 32768 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 9, num_pages = 256, maxpages=2048 ksmbd: Info: rdma_send_wr 27 + max_send_wr 256 = 283 irdma (in iWarp mode): CIFS: max_qp_rd_atom=127, max_fast_reg_page_list_len = 262144 CIFS: max_sgl_rd=0, max_sge_rd=13 CIFS: responder_resources=32 max_frmr_depth=2048 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: max_fast_reg_page_list_len = 262144, max_sgl_rd=0, max_sge_rd=13 ksmbd: device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 9, num_pages = 256, maxpages=2048 ksmbd: rdma_send_wr 27 + max_send_wr 256 = 283 This means that we get the different correct numbers for ROCE, tested with rdma_rxe.ko and irdma.ko (in RoCEv2 mode). rxe: CIFS: max_qp_rd_atom=128, max_fast_reg_page_list_len = 512 CIFS: max_sgl_rd=0, max_sge_rd=32 CIFS: responder_resources=32 max_frmr_depth=512 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 32767 max_qp_wr 1048576 ksmbd: max_fast_reg_page_list_len = 512, max_sgl_rd=0, max_sge_rd=32 ksmbd: device reporting max_cqe 32767 max_qp_wr 1048576 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256 ksmbd: New sc->rw_io.credits: max = 65, num_pages = 32, maxpages=2048 ksmbd: rdma_send_wr 65 + max_send_wr 256 = 321 irdma (in RoCEv2 mode): CIFS: max_qp_rd_atom=127, max_fast_reg_page_list_len = 262144, CIFS: max_sgl_rd=0, max_sge_rd=13 CIFS: responder_resources=32 max_frmr_depth=2048 mr_io.type=0 CIFS: max_send_wr 384, device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: max_fast_reg_page_list_len = 262144, max_sgl_rd=0, max_sge_rd=13 ksmbd: device reporting max_cqe 1048574 max_qp_wr 4063 ksmbd: Old sc->rw_io.credits: max = 9, num_pages = 256, ksmbd: New sc->rw_io.credits: max = 159, num_pages = 13, maxpages=2048 ksmbd: rdma_send_wr 159 + max_send_wr 256 = 415 And rely on rdma_rw_init_qp() to setup ib_mr_pool_init() for RW MRs. ib_mr_pool_destroy() will be called by rdma_rw_cleanup_mrs(). It seems the code was implemented before the rdma_rw_* layer was fully established in the kernel. While there also add additional space for ib_drain_qp(). This should make sure ib_post_send() will never fail because the submission queue is full. Fixes: ddbdc861e37c ("ksmbd: smbd: introduce read/write credits for RDMA read/write") Fixes: 4c564f03e23b ("smb: server: make use of common smbdirect_socket") Fixes: 177368b99243 ("smb: server: make use of common smbdirect_socket_parameters") Fixes: 95475d8886bd ("smb: server: make use smbdirect_socket.rw_io.credits") Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 43e9ad0c55a369ecc84a4788d06a8a6bfa634f1c Merge: 0f3ad9c6105f32 48277906603528 Author: Linus Torvalds Date: Wed Oct 22 15:00:34 2025 -1000 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All driver fixes. The big change is the storvsc one to rejig the hyper-v channel handling to be more efficient for SMP virtual machines" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: phy: dt-bindings: Add QMP UFS PHY compatible for Kaanapali scsi: ufs: qcom: dt-bindings: Document the Kaanapali UFS controller scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() scsi: qla4xxx: Fix typos in comments scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU commit 0f3ad9c6105f32d1755c0bd54a7f98c892f3ceb7 Merge: dd72c8fcf6d35d 9aa12167ef1149 Author: Linus Torvalds Date: Wed Oct 22 14:57:35 2025 -1000 Merge tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "17 hotfixes. 12 are cc:stable and 14 are for MM. There's a two-patch DAMON series from SeongJae Park which addresses a missed check and possible memory leak. Apart from that it's all singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2025-10-22-12-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: csky: abiv2: adapt to new folio flags field mm/damon/core: use damos_commit_quota_goal() for new goal commit mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme hugetlbfs: move lock assertions after early returns in huge_pmd_unshare() vmw_balloon: indicate success when effectively deflating during migration mm/damon/core: fix list_add_tail() call on damon_call() mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap mm: prevent poison consumption when splitting THP ocfs2: clear extent cache after moving/defragmenting extents mm: don't spin in add_stack_record when gfp flags don't allow dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC mm/damon/sysfs: dealloc commit test ctx always mm/damon/sysfs: catch commit test ctx alloc failure hung_task: fix warnings caused by unaligned lock pointers commit 60ad1de8e59278656092f56e87189ec82f078d12 Author: Hannes Reinecke Date: Wed Oct 22 09:59:24 2025 +0200 nvmet-auth: update sc_c in host response The target code should set the sc_c bit in calculating the host response based on the status of the 'concat' setting, otherwise we'll get an authentication mismatch for hosts setting that bit correctly. Fixes: 7e091add9c43 ("nvme-auth: update sc_c in host response") Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 20594cd104abaaabb676c7a2915b150ae5ff093d Author: Kaushlendra Kumar Date: Mon Oct 6 14:17:06 2025 +0530 ACPI: button: Call input_free_device() on failing input device registration Make acpi_button_add() call input_free_device() when input_register_device() fails as required according to the documentation of the latter. Fixes: 0d51157dfaac ("ACPI: button: Eliminate the driver notify callback") Signed-off-by: Kaushlendra Kumar Cc: 6.5+ # 6.5+ [ rjw: Subject and changelog rewrite, Fixes: tag ] Link: https://patch.msgid.link/20251006084706.971855-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 2050280a4bb660b47f8cccf75a69293ae7cbb087 Author: Chen-Yu Tsai Date: Tue Oct 21 01:10:52 2025 +0800 clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate While the user manual states that the PLL's rate should be between 180 MHz and 3 GHz in the register defninition section, it also says the actual operating frequency is 22.5792*4 MHz in the PLL features table. 22.5792*4 MHz is one of the actual clock rates that we want and is is available in the SDM table. Lower the minimum clock rate to 90 MHz so that both rates in the SDM table can be used. Fixes: 7cae1e2b5544 ("clk: sunxi-ng: Add support for the A523/T527 CCU PLLs") Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20251020171059.2786070-7-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 5888533c6011de319c5f23ae147f1f291ce81582 Author: Chen-Yu Tsai Date: Tue Oct 21 01:10:51 2025 +0800 clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical The "bus-r-dma" clock in the A523's PRCM clock controller is also referred to as "DMA_CLKEN_SW" or "DMA ADB400 gating". It is unclear how this ties into the DMA controller MBUS clock gate; however if the clock is not enabled, the DMA controller in the MCU block will fail to access DRAM, even failing to retrieve the DMA descriptors. Mark this clock as critical. This sort of mirrors what is done for the main DMA controller's MBUS clock, which has a separate toggle that is currently left out of the main clock controller driver. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251020171059.2786070-6-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 1af424b15401d2be789c4dc2279889514e7c5c94 Author: Eric Biggers Date: Tue Oct 21 20:34:05 2025 -0700 lib/crypto: poly1305: Restore dependency of arch code on !KMSAN Restore the dependency of the architecture-optimized Poly1305 code on !KMSAN. It was dropped by commit b646b782e522 ("lib/crypto: poly1305: Consolidate into single module"). Unlike the other hash algorithms in lib/crypto/ (e.g., SHA-512), the way the architecture-optimized Poly1305 code is integrated results in assembly code initializing memory, for several different architectures. Thus, it generates false positive KMSAN warnings. These could be suppressed with kmsan_unpoison_memory(), but it would be needed in quite a few places. For now let's just restore the dependency on !KMSAN. Note: this should have been caught by running poly1305_kunit with CONFIG_KMSAN=y, which I did. However, due to an unrelated KMSAN bug (https://lore.kernel.org/r/20251022030213.GA35717@sol/), KMSAN currently isn't working reliably. Thus, the warning wasn't noticed until later. Fixes: b646b782e522 ("lib/crypto: poly1305: Consolidate into single module") Reported-by: syzbot+01fcd39a0d90cdb0e3df@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68f6a48f.050a0220.91a22.0452.GAE@google.com/ Reported-by: Pei Xiao Closes: https://lore.kernel.org/r/751b3d80293a6f599bb07770afcef24f623c7da0.1761026343.git.xiaopei01@kylinos.cn/ Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251022033405.64761-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 060aa0b0c26c9e88cfc1433fab3d0145700e8247 Author: David Wei Date: Tue Oct 21 13:29:44 2025 -0700 io_uring zcrx: add MAINTAINERS entry Same as [1] but also with netdev@ as an additional mailing list. io_uring zero copy receive is of particular interest to netdev participants too, given its tight integration to netdev core. With this updated entry, folks running get_maintainer.pl on patches that touch io_uring/zcrx.* will know to send it to netdev@ as well. Note that this doesn't mean all changes require explicit acks from netdev; this is purely for wider visibility and for other contributors to know where to send patches. [1]: https://lore.kernel.org/io-uring/989528e611b51d71fb712691ebfb76d2059ba561.1755461246.git.asml.silence@gmail.com/ Signed-off-by: David Wei Acked-by: Jakub Kicinski Reviewed-by: Mina Almasry [axboe: use correct io_uring tree URL] Signed-off-by: Jens Axboe commit 915651b7c9473fd23d0e56fe227a97eda483cf7c Author: Ranganath V N Date: Tue Oct 21 22:59:30 2025 +0530 io_uring: Fix code indentation error Fix the indentation to ensure consistent code style and improve readability and to fix the errors: ERROR: code indent should use tabs where possible + return io_net_import_vec(req, kmsg, sr->buf, sr->len, ITER_SOURCE);$ ERROR: code indent should use tabs where possible +^I^I^I struct io_big_cqe *big_cqe)$ Tested by running the /scripts/checkpatch.pl Signed-off-by: Ranganath V N Signed-off-by: Jens Axboe commit a94e0657269c5b8e1a90b17aa2c048b3d276e16d Author: Jens Axboe Date: Tue Oct 21 11:44:39 2025 -0600 io_uring/sqpoll: be smarter on when to update the stime usage The current approach is a bit naive, and hence calls the time querying way too often. Only start the "doing work" timer when there's actual work to do, and then use that information to terminate (and account) the work time once done. This greatly reduces the frequency of these calls, when they cannot have changed anyway. Running a basic random reader that is setup to use SQPOLL, a profile before this change shows these as the top cycle consumers: + 32.60% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime_adjusted + 19.97% iou-sqp-1074 [kernel.kallsyms] [k] thread_group_cputime + 12.20% io_uring io_uring [.] submitter_uring_fn + 4.13% iou-sqp-1074 [kernel.kallsyms] [k] getrusage + 2.45% iou-sqp-1074 [kernel.kallsyms] [k] io_submit_sqes + 2.18% iou-sqp-1074 [kernel.kallsyms] [k] __pi_memset_generic + 2.09% iou-sqp-1074 [kernel.kallsyms] [k] cputime_adjust and after this change, top of profile looks as follows: + 36.23% io_uring io_uring [.] submitter_uring_fn + 23.26% iou-sqp-819 [kernel.kallsyms] [k] io_sq_thread + 10.14% iou-sqp-819 [kernel.kallsyms] [k] io_sq_tw + 6.52% iou-sqp-819 [kernel.kallsyms] [k] tctx_task_work_run + 4.82% iou-sqp-819 [kernel.kallsyms] [k] nvme_submit_cmds.part.0 + 2.91% iou-sqp-819 [kernel.kallsyms] [k] io_submit_sqes [...] 0.02% iou-sqp-819 [kernel.kallsyms] [k] cputime_adjust where it's spending the cycles on things that actually matter. Reported-by: Fengnan Chang Cc: stable@vger.kernel.org Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") Signed-off-by: Jens Axboe commit 8ac9b0d33e5c0a995338ee5f25fe1b6ff7d97f65 Author: Jens Axboe Date: Tue Oct 21 07:16:08 2025 -0600 io_uring/sqpoll: switch away from getrusage() for CPU accounting getrusage() does a lot more than what the SQPOLL accounting needs, the latter only cares about (and uses) the stime. Rather than do a full RUSAGE_SELF summation, just query the used stime instead. Cc: stable@vger.kernel.org Fixes: 3fcb9d17206e ("io_uring/sqpoll: statistics of the true utilization of sq threads") Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit f294a5fd34db564108a16166d891634a3cb25c68 Author: Ilpo Järvinen Date: Fri Oct 17 14:09:03 2025 +0300 MIPS: Malta: Use pcibios_align_resource() to block io range According to Maciej W. Rozycki , the mips_pcibios_init() for malta adjusts root bus IO resource start address to prevent interfering with PIIX4 I/O cycle decoding. Adjusting lower bound leaves PIIX4 IO resources outside of the root bus resource and assign_fixed_resource_on_bus() does not link the resources into the resource tree. Prior to commit ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") the arch specific pcibios_enable_resources() did not check if the resources were assigned which diverges from what PCI core checks, effectively hiding the PIIX4 IO resources were not properly within the resource tree. After starting to use pcibios_enable_resources() from PCI core, enabling PIIX4 fails: ata_piix 0000:00:0a.1: BAR 0 [io 0x01f0-0x01f7]: not claimed; can't enable device ata_piix 0000:00:0a.1: probe with driver ata_piix failed with error -22 MIPS PCI code already has support for enforcing lower bounds using PCIBIOS_MIN_IO in pcibios_align_resource() without altering the IO window start address itself. Make malta PCI code too to use PCIBIOS_MIN_IO. Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Reported-by: Guenter Roeck Link: https://lore.kernel.org/linux-pci/9085ab12-1559-4462-9b18-f03dcb9a4088@roeck-us.net/ Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/linux-pci/alpine.DEB.2.21.2510132229120.39634@angie.orcam.me.uk/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Guenter Roeck Tested-by: Maciej W. Rozycki Acked-by: Thomas Bogendoerfer Link: https://patch.msgid.link/20251017110903.1973-1-ilpo.jarvinen@linux.intel.com commit 1d5d1663619d5a367be538f6a1be1cf5bd2cf494 Author: Maciej W. Rozycki Date: Tue Oct 21 20:38:29 2025 +0100 MIPS: Malta: Fix PCI southbridge legacy resource reservations Covering the PCI southbridge legacy port I/O range with a northbridge resource reservation prevents MIPS Malta platform code from claiming its standard legacy resources. This is because request_resource() calls cause a clash with the previous reservation and consequently fail. Change to using insert_resource() so as to prevent the clash, switching the legacy reservations from: 00000000-00ffffff : MSC PCI I/O 00000020-00000021 : pic1 00000070-00000077 : rtc0 000000a0-000000a1 : pic2 [...] to: 00000000-00ffffff : MSC PCI I/O 00000000-0000001f : dma1 00000020-00000021 : pic1 00000040-0000005f : timer 00000060-0000006f : keyboard 00000070-00000077 : rtc0 00000080-0000008f : dma page reg 000000a0-000000a1 : pic2 000000c0-000000df : dma2 [...] Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()") Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Thomas Bogendoerfer Cc: stable@vger.kernel.org # v6.18+ Link: https://patch.msgid.link/alpine.DEB.2.21.2510212001250.8377@angie.orcam.me.uk commit bf5570590a981d0659d0808d2d4bcda21b27a2a5 Author: Maciej W. Rozycki Date: Tue Oct 21 20:38:22 2025 +0100 MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering MIPS Malta platform code registers the PCI southbridge legacy port I/O PS/2 keyboard range as a standard resource marked as busy. It prevents the i8042 driver from registering as it fails to claim the resource in a call to i8042_platform_init(). Consequently PS/2 keyboard and mouse devices cannot be used with this platform. Fix the issue by removing the busy marker from the standard reservation, making the driver register successfully: serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 and the resource show up as expected among the legacy devices: 00000000-00ffffff : MSC PCI I/O 00000000-0000001f : dma1 00000020-00000021 : pic1 00000040-0000005f : timer 00000060-0000006f : keyboard 00000060-0000006f : i8042 00000070-00000077 : rtc0 00000080-0000008f : dma page reg 000000a0-000000a1 : pic2 000000c0-000000df : dma2 [...] If the i8042 driver has not been configured, then the standard resource will remain there preventing any conflicting dynamic assignment of this PCI port I/O address range. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Thomas Bogendoerfer Cc: stable@vger.kernel.org Link: https://patch.msgid.link/alpine.DEB.2.21.2510211919240.8377@angie.orcam.me.uk commit 4c8cf6bd28d6fea23819f082ddc8063fd6fa963a Author: Christoph Hellwig Date: Wed Oct 22 10:33:31 2025 +0200 block: require LBA dma_alignment when using PI The block layer PI generation / verification code expects the bio_vecs to have at least LBA size (or more correctly integrity internal) granularity. With the direct I/O alignment relaxation in 2022, user space can now feed bios with less alignment than that, leading to scribbling outside the PI buffers. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr"), xfstests generic/013 by default generates such I/O now that the relaxed alignment is advertised by the XFS_IOC_DIOINFO ioctl. Fix this by increasing the required alignment when using PI, although handling arbitrary alignment in the long run would be even nicer. Fixes: bf8d08532bc1 ("iomap: add support for dma aligned direct-io") Fixes: b1a000d3b8ec ("block: relax direct io memory alignment") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 89205c60c0fc96b73567a2e9fe27ee3f59d01193 Author: Reinhard Speyerer Date: Wed Oct 22 16:17:26 2025 +0200 USB: serial: option: add Quectel RG255C Add support for Quectel RG255C devices to complement commit 5c964c8a97c1 ("net: usb: qmi_wwan: add Quectel RG255C"). The composition is DM / NMEA / AT / QMI. T: Bus=01 Lev=02 Prnt=99 Port=01 Cnt=02 Dev#=110 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0316 Rev= 5.15 S: Manufacturer=Quectel S: Product=RG255C-GL S: SerialNumber=xxxxxxxx C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Reinhard Speyerer Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 920aa3a7705a061cb3004572d8b7932b54463dbf Author: Sidharth Seela Date: Mon Sep 29 17:24:06 2025 +0530 selftests: cachestat: Fix warning on declaration under label Fix warning caused from declaration under a case label. The proper way is to declare variable at the beginning of the function. The warning came from running clang using LLVM=1; and is as follows: -test_cachestat.c:260:3: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 260 | char *map = mmap(NULL, filesize, PROT_READ | PROT_WRITE, | Link: https://lore.kernel.org/r/20250929115405.25695-2-sidharthseela@gmail.com Signed-off-by: Sidharth Seela Reviewed-by: SeongJae Park Reviewed-by: wang lian Reviewed-by: Dev Jain Acked-by: Shuah Khan Acked-by: Nhat Pham Signed-off-by: Shuah Khan commit b90cafb438874e1419c14dfbcaf60ec7fc6ea353 Author: Madhur Kumar Date: Mon Oct 13 15:21:49 2025 +0530 selftests/cachestat: add tmpshmcstat file to .gitignore Add the tmpshmcstat file to .gitignore to avoid accidentally staging the build artifact Link: https://lore.kernel.org/r/20251013095149.1386628-1-madhurkumar004@gmail.com Signed-off-by: Madhur Kumar Signed-off-by: Shuah Khan commit dd72c8fcf6d35de5d6d976f20dc1ae84ce7af08b Merge: 250a17e8f9555f 34cbd6e07fddf3 Author: Linus Torvalds Date: Wed Oct 22 05:17:32 2025 -1000 Merge tag 'platform-drivers-x86-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - alienware-wmi-wmax: - Fix NULL pointer dereference in sleep handlers - Add AWCC support to Dell G15 5530 - mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init * tag 'platform-drivers-x86-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530 MAINTAINERS: add Denis Benato as maintainer for asus notebooks platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers commit 250a17e8f9555f5c5207581068ebfa2aa1f540a2 Merge: 9ea7460217423f 2a13fc417f493e Author: Linus Torvalds Date: Wed Oct 22 04:58:00 2025 -1000 Merge tag 'erofs-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Just three small fixes to address fuzzed images in relatively new features, as reported by Robert. - Hardening against fuzzed encoded extents - Fix infinite loops due to crafted subpage compact indexes - Improve z_erofs_extent_lookback()" * tag 'erofs-for-6.18-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: consolidate z_erofs_extent_lookback() erofs: avoid infinite loops due to corrupted subpage compact indexes erofs: fix crafted invalid cases for encoded extents commit 9ea7460217423f07febe273307a5f3b6b1303b29 Merge: 552c50713f273b 43c36a56ccf6d9 Author: Linus Torvalds Date: Wed Oct 22 04:53:34 2025 -1000 Merge tag '9p-for-6.18-rc3-v2' of https://github.com/martinetd/linux Pull 9pfs fix from Dominique Martinet: "Fix 9p cache=mmap regression by revert This reverts the problematic commit instead of trying to fix it in a rush" * tag '9p-for-6.18-rc3-v2' of https://github.com/martinetd/linux: Revert "fs/9p: Refresh metadata in d_revalidate for uncached mode too" commit 7458f72cc28f9eb0de811effcb5376d0ec19094a Author: Sudeep Holla Date: Fri Oct 17 12:03:20 2025 +0100 pmdomain: arm: scmi: Fix genpd leak on provider registration failure If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20 Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") Signed-off-by: Sudeep Holla Reviewed-by: Peng Fan Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit c71af4d6d56665e04634babfc45dce3d9ab58285 Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:00 2025 +0200 of/irq: Fix OF node refcount in of_msi_get_domain() In of_msi_get_domain() if the iterator loop stops early because an irq_domain match is detected, an of_node_put() on the iterator node is needed to keep the OF node refcount in sync. Add it. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Rob Herring Link: https://patch.msgid.link/20251021124103.198419-3-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit 119aaeed0b6729293f41ea33be05ecd27a947d48 Author: Lorenzo Pieralisi Date: Tue Oct 21 14:40:59 2025 +0200 of/irq: Add msi-parent check to of_msi_xlate() In some legacy platforms the MSI controller for a PCI host bridge is identified by an msi-parent property whose phandle points at an MSI controller node with no #msi-cells property, that implicitly means #msi-cells == 0. For such platforms, mapping a device ID and retrieving the MSI controller node becomes simply a matter of checking whether in the device hierarchy there is an msi-parent property pointing at an MSI controller node with such characteristics. Add a helper function to of_msi_xlate() to check the msi-parent property in addition to msi-map and retrieve the MSI controller node (with a 1:1 ID deviceID-IN<->deviceID-OUT mapping) to provide support for deviceID mapping and MSI controller node retrieval for such platforms. Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Signed-off-by: Lorenzo Pieralisi Reviewed-by: Frank Li Cc: Sascha Bischoff Cc: Rob Herring Cc: Marc Zyngier Link: https://patch.msgid.link/20251021124103.198419-2-lpieralisi@kernel.org Signed-off-by: Rob Herring (Arm) commit 1b824134261d2db08fb6583ccbd05cb71861bd53 Author: Heiko Stuebner Date: Wed Oct 22 02:41:59 2025 +0200 spi: dt-bindings: spi-rockchip: Add RK3506 compatible The SPI controller found in the RK3506 SoC is still compatible to the original one introduced with the RK3066, so add the RK3506 compatible to the list of its variants. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251022004200.204276-1-heiko@sntech.de Signed-off-by: Mark Brown commit 3293d3d7b08872cf174bb768b890655f1b22526a Author: Shuming Fan Date: Wed Oct 22 15:39:52 2025 +0800 ASoC: sdw_utils: add name_prefix for rt1321 part id This patch adds name_prefix for rt1321 part id in the codec_info_list. Signed-off-by: Shuming Fan Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251022073952.327451-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 49c98f30f4021b560676a336f8a46a4f642eee2b Author: Mikulas Patocka Date: Mon Oct 20 14:23:58 2025 +0200 objtool: Fix failure when being compiled on x32 system Fix compilation failure when compiling the kernel with the x32 toolchain. In file included from check.c:16: check.c: In function ¡check_abs_references¢: /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:47:17: error: format ¡%lx¢ expects argument of type ¡long unsigned int¢, but argument 7 has type ¡u64¢ {aka ¡long long unsigned int¢} [-Werror=format=] 47 | "%s%s%s: objtool" extra ": " format "\n", \ | ^~~~~~~~~~~~~~~~~ /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:54:9: note: in expansion of macro ¡___WARN¢ 54 | ___WARN(severity, "", format, ##__VA_ARGS__) | ^~~~~~~ /usr/src/git/linux-2.6/tools/objtool/include/objtool/warn.h:74:27: note: in expansion of macro ¡__WARN¢ 74 | #define WARN(format, ...) __WARN(WARN_STR, format, ##__VA_ARGS__) | ^~~~~~ check.c:4713:33: note: in expansion of macro ¡WARN¢ 4713 | WARN("section %s has absolute relocation at offset 0x%lx", | ^~~~ Fixes: 0d6e4563fc03 ("objtool: Add action to check for absence of absolute relocations") Signed-off-by: Mikulas Patocka Signed-off-by: Peter Zijlstra (Intel) Acked-by: Ard Biesheuvel Link: https://patch.msgid.link/1ac32fff-2e67-5155-f570-69aad5bf5412@redhat.com commit dbdf2a7feb422f9bacfd12774e624cf26f503eb0 Author: Miguel Ojeda Date: Mon Oct 20 04:07:14 2025 +0200 objtool/rust: add one more `noreturn` Rust function Between Rust 1.79 and 1.86, under `CONFIG_RUST_KERNEL_DOCTESTS=y`, `objtool` may report: rust/doctests_kernel_generated.o: warning: objtool: rust_doctest_kernel_alloc_kbox_rs_13() falls through to next function rust_doctest_kernel_alloc_kvec_rs_0() (as well as in rust_doctest_kernel_alloc_kvec_rs_0) due to calls to the `noreturn` symbol: core::option::expect_failed from code added in commits 779db37373a3 ("rust: alloc: kvec: implement AsPageIter for VVec") and 671618432f46 ("rust: alloc: kbox: implement AsPageIter for VBox"). Thus add the mangled one to the list so that `objtool` knows it is actually `noreturn`. This can be reproduced as well in other versions by tweaking the code, such as the latest stable Rust (1.90.0). Stable does not have code that triggers this, but it could have it in the future. Downstream forks could too. Thus tag it for backport. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Signed-off-by: Miguel Ojeda Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Alice Ryhl Cc: stable@vger.kernel.org # Needed in 6.12.y and later. Link: https://patch.msgid.link/20251020020714.2511718-1-ojeda@kernel.org commit 0e4a169d1a2b630c607416d9e3739d80e176ed67 Author: K Prateek Nayak Date: Tue Oct 21 05:35:22 2025 +0000 sched/fair: Start a cfs_rq on throttled hierarchy with PELT clock throttled Matteo reported hitting the assert_list_leaf_cfs_rq() warning from enqueue_task_fair() post commit fe8d238e646e ("sched/fair: Propagate load for throttled cfs_rq") which transitioned to using cfs_rq_pelt_clock_throttled() check for leaf cfs_rq insertions in propagate_entity_cfs_rq(). The "cfs_rq->pelt_clock_throttled" flag is used to indicate if the hierarchy has its PELT frozen. If a cfs_rq's PELT is marked frozen, all its descendants should have their PELT frozen too or weird things can happen as a result of children accumulating PELT signals when the parents have their PELT clock stopped. Another side effect of this is the loss of integrity of the leaf cfs_rq list. As debugged by Aaron, consider the following hierarchy: root(#) / \ A(#) B(*) | C <--- new cgroup | D <--- new cgroup # - Already on leaf cfs_rq list * - Throttled with PELT frozen The newly created cgroups don't have their "pelt_clock_throttled" signal synced with cgroup B. Next, the following series of events occur: 1. online_fair_sched_group() for cgroup D will call propagate_entity_cfs_rq(). (Same can happen if a throttled task is moved to cgroup C and enqueue_task_fair() returns early.) propagate_entity_cfs_rq() adds the cfs_rq of cgroup C to "rq->tmp_alone_branch" since its PELT clock is not marked throttled and cfs_rq of cgroup B is not on the list. cfs_rq of cgroup B is skipped since its PELT is throttled. root cfs_rq already exists on cfs_rq leading to list_add_leaf_cfs_rq() returning early. The cfs_rq of cgroup C is left dangling on the "rq->tmp_alone_branch". 2. A new task wakes up on cgroup A. Since the whole hierarchy is already on the leaf cfs_rq list, list_add_leaf_cfs_rq() keeps returning early without any modifications to "rq->tmp_alone_branch". The final assert_list_leaf_cfs_rq() in enqueue_task_fair() sees the dangling reference to cgroup C's cfs_rq in "rq->tmp_alone_branch". !!! Splat !!! Syncing the "pelt_clock_throttled" indicator with parent cfs_rq is not enough since the new cfs_rq is not yet enqueued on the hierarchy. A dequeue on other subtree on the throttled hierarchy can freeze the PELT clock for the parent hierarchy without setting the indicators for this newly added cfs_rq which was never enqueued. Since there are no tasks on the new hierarchy, start a cfs_rq on a throttled hierarchy with its PELT clock throttled. The first enqueue, or the distribution (whichever happens first) will unfreeze the PELT clock and queue the cfs_rq on the leaf cfs_rq list. While at it, add an assert_list_leaf_cfs_rq() in propagate_entity_cfs_rq() to catch such cases in the future. Closes: https://lore.kernel.org/lkml/58a587d694f33c2ea487c700b0d046fa@codethink.co.uk/ Fixes: e1fad12dcb66 ("sched/fair: Switch to task based throttle model") Reported-by: Matteo Martelli Suggested-by: Aaron Lu Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Aaron Lu Tested-by: Aaron Lu Tested-by: Matteo Martelli Link: https://patch.msgid.link/20251021053522.37583-1-kprateek.nayak@amd.com commit d518314a1fa4e980a227d1b2bda1badf433cb932 Author: Daniel Golle Date: Tue Sep 16 22:37:27 2025 +0100 serial: 8250_mtk: Enable baud clock and manage in runtime PM Some MediaTek SoCs got a gated UART baud clock, which currently gets disabled as the clk subsystem believes it would be unused. This results in the uart freezing right after "clk: Disabling unused clocks" on those platforms. Request the baud clock to be prepared and enabled during probe, and to restore run-time power management capabilities to what it was before commit e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management") disable and unprepare the baud clock when suspending the UART, prepare and enable it again when resuming it. Fixes: e32a83c70cf9 ("serial: 8250-mtk: modify mtk uart power and clock management") Fixes: b6c7ff2693ddc ("serial: 8250_mtk: Simplify clock sequencing and runtime PM") Cc: stable Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Golle Link: https://patch.msgid.link/de5197ccc31e1dab0965cabcc11ca92e67246cf6.1758058441.git.daniel@makrotopia.org Signed-off-by: Greg Kroah-Hartman commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b Author: Artem Shimko Date: Sun Oct 19 12:51:31 2025 +0300 serial: 8250_dw: handle reset control deassert error Check the return value of reset_control_deassert() in the probe function to prevent continuing probe when reset deassertion fails. Previously, reset_control_deassert() was called without checking its return value, which could lead to probe continuing even when the device reset wasn't properly deasserted. The fix checks the return value and returns an error with dev_err_probe() if reset deassertion fails, providing better error handling and diagnostics. Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling") Cc: stable Signed-off-by: Artem Shimko Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com Signed-off-by: Greg Kroah-Hartman commit ea9f6d316782bf36141df764634a53d085061091 Author: Geert Uytterhoeven Date: Wed Oct 8 12:50:36 2025 +0200 dt-bindings: serial: sh-sci: Fix r8a78000 interrupts The SCIF instances on R-Car Gen5 have a single interrupt, just like on other R-Car SoCs. Fixes: 6ac1d60473727931 ("dt-bindings: serial: sh-sci: Document r8a78000 bindings") Cc: stable Signed-off-by: Geert Uytterhoeven Acked-by: Kuninori Morimoto Acked-by: Conor Dooley Link: https://patch.msgid.link/09bc9881b31bdb948ce8b69a2b5acf633f5505a4.1759920441.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 1c05bf6c0262f946571a37678250193e46b1ff0f Author: Hugo Villeneuve Date: Mon Oct 6 10:20:02 2025 -0400 serial: sc16is7xx: remove useless enable of enhanced features Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") permanently enabled access to the enhanced features in sc16is7xx_probe(), and it is never disabled after that. Therefore, remove re-enable of enhanced features in sc16is7xx_set_baud(). This eliminates a potential useless read + write cycle each time the baud rate is reconfigured. Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed") Cc: stable Signed-off-by: Hugo Villeneuve Link: https://patch.msgid.link/20251006142002.177475-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman commit e7cbce761fe3fcbcb49bcf30d4f8ca5e1a9ee2a0 Author: Florian Eckert Date: Wed Sep 24 15:41:15 2025 +0200 serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 The Advantech 2-port serial card with PCI vendor=0x13fe and device=0x0018 has a 'XR17V35X' chip installed on the circuit board. Therefore, this driver can be used instead of theu outdated out-of-tree driver from the manufacturer. Signed-off-by: Florian Eckert Cc: stable Link: https://patch.msgid.link/20250924134115.2667650-1-fe@dev.tdt.de Signed-off-by: Greg Kroah-Hartman commit ef8fef45c74b5a0059488fda2df65fa133f7d7d0 Author: Cosmin Tanislav Date: Tue Sep 23 18:47:06 2025 +0300 tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is shared between RSCI and all other SCIF port types, but the RSCI overrun_reg is specified as a memory offset, while for other SCIF types it is an enum value used to index into the sci_port_params->regs array, as mentioned above the sci_serial_in() function. For RSCI, the overrun_reg is CSR (0x48), causing the sci_getreg() call inside the sci_handle_fifo_overrun() function to index outside the bounds of the regs array, which currently has a size of 20, as specified by SCI_NR_REGS. Because of this, we end up accessing memory outside of RSCI's rsci_port_params structure, which, when interpreted as a plat_sci_reg, happens to have a non-zero size, causing the following WARN when sci_serial_in() is called, as the accidental size does not match the supported register sizes. The existence of the overrun_reg needs to be checked because SCIx_SH3_SCIF_REGTYPE has overrun_reg set to SCLSR, but SCLSR is not present in the regs array. Avoid calling sci_getreg() for port types which don't use standard register handling. Use the ops->read_reg() and ops->write_reg() functions to properly read and write registers for RSCI, and change the type of the status variable to accommodate the 32-bit CSR register. sci_getreg() and sci_serial_in() are also called with overrun_reg in the sci_mpxed_interrupt() interrupt handler, but that code path is not used for RSCI, as it does not have a muxed interrupt. ------------[ cut here ]------------ Invalid register access WARNING: CPU: 0 PID: 0 at drivers/tty/serial/sh-sci.c:522 sci_serial_in+0x38/0xac Modules linked in: renesas_usbhs at24 rzt2h_adc industrialio_adc sha256 cfg80211 bluetooth ecdh_generic ecc rfkill fuse drm backlight ipv6 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.17.0-rc1+ #30 PREEMPT Hardware name: Renesas RZ/T2H EVK Board based on r9a09g077m44 (DT) pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sci_serial_in+0x38/0xac lr : sci_serial_in+0x38/0xac sp : ffff800080003e80 x29: ffff800080003e80 x28: ffff800082195b80 x27: 000000000000000d x26: ffff8000821956d0 x25: 0000000000000000 x24: ffff800082195b80 x23: ffff000180e0d800 x22: 0000000000000010 x21: 0000000000000000 x20: 0000000000000010 x19: ffff000180e72000 x18: 000000000000000a x17: ffff8002bcee7000 x16: ffff800080000000 x15: 0720072007200720 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0000000000000058 x10: 0000000000000018 x9 : ffff8000821a6a48 x8 : 0000000000057fa8 x7 : 0000000000000406 x6 : ffff8000821fea48 x5 : ffff00033ef88408 x4 : ffff8002bcee7000 x3 : ffff800082195b80 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800082195b80 Call trace: sci_serial_in+0x38/0xac (P) sci_handle_fifo_overrun.isra.0+0x70/0x134 sci_er_interrupt+0x50/0x39c __handle_irq_event_percpu+0x48/0x140 handle_irq_event+0x44/0xb0 handle_fasteoi_irq+0xf4/0x1a0 handle_irq_desc+0x34/0x58 generic_handle_domain_irq+0x1c/0x28 gic_handle_irq+0x4c/0x140 call_on_irq_stack+0x30/0x48 do_interrupt_handler+0x80/0x84 el1_interrupt+0x34/0x68 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70 default_idle_call+0x28/0x58 (P) do_idle+0x1f8/0x250 cpu_startup_entry+0x34/0x3c rest_init+0xd8/0xe0 console_on_rootfs+0x0/0x6c __primary_switched+0x88/0x90 ---[ end trace 0000000000000000 ]--- Cc: stable Fixes: 0666e3fe95ab ("serial: sh-sci: Add support for RZ/T2H SCI") Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20250923154707.1089900-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Greg Kroah-Hartman commit 9631350885929819d4e46c6521df35960b472ef3 Author: Li Qiang Date: Mon Oct 20 20:53:33 2025 +0800 mtd: rawnand: realtek: Make rtl_ecc_engine_ops const The rtl_ecc_engine_ops structure is only used to provide a set of callback functions and is never modified after initialization. Mark it as const so it can be placed in the read-only section, which improves safety and allows better compiler optimization. Signed-off-by: Li Qiang Signed-off-by: Miquel Raynal commit 0d9c80aa572182d4b1464826cd77aa8973213216 Author: Geert Uytterhoeven Date: Wed Oct 8 11:47:15 2025 +0200 mtd: nand: MTD_NAND_ECC_REALTEK should depend on HAS_DMA If CONFIG_NO_DMA=y: ERROR: modpost: "dma_free_pages" [drivers/mtd/nand/ecc-realtek.ko] undefined! ERROR: modpost: "dma_alloc_pages" [drivers/mtd/nand/ecc-realtek.ko] undefined! The driver cannot function without DMA, hence fix this by adding a dependency on HAS_DMA. Fixes: 3148d0e5b1c5733d ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support") Signed-off-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit 9225f02ff201837e1443076f37a3c008140d1835 Author: Dan Carpenter Date: Fri Oct 3 12:30:10 2025 +0300 mtd: nand: realtek-ecc: Fix a IS_ERR() vs NULL bug in probe The dma_alloc_noncoherent() function doesn't return error pointers, it returns NULL on error. Fix the error checking to match. Fixes: 3148d0e5b1c5 ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support") Signed-off-by: Dan Carpenter Reviewed-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit e4185bed738da755b191aa3f2e16e8b48450e1b8 Author: Dan Carpenter Date: Tue Sep 30 15:32:34 2025 +0300 mtdchar: fix integer overflow in read/write ioctls The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits of "req.len" so that's capped at U32_MAX but the "req.start" variable can go up to U64_MAX which means that the addition can still integer overflow. Use check_add_overflow() to fix this bug. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Fixes: 6420ac0af95d ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Miquel Raynal commit a28352cf2d2f8380e7aca8cb61682396dca7a991 Author: Shawn Lin Date: Mon Oct 20 09:49:41 2025 +0800 mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 strbin signal delay under 0x8 configuration is not stable after massive test. The recommandation of it should be 0x4. Signed-off-by: Shawn Lin Tested-by: Alexey Charkov Tested-by: Hugh Cole-Baker Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit db82b8dbf5f06d7b1abec4e1326ed8c02fa16897 Author: Rafael J. Wysocki Date: Mon Oct 20 17:03:28 2025 +0200 PM: runtime: Fix conditional guard definitions Since pm_runtime_get_active() returns 0 on success, all of the DEFINE_GUARD_COND() macros in pm_runtime.h need the "_RET == 0" condition at the end of the argument list or they would not work correctly. Fixes: 9a0abc39450a ("PM: runtime: Add auto-cleanup macros for "resume and get" operations") Reported-by: kernel test robot Link: https://lore.kernel.org/linux-pm/202510191529.BCyjKlLQ-lkp@intel.com/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Jonathan Cameron Reviewed-by: Dan Williams Tested-by: Farhan Ali Link: https://patch.msgid.link/5943878.DvuYhMxLoT@rafael.j.wysocki commit f477af0cfa0487eddec66ffe10fd9df628ba6f52 Author: Darrick J. Wong Date: Tue Oct 21 11:30:43 2025 -0700 xfs: fix locking in xchk_nlinks_collect_dir On a filesystem with parent pointers, xchk_nlinks_collect_dir walks both the directory entries (data fork) and the parent pointers (attr fork) to determine the correct link count. Unfortunately I forgot to update the lock mode logic to handle the case of a directory whose attr fork is in btree format and has not yet been loaded *and* whose data fork doesn't need loading. This leads to a bunch of assertions from xfs/286 in xfs_iread_extents because we only took ILOCK_SHARED, not ILOCK_EXCL. You'd need the rare happenstance of a directory with a large number of non-pptr extended attributes set and enough memory pressure to cause the directory to be evicted and partially reloaded from disk. I /think/ this only started in 6.18-rc1 because I've started seeing OOM errors with the maple tree slab using 70% of memory, and this didn't happen in 6.17. Yay dynamic systems! Cc: stable@vger.kernel.org # v6.10 Fixes: 77ede5f44b0d86 ("xfs: walk directory parent pointers to determine backref count") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 3e7ec343f066cb3b6916239680ab6ad44537b453 Author: Darrick J. Wong Date: Tue Oct 21 11:30:27 2025 -0700 xfs: loudly complain about defunct mount options Apparently we can never deprecate mount options in this project, because it will invariably turn out that some foolish userspace depends on some behavior and break. From Oleksandr Natalenko: In v6.18, the attr2 XFS mount option is removed. This may silently break system boot if the attr2 option is still present in /etc/fstab for rootfs. Consider Arch Linux that is being set up from scratch with / being formatted as XFS. The genfstab command that is used to generate /etc/fstab produces something like this by default: /dev/sda2 on / type xfs (rw,relatime,attr2,discard,inode64,logbufs=8,logbsize=32k,noquota) Once the system is set up and rebooted, there's no deprecation warning seen in the kernel log: # cat /proc/cmdline root=UUID=77b42de2-397e-47ee-a1ef-4dfd430e47e9 rootflags=discard rd.luks.options=discard quiet # dmesg | grep -i xfs [ 2.409818] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled [ 2.415341] XFS (sda2): Mounting V5 Filesystem 77b42de2-397e-47ee-a1ef-4dfd430e47e9 [ 2.442546] XFS (sda2): Ending clean mount Although as per the deprecation intention, it should be there. Vlastimil (in Cc) suggests this is because xfs_fs_warn_deprecated() doesn't produce any warning by design if the XFS FS is set to be rootfs and gets remounted read-write during boot. This imposes two problems: 1) a user doesn't see the deprecation warning; and 2) with v6.18 kernel, the read-write remount fails because of unknown attr2 option rendering system unusable: systemd[1]: Switching root. systemd-remount-fs[225]: /usr/bin/mount for / exited with exit status 32. # mount -o rw / mount: /: fsconfig() failed: xfs: Unknown parameter 'attr2'. Thorsten (in Cc) suggested reporting this as a user-visible regression. From my PoV, although the deprecation is in place for 5 years already, it may not be visible enough as the warning is not emitted for rootfs. Considering the amount of systems set up with XFS on /, this may impose a mass problem for users. Vlastimil suggested making attr2 option a complete noop instead of removing it. IOWs, the initrd mounts the root fs with (I assume) no mount options, and mount -a remounts with whatever options are in fstab. However, XFS doesn't complain about deprecated mount options during a remount, so technically speaking we were not warning all users in all combinations that they were heading for a cliff. Gotcha!! Now, how did 'attr2' get slurped up on so many systems? The old code would put that in /proc/mounts if the filesystem happened to be in attr2 mode, even if user hadn't mounted with any such option. IOWs, this is because someone thought it would be a good idea to advertise system state via /proc/mounts. The easy way to fix this is to reintroduce the four mount options but map them to a no-op option that ignores them, and hope that nobody's depending on attr2 to appear in /proc/mounts. (Hint: use the fsgeometry ioctl). But we've learned our lesson, so complain as LOUDLY as possible about the deprecation. Lessons learned: 1. Don't expose system state via /proc/mounts; the only strings that ought to be there are options *explicitly* provided by the user. 2. Never tidy, it's not worth the stress and irritation. Reported-by: Vlastimil Babka Reported-by: Oleksandr Natalenko Cc: stable@vger.kernel.org # v6.18-rc1 Fixes: b9a176e54162f8 ("xfs: remove deprecated mount options") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 630785bfbe12c3ee3ebccd8b530a98d632b7e39d Author: Darrick J. Wong Date: Tue Oct 21 11:30:12 2025 -0700 xfs: always warn about deprecated mount options The deprecation of the 'attr2' mount option in 6.18 wasn't entirely successful because nobody noticed that the kernel never printed a warning about attr2 being set in fstab if the only xfs filesystem is the root fs; the initramfs mounts the root fs with no mount options; and the init scripts only conveyed the fstab options by remounting the root fs. Fix this by making it complain all the time. Cc: stable@vger.kernel.org # v5.13 Fixes: 92cf7d36384b99 ("xfs: Skip repetitive warnings about mount options") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit bd721ec7dedcc24ced51559e42a39140b59dfd08 Author: Darrick J. Wong Date: Tue Oct 21 11:29:56 2025 -0700 xfs: don't set bt_nr_sectors to a negative number xfs_daddr_t is a signed type, which means that xfs_buf_map_verify is using a signed comparison. This causes problems if bt_nr_sectors is never overridden (e.g. in the case of an xfbtree for rmap btree repairs) because even daddr 0 can't pass the verifier test in that case. Define an explicit max constant and set the initial bt_nr_sectors to a positive value. Found by xfs/422. Cc: stable@vger.kernel.org # v6.18-rc1 Fixes: 42852fe57c6d2a ("xfs: track the number of blocks in each buftarg") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 2d8713f807a49b8a67c221670e50ae04967e915d Author: Michael Grzeschik Date: Mon Oct 13 11:43:40 2025 +0200 tcpm: switch check for role_sw device with fw_node When there is no port entry in the tcpci entry itself, the driver will trigger an error message "OF: graph: no port node found in /...../typec" . It is documented that the dts node should contain an connector entry with ports and several port pointing to devices with usb-role-switch property set. Only when those connector entry is missing, it should check for port entries in the main node. We switch the search order for looking after ports, which will avoid the failure message while there are explicit connector entries. Fixes: d56de8c9a17d ("usb: typec: tcpm: try to get role switch from tcpc fwnode") Cc: stable Signed-off-by: Michael Grzeschik Reviewed-by: Heikki Krogerus Reviewed-by: Badhri Jagan Sridharan Link: https://patch.msgid.link/20251013-b4-ml-topic-tcpm-v2-1-63c9b2ab8a0b@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit dfc2cf4dcaa03601cd4ca0f7def88b2630fca6ab Author: Tim Guttzeit Date: Mon Oct 20 15:39:04 2025 +0200 usb/core/quirks: Add Huawei ME906S to wakeup quirk The list of Huawei LTE modules needing the quirk fixing spurious wakeups was missing the IDs of the Huawei ME906S module, therefore suspend did not work. Cc: stable Signed-off-by: Tim Guttzeit Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20251020134304.35079-1-wse@tuxedocomputers.com Signed-off-by: Greg Kroah-Hartman commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 Author: Andrey Konovalov Date: Wed Oct 22 00:25:45 2025 +0200 usb: raw-gadget: do not limit transfer length Drop the check on the maximum transfer length in Raw Gadget for both control and non-control transfers. Limiting the transfer length causes a problem with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length. Overall, there does not appear to be any reason to enforce any kind of transfer length limit on the Raw Gadget side for either control or non-control transfers, so let's just drop the related check. Cc: stable Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface") Signed-off-by: Andrey Konovalov Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com Signed-off-by: Greg Kroah-Hartman commit ada7d45b568abe4f1fd9c53d66e05fbea300674b Author: Amit Dhingra Date: Tue Oct 21 07:07:20 2025 -0500 btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree() btrfs_extent_root()/btrfs_global_root() does not return error pointers, it returns NULL on error. Reported-by: Dan Carpenter Link: https://lore.kernel.org/all/aNJfvxj0anEnk9Dm@stanley.mountain/ Fixes : ed4e6b5d644c ("btrfs: ref-verify: handle damaged extent root tree") CC: stable@vger.kernel.org # 6.17+ Signed-off-by: Amit Dhingra Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0fd7e7a1ad7c5fb8801a9c1661fc4e1ae4d9b655 Author: Leo Martins Date: Mon Oct 20 16:16:15 2025 -0700 btrfs: fix delayed_node ref_tracker use after free Move the print before releasing the delayed node. In my initial testing there was a bug that was causing delayed_nodes to not get freed which is why I put the print after the release. This obviously neglects the case where the delayed node is properly freed. Add condition to make sure we only print if we have more than one reference to the delayed_node to prevent printing when we only have the reference taken in btrfs_kill_all_delayed_nodes(). Fixes: b767a28d6154 ("btrfs: print leaked references in kill_all_delayed_nodes()") Tested-by: Christoph Hellwig Signed-off-by: Leo Martins Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2ba5772e530f73eb847fb96ce6c4017894869552 Author: William Breathitt Gray Date: Mon Oct 20 17:51:46 2025 +0900 gpio: idio-16: Define fixed direction of the GPIO lines The direction of the IDIO-16 GPIO lines is fixed with the first 16 lines as output and the remaining 16 lines as input. Set the gpio_config fixed_direction_output member to represent the fixed direction of the GPIO lines. Fixes: db02247827ef ("gpio: idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Michael Walle Cc: stable@vger.kernel.org # ae495810cffe: gpio: regmap: add the .fixed_direction_output configuration parameter Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-3-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit 00aaae60faf554c27c95e93d47f200a93ff266ef Author: Ioana Ciornei Date: Tue Oct 14 18:53:53 2025 +0300 gpio: regmap: add the .fixed_direction_output configuration parameter There are GPIO controllers such as the one present in the LX2160ARDB QIXIS FPGA which have fixed-direction input and output GPIO lines mixed together in a single register. This cannot be modeled using the gpio-regmap as-is since there is no way to present the true direction of a GPIO line. In order to make this use case possible, add a new configuration parameter - fixed_direction_output - into the gpio_regmap_config structure. This will enable user drivers to provide a bitmap that represents the fixed direction of the GPIO lines. Signed-off-by: Ioana Ciornei Acked-by: Bartosz Golaszewski Reviewed-by: Michael Walle Signed-off-by: Bartosz Golaszewski commit 2eead19334516c8e9927c11b448fbe512b1f18a1 Author: Kaushlendra Kumar Date: Tue Sep 23 23:13:08 2025 +0530 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: "The error code within @ptr if it is an error pointer; 0 otherwise." This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate(). Cc: stable Signed-off-by: Kaushlendra Kumar Reviewed-by: Sudeep Holla Fixes: b8fe128dad8f ("arch_topology: Adjust initial CPU capacities with current freq") Link: https://patch.msgid.link/20250923174308.1771906-1-kaushlendra.kumar@intel.com Signed-off-by: Greg Kroah-Hartman commit a8cc9e5fcb0e2eef21513a4fec888f5712cb8162 Author: Victoria Votokina Date: Fri Oct 10 13:52:41 2025 +0300 most: usb: hdm_probe: Fix calling put_device() before device initialization The early error path in hdm_probe() can jump to err_free_mdev before &mdev->dev has been initialized with device_initialize(). Calling put_device(&mdev->dev) there triggers a device core WARN and ends up invoking kref_put(&kobj->kref, kobject_release) on an uninitialized kobject. In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device. This removes the WARNING and fixes the pre-initialization error path. Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Cc: stable Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-3-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman commit 4b1270902609ef0d935ed2faa2ea6d122bd148f5 Author: Victoria Votokina Date: Fri Oct 10 13:52:40 2025 +0300 most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below. Reported-by: syzbot+916742d5d24f6c254761@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=916742d5d24f6c254761 Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver") Signed-off-by: Victoria Votokina Link: https://patch.msgid.link/20251010105241.4087114-2-Victoria.Votokina@kaspersky.com Signed-off-by: Greg Kroah-Hartman commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 Author: Alice Ryhl Date: Wed Oct 15 14:26:55 2025 +0000 binder: remove "invalid inc weak" check There are no scenarios where a weak increment is invalid on binder_node. The only possible case where it could be invalid is if the kernel delivers BR_DECREFS to the process that owns the node, and then increments the weak refcount again, effectively "reviving" a dead node. However, that is not possible: when the BR_DECREFS command is delivered, the kernel removes and frees the binder_node. The fact that you were able to call binder_inc_node_nilocked() implies that the node is not yet destroyed, which implies that BR_DECREFS has not been delivered to userspace, so incrementing the weak refcount is valid. Note that it's currently possible to trigger this condition if the owner calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes BC_INCREFS on binder_ref instances to fail when they should not. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Yu-Ting Tseng Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com Signed-off-by: Greg Kroah-Hartman commit 2463ae285e5c162686fb19e822fb6b535e6e728a Author: Alexander Usyskin Date: Sun Oct 19 10:36:59 2025 +0300 mei: txe: fix initialization order The mei_register() should move before the mei_start() for hook on class device to work. Same change was implemented in mei-me, missed from mei-txe. Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251019073659.2646791-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 87b318ba81dda2ee7b603f4f6c55e78ec3e95974 Author: Deepanshu Kartikey Date: Wed Sep 24 15:56:39 2025 +0530 comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands. Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com Signed-off-by: Greg Kroah-Hartman commit 98718e80af0bb1cd80f4bfe565dd60c57debad51 Author: Nathan Chancellor Date: Sat Sep 20 16:17:50 2025 -0700 mei: late_bind: Fix -Wincompatible-function-pointer-types-strict When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance in the new mei late binding code originating from the type parameter of mei_lb_push_payload(): drivers/misc/mei/mei_lb.c:211:18: error: incompatible function pointer types initializing 'int (*)(struct device *, u32, u32, const void *, size_t)' (aka 'int (*)(struct device *, unsigned int, unsigned int, const void *, unsigned long)') with an expression of type 'int (struct device *, enum intel_lb_type, u32, const void *, size_t)' (aka 'int (struct device *, enum intel_lb_type, unsigned int, const void *, unsigned long)') [-Werror,-Wincompatible-function-pointer-types-strict] 211 | .push_payload = mei_lb_push_payload, | ^~~~~~~~~~~~~~~~~~~ While 'unsigned int' and 'enum intel_lb_type' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when mei_lb_push_payload() is called indirectly. Update the type parameter of mei_lb_push_payload() to be 'u32' to match the prototype in 'struct intel_lb_component_ops', clearing up the warning and kCFI violation. Fixes: 741eeabb7c78 ("mei: late_bind: add late binding component driver") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20250920-drm-xe-fix-wifpts-v1-1-c89b5357c7ba@kernel.org Signed-off-by: Greg Kroah-Hartman commit fff111bf45cbeeb659324316d68554e35d350092 Author: Junhao Xie Date: Fri Oct 17 16:39:06 2025 +0800 misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup In fastrpc_map_lookup, dma_buf_get is called to obtain a reference to the dma_buf for comparison purposes. However, this reference is never released when the function returns, leading to a dma_buf memory leak. Fix this by adding dma_buf_put before returning from the function, ensuring that the temporarily acquired reference is properly released regardless of whether a matching map is found. Fixes: 9031626ade38 ("misc: fastrpc: Fix fastrpc_map_lookup operation") Cc: stable@kernel.org Signed-off-by: Junhao Xie Tested-by: Xilin Wu Rule: add Link: https://lore.kernel.org/stable/48B368FB4C7007A7%2B20251017083906.3259343-1-bigfoot%40radxa.com Link: https://patch.msgid.link/48B368FB4C7007A7+20251017083906.3259343-1-bigfoot@radxa.com Signed-off-by: Greg Kroah-Hartman commit 410d6c2ad4d1a88efa0acbb9966693725b564933 Author: Alexander Usyskin Date: Thu Oct 16 15:59:12 2025 +0300 mei: me: add wildcat lake P DID Add Wildcat Lake P device id. Cc: stable@vger.kernel.org Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251016125912.2146136-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 70ad06df73a9796026b197d84ead751e096618c7 Author: Jean Delvare Date: Thu Oct 16 15:50:40 2025 +0200 misc: amd-sbi: Clarify that this is a BMC driver Add a sentence to the driver description to clarify that the sbrmi-i2c driver is intended to run on the BMC and not on the managed node. Add platform dependencies accordingly. Signed-off-by: Jean Delvare Link: https://lore.kernel.org/r/5c9f7100-0e59-4237-a252-43c3ee4802a2@amd.com Link: https://patch.msgid.link/20251016155040.0e86c102@endymion Signed-off-by: Greg Kroah-Hartman commit 7959ffbec062c35bda02aa635d21ac45dbfacd80 Author: Cosmin Tanislav Date: Fri Sep 19 17:28:53 2025 +0300 nvmem: rcar-efuse: add missing MODULE_DEVICE_TABLE The nvmem-rcar-efuse driver can be compiled as a module. Add missing MODULE_DEVICE_TABLE so it can be matched by modalias and automatically loaded by udev. Cc: stable@vger.kernel.org Fixes: 1530b923a514 ("nvmem: Add R-Car E-FUSE driver") Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250919142856.2313927-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Greg Kroah-Hartman commit 43c36a56ccf6d9b07b4b3f4f614756e687dcdc01 Author: Dominique Martinet Date: Wed Oct 22 06:33:42 2025 +0900 Revert "fs/9p: Refresh metadata in d_revalidate for uncached mode too" This reverts commit 290434474c332a2ba9c8499fe699c7f2e1153280. That commit broke cache=mmap, a mode that doesn't cache metadata, but still has writeback cache. In commit 290434474c33 ("fs/9p: Refresh metadata in d_revalidate for uncached mode too") we considered metadata cache to be enough to not look at the server, but in writeback cache too looking at the server size would make the vfs consider the file has been truncated before the data has been flushed out, making the following repro fail (nothing is ever read back, the resulting file ends up with no data written) ``` #include #include #include #include char buf[4096]; int main(int argc, char *argv[]) { int ret, i; int fdw, fdr; if (argc < 2) return 1; fdw = openat(AT_FDCWD, argv[1], O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0600); if (fdw < 0) { fprintf(stderr, "cannot open fdw\n"); return 1; } write(fdw, buf, sizeof(buf)); fdr = openat(AT_FDCWD, argv[1], O_RDONLY|O_CLOEXEC); if (fdr < 0) { fprintf(stderr, "cannot open fdr\n"); close(fdw); return 1; } for (i = 0; i < 10; i++) { ret = read(fdr, buf, sizeof(buf)); fprintf(stderr, "i: %d, read returns %d\n", i, ret); } close(fdr); close(fdw); return 0; } ``` There is a fix for this particular reproducer but it looks like there are other problems around metadata refresh (e.g. around file rename), so revert this to avoid d_revalidate in uncached mode for now. Reported-by: Song Liu Link: https://lkml.kernel.org/r/CAHzjS_u_SYdt5=2gYO_dxzMKXzGMt-TfdE_ueowg-Hq5tRCAiw@mail.gmail.com Reported-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/CAEf4BzZbCE4tLoDZyUf_aASpgAGFj75QMfSXX4a4dLYixnOiLg@mail.gmail.com/ Fixes: 290434474c33 ("fs/9p: Refresh metadata in d_revalidate for uncached mode too") Signed-off-by: Dominique Martinet commit d63f0391d6c7b75e1a847e1a26349fa8cad0004d Author: Heiner Kallweit Date: Mon Oct 20 08:54:54 2025 +0200 net: hibmcge: select FIXED_PHY hibmcge uses fixed_phy_register() et al, but doesn't cater for the case that hibmcge is built-in and fixed_phy is a module. To solve this select FIXED_PHY. Fixes: 1d7cd7a9c69c ("net: hibmcge: support scenario without PHY") Signed-off-by: Heiner Kallweit Reviewed-by: Jijie Shao Link: https://patch.msgid.link/c4fc061f-b6d5-418b-a0dc-6b238cdbedce@gmail.com Signed-off-by: Jakub Kicinski commit 5523508258d390fd55b25c1c0f99c092f23a39e9 Author: Yeounsu Moon Date: Sun Oct 19 16:55:40 2025 +0900 net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb Replace `dev_kfree_skb()` with `dev_kfree_skb_any()` in `start_xmit()` which can be called from netpoll (hard IRQ) and from other contexts. Also, `np->link_status` can be changed at any time by interrupt handler. -0 [011] dNh4. 4541.754603: start_xmit <-netpoll_start_xmit -0 [011] dNh4. 4541.754622: => [FTRACE TRAMPOLINE] => start_xmit => netpoll_start_xmit => netpoll_send_skb => write_msg => console_flush_all => console_unlock => vprintk_emit => _printk => rio_interrupt => __handle_irq_event_percpu => handle_irq_event => handle_fasteoi_irq => __common_interrupt => common_interrupt => asm_common_interrupt => mwait_idle => default_idle_call => do_idle => cpu_startup_entry => start_secondary => common_startup_64 This issue can occur when the link state changes from off to on (e.g., plugging or unplugging the LAN cable) while transmitting a packet. If the skb has a destructor, a warning message may be printed in this situation. -> consume_skb (dev_kfree_skb()) -> __kfree_skb() -> skb_release_all() -> skb_release_head_state(skb) if (skb->destructor) { DEBUG_NET_WARN_ON_ONCE(in_hardirq()); skb->destructor(skb); } Found by inspection. Signed-off-by: Yeounsu Moon Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-on: D-Link DGE-550T Rev-A3 Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251019075540.55697-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 881a9c9cb7856b24e390fad9f59acfd73b98b3b2 Author: Ondrej Mosnacek Date: Tue Oct 21 14:27:58 2025 +0200 bpf: Do not audit capability check in do_jit() The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder. Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2369326 Fixes: d4e89d212d40 ("x86/bpf: Call branch history clearing sequence on exit") Signed-off-by: Ondrej Mosnacek Reviewed-by: Paul Moore Link: https://lore.kernel.org/r/20251021122758.2659513-1-omosnace@redhat.com Signed-off-by: Alexei Starovoitov commit d54c676d4fe0543d1642ab7a68ffdd31e8639a5d Author: Bart Van Assche Date: Tue Oct 14 15:02:43 2025 -0700 scsi: core: Fix the unit attention counter implementation scsi_decide_disposition() may call scsi_check_sense(). scsi_decide_disposition() calls are not serialized. Hence, counter updates by scsi_check_sense() must be serialized. Hence this patch that makes the counters updated by scsi_check_sense() atomic. Cc: Kai Mäkisara Fixes: a5d518cd4e3e ("scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs") Signed-off-by: Bart Van Assche Reviewed-by: Ewan D. Milne Link: https://patch.msgid.link/20251014220244.3689508-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 35bc3c8ee319083333b758355ffd739a96af5c00 Author: Wonkon Kim Date: Mon Oct 20 15:15:39 2025 +0900 scsi: ufs: core: Declare tx_lanes witout initialization A value of an attribute will be initialized at ufshcd_dme_get_attr(). There is no need to initialize a tx_lanes. Signed-off-by: Wonkon Kim Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251020061539.28661-3-wkon.kim@samsung.com Signed-off-by: Martin K. Petersen commit 6fe4c679dde3075cb481beb3945269bb2ef8b19a Author: Wonkon Kim Date: Mon Oct 20 15:15:38 2025 +0900 scsi: ufs: core: Initialize value of an attribute returned by uic cmd If ufshcd_send_cmd() fails, *mib_val may have a garbage value. It can get an unintended value of an attribute. Make ufshcd_dme_get_attr() always initialize *mib_val. Fixes: 12b4fdb4f6bc ("[SCSI] ufs: add dme configuration primitives") Signed-off-by: Wonkon Kim Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251020061539.28661-2-wkon.kim@samsung.com Signed-off-by: Martin K. Petersen commit e23ef4f22db30a1e49c8b060e4ebc9dc9ca99c49 Author: Peter Wang Date: Wed Oct 8 14:55:43 2025 +0800 scsi: ufs: core: Fix error handler host_sem issue Fix the issue where host_sem is not released due to a new return path in commit f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock"). Check pm_op_in_progress before acquiring hba->host_sem to prevent deadlocks and ensure proper resource management during error handling. Add comment for use ufshcd_rpm_get_noresume() to safely perform link recovery without interfering with ongoing PM operations. Fixes: f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock") Reported-by: Dan Carpenter Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251008065651.1589614-2-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 2653e9c5dda5a320310aae8f0abba6fc1be40eec Merge: 86c48f50bababb 8e93ac51e4c6dc Author: Jakub Kicinski Date: Tue Oct 21 17:42:54 2025 -0700 Merge tag 'linux-can-fixes-for-6.18-20251020' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-10-20 All patches are by me. The first 3 update the bxcan, esd and rockchip driver to drop skbs in xmit of the device is in listen only mode. The last patch targets the CAN netlink implementation to allow the disabling of automatic restart after Bus-Off, even if the a driver doesn't implement that callback. * tag 'linux-can-fixes-for-6.18-20251020' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: netlink: can_changelink(): allow disabling of automatic restart can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() ==================== Link: https://patch.msgid.link/20251020152516.1590553-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 86c48f50bababbb45622616b48385aa94bfadf5f Author: Randy Dunlap Date: Sun Oct 19 22:27:16 2025 -0700 Documentation: networking: ax25: update the mailing list info. Update the mailing list subscription information for the linux-hams mailing list. Signed-off-by: Randy Dunlap Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251020052716.3136773-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit c5394b8b7a92c5013d2917591e28e938fe7ff2a2 Author: Eric Dumazet Date: Mon Oct 20 16:11:14 2025 +0000 net: gro_cells: fix lock imbalance in gro_cells_receive() syzbot found that the local_unlock_nested_bh() call was missing in some cases. WARNING: possible recursive locking detected syzkaller #0 Not tainted -------------------------------------------- syz.2.329/7421 is trying to acquire lock: ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline] ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30 but task is already holding lock: ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline] ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((&cell->bh_lock)); lock((&cell->bh_lock)); *** DEADLOCK *** Given the introduction of @have_bh_lock variable, it seems the author intent was to have the local_unlock_nested_bh() after the @unlock label. Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell") Reported-by: syzbot+f9651b9a8212e1c8906f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68f65eb9.a70a0220.205af.0034.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Sebastian Andrzej Siewior Reviewed-by: David Ahern Link: https://patch.msgid.link/20251020161114.1891141-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9ab614bc818a93810c27f3e1b4c072e087f8500a Merge: 49d34f3dd85195 a9649dfbe552a4 Author: Jakub Kicinski Date: Tue Oct 21 17:36:49 2025 -0700 Merge branch 'mptcp-handle-late-add_addr-selftests-skip' Matthieu Baerts says: ==================== mptcp: handle late ADD_ADDR + selftests skip Here are a few independent fixes related to MPTCP and its selftests: - Patch 1: correctly handle ADD_ADDR being received after the switch to 'fully-established'. A fix for another recent fix backported up to v5.14. - Patches 2-5: properly mark some MPTCP Join subtests as 'skipped' if the tested kernel doesn't support the feature being validated. Some fixes for up to v5.13, v5.18, v6.11 and v6.18-rc1 respectively. ==================== Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-0-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit a9649dfbe552a42a3781fb681d93a2f510565954 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:30 2025 +0200 selftests: mptcp: join: mark laminar tests as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: c912f935a5c7 ("selftests: mptcp: join: validate new laminar endp") Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-5-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit c3496c052ac36ea98ec4f8e95ae6285a425a2457 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:29 2025 +0200 selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: b5e2fb832f48 ("selftests: mptcp: add explicit test case for remove/readd") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-4-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit 973f80d715bd2504b4db6e049f292e694145cd79 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:28 2025 +0200 selftests: mptcp: join: mark implicit tests as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: 36c4127ae8dd ("selftests: mptcp: join: skip implicit tests if not supported") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-3-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit d68460bc31f9c8c6fc81fbb56ec952bec18409f1 Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:27 2025 +0200 selftests: mptcp: join: mark 'flush re-add' as skipped if not supported The call to 'continue_if' was missing: it properly marks a subtest as 'skipped' if the attached condition is not valid. Without that, the test is wrongly marked as passed on older kernels. Fixes: e06959e9eebd ("selftests: mptcp: join: test for flush/re-add endpoints") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-2-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit e84cb860ac3ce67ec6ecc364433fd5b412c448bc Author: Matthieu Baerts (NGI0) Date: Mon Oct 20 22:53:26 2025 +0200 mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR The special C-flag case expects the ADD_ADDR to be received when switching to 'fully-established'. But for various reasons, the ADD_ADDR could be sent after the "4th ACK", and the special case doesn't work. On NIPA, the new test validating this special case for the C-flag failed a few times, e.g. 102 default limits, server deny join id 0 syn rx [FAIL] got 0 JOIN[s] syn rx expected 2 Server ns stats (...) MPTcpExtAddAddrTx 1 MPTcpExtEchoAdd 1 Client ns stats (...) MPTcpExtAddAddr 1 MPTcpExtEchoAddTx 1 synack rx [FAIL] got 0 JOIN[s] synack rx expected 2 ack rx [FAIL] got 0 JOIN[s] ack rx expected 2 join Rx [FAIL] see above syn tx [FAIL] got 0 JOIN[s] syn tx expected 2 join Tx [FAIL] see above I had a suspicion about what the issue could be: the ADD_ADDR might have been received after the switch to the 'fully-established' state. The issue was not easy to reproduce. The packet capture shown that the ADD_ADDR can indeed be sent with a delay, and the client would not try to establish subflows to it as expected. A simple fix is not to mark the endpoints as 'used' in the C-flag case, when looking at creating subflows to the remote initial IP address and port. In this case, there is no need to try. Note: newly added fullmesh endpoints will still continue to be used as expected, thanks to the conditions behind mptcp_pm_add_addr_c_flag_case. Fixes: 4b1ff850e0c1 ("mptcp: pm: in-kernel: usable client side with C-flag") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251020-net-mptcp-c-flag-late-add-addr-v1-1-8207030cb0e8@kernel.org Signed-off-by: Jakub Kicinski commit 2a13fc417f493e28bdd368785320dd4c2b3d732e Author: Gao Xiang Date: Fri Oct 17 15:05:39 2025 +0800 erofs: consolidate z_erofs_extent_lookback() The initial m.delta[0] also needs to be checked against zero. In addition, also drop the redundant logic that errors out for lcn == 0 / m.delta[0] == 1 case. Signed-off-by: Gao Xiang commit e13d315ae077bb7c3c6027cc292401bc0f4ec683 Author: Gao Xiang Date: Fri Oct 17 15:05:38 2025 +0800 erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`. Fixes: 8d2517aaeea3 ("erofs: fix up compacted indexes for block size < 4096") Fixes: 1a5223c182fd ("erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/35167.1760645886@localhost Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 9aa12167ef1149d9980713b120ddcb31cf17222d Author: Thomas Weißschuh Date: Mon Oct 6 14:13:37 2025 +0200 csky: abiv2: adapt to new folio flags field Recent changes require the raw folio flags to be accessed via ".f". The merge commit introducing this change adapted most architecture code but forgot the csky abiv2. [rppt@kernel.org: add fix for arch/csky/abiv2/cacheflush.c] Link: https://lkml.kernel.org/r/aPCE238oxAB9QcZa@kernel.org Fixes: 53fbef56e07d ("mm: introduce memdesc_flags_t") Signed-off-by: Thomas Weißschuh Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Guo Ren Acked-by: Zi Yan Cc: Guo Ren Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 7eca961dd7188f20fdf8ce9ed5018280f79b2438 Author: SeongJae Park Date: Mon Oct 13 17:18:44 2025 -0700 mm/damon/core: use damos_commit_quota_goal() for new goal commit When damos_commit_quota_goals() is called for adding new DAMOS quota goals of DAMOS_QUOTA_USER_INPUT metric, current_value fields of the new goals should be also set as requested. However, damos_commit_quota_goals() is not updating the field for the case, since it is setting only metrics and target values using damos_new_quota_goal(), and metric-optional union fields using damos_commit_quota_goal_union(). As a result, users could see the first current_value parameter that committed online with a new quota goal is ignored. Users are assumed to commit the current_value for DAMOS_QUOTA_USER_INPUT quota goals, since it is being used as a feedback. Hence the real impact would be subtle. That said, this is obviously not intended behavior. Fix the issue by using damos_commit_quota_goal() which sets all quota goal parameters, instead of damos_commit_quota_goal_union(), which sets only the union fields. Link: https://lkml.kernel.org/r/20251014001846.279282-1-sj@kernel.org Fixes: 1aef9df0ee90 ("mm/damon/core: commit damos_quota_goal->nid") Signed-off-by: SeongJae Park Cc: [6.16+] Signed-off-by: Andrew Morton commit 7071537159be845a5c4ed5fb7d3db25aa4bd04a3 Author: Enze Li Date: Tue Oct 14 16:42:25 2025 +0800 mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme Currently, damon_destroy_scheme() only cleans up the filter list but leaves ops_filter untouched, which could lead to memory leaks when a scheme is destroyed. This patch ensures both filter and ops_filter are properly freed in damon_destroy_scheme(), preventing potential memory leaks. Link: https://lkml.kernel.org/r/20251014084225.313313-1-lienze@kylinos.cn Fixes: ab82e57981d0 ("mm/damon/core: introduce damos->ops_filters") Signed-off-by: Enze Li Reviewed-by: SeongJae Park Tested-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit cec944dd329fbefee907da95c298719d900d4787 Author: Deepanshu Kartikey Date: Tue Oct 14 17:03:44 2025 +0530 hugetlbfs: move lock assertions after early returns in huge_pmd_unshare() When hugetlb_vmdelete_list() processes VMAs during truncate operations, it may encounter VMAs where huge_pmd_unshare() is called without the required shareable lock. This triggers an assertion failure in hugetlb_vma_assert_locked(). The previous fix in commit dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") skipped entire VMAs without shareable locks to avoid the assertion. However, this prevented pages from being unmapped and freed, causing a regression in fallocate(PUNCH_HOLE) operations where pages were not freed immediately, as reported by Mark Brown. Instead of checking locks in the caller or skipping VMAs, move the lock assertions in huge_pmd_unshare() to after the early return checks. The assertions are only needed when actual PMD unsharing work will be performed. If the function returns early because sz != PMD_SIZE or the PMD is not shared, no locks are required and assertions should not fire. This approach reverts the VMA skipping logic from commit dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") while moving the assertions to avoid the assertion failure, keeping all the logic within huge_pmd_unshare() itself and allowing page unmapping and freeing to proceed for all VMAs. Link: https://lkml.kernel.org/r/20251014113344.21194-1-kartikey406@gmail.com Fixes: dd83609b8898 ("hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list") Signed-off-by: Deepanshu Kartikey Reported-by: Reported-by: Mark Brown Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 Suggested-by: David Hildenbrand Suggested-by: Oscar Salvador Tested-by: Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 4ba5a8a7faa647ada8eae61a36517cf369f5bbe4 Author: David Hildenbrand Date: Tue Oct 14 14:44:55 2025 +0200 vmw_balloon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively deflated the old page, reducing the balloon size. In that case, the migration actually worked: similar to migrating+ immediately deflating the new page. The old page will be freed back to the buddy. Right now, the core will leave the page be marked as isolated (as we returned an error). When later trying to putback that page, we will run into the WARN_ON_ONCE() in balloon_page_putback(). That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()"); before that change, we would have tolerated that way of handling it. To fix it, let's just return 0 in that case, making the core effectively just clear the "isolated" flag + freeing it back to the buddy as if the migration succeeded. Note that the new page will also get freed when the core puts the last reference. Note that this also makes it all be more consistent: we will no longer unisolate the page in the balloon driver while keeping it marked as being isolated in migration core. This was found by code inspection. Link: https://lkml.kernel.org/r/20251014124455.478345-1-david@redhat.com Fixes: 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()") Signed-off-by: David Hildenbrand Cc: Jerrin Shaji George Cc: Broadcom internal kernel review list Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Signed-off-by: Andrew Morton commit c3fa5b1bfd8380d935fa961f2ac166bdf000f418 Author: SeongJae Park Date: Tue Oct 14 13:59:36 2025 -0700 mm/damon/core: fix list_add_tail() call on damon_call() Each damon_ctx maintains callback requests using a linked list (damon_ctx->call_controls). When a new callback request is received via damon_call(), the new request should be added to the list. However, the function is making a mistake at list_add_tail() invocation: putting the new item to add and the list head to add it before, in the opposite order. Because of the linked list manipulation implementation, the new request can still be reached from the context's list head. But the list items that were added before the new request are dropped from the list. As a result, the callbacks are unexpectedly not invocated. Worse yet, if the dropped callback requests were dynamically allocated, the memory is leaked. Actually DAMON sysfs interface is using a dynamically allocated repeat-mode callback request for automatic essential stats update. And because the online DAMON parameters commit is using a non-repeat-mode callback request, the issue can easily be reproduced, like below. # damo start --damos_action stat --refresh_stat 1s # damo tune --damos_action stat --refresh_stat 1s The first command dynamically allocates the repeat-mode callback request for automatic essential stat update. Users can see the essential stats are automatically updated for every second, using the sysfs interface. The second command calls damon_commit() with a new callback request that was made for the commit. As a result, the previously added repeat-mode callback request is dropped from the list. The automatic stats refresh stops working, and the memory for the repeat-mode callback request is leaked. It can be confirmed using kmemleak. Fix the mistake on the list_add_tail() call. Link: https://lkml.kernel.org/r/20251014205939.1206-1-sj@kernel.org Fixes: 004ded6bee11 ("mm/damon: accept parallel damon_call() requests") Signed-off-by: SeongJae Park Cc: [6.17+] Signed-off-by: Andrew Morton commit 0e59f47c15cec4cd88c51c5cda749607b719c82b Author: Lorenzo Stoakes Date: Mon Oct 13 17:58:36 2025 +0100 mm/mremap: correctly account old mapping after MREMAP_DONTUNMAP remap Commit b714ccb02a76 ("mm/mremap: complete refactor of move_vma()") mistakenly introduced a new behaviour - clearing the VM_ACCOUNT flag of the old mapping when a mapping is mremap()'d with the MREMAP_DONTUNMAP flag set. While we always clear the VM_LOCKED and VM_LOCKONFAULT flags for the old mapping (the page tables have been moved, so there is no data that could possibly be locked in memory), there is no reason to touch any other VMA flags. This is because after the move the old mapping is in a state as if it were freshly mapped. This implies that the attributes of the mapping ought to remain the same, including whether or not the mapping is accounted. Link: https://lkml.kernel.org/r/20251013165836.273113-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Fixes: b714ccb02a76 ("mm/mremap: complete refactor of move_vma()") Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 552c50713f273b494ac6c77052032a49bc9255e2 Merge: 6548d364a3e850 b2c37c1168f537 Author: Linus Torvalds Date: Tue Oct 21 12:33:29 2025 -1000 Merge tag 'vfio-v6.18-rc3' of https://github.com/awilliam/linux-vfio Pull VFIO fixlet from Alex Williamson: "A tiny update as I'm changing jobs. Different email, same signing key for now. - Update VFIO maintainers entry (Alex Williamson)" * tag 'vfio-v6.18-rc3' of https://github.com/awilliam/linux-vfio: MAINTAINERS: Update Alex Williamson's email address commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c Author: Noorain Eqbal Date: Mon Oct 20 23:33:01 2025 +0530 bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2 Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Signed-off-by: Noorain Eqbal Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com Signed-off-by: Alexei Starovoitov commit 1dba74abf3e2fa4484b924d8ba6e54e64ebb8c82 Author: Jernej Skrabec Date: Mon Oct 20 17:27:04 2025 +0200 clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical bus-r-cpucfg clock is important for peripheral which takes care of powering CPU cores on and off. Since this operation is done by firmware (TF-A), mark it as critical. That way Linux won't interfere with that clock. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Signed-off-by: Jernej Skrabec Reviewed-by: Andre Przywara Tested-by: Andre Przywara Link: https://patch.msgid.link/20251020152704.4804-1-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 3e7f011c255582d7c914133785bbba1990441713 Author: Chuck Lever Date: Thu Oct 2 10:00:51 2025 -0400 Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now. Reported-by: tianshuo han Reviewed-by: Jeff Layton Cc: stable@vger.kernel.org Tested-by: Tianshuo Han Signed-off-by: Chuck Lever commit 29cdfb4950702bb849f70f7e3b58b4eeb5c1441c Author: Nathan Chancellor Date: Tue Sep 30 11:31:34 2025 -0700 nfsd: Avoid strlen conflict in nfsd4_encode_components_esc() There is an error building nfs4xdr.c with CONFIG_SUNRPC_DEBUG_TRACE=y and CONFIG_FORTIFY_SOURCE=n due to the local variable strlen conflicting with the function strlen(): In file included from include/linux/cpumask.h:11, from arch/x86/include/asm/paravirt.h:21, from arch/x86/include/asm/irqflags.h:102, from include/linux/irqflags.h:18, from include/linux/spinlock.h:59, from include/linux/mmzone.h:8, from include/linux/gfp.h:7, from include/linux/slab.h:16, from fs/nfsd/nfs4xdr.c:37: fs/nfsd/nfs4xdr.c: In function 'nfsd4_encode_components_esc': include/linux/kernel.h:321:46: error: called object 'strlen' is not a function or function pointer 321 | __trace_puts(_THIS_IP_, str, strlen(str)); \ | ^~~~~~ include/linux/kernel.h:265:17: note: in expansion of macro 'trace_puts' 265 | trace_puts(fmt); \ | ^~~~~~~~~~ include/linux/sunrpc/debug.h:34:41: note: in expansion of macro 'trace_printk' 34 | # define __sunrpc_printk(fmt, ...) trace_printk(fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~ include/linux/sunrpc/debug.h:42:17: note: in expansion of macro '__sunrpc_printk' 42 | __sunrpc_printk(fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~~~~~ include/linux/sunrpc/debug.h:25:9: note: in expansion of macro 'dfprintk' 25 | dfprintk(FACILITY, fmt, ##__VA_ARGS__) | ^~~~~~~~ fs/nfsd/nfs4xdr.c:2646:9: note: in expansion of macro 'dprintk' 2646 | dprintk("nfsd4_encode_components(%s)\n", components); | ^~~~~~~ fs/nfsd/nfs4xdr.c:2643:13: note: declared here 2643 | int strlen, count=0; | ^~~~~~ This dprintk() instance is not particularly useful, so just remove it altogether to get rid of the immediate strlen() conflict. At the same time, eliminate the local strlen variable to avoid potential conflicts with strlen() in the future. Fixes: ec7d8e68ef0e ("sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer") Signed-off-by: Nathan Chancellor Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit abb1f08a2121dd270193746e43b2a9373db9ad84 Author: Chuck Lever Date: Tue Sep 30 10:05:20 2025 -0400 NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4f76435fd517981f01608678c06ad9718a86ee98 Author: Chuck Lever Date: Mon Sep 29 12:53:40 2025 -0400 NFSD: Define actions for the new time_deleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_GETATTR and SETATTR. But NFSD has to do something besides crashing if it ever sees a GETATTR request that queries these attributes. RFC 8881 Section 18.7.3 states: > The server MUST return a value for each attribute that the client > requests if the attribute is supported by the server for the > target file system. If the server does not support a particular > attribute on the target file system, then it MUST NOT return the > attribute value and MUST NOT set the attribute bit in the result > bitmap. The server MUST return an error if it supports an > attribute on the target but cannot obtain its value. In that case, > no attribute values will be returned. Further, RFC 9754 Section 5 states: > These new attributes are invalid to be used with GETATTR, VERIFY, > and NVERIFY, and they can only be used with CB_GETATTR and SETATTR > by a client holding an appropriate delegation. Thus there does not appear to be a specific server response mandated by specification. Taking the guidance that querying these attributes via GETATTR is "invalid", NFSD will return nfserr_inval, failing the request entirely. Reported-by: Robert Morris Closes: https://lore.kernel.org/linux-nfs/7819419cf0cb50d8130dc6b747765d2b8febc88a.camel@kernel.org/T/#t Fixes: 51c0d4f7e317 ("nfsd: add support for FATTR4_OPEN_ARGUMENTS") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc Author: Shuai Xue Date: Sat Sep 13 10:32:24 2025 +0800 acpi,srat: Fix incorrect device handle check for Generic Initiator The Generic Initiator Affinity Structure in SRAT table uses device handle type field to indicate the device type. According to ACPI specification, the device handle type value of 1 represents PCI device, not 0. Fixes: 894c26a1c274 ("ACPI: Support Generic Initiator only domains") Reported-by: Wu Zongyong Signed-off-by: Shuai Xue Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250913023224.39281-1-xueshuai@linux.alibaba.com Signed-off-by: Dave Jiang commit 143937ca51cc6ae2fccc61a1cb916abb24cd34f5 Author: Huang Ying Date: Wed Oct 15 10:37:12 2025 +0800 arm64, mm: avoid always making PTE dirty in pte_mkwrite() Current pte_mkwrite_novma() makes PTE dirty unconditionally. This may mark some pages that are never written dirty wrongly. For example, do_swap_page() may map the exclusive pages with writable and clean PTEs if the VMA is writable and the page fault is for read access. However, current pte_mkwrite_novma() implementation always dirties the PTE. This may cause unnecessary disk writing if the pages are never written before being reclaimed. So, change pte_mkwrite_novma() to clear the PTE_RDONLY bit only if the PTE_DIRTY bit is set to make it possible to make the PTE writable and clean. The current behavior was introduced in commit 73e86cb03cf2 ("arm64: Move PTE_RDONLY bit handling out of set_pte_at()"). Before that, pte_mkwrite() only sets the PTE_WRITE bit, while set_pte_at() only clears the PTE_RDONLY bit if both the PTE_WRITE and the PTE_DIRTY bits are set. To test the performance impact of the patch, on an arm64 server machine, run 16 redis-server processes on socket 1 and 16 memtier_benchmark processes on socket 0 with mostly get transactions (that is, redis-server will mostly read memory only). The memory footprint of redis-server is larger than the available memory, so swap out/in will be triggered. Test results show that the patch can avoid most swapping out because the pages are mostly clean. And the benchmark throughput improves ~23.9% in the test. Fixes: 73e86cb03cf2 ("arm64: Move PTE_RDONLY bit handling out of set_pte_at()") Signed-off-by: Huang Ying Cc: Will Deacon Cc: Anshuman Khandual Cc: Ryan Roberts Cc: Gavin Shan Cc: Ard Biesheuvel Cc: Matthew Wilcox (Oracle) Cc: Yicong Yang Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 6e3a4754717a74e931a9f00b5f953be708e07acb Author: Xi Ruoyao Date: Tue Oct 21 17:28:25 2025 +0800 ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 When ACPI_MISALIGNMENT_NOT_SUPPORTED is set, GCC can produce a bogus -Wstringop-overread warning, see [1]. To me, it's very clear that we have a compiler bug here, thus just disable the warning. Fixes: a9d13433fe17 ("LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled") Link: https://lore.kernel.org/all/899f2dec-e8b9-44f4-ab8d-001e160a2aed@roeck-us.net/ Link: https://github.com/acpica/acpica/commit/abf5b573 Link: https://gcc.gnu.org/PR122073 [1] Co-developed-by: Saket Dumbre Signed-off-by: Saket Dumbre Signed-off-by: Xi Ruoyao Acked-by: Huacai Chen Cc: All applicable [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251021092825.822007-1-xry111@xry111.site Signed-off-by: Rafael J. Wysocki commit 90c82941adf1986364e0f82c35cf59f2bf5f6a1d Author: André Draszik Date: Thu Oct 16 16:58:37 2025 +0100 pmdomain: samsung: plug potential memleak during probe of_genpd_add_provider_simple() could fail, in which case this code leaks the domain name, pd->pd.name. Use devm_kstrdup_const() to plug this leak. As a side-effect, we can simplify existing error handling. Fixes: c09a3e6c97f0 ("soc: samsung: pm_domains: Convert to regular platform driver") Cc: stable@vger.kernel.org Reviewed-by: Peter Griffin Reviewed-by: Krzysztof Kozlowski Signed-off-by: André Draszik Tested-by: Marek Szyprowski Signed-off-by: Ulf Hansson commit 72a1eb3cf573ab957ae412f0efb0cf6ff0876234 Author: Aurabindo Pillai Date: Thu Sep 25 10:23:59 2025 -0400 drm/amd/display: use GFP_NOWAIT for allocation in interrupt handler schedule_dc_vmin_vmax() is called by dm_crtc_high_irq(). Hence, we cannot have the former sleep. Use GFP_NOWAIT for allocation in this function. Fixes: c210b757b400 ("drm/amd/display: fix dmub access race condition") Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Sun peng (Leo) Li Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit c04812cbe2f247a1c1e53a9b6c5e659963fe4065) Cc: stable@vger.kernel.org commit bec947cbe9a65783adb475a5fb47980d7b4f4796 Author: Charlene Liu Date: Mon Sep 29 20:29:30 2025 -0400 drm/amd/display: increase max link count and fix link->enc NULL pointer access [why] 1.) dc->links[MAX_LINKS] array size smaller than actual requested. max_connector + max_dpia + 4 virtual = 14. increase from 12 to 14. 2.) hw_init() access null LINK_ENC for dpia non display_endpoint. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Meenakshikumar Somasundaram Reviewed-by: Chris Park Signed-off-by: Charlene Liu Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45) Cc: stable@vger.kernel.org commit 89939cf252d80237ed380c1d20575ecfe56ff894 Author: Meenakshikumar Somasundaram Date: Mon Sep 29 14:28:34 2025 -0400 drm/amd/display: Fix NULL pointer dereference [Why] On a mst branch with multi display setup, dc context is obselete after updating the first stream. Referencing the same dc context for the next stream update to fetch dc pointer leads to NULL pointer dereference. [How] Get the dc pointer from the link rather than context. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Charlene Liu Signed-off-by: Meenakshikumar Somasundaram Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher (cherry picked from commit dc69b48988b171d6ccb3a083607e4dff015e2c0d) Cc: stable@vger.kernel.org commit 6ed8bfd24ce1cb31742b09a3eb557cd008533eec Author: Hao Ge Date: Tue Oct 21 09:03:53 2025 +0800 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two competing threads enter alloc_slab_obj_exts() and one of them fails to allocate the object extension vector, it might override the valid slab->obj_exts allocated by the other thread with OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and expects a valid pointer to dereference a NULL pointer later on. Update slab->obj_exts atomically using cmpxchg() to avoid slab->obj_exts overrides by racing threads. Thanks for Vlastimil and Suren's help with debugging. Fixes: f7381b911640 ("slab: mark slab->obj_exts allocation failures unconditionally") Cc: Suggested-by: Suren Baghdasaryan Signed-off-by: Hao Ge Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Link: https://patch.msgid.link/20251021010353.1187193-1-hao.ge@linux.dev Signed-off-by: Vlastimil Babka commit 2c2b67af5f5f77fc68261a137ad65dcfb8e52506 Author: Hongbo Li Date: Sat Oct 11 09:22:35 2025 +0000 hostfs: Fix only passing host root in boot stage with new mount In the old mount proceedure, hostfs could only pass root directory during boot. This is because it constructed the root directory using the @root_ino event without any mount options. However, when using it with the new mount API, this step is no longer triggered. As a result, if users mounts without specifying any mount options, the @host_root_path remains uninitialized. To prevent this issue, the @host_root_path should be initialized at the time of allocation. Reported-by: Geoffrey Thorpe Closes: https://lore.kernel.org/all/643333a0-f434-42fb-82ac-d25a0b56f3b7@geoffthorpe.net/ Fixes: cd140ce9f611 ("hostfs: convert hostfs to use the new mount API") Signed-off-by: Hongbo Li Link: https://patch.msgid.link/20251011092235.29880-1-lihongbo22@huawei.com Signed-off-by: Christian Brauner commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b Author: Zhen Ni Date: Mon Oct 13 19:41:51 2025 +0800 fs: Fix uninitialized 'offp' in statmount_string() In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the struct fields instead of using offp. This leaves offp uninitialized, leading to a possible uninitialized dereference when *offp is updated. Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code path consistent. Fixes: 37c4a9590e1e ("statmount: allow to retrieve idmappings") Fixes: e52e97f09fb6 ("statmount: let unset strings be empty") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://patch.msgid.link/20251013114151.664341-1-zhen.ni@easystack.cn Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 6b03360fe9f4e6fd43419487d659c9bd26215953 Merge: fdbb53d318aa94 248adfe32bfd75 Author: Mark Brown Date: Tue Oct 21 12:37:34 2025 +0100 Add support for Cirrus Logic CS530x DAC and CODEC Merge series from Vitaly Rodionov : This patch series introduces DAC, CODEC, and SPI control bus support for Cirrus Logic CS530x variants, along with general code cleanup and resolution of checkpatch.pl warnings. Changes since v1,v2,v3: - Signed off all patches - Splitted "tidy up" pach in 3 separate simple patches - Fixed commit subject to much preferred subject prefix for binding patches. - Moved dt-bindings related patch down the chain - Added all relevant maintainers to CC list Simon Trimmer (4): ASoC: cs530x: Correct log message with expected variable ASoC: cs530x: Add CODEC and DAC support ASoC: cs530x: Check the DEVID matches the devtype ASoC: cs530x: Rename i2c related structures Vitaly Rodionov (7): ASoC: cs530x: Update the copyright headers ASoC: cs530x: Sort #include directives and tidy up whitespaces ASoC: cs530x: Remove unused struct members and constants ASoC: cs530x: Correct constant naming ASoC: dt-bindings: sound: cirrus: cs530x: Add cs530x variants ASoC: cs530x: Correct MCLK reference frequency values ASoC: cs530x: Add SPI bus support for cs530x parts .../bindings/sound/cirrus,cs530x.yaml | 4 + sound/soc/codecs/Kconfig | 10 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/cs530x-i2c.c | 24 +- sound/soc/codecs/cs530x-spi.c | 92 ++++ sound/soc/codecs/cs530x.c | 516 +++++++++++++++--- sound/soc/codecs/cs530x.h | 120 ++-- 7 files changed, 634 insertions(+), 134 deletions(-) create mode 100644 sound/soc/codecs/cs530x-spi.c -- 2.43.0 commit a7b17ece4032dd86bb411297f2169dda395cdc3c Author: Johan Hovold Date: Fri Oct 10 15:38:56 2025 +0200 mmc: wmt-sdmmc: fix compile test default Enabling compile testing should not enable every individual driver (we have "allyesconfig" for that). Fixes: 7cd8db0fb0b2 ("mmc: add COMPILE_TEST to multiple drivers") Cc: Mikko Rapeli Signed-off-by: Johan Hovold Signed-off-by: Ulf Hansson commit 204ced4108f5d38f6804968fd9543cc69c3f8da6 Author: David Kaplan Date: Fri Oct 3 12:19:36 2025 -0500 x86/bugs: Qualify RETBLEED_INTEL_MSG When retbleed mitigation is disabled, the kernel already prints an info message that the system is vulnerable. Recent code restructuring also inadvertently led to RETBLEED_INTEL_MSG being printed as an error, which is unnecessary as retbleed mitigation was already explicitly disabled (by config option, cmdline, etc.). Qualify this print statement so the warning is not printed unless an actual retbleed mitigation was selected and is being disabled due to incompatibility with spectre_v2. Fixes: e3b78a7ad5ea ("x86/bugs: Restructure retbleed mitigation") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220624 Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251003171936.155391-1-david.kaplan@amd.com commit 49d34f3dd8519581030547eb7543a62f9ab5fa08 Author: Aksh Garg Date: Thu Oct 16 17:27:55 2025 +0530 net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions Resolve race conditions in timestamp events list handling between TX and RX paths causing missed timestamps. The current implementation uses a single events list for both TX and RX timestamps. The am65_cpts_find_ts() function acquires the lock, splices all events (TX as well as RX events) to a temporary list, and releases the lock. This function performs matching of timestamps for TX packets only. Before it acquires the lock again to put the non-TX events back to the main events list, a concurrent RX processing thread could acquire the lock (as observed in practice), find an empty events list, and fail to attach timestamp to it, even though a relevant event exists in the spliced list which is yet to be restored to the main list. Fix this by creating separate events lists to handle TX and RX timestamps independently. Fixes: c459f606f66df ("net: ethernet: ti: am65-cpts: Enable RX HW timestamp for PTP packets using CPTS FIFO") Signed-off-by: Aksh Garg Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251016115755.1123646-1-a-garg7@ti.com Signed-off-by: Paolo Abeni commit 876f0d43af78639790bee0e57b39d498ae35adcf Author: Andrew Cooper Date: Mon Oct 20 15:41:24 2025 +0100 x86/microcode: Fix Entrysign revision check for Zen1/Naples ... to match AMD's statement here: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html Fixes: 50cef76d5cb0 ("x86/microcode/AMD: Load only SHA256-checksummed patches") Signed-off-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://patch.msgid.link/20251020144124.2930784-1-andrew.cooper3@citrix.com commit d37623132a6347b4ab9e2179eb3f2fa77863c364 Author: William Breathitt Gray Date: Mon Oct 20 17:51:45 2025 +0900 gpio: pci-idio-16: Define maximum valid register address offset Attempting to load the pci-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure. Fixes: 73d8f3efc5c2 ("gpio: pci-idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Mark Cave-Ayland Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-2-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit c4d35e635f3a65aec291a6045cae8c99cede5bba Author: William Breathitt Gray Date: Mon Oct 20 17:51:44 2025 +0900 gpio: 104-idio-16: Define maximum valid register address offset Attempting to load the 104-idio-16 module fails during regmap initialization with a return error -EINVAL. This is a result of the regmap cache failing initialization. Set the idio_16_regmap_config max_register member to fix this failure. Fixes: 2c210c9a34a3 ("gpio: 104-idio-16: Migrate to the regmap API") Reported-by: Mark Cave-Ayland Closes: https://lore.kernel.org/r/9b0375fd-235f-4ee1-a7fa-daca296ef6bf@nutanix.com Suggested-by: Mark Cave-Ayland Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251020-fix-gpio-idio-16-regmap-v2-1-ebeb50e93c33@kernel.org Signed-off-by: Bartosz Golaszewski commit 0f41997b1b2b769b73415512d2afaae80630e4fe Author: Christoph Hellwig Date: Fri Oct 3 12:12:48 2025 +0200 xfs: don't use __GFP_NOFAIL in xfs_init_fs_context With enough debug options enabled, struct xfs_mount is larger than 4k and thus NOFAIL allocations won't work for it. xfs_init_fs_context is early in the mount process, and if we really are out of memory there we'd better give up ASAP anyway. Fixes: 7b77b46a6137 ("xfs: use kmem functions for struct xfs_mount") Reported-by: syzbot+359a67b608de1ef72f65@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ca3d643a970139f5456f90dd555a0955752d70cb Author: Christoph Hellwig Date: Fri Oct 17 05:55:41 2025 +0200 xfs: cache open zone in inode->i_private The MRU cache for open zones is unfortunately still not ideal, as it can time out pretty easily when doing heavy I/O to hard disks using up most or all open zones. One option would be to just increase the timeout, but while looking into that I realized we're just better off caching it indefinitely as there is no real downside to that once we don't hold a reference to the cache open zone. So switch the open zone to RCU freeing, and then stash the last used open zone into inode->i_private. This helps to significantly reduce fragmentation by keeping I/O localized to zones for workloads that write using many open files to HDD. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Carlos Maiolino commit a8c861f401b4b2f8feda282abff929fa91c1f73a Author: Christoph Hellwig Date: Wed Oct 15 15:29:30 2025 +0900 xfs: avoid busy loops in GCD When GCD has no new work to handle, but read, write or reset commands are outstanding, it currently busy loops, which is a bit suboptimal, and can lead to softlockup warnings in case of stuck commands. Change the code so that the task state is only set to running when work is performed, which looks a bit tricky due to the design of the reading/writing/resetting lists that contain both in-flight and finished commands. Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 23437509a69476d4f896891032d62ac868731668 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:53 2025 +0200 drm/panic: Fix 24bit pixel crossing page boundaries When using page list framebuffer, and using RGB888 format, some pixels can cross the page boundaries, and this case was not handled, leading to writing 1 or 2 bytes on the next virtual address. Add a check and a specific function to handle this case. Fixes: c9ff2808790f0 ("drm/panic: Add support to scanout buffer as array of pages") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-7-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 2e337dd278c6c38982b520c309f36e0f88696e6e Author: Jocelyn Falempe Date: Thu Oct 9 14:24:52 2025 +0200 drm/panic: Fix divide by 0 if the screen width < font width In the unlikely case that the screen is tiny, and smaller than the font width, it leads to a divide by 0: draw_line_with_wrap() chars_per_row = sb->width / font->width = 0 line_wrap.len = line->len % chars_per_row; This will trigger a divide by 0 Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-6-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit e9b36fe0630046e61224216dc92513a69f72b5f0 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:51 2025 +0200 drm/panic: Fix kmsg text drawing rectangle The rectangle height was larger than the screen size. This has no real impact. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-5-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 4fcffb5e5c8c0c8e2ad9c99a22305a0afbecc294 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:50 2025 +0200 drm/panic: Fix qr_code, ensure vmargin is positive Depending on qr_code size and screen size, the vertical margin can be negative, that means there is not enough room to draw the qr_code. So abort early, to avoid a segfault by trying to draw at negative coordinates. Fixes: cb5164ac43d0f ("drm/panic: Add a QR code panic screen") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-4-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit cfa56e0a0e9b259077b0cb88b431e37dc9a67dee Author: Jocelyn Falempe Date: Thu Oct 9 14:24:49 2025 +0200 drm/panic: Fix overlap between qr code and logo The borders of the qr code was not taken into account to check if it overlap with the logo, leading to the logo being partially covered. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-3-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 179753aa5b7890b311968c033d08f558f0a7be21 Author: Jocelyn Falempe Date: Thu Oct 9 14:24:48 2025 +0200 drm/panic: Fix drawing the logo on a small narrow screen If the logo width is bigger than the framebuffer width, and the height is big enough to hold the logo and the message, it will draw at x coordinate that are higher than the width, and ends up in a corrupted image. Fixes: 4b570ac2eb54 ("drm/rect: Add drm_rect_overlap()") Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20251009122955.562888-2-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit f2bc8231fd43a02f9d97252b3435869727054d60 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:17 2025 +0200 xfrm: check all hash buckets for leftover states during netns deletion The current hlist_empty checks only test the first bucket of each hashtable, ignoring any other bucket. They should be caught by the WARN_ON for state_all, but better to make all the checks accurate. Fixes: 73d189dce486 ("netns xfrm: per-netns xfrm_state_bydst hash") Fixes: d320bbb306f2 ("netns xfrm: per-netns xfrm_state_bysrc hash") Fixes: b754a4fd8f58 ("netns xfrm: per-netns xfrm_state_byspi hash") Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 1dcf617bec5cb85f68ca19969e7537ef6f6931d3 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:16 2025 +0200 xfrm: set err and extack on failure to create pcpu SA xfrm_state_construct can fail without setting an error if the requested pcpu_num value is too big. Set err and add an extack message to avoid confusing userspace. Fixes: 1ddf9916ac09 ("xfrm: Add support for per cpu xfrm state handling.") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 7f02285764790e0ff1a731b4187fa3e389ed02c7 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:15 2025 +0200 xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state In case xfrm_state_migrate fails after calling xfrm_dev_state_add, we directly release the last reference and destroy the new state, without calling xfrm_dev_state_delete (this only happens in __xfrm_state_delete, which we're not calling on this path, since the state was never added). Call xfrm_dev_state_delete on error when an offload configuration was provided. Fixes: ab244a394c7f ("xfrm: Migrate offload configuration") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 5502bc4746e86bfe91ecbe0ed1ad53cb17673920 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:14 2025 +0200 xfrm: make state as DEAD before final put when migrate fails xfrm_state_migrate/xfrm_state_clone_and_setup create a new state, and call xfrm_state_put to destroy it in case of failure. __xfrm_state_destroy expects the state to be in XFRM_STATE_DEAD, but we currently don't do that. Reported-by: syzbot+5cd6299ede4d4f70987b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5cd6299ede4d4f70987b Fixes: 78347c8c6b2d ("xfrm: Fix xfrm_state_migrate leak") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 Author: Sabrina Dubroca Date: Thu Oct 16 12:39:13 2025 +0200 xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work). Reported-by: syzbot+999eb23467f83f9bf9bf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=999eb23467f83f9bf9bf Fixes: b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 8d2a2a49c30f67a480fa9ed25e08436a446f057e Author: Sabrina Dubroca Date: Thu Oct 16 12:39:12 2025 +0200 xfrm: drop SA reference in xfrm_state_update if dir doesn't match We're not updating x1, but we still need to put() it. Fixes: a4a87fa4e96c ("xfrm: Add Direction to the SA in or out") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit f5caeb3689ea2d8a8c0790d9eea68b63e8f15496 Author: Geert Uytterhoeven Date: Mon Oct 13 10:48:46 2025 +0200 xfs: XFS_ONLINE_SCRUB_STATS should depend on DEBUG_FS Currently, XFS_ONLINE_SCRUB_STATS selects DEBUG_FS. However, DEBUG_FS is meant for debugging, and people may want to disable it on production systems. Since commit 0ff51a1fd786f47b ("xfs: enable online fsck by default in Kconfig")), XFS_ONLINE_SCRUB_STATS is enabled by default, forcing DEBUG_FS enabled too. Fix this by replacing the selection of DEBUG_FS by a dependency on DEBUG_FS, which is what most other options controlling the gathering and exposing of statistics do. Signed-off-by: Geert Uytterhoeven Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b00bcb190eef35ae4da3c424b8a72f287e69f650 Author: Damien Le Moal Date: Tue Oct 14 13:19:45 2025 +0900 xfs: do not tightly pack-write large files When using a zoned realtime device, tightly packing of data blocks belonging to multiple closed files into the same realtime group (RTG) is very efficient at improving write performance. This is especially true with SMR HDDs as this can reduce, and even suppress, disk head seeks. However, such tight packing does not make sense for large files that require at least a full RTG. If tight packing placement is applied for such files, the VM writeback thread switching between inodes result in the large files to be fragmented, thus increasing the garbage collection penalty later when the RTG needs to be reclaimed. This problem can be avoided with a simple heuristic: if the size of the inode being written back is at least equal to the RTG size, do not use tight-packing. Modify xfs_zoned_pack_tight() to always return false in this case. With this change, a multi-writer workload writing files of 256 MB on a file system backed by an SMR HDD with 256 MB zone size as a realtime device sees all files occupying exactly one RTG (i.e. one device zone), thus completely removing the heavy fragmentation observed without this change. Signed-off-by: Damien Le Moal Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 914f377075d646b4695a7868ba090f4c714dfd4b Author: Damien Le Moal Date: Mon Oct 13 12:08:29 2025 +0900 xfs: Improve CONFIG_XFS_RT Kconfig help Improve the description of the XFS_RT configuration option to document that this option is required for zoned block devices. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 26f0f122f92f2e8c384c08a05956417bfb5f6fbe Author: Heiko Stuebner Date: Mon Oct 20 11:11:39 2025 +0200 arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso The regulator-cam-dovdd-1v8 uses spaces for indentation, where it should use tabs. Fix this. Fixes: 066a69db9db3 ("arm64: dts: rockchip: add overlay for RK3399 Puma Haikou Video Demo adapter") Signed-off-by: Heiko Stuebner Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/20251020091139.3652738-1-heiko@sntech.de Signed-off-by: Heiko Stuebner commit f584239a9ed25057496bf397c370cc5163dde419 Author: Wang Liang Date: Fri Oct 17 10:48:27 2025 +0800 net/smc: fix general protection fault in __smc_diag_dump The syzbot report a crash: Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f] CPU: 1 UID: 0 PID: 6949 Comm: syz.0.335 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89 Call Trace: smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217 smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234 netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442 netlink_dump_start include/linux/netlink.h:341 [inline] smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251 __sock_diag_cmd net/core/sock_diag.c:249 [inline] sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668 __sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The process like this: (CPU1) | (CPU2) ---------------------------------|------------------------------- inet_create() | // init clcsock to NULL | sk = sk_alloc() | | // unexpectedly change clcsock | inet_init_csk_locks() | | // add sk to hash table | smc_inet_init_sock() | smc_sk_init() | smc_hash_sk() | | // traverse the hash table | smc_diag_dump_proto | __smc_diag_dump() | // visit wrong clcsock | smc_diag_msg_common_fill() // alloc clcsock | smc_create_clcsk | sock_create_kern | With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc, just remove it. After removing the INET_PROTOSW_ICSK flag, this patch alse revert commit 6fd27ea183c2 ("net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC") to avoid casting smc_sock to inet_connection_sock. Reported-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f775be4458668f7d220e Tested-by: syzbot+f775be4458668f7d220e@syzkaller.appspotmail.com Fixes: d25a92ccae6b ("net/smc: Introduce IPPROTO_SMC") Signed-off-by: Wang Liang Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: D. Wythe Link: https://patch.msgid.link/20251017024827.3137512-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit bbca8678466032fa32453cebfb9194c8d15c3f1a Merge: a73ca0449bcb7c 87bcef158ac1fa Author: Jakub Kicinski Date: Mon Oct 20 17:39:15 2025 -0700 Merge branch 'fix-generating-skb-from-non-linear-xdp_buff-for-mlx5' Tariq Toukan says: ==================== Fix generating skb from non-linear xdp_buff for mlx5 Link: https://lore.kernel.org/20250915225857.3024997-1-ameryhung@gmail.com ==================== Link: https://patch.msgid.link/1760644540-899148-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 87bcef158ac1faca1bd7e0104588e8e2956d10be Author: Amery Hung Date: Thu Oct 16 22:55:40 2025 +0300 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run. Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it. To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff. Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes. Fixes: f52ac7028bec ("net/mlx5e: RX, Add XDP multi-buffer support in Striding RQ") Signed-off-by: Amery Hung Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1760644540-899148-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit afd5ba577c10639f62e8120df67dc70ea4b61176 Author: Amery Hung Date: Thu Oct 16 22:55:39 2025 +0300 net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ XDP programs can release xdp_buff fragments when calling bpf_xdp_adjust_tail(). The driver currently assumes the number of fragments to be unchanged and may generate skb with wrong truesize or containing invalid frags. Fix the bug by generating skb according to xdp_buff after the XDP program runs. Fixes: ea5d49bdae8b ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ") Reviewed-by: Dragos Tatulea Signed-off-by: Amery Hung Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1760644540-899148-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ce831bffcef3d8f9691b5537d74ffa1b1256c017 Author: Thomas Hellström Date: Wed Oct 15 19:07:26 2025 +0200 drm/xe/uapi: Hide the madvise autoreset behind a VM_BIND flag The madvise implementation currently resets the SVM madvise if the underlying CPU map is unmapped. This is in an attempt to mimic the CPU madvise behaviour. However, it's not clear that this is a desired behaviour since if the end app user relies on it for malloc()ed objects or stack objects, it may not work as intended. Instead of having the autoreset functionality being a direct application-facing implicit UAPI, make the UMD explicitly choose this behaviour if it wants to expose it by introducing DRM_XE_VM_BIND_FLAG_MADVISE_AUTORESET, and add a semantics description. v2: - Kerneldoc fixes. Fix a commit log message. Fixes: a2eb8aec3ebe ("drm/xe: Reset VMA attributes to default in SVM garbage collector") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: "Falkowski, John" Cc: "Mrozek, Michal" Signed-off-by: Thomas Hellström Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251015170726.178685-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 59a2d3f38ab23cce4cd9f0c4a5e08fdfe9e67ae7) Signed-off-by: Lucas De Marchi commit 9a3c0d6834194b6e3cce4ffbb55f800c6cb58c86 Author: Thomas Hellström Date: Wed Oct 15 19:07:25 2025 +0200 drm/xe: Retain vma flags when recreating and splitting vmas for madvise When splitting and restoring vmas for madvise, we only copied the XE_VMA_SYSTEM_ALLOCATOR flag. That meant we lost flags for read_only, dumpable and sparse (in case anyone would call madvise for the latter). Instead, define a mask of relevant flags and ensure all are replicated, To simplify this and make the code a bit less fragile, remove the conversion to VMA_CREATE flags and instead just pass around the gpuva flags after initial conversion from user-space. Fixes: a2eb8aec3ebe ("drm/xe: Reset VMA attributes to default in SVM garbage collector") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20251015170726.178685-1-thomas.hellstrom@linux.intel.com (cherry picked from commit b3af8658ec70f2196190c66103478352286aba3b) Signed-off-by: Lucas De Marchi commit a73ca0449bcb7c238097cc6a1bf3fd82a78374df Author: Xin Long Date: Fri Oct 17 16:06:14 2025 -0400 selftests: net: fix server bind failure in sctp_vrf.sh sctp_vrf.sh could fail: TEST 12: bind vrf-2 & 1 in server, connect from client 1 & 2, N [FAIL] not ok 1 selftests: net: sctp_vrf.sh # exit=3 The failure happens when the server bind in a new run conflicts with an existing association from the previous run: [1] ip netns exec $SERVER_NS ./sctp_hello server ... [2] ip netns exec $CLIENT_NS ./sctp_hello client ... [3] ip netns exec $SERVER_NS pkill sctp_hello ... [4] ip netns exec $SERVER_NS ./sctp_hello server ... It occurs if the client in [2] sends a message and closes immediately. With the message unacked, no SHUTDOWN is sent. Killing the server in [3] triggers a SHUTDOWN the client also ignores due to the unacked message, leaving the old association alive. This causes the bind at [4] to fail until the message is acked and the client responds to a second SHUTDOWN after the server’s T2 timer expires (3s). This patch fixes the issue by preventing the client from sending data. Instead, the client blocks on recv() and waits for the server to close. It also waits until both the server and the client sockets are fully released in stop_server and wait_client before restarting. Additionally, replace 2>&1 >/dev/null with -q in sysctl and grep, and drop other redundant 2>&1 >/dev/null redirections, and fix a typo from N to Y (connect successfully) in the description of the last test. Fixes: a61bd7b9fef3 ("selftests: add a selftest for sctp vrf") Reported-by: Hangbin Liu Tested-by: Jakub Kicinski Signed-off-by: Xin Long Link: https://patch.msgid.link/be2dacf52d0917c4ba5e2e8c5a9cb640740ad2b6.1760731574.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit b09ed52db1e688eb8205b1939ca1345179ecd515 Author: Nicolin Chen Date: Tue Oct 14 14:48:46 2025 -0700 iommufd/selftest: Fix ioctl return value in _test_cmd_trigger_vevents() The ioctl returns 0 upon success, so !0 returning -1 breaks the selftest. Drop the '!' to fix it. Fixes: 1d235d849425 ("iommu/selftest: prevent use of uninitialized variable") Link: https://patch.msgid.link/r/20251014214847.1113759-1-nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit cb30dfa75d55eced379a42fd67bd5fb7ec38555e Author: Jason Gunthorpe Date: Wed Oct 8 15:17:18 2025 -0300 iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows. Link: https://patch.msgid.link/r/0-v1-663679b57226+172-iommufd_dirty_div0_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Reviewed-by: Joao Martins Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257 Signed-off-by: Jason Gunthorpe commit 5da6fb6356362c7eb40ed931b27abc31b3582950 Author: David Howells Date: Mon Oct 20 10:33:06 2025 +0100 cifs: Add a couple of missing smb3_rw_credits tracepoints Add missing smb3_rw_credits tracepoints to cifs_readv_callback() (for SMB1) to match those of SMB2/3. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit b2c37c1168f537900158c860174001d055d8d583 Author: Alex Williamson Date: Mon Oct 13 09:26:11 2025 -0600 MAINTAINERS: Update Alex Williamson's email address Switch to a personal email account as I'll be leaving Red Hat soon. Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20251013152613.3088777-1-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit f3f313c51148668d3c44f1119762325ce2c0715b Author: Sunil V L Date: Fri Oct 17 15:37:44 2025 +0530 ACPI: property: Fix argument order in __acpi_node_get_property_reference() A refactoring bug introduced an argument order mistake in the call to acpi_fwnode_get_reference_args() from __acpi_node_get_property_reference(). This caused incorrect behavior when resolving ACPI property references. Fix the issue by correcting the argument order. Fixes: e121be784d35 ("ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop") Reported-by: Thomas Richard Closes: https://lore.kernel.org/all/1241f2b6-9b4e-4623-8a83-77db8774ac32@bootlin.com/ Tested-by: Thomas Richard Signed-off-by: Sunil V L Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251017100744.71871-1-sunilvl@ventanamicro.com Signed-off-by: Rafael J. Wysocki commit 6548d364a3e850326831799d7e3ea2d7bb97ba08 Merge: 380cb5d3533cdd 0fbbcab7f9082c Author: Linus Torvalds Date: Mon Oct 20 09:41:27 2025 -1000 Merge tag 'cgroup-for-6.18-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix seqcount lockdep assertion failure in cgroup freezer on PREEMPT_RT. Plain seqcount_t expects preemption disabled, but PREEMPT_RT spinlocks don't disable preemption. Switch to seqcount_spinlock_t to properly associate css_set_lock with the freeze timing seqcount. - Misc changes including kernel-doc warning fix for misc_res_type enum and improved selftest diagnostics. * tag 'cgroup-for-6.18-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/misc: fix misc_res_type kernel-doc warning selftests: cgroup: Use values_close_report in test_cpu selftests: cgroup: add values_close_report helper cgroup: Fix seqcount lockdep assertion in cgroup freezer commit 380cb5d3533cddd93050d72d65f7b1fc997823f7 Merge: 211ddde0823f14 a7c4bb43bfdc2b Author: Linus Torvalds Date: Mon Oct 20 09:35:13 2025 -1000 Merge tag 'fsnotify_for_v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fixes from Jan Kara: - Stop-gap solution for a race between unmount of a filesystem with fsnotify marks and someone inspecting fdinfo of fsnotify group with those marks in procfs. A proper solution is in the works but it will get a while to settle. - Fix for non-decodable file handles (used by unprivileged apps using fanotify) * tag 'fsnotify_for_v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs/notify: call exportfs_encode_fid with s_umount expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID commit 10fad4012234a7dea621ae17c0c9486824f645a0 Author: Rafael J. Wysocki Date: Sat Oct 18 14:27:15 2025 +0200 Revert "cpuidle: menu: Avoid discarding useful information" It is reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") led to a performance regression on Intel Jasper Lake systems because it reduced the time spent by CPUs in idle state C7 which is correlated to the maximum frequency the CPUs can get to because of an average running power limit [1]. Before that commit, get_typical_interval() would have returned UINT_MAX whenever it had been unable to make a high-confidence prediction which had led to selecting the deepest available idle state too often and both power and performance had been inadequate as a result of that on some systems. However, this had not been a problem on systems with relatively aggressive average running power limits, like the Jasper Lake systems in question, because on those systems it was compensated by the ability to run CPUs faster. It was addressed by causing get_typical_interval() to return a number based on the recent idle duration information available to it even if it could not make a high-confidence prediction, but that clearly did not take the possible correlation between idle power and available CPU capacity into account. For this reason, revert most of the changes made by commit 85975daeaa4d, except for one cosmetic cleanup, and add a comment explaining the rationale for returning UINT_MAX from get_typical_interval() when it is unable to make a high-confidence prediction. Fixes: 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") Closes: https://lore.kernel.org/linux-pm/36iykr223vmcfsoysexug6s274nq2oimcu55ybn6ww4il3g3cv@cohflgdbpnq7/ [1] Reported-by: Sergey Senozhatsky Cc: All applicable Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3663603.iIbC2pHGDl@rafael.j.wysocki commit 2551a1eedc09f5a86f94b038dc1bb16855c256f1 Author: Florian Schmaus Date: Fri Oct 17 11:28:14 2025 +0200 kunit: test_dev_action: Correctly cast 'priv' pointer to long* The previous implementation incorrectly assumed the original type of 'priv' was void**, leading to an unnecessary and misleading cast. Correct the cast of the 'priv' pointer in test_dev_action() to its actual type, long*, removing an unnecessary cast. As an additional benefit, this fixes an out-of-bounds CHERI fault on hardware with architectural capabilities. The original implementation tried to store a capability-sized pointer using the priv pointer. However, the priv pointer's capability only granted access to the memory region of its original long type, leading to a bounds violation since the size of a long is smaller than the size of a capability. This change ensures that the pointer usage respects the capabilities' bounds. Link: https://lore.kernel.org/r/20251017092814.80022-1-florian.schmaus@codasip.com Fixes: d03c720e03bd ("kunit: Add APIs for managing devices") Reviewed-by: David Gow Signed-off-by: Florian Schmaus Signed-off-by: Shuah Khan commit 39a9ed0fb6dac58547afdf9b6cb032d326a3698f Author: Haofeng Li Date: Wed Oct 15 14:17:53 2025 +0800 timekeeping: Fix aux clocks sysfs initialization loop bound The loop in tk_aux_sysfs_init() uses `i <= MAX_AUX_CLOCKS` as the termination condition, which results in 9 iterations (i=0 to 8) when MAX_AUX_CLOCKS is defined as 8. However, the kernel is designed to support only up to 8 auxiliary clocks. This off-by-one error causes the creation of a 9th sysfs entry that exceeds the intended auxiliary clock range. Fix the loop bound to use `i < MAX_AUX_CLOCKS` to ensure exactly 8 auxiliary clock entries are created, matching the design specification. Fixes: 7b95663a3d96 ("timekeeping: Provide interface to control auxiliary clocks") Signed-off-by: Haofeng Li Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/tencent_2376993D9FC06A3616A4F981B3DE1C599607@qq.com commit 789e46fbfca1875671717a20a916ca1a920268e4 Author: Jani Nikula Date: Wed Oct 15 12:51:35 2025 +0300 drm/i915/panic: fix panic structure allocation memory leak Separating the panic allocation from framebuffer allocation in commit 729c5f7ffa83 ("drm/{i915,xe}/panic: move framebuffer allocation where it belongs") failed to deallocate the panic structure anywhere. The fix is two-fold. First, free the panic structure in intel_user_framebuffer_destroy() in the general case. Second, move the panic allocation later to intel_framebuffer_init() to not leak the panic structure in error paths (if any, now or later) between intel_framebuffer_alloc() and intel_framebuffer_init(). v2: Rebase Fixes: 729c5f7ffa83 ("drm/{i915,xe}/panic: move framebuffer allocation where it belongs") Cc: Jocelyn Falempe Cc: Maarten Lankhorst Reported-by: Michał Grzelak Suggested-by: Ville Syrjälä Tested-by: Michał Grzelak # v1 Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251015095135.2183415-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 8f8ef09fcf6a3b00369bfc704e8f68d7474eca94) Signed-off-by: Rodrigo Vivi commit 9d7dfb95da2cb5c1287df2f3468bcb70d8b31087 Author: Sean Christopherson Date: Thu Oct 16 11:21:47 2025 -0700 KVM: VMX: Inject #UD if guest tries to execute SEAMCALL or TDCALL Add VMX exit handlers for SEAMCALL and TDCALL to inject a #UD if a non-TD guest attempts to execute SEAMCALL or TDCALL. Neither SEAMCALL nor TDCALL is gated by any software enablement other than VMXON, and so will generate a VM-Exit instead of e.g. a native #UD when executed from the guest kernel. Note! No unprivileged DoS of the L1 kernel is possible as TDCALL and SEAMCALL #GP at CPL > 0, and the CPL check is performed prior to the VMX non-root (VM-Exit) check, i.e. userspace can't crash the VM. And for a nested guest, KVM forwards unknown exits to L1, i.e. an L2 kernel can crash itself, but not L1. Note #2! The Intel® Trust Domain CPU Architectural Extensions spec's pseudocode shows the CPL > 0 check for SEAMCALL coming _after_ the VM-Exit, but that appears to be a documentation bug (likely because the CPL > 0 check was incorrectly bundled with other lower-priority #GP checks). Testing on SPR and EMR shows that the CPL > 0 check is performed before the VMX non-root check, i.e. SEAMCALL #GPs when executed in usermode. Note #3! The aforementioned Trust Domain spec uses confusing pseudocode that says that SEAMCALL will #UD if executed "inSEAM", but "inSEAM" specifically means in SEAM Root Mode, i.e. in the TDX-Module. The long- form description explicitly states that SEAMCALL generates an exit when executed in "SEAM VMX non-root operation". But that's a moot point as the TDX-Module injects #UD if the guest attempts to execute SEAMCALL, as documented in the "Unconditionally Blocked Instructions" section of the TDX-Module base specification. Cc: stable@vger.kernel.org Cc: Kai Huang Cc: Xiaoyao Li Cc: Rick Edgecombe Cc: Dan Williams Cc: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20251016182148.69085-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 19de7113bfac33ba92c004a9b510612bb745cfa0 Author: Babu Moger Date: Thu Oct 16 08:34:19 2025 -0500 x86,fs/resctrl: Fix NULL pointer dereference with events force-disabled in mbm_event mode The following NULL pointer dereference is encountered on mount of resctrl fs after booting a system that supports assignable counters with the "rdt=!mbmtotal,!mbmlocal" kernel parameters: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:mbm_cntr_get Call Trace: rdtgroup_assign_cntr_event rdtgroup_assign_cntrs rdt_get_tree Specifying the kernel parameter "rdt=!mbmtotal,!mbmlocal" effectively disables the legacy X86_FEATURE_CQM_MBM_TOTAL and X86_FEATURE_CQM_MBM_LOCAL features and the MBM events they represent. This results in the per-domain MBM event related data structures to not be allocated during early initialization. resctrl fs initialization follows by implicitly enabling both MBM total and local events on a system that supports assignable counters (mbm_event mode), but this enabling occurs after the per-domain data structures have been created. After booting, resctrl fs assumes that an enabled event can access all its state. This results in NULL pointer dereference when resctrl attempts to access the un-allocated structures of an enabled event. Remove the late MBM event enabling from resctrl fs. This leaves a problem where the X86_FEATURE_CQM_MBM_TOTAL and X86_FEATURE_CQM_MBM_LOCAL features may be disabled while assignable counter (mbm_event) mode is enabled without any events to support. Switching between the "default" and "mbm_event" mode without any events is not practical. Create a dependency between the X86_FEATURE_{CQM_MBM_TOTAL,CQM_MBM_LOCAL} and X86_FEATURE_ABMC (assignable counter) hardware features. An x86 system that supports assignable counters now requires support of X86_FEATURE_CQM_MBM_TOTAL or X86_FEATURE_CQM_MBM_LOCAL. This ensures all needed MBM related data structures are created before use and that it is only possible to switch between "default" and "mbm_event" mode when the same events are available in both modes. This dependency does not exist in the hardware but this usage of these feature settings work for known systems. [ bp: Massage commit message. ] Fixes: 13390861b426e ("x86,fs/resctrl: Detect Assignable Bandwidth Monitoring feature details") Co-developed-by: Reinette Chatre Signed-off-by: Reinette Chatre Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/a62e6ac063d0693475615edd213d5be5e55443e6.1760560934.git.babu.moger@amd.com commit a0b7780602b1b196f47e527fec82166a7e67c4d0 Author: Bart Van Assche Date: Tue Oct 7 14:48:00 2025 -0700 scsi: core: Fix a regression triggered by scsi_host_busy() Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag iterators") introduced the following regression: Call trace: __srcu_read_lock+0x30/0x80 (P) blk_mq_tagset_busy_iter+0x44/0x300 scsi_host_busy+0x38/0x70 ufshcd_print_host_state+0x34/0x1bc ufshcd_link_startup.constprop.0+0xe4/0x2e0 ufshcd_init+0x944/0xf80 ufshcd_pltfrm_init+0x504/0x820 ufs_rockchip_probe+0x2c/0x88 platform_probe+0x5c/0xa4 really_probe+0xc0/0x38c __driver_probe_device+0x7c/0x150 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1e0 bus_for_each_dev+0x7c/0xdc driver_attach+0x24/0x30 bus_add_driver+0x110/0x230 driver_register+0x68/0x130 __platform_driver_register+0x20/0x2c ufs_rockchip_pltform_init+0x1c/0x28 do_one_initcall+0x60/0x1e0 kernel_init_freeable+0x248/0x2c4 kernel_init+0x20/0x140 ret_from_fork+0x10/0x20 Fix this regression by making scsi_host_busy() check whether the SCSI host tag set has already been initialized. tag_set->ops is set by scsi_mq_setup_tags() just before blk_mq_alloc_tag_set() is called. This fix is based on the assumption that scsi_host_busy() and scsi_mq_setup_tags() calls are serialized. This is the case in the UFS driver. Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/ Cc: Ming Lei Cc: Jens Axboe Signed-off-by: Bart Van Assche Reviewed-by: Ming Lei Tested-by: Sebastian Reichel Link: https://patch.msgid.link/20251007214800.1678255-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit fc2bc2623e3a099165b02d13567d21fabb5ea54d Author: Krishna Chaitanya Chundru Date: Fri Oct 17 17:10:54 2025 +0530 Revert "PCI: qcom: Prepare for the DWC ECAM enablement" This reverts commit 4660e50cf81800f82eeecf743ad1e3e97ab72190. Commit f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") enabled ECAM access by using the config space start as DBI address. However, this approach breaks vendor drivers that rely on the DBI address for internal accesses, especially when the vendor config space is 256MB aligned. To resolve this, avoid using the DBI as the start of config space and instead introduce a custom ECAM PCI ops implementation. Revert the qcom specific ECAM preparation logic in 4660e50cf818 ("PCI: qcom: Prepare for the DWC ECAM enablement") since it's no longer necessary. Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251017-ecam_fix-v1-2-f6faa3d0edf3@oss.qualcomm.com commit a1978b692a3953241842a89eaa0026158f306cf1 Author: Krishna Chaitanya Chundru Date: Fri Oct 17 17:10:53 2025 +0530 PCI: dwc: Use custom pci_ops for root bus DBI vs ECAM config access When the vendor configuration space is 256MB aligned, the DesignWare PCIe host driver enables ECAM access and sets the DBI base to the start of the config space. This causes vendor drivers to incorrectly program iATU regions, as they rely on the DBI address for internal accesses. To fix this, avoid overwriting the DBI base when ECAM is enabled. Instead, introduce a custom pci_ops that accesses the DBI region directly for the root bus and uses ECAM for other buses. Fixes: f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") Reported-by: Ron Economos Closes: https://lore.kernel.org/all/eac81c57-1164-4d74-a1b4-6f353c577731@w6rz.net/ Suggested-by: Manivannan Sadhasivam Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Ron Economos Link: https://patch.msgid.link/20251017-ecam_fix-v1-1-f6faa3d0edf3@oss.qualcomm.com commit 81ccca31214e11ea2b537fd35d4f66d7cf46268e Author: Ondrej Mosnacek Date: Fri Oct 10 10:09:00 2025 +0200 nbd: override creds to kernel when calling sock_{send,recv}msg() sock_{send,recv}msg() internally calls security_socket_{send,recv}msg(), which does security checks (e.g. SELinux) for socket access against the current task. However, _sock_xmit() in drivers/block/nbd.c may be called indirectly from a userspace syscall, where the NBD socket access would be incorrectly checked against the calling userspace task (which simply tries to read/write a file that happens to reside on an NBD device). To fix this, temporarily override creds to kernel ones before calling the sock_*() functions. This allows the security modules to recognize this as internal access by the kernel, which will normally be allowed. A way to trigger the issue is to do the following (on a system with SELinux set to enforcing): ### Create nbd device: truncate -s 256M /tmp/testfile nbd-server localhost:10809 /tmp/testfile ### Connect to the nbd server: nbd-client localhost ### Create mdraid array mdadm --create -l 1 -n 2 /dev/md/testarray /dev/nbd0 missing After these steps, assuming the SELinux policy doesn't allow the unexpected access pattern, errors will be visible on the kernel console: [ 142.204243] nbd0: detected capacity change from 0 to 524288 [ 165.189967] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 165.252299] md/raid1:md127: active with 1 out of 2 mirrors [ 165.252725] md127: detected capacity change from 0 to 522240 [ 165.255434] block nbd0: Send control failed (result -13) [ 165.255718] block nbd0: Request send failed, requeueing [ 165.256006] block nbd0: Dead connection, failed to find a fallback [ 165.256041] block nbd0: Receive control failed (result -32) [ 165.256423] block nbd0: shutting down sockets [ 165.257196] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.257736] Buffer I/O error on dev md127, logical block 0, async page read [ 165.258263] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.259376] Buffer I/O error on dev md127, logical block 0, async page read [ 165.259920] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.260628] Buffer I/O error on dev md127, logical block 0, async page read [ 165.261661] ldm_validate_partition_table(): Disk read failed. [ 165.262108] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.262769] Buffer I/O error on dev md127, logical block 0, async page read [ 165.263697] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.264412] Buffer I/O error on dev md127, logical block 0, async page read [ 165.265412] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.265872] Buffer I/O error on dev md127, logical block 0, async page read [ 165.266378] I/O error, dev nbd0, sector 2048 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.267168] Buffer I/O error on dev md127, logical block 0, async page read [ 165.267564] md127: unable to read partition table [ 165.269581] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.269960] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.270316] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.270913] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.271253] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 165.271809] Buffer I/O error on dev nbd0, logical block 0, async page read [ 165.272074] ldm_validate_partition_table(): Disk read failed. [ 165.272360] nbd0: unable to read partition table [ 165.289004] ldm_validate_partition_table(): Disk read failed. [ 165.289614] nbd0: unable to read partition table The corresponding SELinux denial on Fedora/RHEL will look like this (assuming it's not silenced): type=AVC msg=audit(1758104872.510:116): avc: denied { write } for pid=1908 comm="mdadm" laddr=::1 lport=32772 faddr=::1 fport=10809 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=0 The respective backtrace looks like this: @security[mdadm, -13, handshake_exit+221615650 handshake_exit+221615650 handshake_exit+221616465 security_socket_sendmsg+5 sock_sendmsg+106 handshake_exit+221616150 sock_sendmsg+5 __sock_xmit+162 nbd_send_cmd+597 nbd_handle_cmd+377 nbd_queue_rq+63 blk_mq_dispatch_rq_list+653 __blk_mq_do_dispatch_sched+184 __blk_mq_sched_dispatch_requests+333 blk_mq_sched_dispatch_requests+38 blk_mq_run_hw_queue+239 blk_mq_dispatch_plug_list+382 blk_mq_flush_plug_list.part.0+55 __blk_flush_plug+241 __submit_bio+353 submit_bio_noacct_nocheck+364 submit_bio_wait+84 __blkdev_direct_IO_simple+232 blkdev_read_iter+162 vfs_read+591 ksys_read+95 do_syscall_64+92 entry_SYSCALL_64_after_hwframe+120 ]: 1 The issue has started to appear since commit 060406c61c7c ("block: add plug while submitting IO"). Cc: Ming Lei Link: https://bugzilla.redhat.com/show_bug.cgi?id=2348878 Fixes: 060406c61c7c ("block: add plug while submitting IO") Signed-off-by: Ondrej Mosnacek Acked-by: Paul Moore Acked-by: Stephen Smalley Reviewed-by: Ming Lei Tested-by: Ming Lei Signed-off-by: Jens Axboe commit 4ec703ec0c384a2199808c4eb2e9037236285a8d Author: Alok Tiwari Date: Sat Oct 18 12:32:54 2025 -0700 io_uring: fix incorrect unlikely() usage in io_waitid_prep() The negation operator is incorrectly placed outside the unlikely() macro: if (!unlikely(iwa)) This inverts the compiler branch prediction hint, marking the NULL case as likely instead of unlikely. The intent is to indicate that allocation failures are rare, consistent with common kernel patterns. Moving the negation inside unlikely(): if (unlikely(!iwa)) Fixes: 2b4fc4cd43f2 ("io_uring/waitid: setup async data in the prep handler") Signed-off-by: Alok Tiwari Reviewed-by: Gabriel Krisman Bertazi Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 8e93ac51e4c6dc399fad59ec21f55f2cfb46d27c Author: Marc Kleine-Budde Date: Mon Oct 20 11:51:03 2025 +0200 can: netlink: can_changelink(): allow disabling of automatic restart Since the commit c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode"), the automatic restart delay can only be set for devices that implement the restart handler struct can_priv::do_set_mode. As it makes no sense to configure a automatic restart for devices that doesn't support it. However, since systemd commit 13ce5d4632e3 ("network/can: properly handle CAN.RestartSec=0") [1], systemd-networkd correctly handles a restart delay of "0" (i.e. the restart is disabled). Which means that a disabled restart is always configured in the kernel. On systems with both changes active this causes that CAN interfaces that don't implement a restart handler cannot be brought up by systemd-networkd. Solve this problem by allowing a delay of "0" to be configured, even if the device does not implement a restart handler. [1] https://github.com/systemd/systemd/commit/13ce5d4632e395521e6205c954493c7fc1c4c6e0 Cc: stable@vger.kernel.org Cc: Andrei Lalaev Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251020-certain-arrogant-vole-of-sunshine-141841-mkl@pengutronix.de Fixes: c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode") Link: https://patch.msgid.link/20251020-netlink-fix-restart-v1-1-3f53c7f8520b@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 942b3c611067385849a912135175a66f25b7b1cb Merge: ffff5c8fc2af22 3a3bc9bbb3a028 Author: Marc Kleine-Budde Date: Mon Oct 20 17:18:39 2025 +0200 Merge patch series "can: drivers: drop skb in xmit if device is in listen only mode" Marc Kleine-Budde says: I notived that 3 drivers (bxcan, esd and rockchip) use the function can_dropped_invalid_skb(), that doesn't check if the device is in listen only mode. This series converts these driver to use the new can_dev_dropped_skb() function. Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-0-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3a3bc9bbb3a0287164a595787df0c70d91e77cfd Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-3-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 0bee15a5caf36fe513fdeee07fd4f0331e61c064 Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: 9721866f07e1 ("can: esd: add support for esd GmbH PCIe/402 CAN interface family") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-2-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3a20c444cd123e820e10ae22eeaf00e189315aa1 Author: Marc Kleine-Budde Date: Fri Oct 17 16:28:49 2025 +0200 can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: f00647d8127b ("can: bxcan: add support for ST bxCAN controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-1-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f7e37affbc9085f2b77ccb6596521a44eabf7505 Author: Mika Westerberg Date: Mon Oct 20 16:54:15 2025 +0200 spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash Add Intel Wildcat Lake SPI serial flash PCI ID to the list of supported devices. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-4-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit bc25c6e0a4880b5ad70c31fe1466f30c9e4c8f52 Author: Mika Westerberg Date: Mon Oct 20 16:54:14 2025 +0200 spi: intel-pci: Add support for Arrow Lake-H SPI serial flash Add Intel Arrow Lake-H PCI ID to the driver list of supported devices. This is the same controller found in previous generations. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-3-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit e46ee2f07e5848d7ec7aec38b72476dc7941b048 Author: Mika Westerberg Date: Mon Oct 20 16:54:13 2025 +0200 spi: intel: Add support for 128M component density With the recent hardware the flash component density can be increased to 128M. Update the driver to support this. While there log a warning if we encounter an unsupported value in this field. Signed-off-by: Mika Westerberg Link: https://patch.msgid.link/20251020145415.3377022-2-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 71c07570b918f000de5d0f7f1bf17a2887e303b5 Author: Renjun Wang Date: Sun Oct 19 18:44:38 2025 +0800 USB: serial: option: add UNISOC UIS7720 Add support for UNISOC (Spreadtrum) UIS7720 (A7720) module. T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4064 Rev=04.04 S: Manufacturer=Unisoc-phone S: Product=Unisoc-phone S: SerialNumber=0123456789ABCDEF C: #Ifs= 9 Cfg#= 1 Atr=c0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0&1: RNDIS, 2: LOG, 3: DIAG, 4&5: AT Ports, 6&7: AT2 Ports, 8: ADB Signed-off-by: Renjun Wang Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit f31e261712a0d107f09fb1d3dc8f094806149c83 Author: Jihed Chaibi Date: Tue Sep 16 00:06:55 2025 +0200 ARM: dts: imx51-zii-rdu1: Fix audmux node names Rename the 'ssi2' and 'aud3' nodes to 'mux-ssi2' and 'mux-aud3' in the audmux configuration of imx51-zii-rdu1.dts to comply with the naming convention in imx-audmux.yaml. This fixes the following dt-schema warning: imx51-zii-rdu1.dtb: audmux@83fd0000 (fsl,imx51-audmux): 'aud3', 'ssi2' do not match any of the regexes: '^mux-[0-9a-z]*$', '^pinctrl-[0-9]+$' Fixes: ceef0396f367f ("ARM: dts: imx: add ZII RDU1 board") Signed-off-by: Jihed Chaibi Signed-off-by: Shawn Guo commit 62bf7708fe80ec0db14b9179c25eeeda9f81e9d0 Author: Dario Binacchi Date: Sat Sep 13 11:16:31 2025 +0200 ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value The 'report-rate-hz' property for the edt-ft5x06 driver was added and handled in the Linux kernel by me with patches [1] and [2] for this specific board. The v1 upstream version, which was the one applied to the customer's kernel, used the 'report-rate' property, which was written directly to the controller register. During review, the 'hz' suffix was added, changing its handling so that writing the value directly to the register was no longer possible for the M06 controller. Once the patches were accepted in mainline, I did not reapply them to the customer's kernel, and when upstreaming the DTS for this board, I forgot to correct the 'report-rate-hz' property value. The property must be set to 60 because this board uses the M06 controller, which expects the report rate in units of 10 Hz, meaning the actual value written to the register is 6. [1] 625f829586ea ("dt-bindings: input: touchscreen: edt-ft5x06: add report-rate-hz") [2] 5bcee83a406c ("Input: edt-ft5x06 - set report rate by dts property") Fixes: ffea3cac94ba ("ARM: dts: imx6ul: support Engicam MicroGEA RMM board") Co-developed-by: Michael Trimarchi Signed-off-by: Michael Trimarchi Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit 69e4b75a5b90ef74300c283c0aafe8d41daf13a8 Merge: 249e1443e3d57e 77e67d5daaf155 Author: Johannes Berg Date: Mon Oct 20 13:57:51 2025 +0200 Merge tag 'iwlwifi-fixes-2025-10-19' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix avoid use after free ==================== Signed-off-by: Johannes Berg commit 249e1443e3d57e059925bdb698f53e4d008fc106 Author: Emmanuel Grumbach Date: Mon Oct 20 10:57:45 2025 +0300 wifi: nl80211: call kfree without a NULL check Coverity is unhappy because we may leak old_radio_rts_threshold. Since this pointer is only valid in the context of the function and kfree is NULL pointer safe, don't check and just call kfree. Note that somehow, we were checking old_rts_threshold to free old_radio_rts_threshold which is a bit odd. Fixes: 264637941cf4 ("wifi: cfg80211: Add Support to Set RTS Threshold for each Radio") Reviewed-by: Johannes Berg Signed-off-by: Emmanuel Grumbach Link: https://patch.msgid.link/20251020075745.44168-1-emmanuel.grumbach@intel.com Signed-off-by: Johannes Berg commit ed6a47346ec69e7f1659e0a1a3558293f60d5dd7 Author: Johannes Berg Date: Sun Oct 19 11:54:27 2025 +0300 wifi: mac80211: fix key tailroom accounting leak For keys added by ieee80211_gtk_rekey_add(), we assume that they're already present in the hardware and set the flag KEY_FLAG_UPLOADED_TO_HARDWARE. However, setting this flag needs to be paired with decrementing the tailroom needed, which was missed. Fixes: f52a0b408ed1 ("wifi: mac80211: mark keys as uploaded when added by the driver") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251019115358.c88eafb4083e.I69e9d4d78a756a133668c55b5570cf15a4b0e6a4@changeid Signed-off-by: Johannes Berg commit 3776c685ebe5f43e9060af06872661de55e80b9a Author: Gokul Sivakumar Date: Mon Oct 13 15:58:19 2025 +0530 wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. Cc: stable@vger.kernel.org Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx") Signed-off-by: Gokul Sivakumar Acked-by: Arend van Spriel Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com [Cc stable] Signed-off-by: Johannes Berg commit 1e1801cab6c7f302baec2a0fe3afe25458d0be7e Author: Dr. David Alan Gilbert Date: Sat Oct 11 00:57:35 2025 +0100 MAINTAINERS: wcn36xx: Add linux-wireless list The wcn36xx is a wireless device but doesn't have the wireless list in its MAINTAINERS entry. Add it. Signed-off-by: Dr. David Alan Gilbert Acked-by: Jeff Johnson Link: https://patch.msgid.link/20251010235735.350638-1-linux@treblig.org Signed-off-by: Johannes Berg commit d3697884672887ced9127be877c9d3d831fb1110 Merge: a2a69add80411d 9c78e747dd4fee Author: Johannes Berg Date: Mon Oct 20 13:54:45 2025 +0200 Merge tag 'ath-current-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc1 Fix memory leaks in both ath10k and ath12k. Fix a sparse issue in ath11k. Allow ath11k suspend/resume to work on more Lenovo laptops. ================== Signed-off-by: Johannes Berg commit a2a69add80411dd295c9088c1bcf925b1f4e53d7 Author: Rafał Miłecki Date: Fri Oct 3 14:51:26 2025 +0200 bcma: don't register devices disabled in OF Some bus devices can be marked as disabled for specific SoCs or models. Those should not be registered to avoid probing them. Signed-off-by: Rafał Miłecki Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251003125126.27950-1-zajec5@gmail.com Signed-off-by: Johannes Berg commit 607844761454e3c17e928002e126ccf21c83f6aa Author: Aloka Dixit Date: Wed Sep 24 18:30:14 2025 +0530 wifi: mac80211: reset FILS discovery and unsol probe resp intervals When ieee80211_stop_ap() deletes the FILS discovery and unsolicited broadcast probe response templates, the associated interval values are not reset. This can lead to drivers subsequently operating with the non-zero values, leading to unexpected behavior. Trigger repeated retrieval attempts of the FILS discovery template in ath12k, resulting in excessive log messages such as: mac vdev 0 failed to retrieve FILS discovery template mac vdev 4 failed to retrieve FILS discovery template Fix this by resetting the intervals in ieee80211_stop_ap() to ensure proper cleanup of FILS discovery and unsolicited broadcast probe response templates. Fixes: 295b02c4be74 ("mac80211: Add FILS discovery support") Fixes: 632189a0180f ("mac80211: Unsolicited broadcast probe response support") Signed-off-by: Aloka Dixit Signed-off-by: Aaradhana Sahu Link: https://patch.msgid.link/20250924130014.2575533-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Johannes Berg commit 3d62f95bd8450cebb4a4741bf83949cd54edd4a3 Author: Nam Cao Date: Thu Oct 2 08:23:17 2025 +0000 rv: Make rtapp/pagefault monitor depends on CONFIG_MMU There is no page fault without MMU. Compiling the rtapp/pagefault monitor without CONFIG_MMU fails as page fault tracepoints' definitions are not available. Make rtapp/pagefault monitor depends on CONFIG_MMU. Fixes: 9162620eb604 ("rv: Add rtapp_pagefault monitor") Signed-off-by: Nam Cao Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509260455.6Z9Vkty4-lkp@intel.com/ Cc: stable@vger.kernel.org Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20251002082317.973839-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 103541e6a5854b08a25e4caa61e990af1009a52e Author: Nam Cao Date: Thu Oct 2 08:22:35 2025 +0000 rv: Fully convert enabled_monitors to use list_head as iterator The callbacks in enabled_monitors_seq_ops are inconsistent. Some treat the iterator as struct rv_monitor *, while others treat the iterator as struct list_head *. This causes a wrong type cast and crashes the system as reported by Nathan. Convert everything to use struct list_head * as iterator. This also makes enabled_monitors consistent with available_monitors. Fixes: de090d1ccae1 ("rv: Fix wrong type cast in enabled_monitors_next()") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/linux-trace-kernel/20250923002004.GA2836051@ax162/ Signed-off-by: Nam Cao Cc: stable@vger.kernel.org Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20251002082235.973099-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 3575254546a27210a4b661ea37fbbfb836c0815d Author: Alan Borzeszkowski Date: Thu Nov 14 10:55:44 2024 +0100 thunderbolt: Add support for Intel Wildcat Lake Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar Lake platform. Add Wildcat Lake PCI ID to the driver list of supported devices. Signed-off-by: Alan Borzeszkowski Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit e607ef686ab95fbcb0dfd16f49aea7918be626e1 Author: Stefan Metzmacher Date: Thu Oct 16 12:54:21 2025 +0200 smb: client: allocate enough space for MR WRs and ib_drain_qp() The IB_WR_REG_MR and IB_WR_LOCAL_INV operations for smbdirect_mr_io structures should never fail because the submission or completion queues are too small. So we allocate more send_wr depending on the (local) max number of MRs. While there also add additional space for ib_drain_qp(). This should make sure ib_post_send() will never fail because the submission queue is full. Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Fixes: cc55f65dd352 ("smb: client: make use of common smbdirect_socket_parameters") Cc: stable@vger.kernel.org Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8dcc66ad379ec0642fb281c45ccfd7d2d366e53f Author: Guenter Roeck Date: Sat Oct 18 06:04:57 2025 -0700 hwmon: (sht3x) Fix error handling Handling of errors when reading status, temperature, and humidity returns the error number as negative attribute value. Fix it up by returning the error as return value. Fixes: a0ac418c6007c ("hwmon: (sht3x) convert some of sysfs interface to hwmon") Cc: JuenKit Yip Signed-off-by: Guenter Roeck commit a09a5aa8bf258ddc99a22c30f17fe304b96b5350 Author: Li Qiang Date: Fri Oct 17 14:34:14 2025 +0800 hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() The driver allocates memory for sensor data using devm_kzalloc(), but did not check if the allocation succeeded. In case of memory allocation failure, dereferencing the NULL pointer would lead to a kernel crash. Add a NULL pointer check and return -ENOMEM to handle allocation failure properly. Signed-off-by: Li Qiang Fixes: 08ebc9def79fc ("hwmon: Add Congatec Board Controller monitoring driver") Reviewed-by: Thomas Richard Link: https://lore.kernel.org/r/20251017063414.1557447-1-liqiang01@kylinos.cn Signed-off-by: Guenter Roeck commit 57f6f47920ef2f598c46d0a04bd9c8984c98e6df Author: Erick Karanja Date: Sun Oct 12 21:12:49 2025 +0300 hwmon: (pmbus/isl68137) Fix child node reference leak on early return In the case of an early return, the reference to the child node needs to be released. Use for_each_child_of_node_scoped to fix the issue. Fixes: 3996187f80a0e ("hwmon: (pmbus/isl68137) add support for voltage divider on Vout") Signed-off-by: Erick Karanja Link: https://lore.kernel.org/r/20251012181249.359401-1-karanja99erick@gmail.com [groeck: Updated subject/description] Signed-off-by: Guenter Roeck commit 72ac14851012d45dcbb9d3533e372e33001b873e Author: Harshit Mogalapalli Date: Fri Oct 10 13:44:46 2025 -0700 hwmon: (gpd-fan) Fix error handling in gpd_fan_probe() devm_request_region() returns a NULL pointer on error, not an ERR_PTR(). Handle it accordingly. Also fix error return from the call to devm_hwmon_device_register_with_info(). Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Harshit Mogalapalli Reviewed-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20251010204447.94343-1-harshit.m.mogalapalli@oracle.com [groeck: Updated subject to improve readability] Signed-off-by: Guenter Roeck commit ab0fd09d25e1d706e1ffc240f5cf66dcc89eeb49 Author: Harshit Mogalapalli Date: Fri Oct 10 13:43:59 2025 -0700 hwmon: (gpd-fan) Fix return value when platform_get_resource() fails When platform_get_resource() fails it returns NULL and not an error pointer, accordingly change the error handling. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20251010204359.94300-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Guenter Roeck commit 41de7440e6a00b8e70a068c50e3fba2f56302e8a Author: Alexis Czezar Torreno Date: Wed Oct 1 08:37:07 2025 +0800 hwmon: (pmbus/max34440) Update adpm12160 coeff due to latest FW adpm12160 is a dc-dc power module. The firmware was updated and the coeeficients in the pmbus_driver_info needs to be updated. Since the part has not yet released with older FW, this permanent change to reflect the latest should be ok. Signed-off-by: Alexis Czezar Torreno Link: https://lore.kernel.org/r/20251001-hwmon-next-v1-1-f8ca6a648203@analog.com Fixes: 629cf8f6c23a ("hwmon: (pmbus/max34440) Add support for ADPM12160") Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Guenter Roeck commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 Author: Srinivas Kandagatla Date: Fri Oct 17 09:52:56 2025 +0100 ASoC: qdsp6: q6asm: do not sleep while atomic For some reason we ended up kfree between spinlock lock and unlock, which can sleep. move the kfree out of spinlock section. Fixes: a2a5d30218fd ("ASoC: qdsp6: q6asm: Add support to memory map and unmap") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251017085307.4325-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 3bcdbc221d676f871e23da30fd485a76728f55c7 Author: Simon Trimmer Date: Thu Oct 16 11:26:01 2025 +0000 ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 Removing this match entry ensures that a PTL system comprising of a cs42l43 codec on link3 will use function topologies. Previously the behaviour would be use the monolithic topology associated with this codec match table entry in preference to function topologies and if the system had a number of smart amplifiers then they would not be instantiated. Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20251016112601.187020-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit bf6fb4a272739e0d1b2c570276324142517d1905 Author: Sharique Mohammad Date: Thu Oct 16 17:11:52 2025 +0200 ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added The filter configuration register(0x26) has AHPF(bit6) for primary record path, which is common in max98090 and max98091 and has been defined as DAPM suppy widget as "AHPF" in "struct snd_soc_dapm_widget max98090_dapm_widget[]". It is the DC-Blocking filter for the primary record path. But the same functionality for secondary record path in the configuration register(0x26) is DMIC2_HPF(bit2). It is not present as a DAPM supply widget in the current code. With this patch adding it as a DAPM supply widget. In the current code, the mics on secondary record path in code are named as "DMIC3" and "DMIC4", so accordingly naming DMIC2_HPF(bit2) as "DMIC34_HPF", and declaring it as a DAPM supply widget in "struct snd_soc_dapm_widget max98091_dapm_widget[]". Also it is specific to max98091, and should be visible or working only when max98091 codec chip is used. Therefore, written in "max98091_dapm_widget[]". As "AHPF" is not part of secondary record path, replacing it with "DMIC34_HPF" in the ALSA routes to "DMIC3" and "DMIC4" in "max98091_dapm_routes[]". Signed-off-by: Sharique Mohammad Link: https://patch.msgid.link/20251016151152.1107083-1-sharq0406@gmail.com Signed-off-by: Mark Brown commit ef30cb1304f033eaee3b46e22b8f523446db8f53 Author: Simon Trimmer Date: Thu Oct 16 15:08:37 2025 +0000 ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 This adds some match entries for a few system configurations: cs42l43 link 0 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs42l43 link 1 UID 0 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 cs35l56 link 1 UID 0 cs35l56 link 1 UID 1 cs35l56 link 1 UID 2 cs35l56 link 1 UID 3 Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20251016150837.320886-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit ec20584f25233bfe292c8e18f9a429dfaff58a49 Author: Richard Fitzgerald Date: Thu Oct 16 10:48:44 2025 +0100 ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h cs-amp-lib-test uses functions from kunit/test-bug.h but wasn't including it. This error was found by smatch. Fixes: 177862317a98 ("ASoC: cs-amp-lib: Add KUnit test for calibration helpers") Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251016094844.92796-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 248adfe32bfd75afbcb8f6d4b68f7e0a9fb2c438 Author: Simon Trimmer Date: Fri Oct 17 17:15:28 2025 +0100 ASoC: cs530x: Correct log message with expected variable The function used one parameter for the switch statement, but logged a different parameter when it defaulted. Signed-off-by: Simon Trimmer Signed-off-by: Vitaly Rodionov Link: https://patch.msgid.link/20251017161543.214235-2-vitalyr@opensource.cirrus.com Signed-off-by: Mark Brown commit 211ddde0823f1442e4ad052a2f30f050145ccada Author: Linus Torvalds Date: Sun Oct 19 15:19:16 2025 -1000 Linux 6.18-rc2 commit d9043c79ba68a089f95bb4344ab0232c3585f9f1 Merge: 343b4b44a10f6e 17e3e88ed0b631 Author: Linus Torvalds Date: Sun Oct 19 04:59:43 2025 -1000 Merge tag 'sched_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Make sure the check for lost pelt idle time is done unconditionally to have correct lost idle time accounting - Stop the deadline server task before a CPU goes offline * tag 'sched_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix pelt lost idle time detection sched/deadline: Stop dl_server before CPU goes offline commit 343b4b44a10f6e383bd829ba130024cfde2a08d4 Merge: c7864eeaa4b743 fa4f4bae893fbc Author: Linus Torvalds Date: Sun Oct 19 04:54:08 2025 -1000 Merge tag 'perf_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Make sure perf reporting works correctly in setups using overlayfs or FUSE - Move the uprobe optimization to a better location logically * tag 'perf_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix MMAP2 event device with backing files perf/core: Fix MMAP event path names with backing files perf/core: Fix address filter match with backing files uprobe: Move arch_uprobe_optimize right after handlers execution commit c7864eeaa4b743bffe4abb396a03b9d4730195fe Merge: 1c64efcb083c48 e6416c2dfe23c9 Author: Linus Torvalds Date: Sun Oct 19 04:41:27 2025 -1000 Merge tag 'x86_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Reset the why-the-system-rebooted register on AMD to avoid stale bits remaining from previous boots - Add a missing barrier in the TLB flushing code to prevent erroneously not flushing a TLB generation - Make sure cpa_flush() does not overshoot when computing the end range of a flush region - Fix resctrl bandwidth counting on AMD systems when the amount of monitoring groups created exceeds the number the hardware can track * tag 'x86_urgent_for_v6.18_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Prevent reset reasons from being retained across reboot x86/mm: Fix SMP ordering in switch_mm_irqs_off() x86/mm: Fix overflow in __cpa_addr() x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID commit 77e67d5daaf155f7d0f99f4e797c4842169ec19e Author: Dan Carpenter Date: Tue Sep 23 14:20:16 2025 +0300 wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() This code frees "link" by calling kfree_rcu(link, rcu_head) and then it dereferences "link" to get the "link->fw_id". Save the "link->fw_id" first to avoid a potential use after free. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aNKCcKlbSkkS4_gO@stanley.mountain Signed-off-by: Miri Korenblit commit d8713158faad0fd4418cb2f4e432c3876ad53a1f Author: Shuhao Fu Date: Fri Oct 10 10:55:17 2025 +0800 RDMA/uverbs: Fix umem release in UVERBS_METHOD_CQ_CREATE In `UVERBS_METHOD_CQ_CREATE`, umem should be released if anything goes wrong. Currently, if `create_cq_umem` fails, umem would not be released or referenced, causing a possible leak. In this patch, we release umem at `UVERBS_METHOD_CQ_CREATE`, the driver should not release umem if it returns an error code. Fixes: 1a40c362ae26 ("RDMA/uverbs: Add a common way to create CQ with umem") Signed-off-by: Shuhao Fu Link: https://patch.msgid.link/aOh1le4YqtYwj-hH@osx.local Signed-off-by: Leon Romanovsky commit 5575b7646b94c0afb0f4c0d86e00e13cf3397a62 Author: Jacob Moroni Date: Tue Sep 23 14:24:39 2025 +0000 RDMA/irdma: Set irdma_cq cq_num field during CQ create The driver maintains a CQ table that is used to ensure that a CQ is still valid when processing CQ related AEs. When a CQ is destroyed, the table entry is cleared, using irdma_cq.cq_num as the index. This field was never being set, so it was just always clearing out entry 0. Additionally, the cq_num field size was increased to accommodate HW supporting more than 64K CQs. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20250923142439.943930-1-jmoroni@google.com Acked-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 8d158f47f1f33d8747e80c3afbea5aa337e59d41 Author: Jacob Moroni Date: Tue Sep 23 19:08:50 2025 +0000 RDMA/irdma: Fix SD index calculation In some cases, it is possible for pble_rsrc->next_fpm_addr to be larger than u32, so remove the u32 cast to avoid unintentional truncation. This fixes the following error that can be observed when registering massive memory regions: [ 447.227494] (NULL ib_device): cqp opcode = 0x1f maj_err_code = 0xffff min_err_code = 0x800c [ 447.227505] (NULL ib_device): [Update PE SDs Cmd Error][op_code=21] status=-5 waiting=1 completion_err=1 maj=0xffff min=0x800c Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20250923190850.1022773-1-jmoroni@google.com Acked-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 88de89f184661ebb946804a5abdf2bdec7f0a7ab Author: YanLong Dai Date: Wed Sep 24 14:14:44 2025 +0800 RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp The current error handling path in bnxt_re_destroy_gsi_sqp() could lead to a resource leak. When bnxt_qplib_destroy_qp() fails, the function jumps to the 'fail' label and returns immediately, skipping the call to bnxt_qplib_free_qp_res(). Continue the resource teardown even if bnxt_qplib_destroy_qp() fails, which aligns with the driver's general error handling strategy and prevents the potential leak. Fixes: 8dae419f9ec73 ("RDMA/bnxt_re: Refactor queue pair creation code") Signed-off-by: YanLong Dai Link: https://patch.msgid.link/20250924061444.11288-1-daiyanlong@kylinos.cn Signed-off-by: Leon Romanovsky commit cb372b4f46d4285e5d2c07ba734374151b8e34e7 Author: Dimitri Fedrau Date: Thu Oct 16 07:20:39 2025 +0200 iio: humditiy: hdc3020: fix units for thresholds and hysteresis According to the ABI the units after application of scale and offset are milli degree celsius for temperature thresholds and milli percent for relative humidity thresholds. Currently the resulting units are degree celsius for temperature thresholds and hysteresis and percent for relative humidity thresholds and hysteresis. Change scale factor to fix this issue. Fixes: 3ad0e7e5f0cb ("iio: humidity: hdc3020: add threshold events support") Reported-by: Chris Lesiak Reviewed-by: Javier Carrasco Signed-off-by: Dimitri Fedrau Cc: Signed-off-by: Jonathan Cameron commit 7b8dc11c0a830caa0d890c603d597161c6c26095 Author: Dimitri Fedrau Date: Thu Oct 16 07:20:38 2025 +0200 iio: humditiy: hdc3020: fix units for temperature and humidity measurement According to the ABI the units after application of scale and offset are milli degrees for temperature measurements and milli percent for relative humidity measurements. Currently the resulting units are degree celsius for temperature measurements and percent for relative humidity measurements. Change scale factor to fix this issue. Fixes: c9180b8e39be ("iio: humidity: Add driver for ti HDC302x humidity sensors") Reported-by: Chris Lesiak Suggested-by: Chris Lesiak Reviewed-by: Javier Carrasco Signed-off-by: Dimitri Fedrau Cc: Signed-off-by: Jonathan Cameron commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a Author: Francesco Lavra Date: Fri Oct 17 19:32:08 2025 +0200 iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields The `decimator` and `batch` fields of struct st_lsm6dsx_settings are arrays indexed by sensor type, not by sensor hardware identifier; moreover, the `batch` field is only used for the accelerometer and gyroscope. Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to ST_LSM6DSX_ID_MAX, and change the array size for `batch` from ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id definition so that the ST_LSM6DSX_ID_MAX value is usable within the struct st_lsm6dsx_settings definition. Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO") Signed-off-by: Francesco Lavra Acked-by: Lorenzo Bianconi Cc: Signed-off-by: Jonathan Cameron commit 1c64efcb083c48c85227cb4d72ab137feef2cdac Merge: 648937f64a09ae 1f1d3e1d094db7 Author: Linus Torvalds Date: Sat Oct 18 10:05:13 2025 -1000 Merge tag 'rust-rustfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rustfmt fixes from Miguel Ojeda: "Rust 'rustfmt' cleanup 'rustfmt', by default, formats imports in a way that is prone to conflicts while merging and rebasing, since in some cases it condenses several items into the same line. Document in our guidelines that we will handle this for the moment with the trailing empty comment workaround and make the tree 'rustfmt'-clean again" * tag 'rust-rustfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: bitmap: fix formatting rust: cpufreq: fix formatting rust: alloc: employ a trailing comment to keep vertical layout docs: rust: add section on imports formatting commit 648937f64a09ae4a938a6793f95207d955098038 Merge: e67bb0da332c60 dbfdaeb381a49a Author: Linus Torvalds Date: Sat Oct 18 08:38:28 2025 -1000 Merge tag 'tpmdd-next-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fix from Jarkko Sakkinen: "Correct the state transitions for ARM FF-A to match the spec and how tpm_crb behaves on other platforms" * tag 'tpmdd-next-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_crb: Add idle support for the Arm FF-A start method commit e67bb0da332c6058b29a9c46cc4035647d049a0c Merge: ea0bdf2b945e91 a78835b86a4414 Author: Linus Torvalds Date: Sat Oct 18 08:35:09 2025 -1000 Merge tag 'pci-v6.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Search for MSI Capability with correct ID to fix an MSI regression on platforms with Cadence IP (Hans Zhang) - Revert early bridge resource set up to fix resource assignment failures that broke at least alpha boot and Snapdragon ath12k WiFi (Ilpo Järvinen) - Implement VMD .irq_startup()/.irq_shutdown() to fix IRQ issues that caused boot crashes and broken devices below VMD (Inochi Amaoto) - Select CONFIG_SCREEN_INFO on X86 to fix black screen on boot when SCREEN_INFO not selected (Mario Limonciello) * tag 'pci-v6.18-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI/VGA: Select SCREEN_INFO on X86 PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() PCI: Revert early bridge resource set up PCI: cadence: Search for MSI Capability with correct ID commit ea0bdf2b945e91137cc465d3833aeb659ba93d79 Merge: 2953fb65481b26 a4bbb493a3247e Author: Linus Torvalds Date: Sat Oct 18 08:22:07 2025 -1000 Merge tag 'cxl-fixes-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link fixes from Dave Jiang: "A small collection of CXL fixes. In addition to some misc fixes for the CXL subsystem, a number of fixes for CXL extended linear cache support are included to make it functional again. - Avoid missing port component registers setup due to dport enumeration failure - Add check for no entries in cxl_feature_info to address accessing invalid pointer. - Use %pa printk format to emit resource_size_t in validate_region_offset() CXL extended linear cache support fixes: - Fix setup of memory resource in cxl_acpi_set_cache_size() - Set range param for region_res_match_cxl_range() as const (addresses a compile warning for match_region_by_range() fix) - Fix match_region_by_range() to use region_res_match_cxl_range() - Subtract to find an hpa_alias0 in cxl_poison events to correct the alias math calculation" * tag 'cxl-fixes-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events cxl/region: Use %pa printk format to emit resource_size_t cxl: Fix match_region_by_range() to use region_res_match_cxl_range() cxl: Set range param for region_res_match_cxl_range() as const cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size() cxl/features: Add check for no entries in cxl_feature_info cxl/port: Avoid missing port component registers setup commit 2953fb65481b262514ac13f24ffbc70eeace68c6 Merge: d303caf5caf453 ed80cc4667ac99 Author: Linus Torvalds Date: Sat Oct 18 08:18:18 2025 -1000 Merge tag 'hid-for-linus-2025101701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fix for sticky fingers handling in hid-multitouch (Benjamin Tissoires) - fix for reporting of 0 battery levels (Dmitry Torokhov) - build fix for hid-haptic in certain configurations (Jonathan Denose) - improved probe and avoiding spamming kernel log by hid-nintendo (Vicki Pfau) - fix for OOB in hid-cp2112 (Deepak Sharma) - interrupt handling fix for intel-thc-hid (Even Xu) - a couple of new device IDs and device-specific quirks * tag 'hid-for-linus-2025101701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL selftests/hid: add tests for missing release on the Dell Synaptics HID: multitouch: fix sticky fingers HID: multitouch: fix name of Stylus input devices HID: hid-input: only ignore 0 battery events for digitizers HID: hid-debug: Fix spelling mistake "Rechargable" -> "Rechargeable" HID: Kconfig: Fix build error from CONFIG_HID_HAPTIC HID: nintendo: Rate limit IMU compensation message HID: nintendo: Wait longer for initial probe HID: core: Add printk_ratelimited variants to hid_warn() etc HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel HID: quirks: avoid Cooler Master MM712 dongle wakeup bug HID: cp2112: Add parameter validation to data length HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection HID: intel-thc-hid: intel-quicki2c: Fix wrong type casting commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 Author: Roy Vegard Ovesen Date: Sat Oct 18 19:18:22 2025 +0200 ALSA: usb-audio: fix control pipe direction Since the requesttype has USB_DIR_OUT the pipe should be constructed with usb_sndctrlpipe(). Fixes: 8dc5efe3d17c ("ALSA: usb-audio: Add support for Presonus Studio 1810c") Signed-off-by: Roy Vegard Ovesen Link: https://patch.msgid.link/aPPL3tBFE_oU-JHv@ark Signed-off-by: Takashi Iwai commit d303caf5caf453da2abfd84d249d210aaffe9873 Merge: 847f242f7a44fb a1e83d4c0361f4 Author: Linus Torvalds Date: Sat Oct 18 08:00:43 2025 -1000 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Replace bpf_map_kmalloc_node() with kmalloc_nolock() to fix kmemleak imbalance in tracking of bpf_async_cb structures (Alexei Starovoitov) - Make selftests/bpf arg_parsing.c more robust to errors (Andrii Nakryiko) - Fix redefinition of 'off' as different kind of symbol when I40E driver is builtin (Brahmajit Das) - Do not disable preemption in bpf_test_run (Sahil Chandna) - Fix memory leak in __lookup_instance error path (Shardul Bankar) - Ensure test data is flushed to disk before reading it (Xing Guo) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Fix redefinition of 'off' as different kind of symbol bpf: Do not disable preemption in bpf_test_run(). bpf: Fix memory leak in __lookup_instance error path selftests: arg_parsing: Ensure data is flushed to disk before reading. bpf: Replace bpf_map_kmalloc_node() with kmalloc_nolock() to allocate bpf_async_cb structures. selftests/bpf: make arg_parsing.c more robust to crashes bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path commit 847f242f7a44fba5aab474534fc498033e48fd72 Merge: 2d07c6c2098805 2d8636119b9297 Author: Linus Torvalds Date: Sat Oct 18 07:23:59 2025 -1000 Merge tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat fixes from Namjae Jeon: - Fix out-of-bounds in FS_IOC_SETFSLABEL - Add validation for stream entry size to prevent infinite loop * tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix out-of-bounds in exfat_nls_to_ucs2() exfat: fix improper check of dentry.stream.valid_size commit 2d07c6c2098805054f84ce642587093bb8feaf8c Merge: 4ccb3a80002875 9bb3baa9d1604c Author: Linus Torvalds Date: Sat Oct 18 07:18:48 2025 -1000 Merge tag 'nfs-for-6.18-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix for FlexFiles mirror->dss allocation - Apply delay_retrans to async operations - Check if suid/sgid is cleared after a write when needed - Fix setting the state renewal timer for early mounts after a reboot * tag 'nfs-for-6.18-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS4: Fix state renewals missing after boot NFS: check if suid/sgid was cleared after a write as needed NFS4: Apply delay_retrans to async operations NFSv4/flexfiles: fix to allocate mirror->dss before use commit 4ccb3a800028759b2ba39857cb180589575d7445 Merge: 02e5f74ef08d3e 3c15a6df61bab0 Author: Linus Torvalds Date: Sat Oct 18 07:11:32 2025 -1000 Merge tag '6.18-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "smb client fixes, security and smbdirect improvements, and some minor cleanup: - Important OOB DFS fix - Fix various potential tcon refcount leaks - smbdirect (RDMA) fixes (following up from test event a few weeks ago): - Fixes to improve and simplify handling of memory lifetime of smbdirect_mr_io structures, when a connection gets disconnected - Make sure we really wait to reach SMBDIRECT_SOCKET_DISCONNECTED before destroying resources - Make sure the send/recv submission/completion queues are large enough to avoid ib_post_send() from failing under pressure - convert cifs.ko to use the recommended crypto libraries (instead of crypto_shash), this also can improve performance - Three small cleanup patches" * tag '6.18-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (24 commits) smb: client: Consolidate cmac(aes) shash allocation smb: client: Remove obsolete crypto_shash allocations smb: client: Use HMAC-MD5 library for NTLMv2 smb: client: Use MD5 library for SMB1 signature calculation smb: client: Use MD5 library for M-F symlink hashing smb: client: Use HMAC-SHA256 library for SMB2 signature calculation smb: client: Use HMAC-SHA256 library for key generation smb: client: Use SHA-512 library for SMB3.1.1 preauth hash cifs: parse_dfs_referrals: prevent oob on malformed input smb: client: Fix refcount leak for cifs_sb_tlink smb: client: let smbd_destroy() wait for SMBDIRECT_SOCKET_DISCONNECTED smb: move some duplicate definitions to common/cifsglob.h smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered smb: client: let destroy_mr_list() call ib_dereg_mr() before ib_dma_unmap_sg() smb: client: call ib_dma_unmap_sg if mr->sgt.nents is not 0 smb: client: improve logic in smbd_deregister_mr() smb: client: improve logic in smbd_register_mr() smb: client: improve logic in allocate_mr_list() smb: client: let destroy_mr_list() remove locked from the list smb: client: let destroy_mr_list() call list_del(&mr->list) ... commit 02e5f74ef08d3e6afec438d571487d0d0cec3c48 Merge: 0e622c4b0e02ca 4361f5aa8bfcec Author: Linus Torvalds Date: Sat Oct 18 07:07:14 2025 -1000 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Fix the handling of ZCR_EL2 in NV VMs - Pick the correct translation regime when doing a PTW on the back of a SEA - Prevent userspace from injecting an event into a vcpu that isn't initialised yet - Move timer save/restore to the sysreg handling code, fixing EL2 timer access in the process - Add FGT-based trapping of MDSCR_EL1 to reduce the overhead of debug - Fix trapping configuration when the host isn't GICv3 - Improve the detection of HCR_EL2.E2H being RES1 - Drop a spurious 'break' statement in the S1 PTW - Don't try to access SPE when owned by EL3 Documentation updates: - Document the failure modes of event injection - Document that a GICv3 guest can be created on a GICv5 host with FEAT_GCIE_LEGACY Selftest improvements: - Add a selftest for the effective value of HCR_EL2.AMO - Address build warning in the timer selftest when building with clang - Teach irqfd selftests about non-x86 architectures - Add missing sysregs to the set_id_regs selftest - Fix vcpu allocation in the vgic_lpi_stress selftest - Correctly enable interrupts in the vgic_lpi_stress selftest x86: - Expand the KVM_PRE_FAULT_MEMORY selftest to add a regression test for the bug fixed by commit 3ccbf6f47098 ("KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault") - Don't try to get PMU capabilities from perf when running a CPU with hybrid CPUs/PMUs, as perf will rightly WARN. guest_memfd: - Rework KVM_CAP_GUEST_MEMFD_MMAP (newly introduced in 6.18) into a more generic KVM_CAP_GUEST_MEMFD_FLAGS - Add a guest_memfd INIT_SHARED flag and require userspace to explicitly set said flag to initialize memory as SHARED, irrespective of MMAP. The behavior merged in 6.18 is that enabling mmap() implicitly initializes memory as SHARED, which would result in an ABI collision for x86 CoCo VMs as their memory is currently always initialized PRIVATE. - Allow mmap() on guest_memfd for x86 CoCo VMs, i.e. on VMs with private memory, to enable testing such setups, i.e. to hopefully flush out any other lurking ABI issues before 6.18 is officially released. - Add testcases to the guest_memfd selftest to cover guest_memfd without MMAP, and host userspace accesses to mmap()'d private memory" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (46 commits) arm64: Revamp HCR_EL2.E2H RES1 detection KVM: arm64: nv: Use FGT write trap of MDSCR_EL1 when available KVM: arm64: Compute per-vCPU FGTs at vcpu_load() KVM: arm64: selftests: Fix misleading comment about virtual timer encoding KVM: arm64: selftests: Add an E2H=0-specific configuration to get_reg_list KVM: arm64: selftests: Make dependencies on VHE-specific registers explicit KVM: arm64: Kill leftovers of ad-hoc timer userspace access KVM: arm64: Fix WFxT handling of nested virt KVM: arm64: Move CNT*CT_EL0 userspace accessors to generic infrastructure KVM: arm64: Move CNT*_CVAL_EL0 userspace accessors to generic infrastructure KVM: arm64: Move CNT*_CTL_EL0 userspace accessors to generic infrastructure KVM: arm64: Add timer UAPI workaround to sysreg infrastructure KVM: arm64: Make timer_set_offset() generally accessible KVM: arm64: Replace timer context vcpu pointer with timer_id KVM: arm64: Introduce timer_context_to_vcpu() helper KVM: arm64: Hide CNTHV_*_EL2 from userspace for nVHE guests Documentation: KVM: Update GICv3 docs for GICv5 hosts KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests KVM: arm64: selftests: Actually enable IRQs in vgic_lpi_stress KVM: arm64: selftests: Allocate vcpus with correct size ... commit 0e622c4b0e02ca1946a9fadb63f00ef733e8ba28 Merge: 959f018f97e63f 0843ba458439f3 Author: Linus Torvalds Date: Sat Oct 18 07:02:28 2025 -1000 Merge tag 'powerpc-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix to handle NULL pointer dereference at irq domain teardown - Fix for handling extraction of struct xive_irq_data - Fix to skip parameter area allocation when fadump disabled Thanks to Ganesh Goudar, Hari Bathini, Nam Cao, Ritesh Harjani (IBM), Sourabh Jain, and Venkat Rao Bagalkote, * tag 'powerpc-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/fadump: skip parameter area allocation when fadump is disabled powerpc, ocxl: Fix extraction of struct xive_irq_data powerpc/pseries/msi: Fix NULL pointer dereference at irq domain teardown commit 959f018f97e63fc188c6a7519baa6dc2d1248828 Merge: f406055cb18c6e 86f54f9b6c17d6 Author: Linus Torvalds Date: Sat Oct 18 06:59:25 2025 -1000 Merge tag 'slab-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fixes for two bugs that can be triggered when debugging options are enabled (Hao Ge, Vlastimil Babka) * tag 'slab-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL slab: fix clearing freelist in free_deferred_objects() commit 1386d16761c0b569efedb998f56c1ae048a086e2 Author: J-Donald Tournier Date: Sat Oct 18 15:52:26 2025 +0100 ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10 This laptop requires the same quirk as Lenovo Yoga9 14IAP7 for fixing the bass speaker problems. Use HDA_CODEC_QUIRK to match on the codec SSID to avoid conflict with the Lenovo Legion Slim 7 16IRH8, which has the same PCI SSID. Signed-off-by: J-Donald Tournier Link: https://patch.msgid.link/20251018145322.39119-1-jdournier@gmail.com Signed-off-by: Takashi Iwai commit b7776a802f2f80139f96530a489dd00fd7089eda Author: Paul Walmsley Date: Sat Oct 18 09:32:12 2025 -0600 riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id() Resolve this smatch warning: arch/riscv/kernel/sys_hwprobe.c:50 hwprobe_arch_id() error: uninitialized symbol 'cpu_id'. This could happen if hwprobe_arch_id() was called with a key ID of something other than MVENDORID, MIMPID, and MARCHID. This does not happen in the current codebase. The only caller of hwprobe_arch_id() is a function that only passes one of those three key IDs. For the sake of reducing static analyzer warning noise, and in the unlikely event that hwprobe_arch_id() is someday called with some other key ID, validate hwprobe_arch_id()'s input to ensure that 'cpu_id' is always initialized before use. Fixes: ea3de9ce8aa280 ("RISC-V: Add a syscall for HW probing") Cc: Evan Green Signed-off-by: Paul Walmsley Link: https://lore.kernel.org/r/cf5a13ec-19d0-9862-059b-943f36107bf3@kernel.org commit 2dc99ea2727640b2fe12f9aa0e38ea2fc3cbb92d Author: Paul Walmsley Date: Sat Oct 18 00:31:11 2025 -0600 riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb() In has_thead_homogeneous_vlenb(), smatch detected that the vlenb variable could be used while uninitialized. It appears that this could happen if no CPUs described in DT have the "thead,vlenb" property. Fix by initializing vlenb to 0, which will keep thead_vlenb_of set to 0 (as it was statically initialized). This in turn will cause riscv_v_setup_vsize() to fall back to CSR probing - the desired result if thead,vlenb isn't provided in the DT data. While here, fix a nearby comment typo. Cc: stable@vger.kernel.org Cc: Charlie Jenkins Fixes: 377be47f90e41 ("riscv: vector: Use vlenb from DT for thead") Signed-off-by: Paul Walmsley Link: https://lore.kernel.org/r/22674afb-2fe8-2a83-1818-4c37bd554579@kernel.org commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 Author: Valek Andrej Date: Tue Oct 14 09:13:44 2025 +0200 iio: accel: fix ADXL355 startup race condition There is an race-condition where device is not full working after SW reset. Therefore it's necessary to wait some time after reset and verify shadow registers values by reading and comparing the values before/after reset. This mechanism is described in datasheet at least from revision D. Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355") Signed-off-by: Valek Andrej Signed-off-by: Kessler Markus Cc: Signed-off-by: Jonathan Cameron commit 673e75ea55df5f437471371a970b31df9d0b852c Merge: 3a8660878839fa 85d7dda5a9f665 Author: Rafael J. Wysocki Date: Sat Oct 18 14:42:39 2025 +0200 Merge tag 'amd-pstate-v6.18-2025-10-15' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate 6.18 content (10/15/25) from Mario Limonciello: "Fix for EPP value in wrong state after S4" * tag 'amd-pstate-v6.18-2025-10-15' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate commit dbfdaeb381a49a7bc753d18e2876bc56a15e01cc Author: Stuart Yoder Date: Sat Oct 18 14:25:18 2025 +0300 tpm_crb: Add idle support for the Arm FF-A start method According to the CRB over FF-A specification [1], a TPM that implements the ABI must comply with the TCG PTP specification. This requires support for the Idle and Ready states. This patch implements CRB control area requests for goIdle and cmdReady on FF-A based TPMs. The FF-A message used to notify the TPM of CRB updates includes a locality parameter, which provides a hint to the TPM about which locality modified the CRB. This patch adds a locality parameter to __crb_go_idle() and __crb_cmd_ready() to support this. [1] https://developer.arm.com/documentation/den0138/latest/ Signed-off-by: Stuart Yoder Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4361f5aa8bfcecbab3fc8db987482b9e08115a6a Merge: 5d26eaae15fb5c 505f5224b197b7 Author: Paolo Bonzini Date: Sat Oct 18 10:25:43 2025 +0200 Merge tag 'kvm-x86-fixes-6.18-rc2' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes for 6.18: - Expand the KVM_PRE_FAULT_MEMORY selftest to add a regression test for the bug fixed by commit 3ccbf6f47098 ("KVM: x86/mmu: Return -EAGAIN if userspace deletes/moves memslot during prefault") - Don't try to get PMU capabbilities from perf when running a CPU with hybrid CPUs/PMUs, as perf will rightly WARN. - Rework KVM_CAP_GUEST_MEMFD_MMAP (newly introduced in 6.18) into a more generic KVM_CAP_GUEST_MEMFD_FLAGS - Add a guest_memfd INIT_SHARED flag and require userspace to explicitly set said flag to initialize memory as SHARED, irrespective of MMAP. The behavior merged in 6.18 is that enabling mmap() implicitly initializes memory as SHARED, which would result in an ABI collision for x86 CoCo VMs as their memory is currently always initialized PRIVATE. - Allow mmap() on guest_memfd for x86 CoCo VMs, i.e. on VMs with private memory, to enable testing such setups, i.e. to hopefully flush out any other lurking ABI issues before 6.18 is officially released. - Add testcases to the guest_memfd selftest to cover guest_memfd without MMAP, and host userspace accesses to mmap()'d private memory. commit 5d26eaae15fb5c190164362a3e19081935574efc Merge: 3a8660878839fa ca88ecdce5f518 Author: Paolo Bonzini Date: Sat Oct 18 10:25:31 2025 +0200 Merge tag 'kvmarm-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.18, take #1 Improvements and bug fixes: - Fix the handling of ZCR_EL2 in NV VMs (20250926194108.84093-1-oliver.upton@linux.dev) - Pick the correct translation regime when doing a PTW on the back of a SEA (20250926224246.731748-1-oliver.upton@linux.dev) - Prevent userspace from injecting an event into a vcpu that isn't initialised yet (20250930085237.108326-1-oliver.upton@linux.dev) - Move timer save/restore to the sysreg handling code, fixing EL2 timer access in the process (20250929160458.3351788-1-maz@kernel.org) - Add FGT-based trapping of MDSCR_EL1 to reduce the overhead of debug (20250924235150.617451-1-oliver.upton@linux.dev) - Fix trapping configuration when the host isn't GICv3 (20251007160704.1673584-1-sascha.bischoff@arm.com) - Improve the detection of HCR_EL2.E2H being RES1 (20251009121239.29370-1-maz@kernel.org) - Drop a spurious 'break' statement in the S1 PTW (20250930135621.162050-1-osama.abdelkader@gmail.com) - Don't try to access SPE when owned by EL3 (20251010174707.1684200-1-mukesh.ojha@oss.qualcomm.com) Documentation updates: - Document the failure modes of event injection (20250930233620.124607-1-oliver.upton@linux.dev) - Document that a GICv3 guest can be created on a GICv5 host with FEAT_GCIE_LEGACY (20251007154848.1640444-1-sascha.bischoff@arm.com) Selftest improvements: - Add a selftest for the effective value of HCR_EL2.AMO (20250926224454.734066-1-oliver.upton@linux.dev) - Address build warning in the timer selftest when building with clang (20250926155838.2612205-1-seanjc@google.com) - Teach irq_fd selftests about non-x86 architectures (20250930193301.119859-1-oliver.upton@linux.dev) - Add missing sysregs to the set_id_regs selftest (20251012154352.61133-1-zenghui.yu@linux.dev) - Fix vcpu allocation in the vgic_lpi_stress selftest (20251008154520.54801-1-zenghui.yu@linux.dev) - Correctly enable interrupts in the vgic_lpi_stress selftest (20251007195254.260539-1-oliver.upton@linux.dev) commit 5d15d2ad36b0f7afab83ca9fc8a2a6e60cbe54c4 Author: Jingwei Wang Date: Mon Aug 11 22:20:06 2025 +0800 riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot The hwprobe vDSO data for some keys, like MISALIGNED_VECTOR_PERF, is determined by an asynchronous kthread. This can create a race condition where the kthread finishes after the vDSO data has already been populated, causing userspace to read stale values. To fix this race, a new 'ready' flag is added to the vDSO data, initialized to 'false' during arch_initcall_sync. This flag is checked by both the vDSO's user-space code and the riscv_hwprobe syscall. The syscall serves as a one-time gate, using a completion to wait for any pending probes before populating the data and setting the flag to 'true', thus ensuring userspace reads fresh values on its first request. Reported-by: Tsukasa OI Closes: https://lore.kernel.org/linux-riscv/760d637b-b13b-4518-b6bf-883d55d44e7f@irq.a4lg.com/ Fixes: e7c9d66e313b ("RISC-V: Report vector unaligned access speed hwprobe") Cc: Palmer Dabbelt Cc: Alexandre Ghiti Cc: Olof Johansson Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti Co-developed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt Signed-off-by: Jingwei Wang Link: https://lore.kernel.org/r/20250811142035.105820-1-wangjingwei@iscas.ac.cn [pjw@kernel.org: fix checkpatch issues] Signed-off-by: Paul Walmsley commit 492c513ec6de1ce51b5f033bd6c708e4b8e46ae4 Author: Paul Walmsley Date: Tue Oct 14 17:25:26 2025 -0600 riscv: add a forward declaration for cpuinfo_op Add a forward declaration for cpuinfo_op to resolve a sparse warning. Link: https://lore.kernel.org/r/b831f349-5d0c-f7ac-8362-acb20bc6221a@kernel.org Signed-off-by: Paul Walmsley commit d2721bb165b3ee00dd23525885381af07fec852a Author: Anup Patel Date: Tue Oct 14 22:00:09 2025 +0530 RISC-V: Don't print details of CPUs disabled in DT Early boot stages may disable CPU DT nodes for unavailable CPUs based on SKU, pinstraps, eFuse, etc. Currently, the riscv_early_of_processor_hartid() prints details of a CPU if it is disabled in DT which has no value and gives a false impression to the users that there some issue with the CPU. Fixes: e3d794d555cd ("riscv: treat cpu devicetree nodes without status as enabled") Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20251014163009.182381-1-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 768e054de01bef8701c24ec49309e57e0167af44 Author: Samuel Holland Date: Wed Oct 15 15:56:00 2025 -0700 riscv: Remove the PER_CPU_OFFSET_SHIFT macro __per_cpu_offset is an array of unsigned long, so we can reuse the existing RISCV_LGPTR macro. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251015225604.3860409-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit 5898fc01ff344075e4332aa9abeb0841c85e7e51 Author: Samuel Holland Date: Wed Oct 15 16:33:24 2025 -0700 riscv: mm: Define MAX_POSSIBLE_PHYSMEM_BITS for zsmalloc This definition is used by zsmalloc to optimize memory allocation. On riscv64, it is the same as MAX_PHYSMEM_BITS from asm/sparsemem.h, but that definition depends on CONFIG_SPARSEMEM. The correct definition is already provided for riscv32. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251015233327.3885003-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit 223bfc4d403c5e4841f9d2b5be88a6e236942e4e Author: Samuel Holland Date: Wed Oct 15 17:32:05 2025 -0700 riscv: Register IPI IRQs with unique names This allows different IPIs to be distinguished in tracing output. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20251016003244.3910332-1-samuel.holland@sifive.com Signed-off-by: Paul Walmsley commit e7b969cbe302d49032d4c2bb36c57c9c623ebfdc Author: Sunil V L Date: Mon Oct 13 23:49:47 2025 +0530 ACPI: RIMT: Fix unused function warnings when CONFIG_IOMMU_API is disabled When CONFIG_IOMMU_API is disabled, some functions defined outside its conditional scope become unused, triggering compiler warnings reported by the kernel test robot. Move these function definitions inside the #ifdef CONFIG_IOMMU_API block to prevent unused function warnings when the configuration is disabled. Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280031.8Sjkr4bh-lkp@intel.com/ Signed-off-by: Sunil V L Link: https://lore.kernel.org/r/20251013181947.261759-1-sunilvl@ventanamicro.com commit ca525d53f994d45c8140968b571372c45f555ac1 Author: Anup Patel Date: Fri Oct 17 21:30:05 2025 -0600 RISC-V: Define pgprot_dmacoherent() for non-coherent devices The pgprot_dmacoherent() is used when allocating memory for non-coherent devices and by default pgprot_dmacoherent() is same as pgprot_noncached() unless architecture overrides it. Currently, there is no pgprot_dmacoherent() definition for RISC-V hence non-coherent device memory is being mapped as IO thereby making CPU access to such memory slow. Define pgprot_dmacoherent() to be same as pgprot_writecombine() for RISC-V so that CPU access non-coherent device memory as NOCACHE which is better than accessing it as IO. Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Signed-off-by: Anup Patel Tested-by: Han Gao Tested-by: Guo Ren (Alibaba DAMO Academy) Link: https://lore.kernel.org/r/20250820152316.1012757-1-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 69aeb507312306f73495598a055293fa749d454e Author: Seungjin Bae Date: Fri Oct 17 15:36:31 2025 -0700 Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pegasus_parse_packet() function parses the packet without checking the allocated buffer size. This leads to an out-of-bounds memory access. Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver") Signed-off-by: Seungjin Bae Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ffff5c8fc2af2218a3332b3d5b97654599d50cde Author: Aleksander Jan Bajkowski Date: Thu Oct 16 21:22:52 2025 +0200 net: phy: realtek: fix rtl8221b-vm-cg name When splitting the RTL8221B-VM-CG into C22 and C45 variants, the name was accidentally changed to RTL8221B-VN-CG. This patch brings back the previous part number. Fixes: ad5ce743a6b0 ("net: phy: realtek: Add driver instances for rtl8221b via Clause 45") Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016192325.2306757-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit 902e81e679d86846a2404630d349709ad9372d0d Author: Ioana Ciornei Date: Thu Oct 16 16:58:07 2025 +0300 dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path The blamed commit increased the needed headroom to account for alignment. This means that the size required to always align a Tx buffer was added inside the dpaa2_eth_needed_headroom() function. By doing that, a manual adjustment of the pointer passed to PTR_ALIGN() was no longer correct since the 'buffer_start' variable was already pointing to the start of the skb's memory. The behavior of the dpaa2-eth driver without this patch was to drop frames on Tx even when the headroom was matching the 128 bytes necessary. Fix this by removing the manual adjust of 'buffer_start' from the PTR_MODE call. Closes: https://lore.kernel.org/netdev/70f0dcd9-1906-4d13-82df-7bbbbe7194c6@app.fastmail.com/T/#u Fixes: f422abe3f23d ("dpaa2-eth: increase the needed headroom to account for alignment") Signed-off-by: Ioana Ciornei Tested-by: Mathew McBride Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016135807.360978-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski commit e0caeb24f538c3c9c94f471882ceeb43d9dc2739 Author: Tonghao Zhang Date: Thu Oct 16 20:51:36 2025 +0800 net: bonding: update the slave array for broadcast mode This patch fixes ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad"). Before this commit, on the broadcast mode, all devices were traversed using the bond_for_each_slave_rcu. This patch supports traversing devices by using all_slaves. Therefore, we need to update the slave array when enslave or release slave. Fixes: ce7a381697cb ("net: bonding: add broadcast_neighbor option for 802.3ad") Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Reported-by: Jiri Slaby Tested-by: Jiri Slaby Link: https://lore.kernel.org/all/a97e6e1e-81bc-4a79-8352-9e4794b0d2ca@kernel.org/ Signed-off-by: Tonghao Zhang Reviewed-by: Hangbin Liu Reviewed-by: Nikolay Aleksandrov Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20251016125136.16568-1-tonghao@bamaicloud.com Signed-off-by: Jakub Kicinski commit cb74f8c952508bc85ec9583fa7da31c9b1440f26 Author: Bagas Sanjaya Date: Thu Oct 16 16:39:37 2025 +0700 Documentation: net: net_failover: Separate cloud-ifupdown-helper and reattach-vf.sh code blocks marker cloud-ifupdown-helper patch and reattach-vf.sh script are rendered in htmldocs output as normal paragraphs instead of literal code blocks due to missing separator from respective code block marker. Add it. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251016093936.29442-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit e59bc32df2e989f034623a580e30a2a72af33b3f Author: Wei Fang Date: Thu Oct 16 16:01:31 2025 +0800 net: enetc: correct the value of ENETC_RXB_TRUESIZE The ENETC RX ring uses the page halves flipping mechanism, each page is split into two halves for the RX ring to use. And ENETC_RXB_TRUESIZE is defined to 2048 to indicate the size of half a page. However, the page size is configurable, for ARM64 platform, PAGE_SIZE is default to 4K, but it could be configured to 16K or 64K. When PAGE_SIZE is set to 16K or 64K, ENETC_RXB_TRUESIZE is not correct, and the RX ring will always use the first half of the page. This is not consistent with the description in the relevant kernel doc and commit messages. This issue is invisible in most cases, but if users want to increase PAGE_SIZE to receive a Jumbo frame with a single buffer for some use cases, it will not work as expected, because the buffer size of each RX BD is fixed to 2048 bytes. Based on the above two points, we expect to correct ENETC_RXB_TRUESIZE to (PAGE_SIZE >> 1), as described in the comment. Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20251016080131.3127122-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 50bd33f6b3922a6b760aa30d409cae891cec8fb5 Author: Jianpeng Chang Date: Wed Oct 15 10:14:27 2025 +0800 net: enetc: fix the deadlock of enetc_mdio_lock After applying the workaround for err050089, the LS1028A platform experiences RCU stalls on RT kernel. This issue is caused by the recursive acquisition of the read lock enetc_mdio_lock. Here list some of the call stacks identified under the enetc_poll path that may lead to a deadlock: enetc_poll -> enetc_lock_mdio -> enetc_clean_rx_ring OR napi_complete_done -> napi_gro_receive -> enetc_start_xmit -> enetc_lock_mdio -> enetc_map_tx_buffs -> enetc_unlock_mdio -> enetc_unlock_mdio After enetc_poll acquires the read lock, a higher-priority writer attempts to acquire the lock, causing preemption. The writer detects that a read lock is already held and is scheduled out. However, readers under enetc_poll cannot acquire the read lock again because a writer is already waiting, leading to a thread hang. Currently, the deadlock is avoided by adjusting enetc_lock_mdio to prevent recursive lock acquisition. Fixes: 6d36ecdbc441 ("net: enetc: take the MDIO lock only once per NAPI poll cycle") Signed-off-by: Jianpeng Chang Acked-by: Wei Fang Link: https://patch.msgid.link/20251015021427.180757-1-jianpeng.chang.cn@windriver.com Signed-off-by: Jakub Kicinski commit f406055cb18c6e299c4a783fc1effeb16be41803 Merge: fe69107ec7d8b9 ea0d55ae4b3207 Author: Linus Torvalds Date: Fri Oct 17 13:04:21 2025 -1000 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Explicitly encode the XZR register if the value passed to write_sysreg_s() is 0. The GIC CDEOI instruction is encoded as a system register write with XZR as the source register. However, clang does not honour the "Z" register constraint, leading to incorrect code generation - Ensure the interrupts (DAIF.IF) are unmasked when completing single-step of a suspended breakpoint before calling exit_to_user_mode(). With pseudo-NMIs, interrupts are (additionally) masked at the PMR_EL1 register, handled by local_irq_*() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: debug: always unmask interrupts in el0_softstp() arm64/sysreg: Fix GIC CDEOI instruction encoding commit fe69107ec7d8b946ab413cfe118984dac8f1a0d8 Merge: 6f3b6e91f7201e 852947be66b826 Author: Linus Torvalds Date: Fri Oct 17 12:59:31 2025 -1000 Merge tag 'riscv-for-linux-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Disable CFI with Rust for any platform other than x86 and ARM64 - Keep task mm_cpumasks up-to-date to avoid triggering M-mode firmware warnings if the kernel tries to send an IPI to an offline CPU - Improve kprobe address validation performance and avoid desyncs (following x86) - Avoid duplicate device probes by avoiding DT hardware probing when ACPI is enabled in early boot - Use the correct set of dependencies for CONFIG_ARCH_HAS_ELF_CORE_EFLAGS, avoiding an allnoconfig warning - Fix a few other minor issues * tag 'riscv-for-linux-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: kprobes: convert one final __ASSEMBLY__ to __ASSEMBLER__ riscv: Respect dependencies of ARCH_HAS_ELF_CORE_EFLAGS riscv: acpi: avoid errors caused by probing DT devices when ACPI is used riscv: kprobes: Fix probe address validation riscv: entry: fix typo in comment 'instruciton' -> 'instruction' RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors riscv: kgdb: Ensure that BUFMAX > NUMREGBYTES rust: cfi: only 64-bit arm and x86 support CFI_CLANG commit cfec502b3d091ff7c24df6ccf8079470584315a0 Author: Danilo Krummrich Date: Thu Oct 16 15:31:44 2025 +0200 rust: device: fix device context of Device::parent() Regardless of the DeviceContext of a device, we can't give any guarantees about the DeviceContext of its parent device. This is very subtle, since it's only caused by a simple typo, i.e. Self::from_raw(parent) which preserves the DeviceContext in this case, vs. Device::from_raw(parent) which discards the DeviceContext. (I should have noticed it doing the correct thing in auxiliary::Device subsequently, but somehow missed it.) Hence, fix both Device::parent() and auxiliary::Device::parent(). Cc: stable@vger.kernel.org Fixes: a4c9f71e3440 ("rust: device: implement Device::parent()") Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Acked-by: Greg Kroah-Hartman Signed-off-by: Danilo Krummrich commit a1e83d4c0361f4b0e3b7ef8b603bf5e5ef60af86 Author: Brahmajit Das Date: Fri Oct 17 22:45:51 2025 +0530 selftests/bpf: Fix redefinition of 'off' as different kind of symbol This fixes the following build error CLNG-BPF [test_progs] verifier_global_ptr_args.bpf.o progs/verifier_global_ptr_args.c:228:5: error: redefinition of 'off' as different kind of symbol 228 | u32 off; | ^ The symbol 'off' was previously defined in tools/testing/selftests/bpf/tools/include/vmlinux.h, which includes an enum i40e_ptp_gpio_pin_state from drivers/net/ethernet/intel/i40e/i40e_ptp.c: enum i40e_ptp_gpio_pin_state { end = -2, invalid = -1, off = 0, in_A = 1, in_B = 2, out_A = 3, out_B = 4, }; This enum is included when CONFIG_I40E is enabled. As of commit 032676ff8217 ("LoongArch: Update Loongson-3 default config file"), CONFIG_I40E is set in the defconfig, which leads to the conflict. Renaming the local variable avoids the redefinition and allows the build to succeed. Suggested-by: Yonghong Song Signed-off-by: Brahmajit Das Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251017171551.53142-1-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 7c33e97a6ef5d84e98b892c3e00c6d1678d20395 Author: Sahil Chandna Date: Wed Oct 15 00:26:35 2025 +0530 bpf: Do not disable preemption in bpf_test_run(). The timer mode is initialized to NO_PREEMPT mode by default, this disables preemption and force execution in atomic context causing issue on PREEMPT_RT configurations when invoking spin_lock_bh(), leading to the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6107, name: syz.0.17 preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 Preemption disabled at: [] bpf_test_timer_enter+0xf8/0x140 net/bpf/test_run.c:42 Fix this, by removing NO_PREEMPT/NO_MIGRATE mode check. Also, the test timer context no longer needs explicit calls to migrate_disable()/migrate_enable() with rcu_read_lock()/rcu_read_unlock(). Use helpers rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate() instead. Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1f1fbecb9413cdbfbef8 Suggested-by: Yonghong Song Suggested-by: Menglong Dong Acked-by: Yonghong Song Tested-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com Co-developed-by: Brahmajit Das Signed-off-by: Brahmajit Das Signed-off-by: Sahil Chandna Link: https://lore.kernel.org/r/20251014185635.10300-1-chandna.sahil@gmail.com Signed-off-by: Alexei Starovoitov commit ea0d55ae4b3207c33691a73da3443b1fd379f1d2 Author: Ada Couprie Diaz Date: Tue Oct 14 10:25:36 2025 +0100 arm64: debug: always unmask interrupts in el0_softstp() We intend that EL0 exception handlers unmask all DAIF exceptions before calling exit_to_user_mode(). When completing single-step of a suspended breakpoint, we do not call local_daif_restore(DAIF_PROCCTX) before calling exit_to_user_mode(), leaving all DAIF exceptions masked. When pseudo-NMIs are not in use this is benign. When pseudo-NMIs are in use, this is unsound. At this point interrupts are masked by both DAIF.IF and PMR_EL1, and subsequent irq flag manipulation may not work correctly. For example, a subsequent local_irq_enable() within exit_to_user_mode_loop() will only unmask interrupts via PMR_EL1 (leaving those masked via DAIF.IF), and anything depending on interrupts being unmasked (e.g. delivery of signals) will not work correctly. This was detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING. Move the call to `try_step_suspended_breakpoints()` outside of the check so that interrupts can be unmasked even if we don't call the step handler. Fixes: 0ac7584c08ce ("arm64: debug: split single stepping exception entry") Cc: # 6.17 Signed-off-by: Ada Couprie Diaz Acked-by: Mark Rutland [catalin.marinas@arm.com: added Mark's rewritten commit log and some whitespace] Signed-off-by: Catalin Marinas commit e9ad390a4812fd60c1da46823f7a6f84f2411f0c Author: Lorenzo Pieralisi Date: Tue Oct 7 12:26:00 2025 +0200 arm64/sysreg: Fix GIC CDEOI instruction encoding The GIC CDEOI system instruction requires the Rt field to be set to 0b11111 otherwise the instruction behaviour becomes CONSTRAINED UNPREDICTABLE. Currenly, its usage is encoded as a system register write, with a constant 0 value: write_sysreg_s(0, GICV5_OP_GIC_CDEOI) While compiling with GCC, the 0 constant value, through these asm constraints and modifiers ('x' modifier and 'Z' constraint combo): asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); forces the compiler to issue the XZR register for the MSR operation (ie that corresponds to Rt == 0b11111) issuing the right instruction encoding. Unfortunately LLVM does not yet understand that modifier/constraint combo so it ends up issuing a different register from XZR for the MSR source, which in turns means that it encodes the GIC CDEOI instruction wrongly and the instruction behaviour becomes CONSTRAINED UNPREDICTABLE that we must prevent. Add a conditional to write_sysreg_s() macro that detects whether it is passed a constant 0 value and issues an MSR write with XZR as source register - explicitly doing what the asm modifier/constraint is meant to achieve through constraints/modifiers, fixing the LLVM compilation issue. Fixes: 7ec80fb3f025 ("irqchip/gic-v5: Add GICv5 PPI support") Suggested-by: Catalin Marinas Signed-off-by: Lorenzo Pieralisi Acked-by: Marc Zyngier Cc: stable@vger.kernel.org Cc: Sascha Bischoff Cc: Will Deacon Cc: Mark Rutland Cc: Marc Zyngier Reviewed-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 1fabe43b4e1a97597ec5d5ffcd2b7cf96e654b8f Author: Ting-Chang Hou Date: Thu Oct 16 15:53:51 2025 +0800 btrfs: send: fix duplicated rmdir operations when using extrefs Commit 29d6d30f5c8a ("Btrfs: send, don't send rmdir for same target multiple times") has fixed an issue that a send stream contained a rmdir operation for the same directory multiple times. After that fix we keep track of the last directory for which we sent a rmdir operation and compare with it before sending a rmdir for the parent inode of a deleted hardlink we are processing. But there is still a corner case that in between rmdir dir operations for the same inode we find deleted hardlinks for other parent inodes, so tracking just the last inode for which we sent a rmdir operation is not enough. Hardlinks of a file in the same directory are stored in the same INODE_REF item, but if the number of hardlinks is too large and can not fit in a leaf, we use INODE_EXTREF items to store them. The key of an INODE_EXTREF item is (inode_id, INODE_EXTREF, hash[name, parent ino]), so between two hardlinks for the same parent directory, we can find others for other parent directories. For example for the reproducer below we get the following (from a btrfs inspect-internal dump-tree output): item 0 key (259 INODE_EXTREF 2309449) itemoff 16257 itemsize 26 index 6925 parent 257 namelen 8 name: foo.6923 item 1 key (259 INODE_EXTREF 2311350) itemoff 16231 itemsize 26 index 6588 parent 258 namelen 8 name: foo.6587 item 2 key (259 INODE_EXTREF 2457395) itemoff 16205 itemsize 26 index 6611 parent 257 namelen 8 name: foo.6609 (...) So tracking the last directory's inode number does not work in this case since we process a link for parent inode 257, then for 258 and then back again for 257, and that second time we process a deleted link for 257 we think we have not yet sent a rmdir operation. Fix this by using a rbtree to keep track of all the directories for which we have already sent rmdir operations, and add those directories to the 'check_dirs' ref list in process_recorded_refs() only if the directory is not yet in the rbtree, otherwise skip it since it means we have already sent a rmdir operation for that directory. The following test script reproduces the problem: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT mkdir $MNT/a $MNT/b echo 123 > $MNT/a/foo for ((i = 1; i <= 1000; i++)); do ln $MNT/a/foo $MNT/a/foo.$i ln $MNT/a/foo $MNT/b/foo.$i done btrfs subvolume snapshot -r $MNT $MNT/snap1 btrfs send $MNT/snap1 -f /tmp/base.send rm -r $MNT/a $MNT/b btrfs subvolume snapshot -r $MNT $MNT/snap2 btrfs send -p $MNT/snap1 $MNT/snap2 -f /tmp/incremental.send umount $MNT mkfs.btrfs -f $DEV mount $DEV $MNT btrfs receive $MNT -f /tmp/base.send btrfs receive $MNT -f /tmp/incremental.send rm -f /tmp/base.send /tmp/incremental.send umount $MNT When running it, it fails like this: $ ./test.sh (...) At subvol snap1 At snapshot snap2 ERROR: rmdir o257-9-0 failed: No such file or directory CC: Reviewed-by: Filipe Manana Signed-off-by: Ting-Chang Hou [ Updated changelog ] Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 17679ac6df6c4830ba711835aa8cf961be36cfa1 Author: Dewei Meng Date: Thu Oct 16 14:10:11 2025 +0800 btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() If fs_info->super_copy or fs_info->super_for_commit allocated failed in btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info(). Otherwise btrfs_check_leaked_roots() would access NULL pointer because fs_info->allocated_roots had not been initialised. syzkaller reported the following information: ------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcount_read include/linux/refcount.h:170 [inline] RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace: btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097 vfs_get_tree+0x98/0x320 fs/super.c:1759 do_new_mount+0x357/0x660 fs/namespace.c:3899 path_mount+0x716/0x19c0 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount fs/namespace.c:4427 [inline] __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...] Fixes: 3bb17a25bcb0 ("btrfs: add get_tree callback for new mount API") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Dewei Meng Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f3b6e91f7201e248d83232538db14d30100e9c7 Merge: 0c8df15f758a69 18d6b1743eafeb Author: Linus Torvalds Date: Fri Oct 17 08:45:54 2025 -0700 Merge tag 'io_uring-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Revert of a change that went into an older kernel, and which has been reported to cause a regression for some write workloads on LVM while a snapshop is being created - Fix a regression from this merge window, where some compilers (and/or certain .config options) would cause an earlier evaluations of a dereference which would then cause a NULL pointer dereference. I was only able to reproduce this with OPTIMIZE_FOR_SIZE=y, but David Howells hit it with just KASAN enabled. Depending on how things inlined, this makes sense - Fix for a missing lock around a mem region unregistration - Fix for ring resizing with the same placement after resize * tag 'io_uring-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rw: check for NULL io_br_sel when putting a buffer io_uring: fix unexpected placement on same size resizing io_uring: protect mem region deregistration Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" commit 0fbbcab7f9082cdc233da5e5e353f69830f11956 Author: Randy Dunlap Date: Fri Oct 17 00:07:42 2025 -0700 cgroup/misc: fix misc_res_type kernel-doc warning Format the kernel-doc for SCALE_HW_CALIB_INVALID correctly to avoid a kernel-doc warning: Warning: include/linux/misc_cgroup.h:26 Enum value 'MISC_CG_RES_TDX' not described in enum 'misc_res_type' Fixes: 7c035bea9407 ("KVM: TDX: Register TDX host key IDs to cgroup misc controller") Signed-off-by: Randy Dunlap Signed-off-by: Tejun Heo commit 0c8df15f758a69a7bf88ecf9b7f95dc7db2c463c Merge: cf1ea8854e4fb1 f0624c6646435c Author: Linus Torvalds Date: Fri Oct 17 08:31:26 2025 -0700 Merge tag 'block-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - iostats accounting fixed on multipath retries (Amit) - secure concatenation response fixup (Martin) - tls partial record fixup (Wilfred) - Fix for a lockdep reported issue with the elevator lock and blk group frozen operations - Fix for a regression in this merge window, where updating 'nr_requests' would not do the right thing for queues with shared tags * tag 'block-6.18-20251016' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: nvme/tcp: handle tls partially sent records in write_space() block: Remove elevator_lock usage from blkg_conf frozen operations blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests() nvme-auth: update sc_c in host response nvme-multipath: Skip nr_active increments in RETRY disposition commit cf1ea8854e4fb1341c08f66e6c91da97d038ab6a Merge: 1422424187a548 7e8242405b94ce Author: Linus Torvalds Date: Fri Oct 17 08:22:20 2025 -0700 Merge tag 'mmc-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc cleanup from Ulf Hansson: "Move rpmb_frame struct and constants to rpmb common header This helps us to avoid sharing an immutable branch between our git trees. I was planning to send it before rc1, but I didn't make it" * tag 'mmc-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: rpmb: move rpmb_frame struct and constants to common header commit 1422424187a548c24825645410fb7f691c2df47f Merge: e96687c6d3b781 2a786348004b34 Author: Linus Torvalds Date: Fri Oct 17 08:20:10 2025 -0700 Merge tag 'sound-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All changes are rather boring device-specific fixes and quirks: - A few fixes for missing NULL checks - ASoC NAU8821 fixes for jack and irq handling - Various fixes for ASoC TAS2781, IDT821034, sc8280xp, max9809x, wcd938x, and SoundWire - Usual HD-audio and USB-audio quirks" * tag 'sound-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (27 commits) ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx ALSA: usb-audio: fix vendor quirk for Logitech H390 ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails ASoC: max98090/91: fixed max98091 ALSA widget powering up/down ASoC: dt-bindings: Add compatible string fsl,imx-audio-tlv320 ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls ASoC: sdw_utils: add rt1321 part id to codec_info_list ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 ASoC: nau8821: Avoid unnecessary blocking in IRQ handler ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit ASoC: nau8821: Consistently clear interrupts before unmasking ASoC: nau8821: Generalize helper to clear IRQ status ASoC: nau8821: Cancel jdet_work before handling jack ejection ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver ASoC: qcom: sc8280xp: Add support for QCS615 ... commit e96687c6d3b7814e6516dfa732946d3f40142819 Merge: 389dfd9db63840 62cab426d0e340 Author: Linus Torvalds Date: Fri Oct 17 08:16:58 2025 -0700 Merge tag 'drm-fixes-2025-10-17' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "As per usual xe/amdgpu are the leaders, with some i915 and then a bunch of scattered fixes. There are a bunch of stability fixes for some older amdgpu cards. draw: - Avoid color truncation gpuvm: - Avoid kernel-doc warning sched: - Avoid double free i915: - Skip GuC communication warning if reset is in progress - Couple frontbuffer related fixes - Deactivate PSR only on LNL and when selective fetch enabled xe: - Increase global invalidation timeout to handle some workloads - Fix NPD while evicting BOs in an array of VM binds - Fix resizable BAR to account for possibly needing to move BARs other than the LMEMBAR - Fix error handling in xe_migrate_init() - Fix atomic fault handling with mixed mappings or if the page is already in VRAM - Enable media samplers power gating for platforms before Xe2 - Fix de-registering exec queue from GuC when unbinding - Ensure data migration to system if indicated by madvise with SVM - Fix kerneldoc for kunit change - Always account for cacheline alignment on migration - Drop bogus assertion on eviction amdgpu: - Backlight fix - SI fixes - CIK fix - Make CE support debug only - IP discovery fix - Ring reset fixes - GPUVM fault memory barrier fix - Drop unused structures in amdgpu_drm.h - JPEG debugfs fix - VRAM handling fixes for GPUs without VRAM - GC 12 MES fixes amdkfd: - MES fix ast: - Fix display output after reboot bridge: - lt9211: Fix version check panthor: - Fix MCU suspend qaic: - Init bootlog in correct order - Treat remaining == 0 as error in find_and_map_user_pages() - Lock access to DBC request queue rockchip: - vop2: Fix destination size in atomic check" * tag 'drm-fixes-2025-10-17' of https://gitlab.freedesktop.org/drm/kernel: (44 commits) drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies drm/xe/evict: drop bogus assert drm/xe/migrate: don't misalign current bytes drm/xe/kunit: Fix kerneldoc for parameterized tests drm/xe/svm: Ensure data will be migrated to system if indicated by madvise. drm/gpuvm: Fix kernel-doc warning for drm_gpuvm_map_req.map drm/i915/psr: Deactivate PSR only on LNL and when selective fetch enabled drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off accel/qaic: Synchronize access to DBC request queue head & tail pointer accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() accel/qaic: Fix bootlog initialization ordering drm/rockchip: vop2: use correct destination rectangle height check drm/draw: fix color truncation in drm_draw_fill24 drm/xe/guc: Check GuC running state before deregistering exec queue drm/xe: Enable media sampler power gating drm/xe: Handle mixed mappings and existing VRAM on atomic faults drm/xe/migrate: Fix an error path drm/xe: Move rebar to be done earlier drm/xe: Don't allow evicting of BOs in same VM in array of VM binds drm/xe: Increase global invalidation timeout to 1000us ... commit 389dfd9db6384026fef50afdbf91bcc41446e032 Merge: 98ac9cc4b4452e 867537094124b0 Author: Linus Torvalds Date: Fri Oct 17 08:12:19 2025 -0700 Merge tag 'i2c-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - PM cleanup after all prerequisites are merged with rc1 - usbio: missing addition after all dependencies are in - slimpro: DT binding schema conversion * tag 'i2c-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: Convert apm,xgene-slimpro-i2c to DT schema i2c: usbio: Add ACPI device-id for MTL-CVF devices i2c: Remove redundant pm_runtime_mark_last_busy() calls commit 2a786348004b34c5f61235d51c40c1c718b1f8f9 Author: Dawn Gardner Date: Thu Oct 16 15:42:06 2025 -0300 ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx This laptop uses the ALC285 codec, fixed by enabling the ALC285_FIXUP_HP_MUTE_LED quirk Signed-off-by: Dawn Gardner Link: https://patch.msgid.link/20251016184218.31508-3-dawn.auroali@gmail.com Signed-off-by: Takashi Iwai commit a78835b86a4414230e4cf9a9f16d22302cdb8388 Author: Mario Limonciello (AMD) Date: Mon Oct 13 17:08:26 2025 -0500 PCI/VGA: Select SCREEN_INFO on X86 commit 337bf13aa9dda ("PCI/VGA: Replace vga_is_firmware_default() with a screen info check") introduced an implicit dependency upon SCREEN_INFO by removing the open coded implementation. If a user didn't have CONFIG_SCREEN_INFO set, vga_is_firmware_default() would now return false. SCREEN_INFO is only used on X86 so add a conditional select for SCREEN_INFO to ensure that the VGA arbiter works as intended. Fixes: 337bf13aa9dda ("PCI/VGA: Replace vga_is_firmware_default() with a screen info check") Reported-by: Eric Biggers Closes: https://lore.kernel.org/linux-pci/20251012182302.GA3412@sol/ Suggested-by: Thomas Zimmermann Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Zimmermann Reviewed-by: Ilpo Järvinen Tested-by: Eric Biggers Link: https://patch.msgid.link/20251013220829.1536292-1-superm1@kernel.org commit e433110eb5bf067f74d3d15c5fb252206c66ae0b Author: Inochi Amaoto Date: Tue Oct 14 09:46:07 2025 +0800 PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() Since commit 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") set callback irq_startup() and irq_shutdown() of the struct pci_msi[x]_template, __irq_startup() will always invokes irq_startup() callback instead of irq_enable() callback overridden in vmd_init_dev_msi_info(). This will not start the IRQ correctly. Also override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info(), so the irq_startup() can invoke the real logic. Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains") Reported-by: Kenneth Crudup Closes: https://lore.kernel.org/r/8a923590-5b3a-406f-a324-7bd1cf894d8f@panix.com/ Reported-by: Genes Lists Closes: https://lore.kernel.org/r/4b392af8847cc19720ffcd53865f60ab3edc56b3.camel@sapience.com Reported-by: Todd Brandt Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220658 Reported-by: Oliver Hartkopp Closes: https://lore.kernel.org/r/8d6887a5-60bc-423c-8f7a-87b4ab739f6a@hartkopp.net Reported-by: Hervé Signed-off-by: Inochi Amaoto Signed-off-by: Bjorn Helgaas Tested-by: Kenneth R. Crudup Tested-by: Genes Lists Tested-by: Oliver Hartkopp Tested-by: Todd Brandt Tested-by: Hervé Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251014014607.612586-1-inochiama@gmail.com commit 1d4e7d9f6b7e4e45ec8ca03ae1bbc6ae7165b6f0 Merge: 3a8660878839fa 3b63efa21bc6ac Author: Arnd Bergmann Date: Fri Oct 17 15:26:23 2025 +0200 Merge tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE QTEE fixes for v6.18 - Adds ARCH_QCOM dependency for the QTEE driver - Fixing return values for copy_from_user() failures - Guarding against potential off by one read * tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: QCOMTEE should depend on ARCH_QCOM tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails tee: qcom: prevent potential off by one read commit 4eabd0d8791eaf9a7b114ccbf56eb488aefe7b1f Author: Akash Goel Date: Fri Oct 17 11:29:22 2025 +0100 drm/panthor: Fix kernel panic on partial unmap of a GPU VA region This commit address a kernel panic issue that can happen if Userspace tries to partially unmap a GPU virtual region (aka drm_gpuva). The VM_BIND interface allows partial unmapping of a BO. Panthor driver pre-allocates memory for the new drm_gpuva structures that would be needed for the map/unmap operation, done using drm_gpuvm layer. It expected that only one new drm_gpuva would be needed on umap but a partial unmap can require 2 new drm_gpuva and that's why it ended up doing a NULL pointer dereference causing a kernel panic. Following dump was seen when partial unmap was exercised. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000078 Mem abort info: ESR = 0x0000000096000046 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000088a863000 [000000000000078] pgd=080000088a842003, p4d=080000088a842003, pud=0800000884bf5003, pmd=0000000000000000 Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] lr : panthor_gpuva_sm_step_remap+0x6c/0x330 [panthor] sp : ffff800085d43970 x29: ffff800085d43970 x28: ffff00080363e440 x27: ffff0008090c6000 x26: 0000000000000030 x25: ffff800085d439f8 x24: ffff00080d402000 x23: ffff800085d43b60 x22: ffff800085d439e0 x21: ffff00080abdb180 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000010 x17: 6e656c202c303030 x16: 3666666666646466 x15: 393d61766f69202c x14: 312d3d7361203a70 x13: 303030323d6e656c x12: ffff80008324bf58 x11: 0000000000000003 x10: 0000000000000002 x9 : ffff8000801a6a9c x8 : ffff00080360b300 x7 : 0000000000000000 x6 : 000000088aa35fc7 x5 : fff1000080000000 x4 : ffff8000842ddd30 x3 : 0000000000000001 x2 : 0000000100000000 x1 : 0000000000000001 x0 : 0000000000000078 Call trace: panthor_gpuva_sm_step_remap+0xe4/0x330 [panthor] op_remap_cb.isra.22+0x50/0x80 __drm_gpuvm_sm_unmap+0x10c/0x1c8 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xb4/0x3d0 [panthor] panthor_vm_bind_exec_sync_op+0x154/0x278 [panthor] panthor_ioctl_vm_bind+0x160/0x4a0 [panthor] drm_ioctl_kernel+0xbc/0x138 drm_ioctl+0x240/0x500 __arm64_sys_ioctl+0xb0/0xf8 invoke_syscall+0x4c/0x110 el0_svc_common.constprop.1+0x98/0xf8 do_el0_svc+0x24/0x38 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xc8 el0t_64_sync+0x174/0x178 Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Liviu Dudau Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20251017102922.670084-1-akash.goel@arm.com commit 1f1d3e1d094db732d22b892227bf1e1ac3a8ca04 Author: Miguel Ojeda Date: Fri Oct 17 00:57:54 2025 +0200 rust: bitmap: fix formatting We do our best to keep the repository `rustfmt`-clean, thus run the tool to fix the formatting issue. Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting Link: https://rust-for-linux.com/contributing#submit-checklist-addendum Fixes: 0f5878834d6c ("rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning") Reviewed-by: Burak Emir Signed-off-by: Miguel Ojeda commit c7fbb8218b4ad35fec0bd2256d2b9c8d60331f33 Author: Fernando Fernandez Mancera Date: Thu Oct 16 12:14:56 2025 +0200 sysfs: check visibility before changing group attribute ownership Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below: WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] Fix this by checking is_visible() before trying to touch the attribute. Fixes: 303a42769c4c ("sysfs: add sysfs_group{s}_change_owner()") Fixes: 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)") Reported-by: Cynthia Closes: https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab-d3f1-46d9-b9a0-048ab05eb09b-000000@eu-central-1.amazonses.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20251016101456.4087-1-fmancera@suse.de Signed-off-by: Greg Kroah-Hartman commit a91c8096590bd7801a26454789f2992094fe36da Author: Maarten Lankhorst Date: Wed Jul 23 16:24:16 2025 +0200 devcoredump: Fix circular locking dependency with devcd->mutex. The original code causes a circular locking dependency found by lockdep. ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U ------------------------------------------------------ xe_fault_inject/5091 is trying to acquire lock: ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660 but task is already holding lock: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&devcd->mutex){+.+.}-{3:3}: mutex_lock_nested+0x4e/0xc0 devcd_data_write+0x27/0x90 sysfs_kf_bin_write+0x80/0xf0 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (kn->active#236){++++}-{0:0}: kernfs_drain+0x1e2/0x200 __kernfs_remove+0xae/0x400 kernfs_remove_by_name_ns+0x5d/0xc0 remove_files+0x54/0x70 sysfs_remove_group+0x3d/0xa0 sysfs_remove_groups+0x2e/0x60 device_remove_attrs+0xc7/0x100 device_del+0x15d/0x3b0 devcd_del+0x19/0x30 process_one_work+0x22b/0x6f0 worker_thread+0x1e8/0x3d0 kthread+0x11c/0x250 ret_from_fork+0x26c/0x2e0 ret_from_fork_asm+0x1a/0x30 -> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}: __lock_acquire+0x1661/0x2860 lock_acquire+0xc4/0x2f0 __flush_work+0x27a/0x660 flush_delayed_work+0x5d/0xa0 dev_coredump_put+0x63/0xa0 xe_driver_devcoredump_fini+0x12/0x20 [xe] devm_action_release+0x12/0x30 release_nodes+0x3a/0x120 devres_release_all+0x8a/0xd0 device_unbind_cleanup+0x12/0x80 device_release_driver_internal+0x23a/0x280 device_driver_detach+0x14/0x20 unbind_store+0xaf/0xc0 drv_attr_store+0x21/0x50 sysfs_kf_write+0x4a/0x80 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&devcd->mutex); lock(kn->active#236); lock(&devcd->mutex); lock((work_completion)(&(&devcd->del_wk)->work)); *** DEADLOCK *** 5 locks held by xe_fault_inject/5091: #0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0 #1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220 #2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280 #3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0 #4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660 stack backtrace: CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)} Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021 Call Trace: dump_stack_lvl+0x91/0xf0 dump_stack+0x10/0x20 print_circular_bug+0x285/0x360 check_noncircular+0x135/0x150 ? register_lock_class+0x48/0x4a0 __lock_acquire+0x1661/0x2860 lock_acquire+0xc4/0x2f0 ? __flush_work+0x25d/0x660 ? mark_held_locks+0x46/0x90 ? __flush_work+0x25d/0x660 __flush_work+0x27a/0x660 ? __flush_work+0x25d/0x660 ? trace_hardirqs_on+0x1e/0xd0 ? __pfx_wq_barrier_func+0x10/0x10 flush_delayed_work+0x5d/0xa0 dev_coredump_put+0x63/0xa0 xe_driver_devcoredump_fini+0x12/0x20 [xe] devm_action_release+0x12/0x30 release_nodes+0x3a/0x120 devres_release_all+0x8a/0xd0 device_unbind_cleanup+0x12/0x80 device_release_driver_internal+0x23a/0x280 ? bus_find_device+0xa8/0xe0 device_driver_detach+0x14/0x20 unbind_store+0xaf/0xc0 drv_attr_store+0x21/0x50 sysfs_kf_write+0x4a/0x80 kernfs_fop_write_iter+0x169/0x220 vfs_write+0x293/0x560 ksys_write+0x72/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0xb60 ? __f_unlock_pos+0x15/0x20 ? __x64_sys_getdents64+0x9b/0x130 ? __pfx_filldir64+0x10/0x10 ? do_syscall_64+0x1a2/0xb60 ? clear_bhb_loop+0x30/0x80 ? clear_bhb_loop+0x30/0x80 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x76e292edd574 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574 RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063 R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000 xe 0000:03:00.0: [drm] Xe device coredump has been deleted. Fixes: 01daccf74832 ("devcoredump : Serialize devcd_del work") Cc: Mukesh Ojha Cc: Greg Kroah-Hartman Cc: Johannes Berg Cc: Rafael J. Wysocki Cc: Danilo Krummrich Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Maarten Lankhorst Cc: Matthew Brost Acked-by: Mukesh Ojha Link: https://lore.kernel.org/r/20250723142416.1020423-1-dev@lankhorst.se Signed-off-by: Greg Kroah-Hartman commit 74b84d1be0220b99405c16a4a3e1e503e3bd8387 Author: Ulf Hansson Date: Tue Oct 7 11:43:12 2025 +0200 driver core: fw_devlink: Don't warn about sync_state() pending Due to the wider deployment of the ->sync_state() support, for PM domains for example, we are receiving reports about the sync_state() pending message that is being logged in fw_devlink_dev_sync_state(). In particular as it's printed at the warning level, which is questionable. Even if it certainly is useful to know that the ->sync_state() condition could not be met, there may be nothing wrong with it. For example, a driver may be built as module and are still waiting to be initialized/probed. For this reason let's move to the info level for now. Reported-by: Geert Uytterhoeven Reported-by: Sebin Francis Reported-by: Diederik de Haas Reported-by: Jon Hunter Reviewed-by: Tomi Valkeinen Signed-off-by: Ulf Hansson Reviewed-by: Dhruva Gole Reviewed-by: Sebastian Reichel Reviewed-by: Kevin Hilman Acked-by: Saravana Kannan Reviewed-by: Sebin Francis Tested-by: Sebin Francis Signed-off-by: Greg Kroah-Hartman commit 873f10cf8e4d59605bc38fa1051dea8ee56fe3be Author: Fangyu Yu Date: Thu Oct 16 09:26:59 2025 +0800 RISC-V: KVM: Read HGEIP CSR on the correct cpu When executing kvm_riscv_vcpu_aia_has_interrupts, the vCPU may have migrated and the IMSIC VS-file have not been updated yet, currently the HGEIP CSR should be read from the imsic->vsfile_cpu ( the pCPU before migration ) via on_each_cpu_mask, but this will trigger an IPI call and repeated IPI within a period of time is expensive in a many-core systems. Just let the vCPU execute and update the correct IMSIC VS-file via kvm_riscv_vcpu_aia_imsic_update may be a simple solution. Fixes: 4cec89db80ba ("RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization") Signed-off-by: Fangyu Yu Reviewed-by: Guo Ren Reviewed-by: Anup Patel Tested-by: Anup Patel Link: https://lore.kernel.org/r/20251016012659.82998-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit a429b76114aaca3ef1aff4cd469dcf025431bd11 Author: Gao Xiang Date: Sun Oct 12 21:59:25 2025 +0800 erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupted images that can cause system crashes, which are related to the new encoded extents introduced in Linux 6.15: - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent special extents such as sparse extents (!EROFS_MAP_MAPPED), but previously only plen == 0 was handled; - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000, then "cur [0xfffffffffffff000] += bvec.bv_len [0x1000]" in "} while ((cur += bvec.bv_len) < end);" wraps around, causing an out-of-bound access of pcl->compressed_bvecs[] in z_erofs_submit_queue(). EROFS only supports 48-bit physical block addresses (up to 1EiB for 4k blocks), so add a sanity check to enforce this. Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Reported-by: Robert Morris Closes: https://lore.kernel.org/r/75022.1759355830@localhost [1] Closes: https://lore.kernel.org/r/80524.1760131149@localhost [2] Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit 85893094535cced32b33766e283240164a5b11f8 Author: Tao Ren Date: Wed Oct 15 13:48:37 2025 -0700 ARM: dts: aspeed: fuji-data64: Enable mac3 controller "mac3" controller was removed from the initial version of fuji-data64 dts because the rgmii setting is incorrect, but dropping mac3 leads to regression in the existing fuji platform, because fuji.dts simply includes fuji-data64.dts. This patch adds mac3 back to fuji-data64.dts to fix the fuji regression[1], and rgmii settings need to be fixed later. Fixes: b0f294fdfc3e ("ARM: dts: aspeed: facebook-fuji: Include facebook-fuji-data64.dts") Link: https://lore.kernel.org/all/79ddc7b9-ef26-4959-9a16-aa4e006eb145@roeck-us.net/ [1] Signed-off-by: Tao Ren Reviewed-by: Andrew Lunn Signed-off-by: Andrew Jeffery commit 7f864458e9a6d2000b726d14b3d3a706ac92a3b0 Author: Sebastian Reichel Date: Tue Oct 14 17:49:34 2025 +0200 net: stmmac: dwmac-rk: Fix disabling set_clock_selection On all platforms set_clock_selection() writes to a GRF register. This requires certain clocks running and thus should happen before the clocks are disabled. This has been noticed on RK3576 Sige5, which hangs during system suspend when trying to suspend the second network interface. Note, that suspending the first interface works, because the second device ensures that the necessary clocks for the GRF are enabled. Cc: stable@vger.kernel.org Fixes: 2f2b60a0ec28 ("net: ethernet: stmmac: dwmac-rk: Add gmac support for rk3588") Signed-off-by: Sebastian Reichel Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251014-rockchip-network-clock-fix-v1-1-c257b4afdf75@collabora.com Signed-off-by: Jakub Kicinski commit 62cab426d0e340cd38893227c279705cc9e8416a Merge: d6dd930a6b3d17 225bc03d85427e Author: Dave Airlie Date: Fri Oct 17 09:39:34 2025 +1000 Merge tag 'drm-xe-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Increase global invalidation timeout to handle some workloads (Kenneth Graunke) - Fix NPD while evicting BOs in an array of VM binds (Matthew Brost) - Fix resizable BAR to account for possibly needing to move BARs other than the LMEMBAR (Lucas De Marchi) - Fix error handling in xe_migrate_init() (Thomas Hellström) - Fix atomic fault handling with mixed mappings or if the page is already in VRAM (Matthew Brost) - Enable media samplers power gating for platforms before Xe2 (Vinay Belgaumkar) - Fix de-registering exec queue from GuC when unbinding (Matthew Brost) - Ensure data migration to system if indicated by madvise with SVM (Thomas Hellström) - Fix kerneldoc for kunit change (Matt Roper) - Always account for cacheline alignment on migration (Matthew Auld) - Drop bogus assertion on eviction (Matthew Auld) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/rch735eqkmprfyutk3ux2fsqa3e5ve4p77w7a5j66qdpgyquxr@ao3wzcqtpn6s commit d6dd930a6b3d177cda9aa8dfdcc6b2c7dda4d78a Merge: 520133b0ba97fb 5801e65206b065 Author: Dave Airlie Date: Fri Oct 17 07:10:24 2025 +1000 Merge tag 'drm-misc-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: ast: - Fix display output after reboot bridge: - lt9211: Fix version check core: - draw: Avoid color truncation - gpuvm: Avoid kernel-doc warning - sched: Avoid double free panthor: - Fix MCU suspend qaic: - Init bootlog in correct order - Treat remaining == 0 as error in find_and_map_user_pages() - Lock access to DBC request queue rockchip: - vop2: Fix destination size in atomic check Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251016141607.GA73919@linux.fritz.box commit bf29555f5bdc017bac22ca66fcb6c9f46ec8788f Author: Johannes Wiesböck Date: Wed Oct 15 22:15:43 2025 +0200 rtnetlink: Allow deleting FDB entries in user namespace Creating FDB entries is possible from a non-initial user namespace when having CAP_NET_ADMIN, yet, when deleting FDB entries, processes receive an EPERM because the capability is always checked against the initial user namespace. This restricts the FDB management from unprivileged containers. Drop the netlink_capable check in rtnl_fdb_del as it was originally dropped in c5c351088ae7 and reintroduced in 1690be63a27b without intention. This patch was tested using a container on GyroidOS, where it was possible to delete FDB entries from an unprivileged user namespace and private network namespace. Fixes: 1690be63a27b ("bridge: Add vlan support to static neighbors") Reviewed-by: Michael Weiß Tested-by: Harshal Gohel Signed-off-by: Johannes Wiesböck Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251015201548.319871-1-johannes.wiesboeck@aisec.fraunhofer.de Signed-off-by: Jakub Kicinski commit 32f072d9eaf9c31c2b0527a4a3370570a731e3cc Author: Miguel Ojeda Date: Fri Oct 10 19:43:51 2025 +0200 rust: cpufreq: fix formatting We do our best to keep the repository `rustfmt`-clean, thus run the tool to fix the formatting issue. Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting Link: https://rust-for-linux.com/contributing#submit-checklist-addendum Fixes: f97aef092e19 ("cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency") Acked-by: Viresh Kumar Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 8a7c601e14576a22c2bbf7f67455ccf3f3d2737f Author: Miguel Ojeda Date: Fri Oct 10 19:43:50 2025 +0200 rust: alloc: employ a trailing comment to keep vertical layout Apply the formatting guidelines introduced in the previous commit to make the file `rustfmt`-clean again. Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 4a9cb2eecc78fa9d388481762dd798fa770e1971 Author: Miguel Ojeda Date: Fri Oct 10 19:43:49 2025 +0200 docs: rust: add section on imports formatting `rustfmt`, by default, formats imports in a way that is prone to conflicts while merging and rebasing, since in some cases it condenses several items into the same line. For instance, Linus mentioned [1] that the following case: use crate::{ fmt, page::AsPageIter, }; is compressed by `rustfmt` into: use crate::{fmt, page::AsPageIter}; which is undesirable. Similarly, `rustfmt` may put several items in the same line even if the braces span already multiple lines, e.g.: use kernel::{ acpi, c_str, device::{property, Core}, of, platform, }; The options that control the formatting behavior around imports are generally unstable, and `rustfmt` releases do not allow to use nightly features, unlike the compiler and other Rust tooling [2]. For the moment, we can introduce a workaround to prevent `rustfmt` from compressing the example above -- the "trailing empty comment": use crate::{ fmt, page::AsPageIter, // }; which is reminiscent of the trailing comma behavior in other formatters. We already used empty comments for formatting purposes in the past, e.g. in commit b9b701fce49a ("rust: clarify the language unstable features in use"). In addition, `rustfmt` actually reformats with a vertical layout (i.e. it does not put two items in the same line) when seeing such a comment, i.e. it doesn't just preserve the formatting, which is good in the sense that we can use it to easily reformat some imports, since it matches the style we generally want to have. A Git merge driver would help (suggested by Gary and Wedson), though maintainers would need to set it up, the diffs would still be larger and the formatting rules for imports would remain hard to predict. Thus document the style that we will follow in the coding guidelines by introducing a new section and explain how the trailing empty comment works there too. We discussed the issue with upstream Rust in our usual Rust <-> Rust for Linux meeting [3], and there have also been a few other discussions in parallel in issues [4][5] and Zulip [6]. We will see what happens, but upstream Rust has already created a subteam of `rustfmt` to try to overcome the bandwidth issue [7], which is a good signal, and some organization work has already started (e.g. tracking issues). We will continue our discussions with them about it. Cc: Caleb Cartwright Cc: Yacin Tmimi Cc: Manish Goregaokar Cc: Deadbeef Cc: Cameron Steffen Cc: Jieyou Xu Link: https://lore.kernel.org/all/CAHk-=wgO7S_FZUSBbngG5vtejWOpzDfTTBkVvP3_yjJmFddbzA@mail.gmail.com/ [1] Link: https://github.com/rust-lang/rustfmt/issues/4884 [2] Link: https://hackmd.io/iSCyY3JTTz-g8YM-nnzTTA [3] Link: https://github.com/rust-lang/rustfmt/issues/4991 [4] Link: https://github.com/rust-lang/rustfmt/issues/3361 [5] Link: https://rust-lang.zulipchat.com/#narrow/channel/392734-council/topic/rustfmt.20maintenance/near/543815381 [6] Link: https://github.com/rust-lang/team/pull/2017 [7] Reviewed-by: Benno Lossin Signed-off-by: Miguel Ojeda commit 1b0124ad5039678a9dfafb6aafef6f430a246b91 Author: Bagas Sanjaya Date: Wed Oct 15 16:25:41 2025 +0700 net: rmnet: Fix checksum offload header v5 and aggregation packet formatting Packet format for checksum offload header v5 and aggregation, and header type table for the former, are shown in normal paragraphs instead. Use appropriate markup. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251015092540.32282-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 5348d6312446929edabced02bd6438bfe5220e31 Author: Cosmin Ratiu Date: Wed Oct 15 10:05:23 2025 +0300 net/mlx5e: psp, avoid 'accel' NULL pointer dereference The 'accel' parameter of mlx5e_txwqe_build_eseg_csum() and the similar 'state' parameter of mlx5e_accel_tx_ids_len() were NULL when called from mlx5i_sq_xmit() and were causing kernel panics from that context. Fix that by passing in a local empty mlx5e_accel_tx_state variable, thus guaranteeing that 'accel' is never NULL. Also remove an unnecessary check from mlx5e_tx_wqe_inline_mode(). Fixes: e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1760511923-890650-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d0d3e9c2867b32c9c70e39e74b9425871cf0042a Author: Eric Dumazet Date: Wed Oct 15 06:32:21 2025 +0000 net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb() Some network drivers assume this field is zero after napi_get_frags(). We must clear it in napi_reuse_skb() otherwise the following can happen: 1) A packet is received, and skb_shinfo(skb)->hwtstamps is populated because a bit in the receive descriptor announced hwtstamp availability for this packet. 2) Packet is given to gro layer via napi_gro_frags(). 3) Packet is merged to a prior one held in GRO queues. 4) skb is saved after some cleanup in napi->skb via a call to napi_reuse_skb(). 5) Next packet is received 10 seconds later, gets the recycled skb from napi_get_frags(). 6) The receive descriptor does not announce hwtstamp availability. Driver does not clear shinfo->hwtstamps. 7) We have in shinfo->hwtstamps an old timestamp. Fixes: ac45f602ee3d ("net: infrastructure for hardware time stamping") Signed-off-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251015063221.4171986-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit aaf043a5688114703ae2c1482b92e7e0754d684e Author: Nathan Chancellor Date: Tue Oct 14 13:46:49 2025 -0700 net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() When building with Clang 20 or newer, there are some objtool warnings from unexpected fallthroughs to other functions: vmlinux.o: warning: objtool: mlx5e_mpwrq_mtts_per_wqe() falls through to next function mlx5e_mpwrq_max_num_entries() vmlinux.o: warning: objtool: mlx5e_mpwrq_max_log_rq_size() falls through to next function mlx5e_get_linear_rq_headroom() LLVM 20 contains an (admittedly problematic [1]) optimization [2] to convert divide by zero into the equivalent of __builtin_unreachable(), which invokes undefined behavior and destroys code generation when it is encountered in a control flow graph. mlx5e_mpwrq_umr_entry_size() returns 0 in the default case of an unrecognized mlx5e_mpwrq_umr_mode value. mlx5e_mpwrq_mtts_per_wqe(), which is inlined into mlx5e_mpwrq_max_log_rq_size(), uses the result of mlx5e_mpwrq_umr_entry_size() in a divide operation without checking for zero, so LLVM is able to infer there will be a divide by zero in this case and invokes undefined behavior. While there is some proposed work to isolate this undefined behavior and avoid the destructive code generation that results in these objtool warnings, code should still be defensive against divide by zero. As the WARN_ONCE() implies that an invalid value should be handled gracefully, return 1 instead of 0 in the default case so that the results of this division operation is always valid. Fixes: 168723c1f8d6 ("net/mlx5e: xsk: Use umr_mode to calculate striding RQ parameters") Link: https://lore.kernel.org/CAGG=3QUk8-Ak7YKnRziO4=0z=1C_7+4jF+6ZeDQ9yF+kuTOHOQ@mail.gmail.com/ [1] Link: https://github.com/llvm/llvm-project/commit/37932643abab699e8bb1def08b7eb4eae7ff1448 [2] Closes: https://github.com/ClangBuiltLinux/linux/issues/2131 Closes: https://github.com/ClangBuiltLinux/linux/issues/2132 Signed-off-by: Nathan Chancellor Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20251014-mlx5e-avoid-zero-div-from-mlx5e_mpwrq_umr_entry_size-v1-1-dc186b8819ef@kernel.org Signed-off-by: Jakub Kicinski commit 75cea9860aa6b2350d90a8d78fed114d27c7eca2 Author: Michal Pecio Date: Tue Oct 14 20:35:28 2025 +0200 net: usb: rtl8150: Fix frame padding TX frames aren't padded and unknown memory is sent into the ether. Theoretically, it isn't even guaranteed that the extra memory exists and can be sent out, which could cause further problems. In practice, I found that plenty of tailroom exists in the skb itself (in my test with ping at least) and skb_padto() easily succeeds, so use it here. In the event of -ENOMEM drop the frame like other drivers do. The use of one more padding byte instead of a USB zero-length packet is retained to avoid regression. I have a dodgy Etron xHCI controller which doesn't seem to support sending ZLPs at all. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Michal Pecio Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251014203528.3f9783c4.michal.pecio@gmail.com Signed-off-by: Jakub Kicinski commit 520133b0ba97fbc4b2b92daa66fed9b279550021 Merge: f69f31e5a7b885 079ae5118e1f0d Author: Dave Airlie Date: Fri Oct 17 06:57:44 2025 +1000 Merge tag 'amd-drm-fixes-6.18-2025-10-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.18-2025-10-16: amdgpu: - Backlight fix - SI fixes - CIK fix - Make CE support debug only - IP discovery fix - Ring reset fixes - GPUVM fault memory barrier fix - Drop unused structures in amdgpu_drm.h - JPEG debugfs fix - VRAM handling fixes for GPUs without VRAM - GC 12 MES fixes amdkfd: - MES fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20251016132224.2534946-1-alexander.deucher@amd.com commit f69f31e5a7b885c7953a165a56f351e7b4e9e613 Merge: 3a8660878839fa 95355766e5871e Author: Dave Airlie Date: Fri Oct 17 06:46:14 2025 +1000 Merge tag 'drm-intel-fixes-2025-10-16' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Skip GuC communication warning if reset is in progress (Zhanjun) - Couple frontbuffer related fixes (Ville) - Deactivate PSR only on LNL and when selective fetch enabled (Jouni) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aPDoguxlhXlvjNAi@intel.com commit f0624c6646435c1b56652193cce3e34062d50e3f Merge: 08823e89e3e269 5a869d01779339 Author: Jens Axboe Date: Thu Oct 16 13:25:40 2025 -0600 Merge tag 'nvme-6.18-2025-10-16' of git://git.infradead.org/nvme into block-6.18 Pull NVMe fixes from Keith: "- iostats accounting fixed on multipath retries (Amit) - secure concatenation response fixup (Martin) - tls partial record fixup (Wilfred)" * tag 'nvme-6.18-2025-10-16' of git://git.infradead.org/nvme: nvme/tcp: handle tls partially sent records in write_space() nvme-auth: update sc_c in host response nvme-multipath: Skip nr_active increments in RETRY disposition commit a3c4a0a42e61aad1056a3d33fd603c1ae66d4288 Author: Emil Tsalapatis Date: Thu Oct 16 11:11:26 2025 -0700 sched_ext: fix flag check for deferred callbacks When scheduling the deferred balance callbacks, check SCX_RQ_BAL_CB_PENDING instead of SCX_RQ_BAL_PENDING. This way schedule_deferred() properly tests whether there is already a pending request for queue_balance_callback() to be invoked at the end of .balance(). Fixes: a8ad873113d3 ("sched_ext: defer queue_balance_callback() until after ops.dispatch") Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 5a869d017793399fd1d2609ff27e900534173eb3 Author: Wilfred Mallawa Date: Fri Oct 10 17:19:42 2025 +1000 nvme/tcp: handle tls partially sent records in write_space() With TLS enabled, records that are encrypted and appended to TLS TX list can fail to see a retry if the underlying TCP socket is busy, for example, hitting an EAGAIN from tcp_sendmsg_locked(). This is not known to the NVMe TCP driver, as the TLS layer successfully generated a record. Typically, the TLS write_space() callback would ensure such records are retried, but in the NVMe TCP Host driver, write_space() invokes nvme_tcp_write_space(). This causes a partially sent record in the TLS TX list to timeout after not being retried. This patch fixes the above by calling queue->write_space(), which calls into the TLS layer to retry any pending records. Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") Signed-off-by: Wilfred Mallawa Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit ec2e0fb07d789976c601bec19ecced7a501c3705 Merge: c6fceaf166479c f1a450f9e17d34 Author: Takashi Iwai Date: Thu Oct 16 20:14:24 2025 +0200 Merge tag 'asoc-fix-v6.18-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A moderately large collection of driver specific fixes, plus a few new quirks and device IDs. The NAU8821 changes are a little large but more in mechanical ways than in ways that are complex. commit 98ac9cc4b4452ed7e714eddc8c90ac4ae5da1a09 Merge: 9f388a653c8a48 9d5c4f5c7a2c76 Author: Linus Torvalds Date: Thu Oct 16 10:58:49 2025 -0700 Merge tag 'f2fs-fix-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fixes from Jaegeuk Kim: - fix soft lockupg caused by iput() added in bc986b1d756482a ("fs: stop accessing ->i_count directly in f2fs and gfs2") - fix a wrong block address map on multiple devices Link: https://lore.kernel.org/oe-lkp/202509301450.138b448f-lkp@intel.com [1] * tag 'f2fs-fix-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: fix wrong block mapping for multi-devices f2fs: don't call iput() from f2fs_drop_inode() commit f6fddc6df3fc0cffce329b87927db4eb5989728d Author: Shardul Bankar Date: Thu Oct 16 12:03:30 2025 +0530 bpf: Fix memory leak in __lookup_instance error path When __lookup_instance() allocates a func_instance structure but fails to allocate the must_write_set array, it returns an error without freeing the previously allocated func_instance. This causes a memory leak of 192 bytes (sizeof(struct func_instance)) each time this error path is triggered. Fix by freeing 'result' on must_write_set allocation failure. Fixes: b3698c356ad9 ("bpf: callchain sensitive stack liveness tracking using CFG") Reported-by: BPF Runtime Fuzzer (BRF) Signed-off-by: Shardul Bankar Signed-off-by: Martin KaFai Lau Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20251016063330.4107547-1-shardulsb08@gmail.com commit 9f388a653c8a481cbdbdedca081a1f9f3ba204a2 Merge: 05de41f3e26237 8aec9dbf2db2e9 Author: Linus Torvalds Date: Thu Oct 16 10:22:38 2025 -0700 Merge tag 'for-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - in tree-checker fix extref bounds check - reorder send context structure to avoid -Wflex-array-member-not-at-end warning - fix extent readahead length for compressed extents - fix memory leaks on error paths (qgroup assign ioctl, zone loading with raid stripe tree enabled) - fix how device specific mount options are applied, in particular the 'ssd' option will be set unexpectedly - fix tracking of relocation state when tasks are running and cancellation is attempted - adjust assertion condition for folios allocated for scrub - remove incorrect assertion checking for block group when populating free space tree * tag 'for-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: send: fix -Wflex-array-member-not-at-end warning in struct send_ctx btrfs: tree-checker: fix bounds check in check_inode_extref() btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST btrfs: fix incorrect readahead expansion length btrfs: do not assert we found block group item when creating free space tree btrfs: do not use folio_test_partial_kmap() in ASSERT()s btrfs: only set the device specific options after devices are opened btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running commit 05de41f3e26237bc34822268f958be1820bf968b Merge: 634ec1fc7982ef 88f170814fea74 Author: Linus Torvalds Date: Thu Oct 16 10:16:41 2025 -0700 Merge tag 'v6.18-rc1-smb-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix RPC hang due to locking bug - Fix for memory leak in read and refcount leak (in session setup) - Minor cleanup * tag 'v6.18-rc1-smb-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix recursive locking in RPC handle list access smb/server: fix possible refcount leak in smb2_sess_setup() smb/server: fix possible memory leak in smb2_read() smb: server: Use common error handling code in smb_direct_rdma_xmit() commit 634ec1fc7982efeeeeed4a7688b0004827b43a21 Merge: ef25485516b09d 6de1dec1c166c7 Author: Linus Torvalds Date: Thu Oct 16 09:41:21 2025 -0700 Merge tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from CAN Current release - regressions: - udp: do not use skb_release_head_state() before skb_attempt_defer_free() - gro_cells: use nested-BH locking for gro_cell - dpll: zl3073x: increase maximum size of flash utility Previous releases - regressions: - core: fix lockdep splat on device unregister - tcp: fix tcp_tso_should_defer() vs large RTT - tls: - don't rely on tx_work during send() - wait for pending async decryptions if tls_strp_msg_hold fails - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler - eth: lan78xx: fix lost EEPROM write timeout in lan78xx_write_raw_eeprom Previous releases - always broken: - ip6_tunnel: prevent perpetual tunnel growth - dpll: zl3073x: handle missing or corrupted flash configuration - can: m_can: fix pm_runtime and CAN state handling - eth: - ixgbe: fix too early devlink_free() in ixgbe_remove() - ixgbevf: fix mailbox API compatibility - gve: Check valid ts bit on RX descriptor before hw timestamping - idpf: cleanup remaining SKBs in PTP flows - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H" * tag 'net-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits) udp: do not use skb_release_head_state() before skb_attempt_defer_free() net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset netdevsim: set the carrier when the device goes up selftests: tls: add test for short splice due to full skmsg selftests: net: tls: add tests for cmsg vs MSG_MORE tls: don't rely on tx_work during send() tls: wait for pending async decryptions if tls_strp_msg_hold fails tls: always set record_type in tls_process_cmsg tls: wait for async encrypt in case of error during latter iterations of sendmsg tls: trim encrypted message to match the plaintext on short splice tg3: prevent use of uninitialized remote_adv and local_adv variables MAINTAINERS: new entry for IPv6 IOAM gve: Check valid ts bit on RX descriptor before hw timestamping net: core: fix lockdep splat on device unregister MAINTAINERS: add myself as maintainer for b53 selftests: net: check jq command is supported net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit() tcp: fix tcp_tso_should_defer() vs large RTT r8152: add error handling in rtl8152_driver_init usbnet: Fix using smp_processor_id() in preemptible code warnings ... commit ef25485516b09db57493f5e78b3358db7cbdcaa0 Merge: 7ea30958b3054f 12d724f2852d09 Author: Linus Torvalds Date: Thu Oct 16 09:39:29 2025 -0700 Merge tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - Do not print an error message (and assume that the General Purpose Log Directory log page is not supported) for a device that reports a bogus General Purpose Logging Version. Unsurprisingly, many vendors fail to report the only valid General Purpose Logging Version (Damien) * tag 'ata-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: relax checks in ata_read_log_directory() commit 0c1999ed33722f85476a248186d6e0eb2bf3dd2a Author: Xing Guo Date: Thu Oct 16 11:53:30 2025 +0800 selftests: arg_parsing: Ensure data is flushed to disk before reading. test_parse_test_list_file writes some data to /tmp/bpf_arg_parsing_test.XXXXXX and parse_test_list_file() will read the data back. However, after writing data to that file, we forget to call fsync() and it's causing testing failure in my laptop. This patch helps fix it by adding the missing fsync() call. Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") Signed-off-by: Xing Guo Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251016035330.3217145-1-higuoxing@gmail.com commit ed80cc4667ac997b84546e6d35f0a0ae525d239c Author: Stuart Hayhurst Date: Mon Oct 6 02:05:49 2025 +0100 HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL The Logitech G502 Hero Wireless's high resolution scrolling resets after being unplugged without notifying the driver, causing extremely slow scrolling. The only indication of this is a battery update packet, so add a quirk to detect when the device is unplugged and re-enable the scrolling. Link: https://bugzilla.kernel.org/show_bug.cgi?id=218037 Signed-off-by: Stuart Hayhurst Signed-off-by: Jiri Kosina commit c700e7279b29948f5d2aee30df2dbd3124df3b9c Author: Alok Tiwari Date: Fri Oct 10 10:31:41 2025 -0700 drm/rockchip: dw_hdmi: use correct SCLIN mask for RK3228 In dw_hdmi_rk3228_setup_hpd(), the SCLIN mask incorrectly references the RK3328 variant. This change updates it to the RK3228-specific mask RK3228_HDMI_SCLIN_MSK using FIELD_PREP_WM16, ensuring proper HPD and I2C pin configuration for RK3228. Change: RK3328_HDMI_SCLIN_MSK -> RK3228_HDMI_SCLIN_MSK Fixes: 63df37f3fc71 ("drm/rockchip: dw_hdmi: switch to FIELD_PREP_WM16* macros") Signed-off-by: Alok Tiwari Reviewed-by: Nicolas Frattaroli Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251010173143.72733-1-alok.a.tiwari@oracle.com commit 7f9335f2d99815199d9d8d8e6687e68989728ce3 Author: Vignesh Raman Date: Mon Oct 13 11:32:10 2025 +0530 drm/ci: disable broken MR check in sanity job GitLab recently changed the required permissions for the are-developers-allowed-to-push-to-my-MR check: https://gitlab.freedesktop.org/freedesktop/ci-templates/-/issues/81 Until that’s resolved, disable the check - it’s mostly obsolete anyway. Based on https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/37782 Signed-off-by: Vignesh Raman Reviewed-by: Daniel Stone Patchwork: https://patchwork.freedesktop.org/patch/680263/ Message-ID: <20251013060212.14583-1-vignesh.raman@collabora.com> Signed-off-by: Rob Clark commit 86404a9e3013d814a772ac407573be5d3cd4ee0d Author: Anna Maniscalco Date: Sat Oct 11 15:45:10 2025 +0200 drm/msm: make sure last_fence is always updated Update last_fence in the vm-bind path instead of kernel managed path. last_fence is used to wait for work to finish in vm_bind contexts but not used for kernel managed contexts. This fixes a bug where last_fence is not waited on context close leading to faults as resources are freed while in use. Fixes: 92395af63a99 ("drm/msm: Add VM_BIND submitqueue") Signed-off-by: Anna Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/680080/ Message-ID: <20251011-close_fence_wait_fix-v3-1-5134787755ff@gmail.com> Signed-off-by: Rob Clark commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 Author: Akhil P Oommen Date: Thu Sep 11 02:14:05 2025 +0530 drm/msm/a6xx: Fix GMU firmware parser Current parser logic for GMU firmware assumes a dword aligned payload size for every block. This is not true for all GMU firmwares. So, fix this by using correct 'size' value in the calculation for the offset for the next block's header. Fixes: c6ed04f856a4 ("drm/msm/a6xx: A640/A650 GMU firmware path") Signed-off-by: Akhil P Oommen Acked-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/674040/ Message-ID: <20250911-assorted-sept-1-v2-2-a8bf1ee20792@oss.qualcomm.com> Signed-off-by: Rob Clark commit 830d68f2cb8ab6fb798bb9555016709a9e012af0 Author: Rob Clark Date: Mon Oct 6 08:35:41 2025 -0700 drm/msm: Fix pgtable prealloc error path The following splat was reported: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000 [0000000000000010] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S 6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT) pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : build_detached_freelist+0x28/0x224 lr : kmem_cache_free_bulk.part.0+0x38/0x244 sp : ffff000a508c7a20 x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350 x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000 x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000 x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8 x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640 x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30 x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940 x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000 x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8 x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00 Call trace: build_detached_freelist+0x28/0x224 (P) kmem_cache_free_bulk.part.0+0x38/0x244 kmem_cache_free_bulk+0x10/0x1c msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0 msm_vma_job_free+0x30/0x240 msm_ioctl_vm_bind+0x1d0/0x9a0 drm_ioctl_kernel+0x84/0x104 drm_ioctl+0x358/0x4d4 __arm64_sys_ioctl+0x8c/0xe0 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x3c/0xe0 do_el0_svc+0x18/0x20 el0_svc+0x30/0x100 el0t_64_sync_handler+0x104/0x130 el0t_64_sync+0x170/0x174 Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6) ---[ end trace 0000000000000000 ]--- Since msm_vma_job_free() is called directly from the ioctl, this looks like an error path cleanup issue. Which I think results from prealloc_cleanup() called without a preceding successful prealloc_allocate() call. So handle that case better. Reported-by: Connor Abbott Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/678677/ Message-ID: <20251006153542.419998-1-robin.clark@oss.qualcomm.com> commit 6de1dec1c166c7f7324ce52ccfdf43e2fa743b19 Author: Eric Dumazet Date: Wed Oct 15 05:27:15 2025 +0000 udp: do not use skb_release_head_state() before skb_attempt_defer_free() Michal reported and bisected an issue after recent adoption of skb_attempt_defer_free() in UDP. The issue here is that skb_release_head_state() is called twice per skb, one time from skb_consume_udp(), then a second time from skb_defer_free_flush() and napi_consume_skb(). As Sabrina suggested, remove skb_release_head_state() call from skb_consume_udp(). Add a DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb)) in skb_attempt_defer_free() Many thanks to Michal, Sabrina, Paolo and Florian for their help. Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()") Reported-and-bisected-by: Michal Kubecek Closes: https://lore.kernel.org/netdev/gpjh4lrotyephiqpuldtxxizrsg6job7cvhiqrw72saz2ubs3h@g6fgbvexgl3r/ Signed-off-by: Eric Dumazet Tested-by: Michal Kubecek Cc: Sabrina Dubroca Cc: Florian Westphal Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20251015052715.4140493-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 0b7d9b25e4bc2e478c9d06281a65f930769fca09 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:57 2025 +0300 spi: airoha: fix reading/writing of flashes with more than one plane per lun Attaching UBI on the flash with more than one plane per lun will lead to the following error: [ 2.980989] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986309] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994978] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001350] Creating 2 MTD partitions on "spi0.0": [ 3.006159] 0x000000000000-0x000000020000 : "bl2" [ 3.011663] 0x000000020000-0x000010000000 : "ubi" ... [ 6.391748] ubi0: attaching mtd1 [ 6.412545] ubi0 error: ubi_attach: PEB 0 contains corrupted VID header, and the data does not contain all 0xFF [ 6.422677] ubi0 error: ubi_attach: this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection [ 6.434249] Volume identifier header dump: [ 6.438349] magic 55424923 [ 6.441482] version 1 [ 6.444007] vol_type 0 [ 6.446539] copy_flag 0 [ 6.449068] compat 0 [ 6.451594] vol_id 0 [ 6.454120] lnum 1 [ 6.456651] data_size 4096 [ 6.459442] used_ebs 1061644134 [ 6.462748] data_pad 0 [ 6.465274] sqnum 0 [ 6.467805] hdr_crc 61169820 [ 6.470943] Volume identifier header hexdump: [ 6.475308] hexdump of PEB 0 offset 4096, length 126976 [ 6.507391] ubi0 warning: ubi_attach: valid VID header but corrupted EC header at PEB 4 [ 6.515415] ubi0 error: ubi_compare_lebs: unsupported on-flash UBI format [ 6.522222] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 6.529294] UBI error: cannot attach mtd1 Non dirmap reading works good. Looking to spi_mem_no_dirmap_read() code we'll see: static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc, u64 offs, size_t len, void *buf) { struct spi_mem_op op = desc->info.op_tmpl; int ret; // --- see here --- op.addr.val = desc->info.offset + offs; //----------------- op.data.buf.in = buf; op.data.nbytes = len; ret = spi_mem_adjust_op_size(desc->mem, &op); if (ret) return ret; ret = spi_mem_exec_op(desc->mem, &op); if (ret) return ret; return op.data.nbytes; } The similar happens for spi_mem_no_dirmap_write(). Thus the address passed to the flash should take in the account the value of desc->info.offset. This patch fix dirmap reading/writing of flashes with more than one plane per lun. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-7-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 20d7b236b78c7ec685a22db5689b9c829975e0c3 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:56 2025 +0300 spi: airoha: switch back to non-dma mode in the case of error Current dirmap code does not switch back to non-dma mode in the case of error. This is wrong. This patch fixes dirmap read/write error path. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Acked-by: Lorenzo Bianconi Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-6-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit edd2e261b1babb92213089b5feadca12e3459322 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:54 2025 +0300 spi: airoha: add support of dual/quad wires spi modes to exec_op() handler Booting without this patch and disabled dirmap support results in [ 2.980719] spi-nand spi0.0: Micron SPI NAND was found. [ 2.986040] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128 [ 2.994709] 2 fixed-partitions partitions found on MTD device spi0.0 [ 3.001075] Creating 2 MTD partitions on "spi0.0": [ 3.005862] 0x000000000000-0x000000020000 : "bl2" [ 3.011272] 0x000000020000-0x000010000000 : "ubi" ... [ 6.195594] ubi0: attaching mtd1 [ 13.338398] ubi0: scanning is finished [ 13.342188] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 13.349784] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22 [ 13.356897] UBI error: cannot attach mtd1 If dirmap is disabled or not supported in the spi driver, the dirmap requests will be executed via exec_op() handler. Thus, if the hardware supports dual/quad spi modes, then corresponding requests will be sent to exec_op() handler. Current driver does not support such requests, so error is arrised. As result the flash can't be read/write. This patch adds support of dual and quad wires spi modes to exec_op() handler. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251012121707.2296160-4-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 4314ffce4eb81a6c18700af1b6e29b6e0c6b9e37 Author: Mikhail Kshevetskiy Date: Sun Oct 12 15:16:52 2025 +0300 spi: airoha: return an error for continuous mode dirmap creation cases This driver can accelerate single page operations only, thus continuous reading mode should not be used. Continuous reading will use sizes up to the size of one erase block. This size is much larger than the size of single flash page. Use this difference to identify continuous reading and return an error. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Frieder Schrempf Reviewed-by: AngeloGioacchino Del Regno Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Link: https://patch.msgid.link/20251012121707.2296160-2-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 86f54f9b6c17d6567c69e3a6fed52fdf5d7dbe93 Author: Hao Ge Date: Wed Oct 15 22:16:42 2025 +0800 slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL If obj_exts allocation failed, slab->obj_exts is set to OBJEXTS_ALLOC_FAIL, But we do not clear it when freeing the slab. Since OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS currently share the same bit position, during the release of the associated folio, a VM_BUG_ON_FOLIO() check in folio_memcg_kmem() is triggered because the OBJEXTS_ALLOC_FAIL flag was not cleared, causing it to be interpreted as a kmem folio (non-slab) with MEMCG_OBJEXTS_DATA flag set, which is invalid because MEMCG_OBJEXTS_DATA is supposed to be set only on slabs. Another problem that predates sharing the OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS bits is that on configurations with is_check_pages_enabled(), the non-cleared bit in page->memcg_data will trigger a free_page_is_bad() failure "page still charged to cgroup" When freeing a slab, we clear slab->obj_exts if the obj_ext array has been successfully allocated. So let's clear it also when the allocation has failed. Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations") Fixes: 7612833192d5 ("slab: Reuse first bit for OBJEXTS_ALLOC_FAIL") Link: https://lore.kernel.org/all/20251015141642.700170-1-hao.ge@linux.dev/ Cc: Signed-off-by: Hao Ge Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 5801e65206b065b0b2af032f7f1eef222aa2fd83 Author: Tvrtko Ursulin Date: Wed Oct 15 09:40:15 2025 +0100 drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it. Signed-off-by: Tvrtko Ursulin Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/dri-devel/aNFbXq8OeYl3QSdm@stanley.mountain/ Cc: Christian König Cc: Rob Clark Cc: Daniel Vetter Cc: Matthew Brost Cc: Danilo Krummrich Cc: Philipp Stanner Cc: Christian König Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v5.16+ Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20251015084015.6273-1-tvrtko.ursulin@igalia.com commit ea138a607709bf72c162f62d2a670fe899d73daa Author: Samuel Holland Date: Wed Oct 15 17:17:09 2025 -0700 RISC-V: KVM: Fix check for local interrupts on riscv32 To set all 64 bits in the mask on a 32-bit system, the constant must have type `unsigned long long`. Fixes: 6b1e8ba4bac4 ("RISC-V: KVM: Use bitmap for irqs_pending and irqs_pending_mask") Signed-off-by: Samuel Holland Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251016001714.3889380-1-samuel.holland@sifive.com Signed-off-by: Anup Patel commit f1a450f9e17d341f69f8fb19f6d13ef9f1aa508b Merge: 62ef9b2a01a0af ee70bacef1c605 Author: Mark Brown Date: Thu Oct 16 12:41:35 2025 +0100 ASoC: nau8821: Fix IRQ handling and improve jack Merge series from Cristian Ciocaltea : This patch series addresses a set of issues in the Nuvoton NAU88L21 audio codec driver related to interrupt handling and jack hotplug detection reliability. The changes focus on: * Eliminating race conditions between jack insertion and ejection events * Ensuring interrupts are consistently and correctly cleared before unmasking * Introducing a DMI-based quirk to bypass the jack debounce circuit on Valve Steam Deck, improving detection accuracy under stress * Improving robustness of the IRQ handler by avoiding unnecessary blocking operations The series has been tested on affected hardware to verify correct behavior during repeated and rapid jack hotplug cycles. commit 62ef9b2a01a0af5199986a2466dace54b8703b3e Merge: 5726b68473f715 dee4ef0ebe4dee Author: Mark Brown Date: Thu Oct 16 12:41:30 2025 +0100 ASoC: Add QCS615 sound card support Merge series from Le Qi : This patch series adds support for the QCS615 sound card: - Updates device tree bindings for SM8250 to include QCS615. - Adds QCS615 support in the SC8280XP ASoC driver. commit ce121914f38aaa59504e20a1a625e5988fc6ead4 Author: Russell King (Oracle) Date: Wed Oct 15 16:52:26 2025 +0100 arm64: tegra: Mark Jetson Xavier NX's PHY as a wakeup source Mark the RTL8211F PHY as a wakeup source for the Jetson Xavier NX. This allows the reworked RTL8211F driver to know that the PHY is wired to wakeup capable hardware, and thus to expose WoL capabilities. Signed-off-by: Russell King (Oracle) Acked-by: Jon Hunter Signed-off-by: Thierry Reding commit c6fceaf166479c05f7d3158ef08e78ae3e3dfa23 Author: Pauli Virtanen Date: Thu Oct 16 00:11:30 2025 +0300 ALSA: usb-audio: fix vendor quirk for Logitech H390 Vendor quirk QUIRK_FLAG_CTL_MSG_DELAY_1M was inadvertently missing when adding quirk for Logitech H390. Add it back. Fixes: 2b929b6eec0c ("ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390") Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 9af61fc91486c7ba93cf1ec3bd381978cac8308c Author: Pauli Virtanen Date: Wed Oct 15 22:47:10 2025 +0300 ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 ID 045e:070f Microsoft Corp. LifeChat LX-3000 Headset has muted minimum Speaker Playback Volume, and 4 amixer steps were observed to produce 1 actual volume step. Apply min_mute quirk and correct res=48 -> 4*48. Tested with the device. Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 225bc03d85427e7e3821d6f99f4f2d4a09350dda Author: Matthew Auld Date: Fri Oct 10 16:24:58 2025 +0100 drm/xe/evict: drop bogus assert This assert can trigger here with non pin_map users that select LATE_RESTORE, since the vmap is allowed to be NULL given that save/restore can now use the blitter instead. The check here doesn't seem to have much value anymore given that we no longer move pinned memory, so any existing vmap is left well alone, and doesn't need to be recreated upon restore, so just drop the assert here. Fixes: 86f69c26113c ("drm/xe: use backup object for pinned save/restore") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6213 Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20251010152457.177884-2-matthew.auld@intel.com (cherry picked from commit a10b4a69c7f8f596d2c5218fbe84430734fab3b2) Signed-off-by: Lucas De Marchi commit 6a91af25cdbce2086d85cc4994cf791bda3a2c90 Author: Matthew Auld Date: Fri Oct 10 17:20:21 2025 +0100 drm/xe/migrate: don't misalign current bytes If current bytes exceeds the max copy size, ensure the clamped size still accounts for the XE_CACHELINE_BYTES alignment, otherwise we trigger the assert in xe_migrate_vram with the size now being out of alignment. Fixes: 8c2d61e0e916 ("drm/xe/migrate: don't overflow max copy size") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6212 Signed-off-by: Matthew Auld Cc: Stuart Summers Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20251010162020.190962-2-matthew.auld@intel.com (cherry picked from commit 641bcf8731d21b56760e3646a39a65f471e9efd1) Signed-off-by: Lucas De Marchi commit 6d36f65ba551d28710c3e1aaceecacf19df0cd8f Author: Matt Roper Date: Mon Oct 13 08:30:15 2025 -0700 drm/xe/kunit: Fix kerneldoc for parameterized tests Kunit's generate_params() was recently updated to take an additional test context parameter. Xe's IP and platform parameter generators were updated accordingly at the same time, but the new parameter was not added to the functions' kerneldoc, resulting in the following warnings: Warning: drivers/gpu/drm/xe/tests/xe_pci.c:78 function parameter 'test' not described in 'xe_pci_fake_data_gen_params' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:254 function parameter 'test' not described in 'xe_pci_graphics_ip_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:278 function parameter 'test' not described in 'xe_pci_media_ip_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:302 function parameter 'test' not described in 'xe_pci_id_gen_param' Warning: drivers/gpu/drm/xe/tests/xe_pci.c:390 function parameter 'test' not described in 'xe_pci_live_device_gen_param' 5 warnings as errors Document the new parameter to eliminate the warnings and make CI happy. Fixes: b9a214b5f6aa ("kunit: Pass parameterized test context to generate_params()") Reviewed-by: Shuicheng Lin Link: https://lore.kernel.org/r/20251013153014.2362879-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 89e347f8a70165d1e8d88a93d875da7742c902ce) Signed-off-by: Lucas De Marchi commit 7987b93e3a11a7a95ddf2b21563d3286661b999c Author: Thomas Hellström Date: Fri Oct 10 12:41:48 2025 +0200 drm/xe/svm: Ensure data will be migrated to system if indicated by madvise. If the location madvise() is set to DRM_XE_PREFERRED_LOC_DEFAULT_SYSTEM, the drm_pagemap in the SVM gpu fault handler will be set to NULL. However there is nothing that explicitly migrates the data to system if it is already present in device memory. In that case, set the device memory owner to NULL to ensure data gets properly migrated to system on page-fault. v2: - Remove redundant dpagemap assignment (Himal Prasad Ghimiray) Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost #v1 Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251010104149.72783-2-thomas.hellstrom@linux.intel.com Fixes: 10aa5c806030 ("drm/gpusvm, drm/xe: Fix userptr to not allow device private pages") (cherry picked from commit 2cfcea7a745794f9b8e265a309717ca6ba335fc4) Signed-off-by: Lucas De Marchi commit 3c15a6df61bab034b087f00181408b1537a535bb Author: Eric Biggers Date: Sat Oct 11 18:57:38 2025 -0700 smb: client: Consolidate cmac(aes) shash allocation Now that smb3_crypto_shash_allocate() and smb311_crypto_shash_allocate() are identical and only allocate "cmac(aes)", delete the latter and replace the call to it with the former. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 2c09630d09c64b6b46e3d59a0031bc1807f742c4 Author: Eric Biggers Date: Sat Oct 11 18:57:37 2025 -0700 smb: client: Remove obsolete crypto_shash allocations Now that the SMB client accesses MD5, HMAC-MD5, HMAC-SHA256, and SHA-512 only via the library API and not via crypto_shash, allocating crypto_shash objects for these algorithms is no longer necessary. Remove all these allocations, their corresponding kconfig selections, and their corresponding module soft dependencies. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 395a77b030a878a353465386e8618b5272a480ca Author: Eric Biggers Date: Sat Oct 11 18:57:36 2025 -0700 smb: client: Use HMAC-MD5 library for NTLMv2 For the HMAC-MD5 computations in NTLMv2, use the HMAC-MD5 library instead of a "hmac(md5)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To preserve the existing behavior of NTLMv2 support being disabled when the kernel is booted with "fips=1", make setup_ntlmv2_rsp() check fips_enabled itself. Previously it relied on the error from cifs_alloc_hash("hmac(md5)", &hmacmd5). Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit c04e55b257b42f5eb5a2c5e92ebd043fd75fe3ab Author: Eric Biggers Date: Sat Oct 11 18:57:35 2025 -0700 smb: client: Use MD5 library for SMB1 signature calculation Convert cifs_calc_signature() to use the MD5 library instead of a "md5" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To preserve the existing behavior of MD5 signature support being disabled when the kernel is booted with "fips=1", make cifs_calc_signature() check fips_enabled itself. Previously it relied on the error from cifs_alloc_hash("md5", &server->secmech.md5). Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit ae04b1bb06f8c1738d01dc2f9b9391c4480544e4 Author: Eric Biggers Date: Sat Oct 11 18:57:34 2025 -0700 smb: client: Use MD5 library for M-F symlink hashing Convert parse_mf_symlink() and format_mf_symlink() to use the MD5 library instead of a "md5" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. This also fixes an issue where these functions did not work on kernels booted in FIPS mode. The use of MD5 here is for data integrity rather than a security purpose, so it can use a non-FIPS-approved algorithm. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit e05b3115e75381369be84abe5d46565ce0fcedc8 Author: Eric Biggers Date: Sat Oct 11 18:57:33 2025 -0700 smb: client: Use HMAC-SHA256 library for SMB2 signature calculation Convert smb2_calc_signature() to use the HMAC-SHA256 library instead of a "hmac(sha256)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-SHA256 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To make this possible, make __cifs_calc_signature() support both the HMAC-SHA256 library and crypto_shash. (crypto_shash is still needed for HMAC-MD5 and AES-CMAC. A later commit will switch HMAC-MD5 from shash to the library. I'd like to eventually do the same for AES-CMAC, but it doesn't have a library API yet. So for now, shash is still needed.) Also remove the unnecessary 'sigptr' variable. For now smb3_crypto_shash_allocate() still allocates a "hmac(sha256)" crypto_shash. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 4b4c6fdb25de4edc0a34b1b93cccb439e00e1f35 Author: Eric Biggers Date: Sat Oct 11 18:57:32 2025 -0700 smb: client: Use HMAC-SHA256 library for key generation Convert generate_key() to use the HMAC-SHA256 library instead of a "hmac(sha256)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-SHA256 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Also remove the unnecessary 'hashptr' variable. For now smb3_crypto_shash_allocate() still allocates a "hmac(sha256)" crypto_shash. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit af5fea51411224cae61d54064a55fe22020bd2b7 Author: Eric Biggers Date: Sat Oct 11 18:57:31 2025 -0700 smb: client: Use SHA-512 library for SMB3.1.1 preauth hash Convert smb311_update_preauth_hash() to use the SHA-512 library instead of a "sha512" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the SHA-512 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Remove the call to smb311_crypto_shash_allocate() from smb311_update_preauth_hash(), since it appears to have been needed only to allocate the "sha512" crypto_shash. (It also had the side effect of allocating the "cmac(aes)" crypto_shash, but that's also done in generate_key() which is where the AES-CMAC key is initialized.) For now the "sha512" crypto_shash is still being allocated elsewhere. It will be removed in a later commit. Reviewed-by: Stefan Metzmacher Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Steve French commit 6447b0e355562a1ff748c4a2ffb89aae7e84d2c9 Author: Eugene Korenevsky Date: Mon Oct 13 21:39:30 2025 +0300 cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header Processing of such replies will cause oob. Return -EINVAL error on such replies to prevent oob-s. Signed-off-by: Eugene Korenevsky Cc: stable@vger.kernel.org Suggested-by: Nathan Chancellor Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit c2b77f42205ef485a647f62082c442c1cd69d3fc Author: Shuhao Fu Date: Thu Oct 16 02:52:55 2025 +0000 smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks. Fixes: 8ceb98437946 ("CIFS: Move rename to ops struct") Fixes: 2f1afe25997f ("cifs: Use smb 2 - 3 and cifsacl mount options getacl functions") Fixes: 366ed846df60 ("cifs: Use smb 2 - 3 and cifsacl mount options setacl function") Cc: stable@vger.kernel.org Signed-off-by: Shuhao Fu Signed-off-by: Steve French commit 8d93ff40d49d70e05c82a74beae31f883fe0eaf8 Author: I Viswanath Date: Mon Oct 13 23:46:48 2025 +0530 net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset dev->chipid is used in lan78xx_init_mac_address before it's initialized: lan78xx_reset() { lan78xx_init_mac_address() lan78xx_read_eeprom() lan78xx_read_raw_eeprom() <- dev->chipid is used here dev->chipid = ... <- dev->chipid is initialized correctly here } Reorder initialization so that dev->chipid is set before calling lan78xx_init_mac_address(). Fixes: a0db7d10b76e ("lan78xx: Add to handle mux control per chip id") Signed-off-by: I Viswanath Reviewed-by: Vadim Fedorenko Reviewed-by: Khalid Aziz Link: https://patch.msgid.link/20251013181648.35153-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 5e655aaddaa37e6c5a103d2854cb561552d710be Merge: 1a8fed52f7be14 93a27b5891b819 Author: Jakub Kicinski Date: Wed Oct 15 17:56:20 2025 -0700 Merge tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-10-14 The first 2 paches are by Celeste Liu and target the gS_usb driver. The first patch remove the limitation to 3 CAN interface per USB device. The second patch adds the missing population of net_device->dev_port. The next 4 patches are by me and fix the m_can driver. They add a missing pm_runtime_disable(), fix the CAN state transition back to Error Active and fix the state after ifup and suspend/resume. Another patch by me targets the m_can driver, too and replaces Dong Aisheng's old email address. The next 2 patches are by Vincent Mailhol and update the CAN networking Documentation. Tetsuo Handa contributes the last patch that add missing cleanup calls in the NETDEV_UNREGISTER notification handler. * tag 'linux-can-fixes-for-6.18-20251014' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: j1939: add missing calls in NETDEV_UNREGISTER notification handler can: add Transmitter Delay Compensation (TDC) documentation can: remove false statement about 1:1 mapping between DLC and length can: m_can: replace Dong Aisheng's old email address can: m_can: fix CAN state in system PM can: m_can: m_can_chip_config(): bring up interface in correct state can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() can: gs_usb: gs_make_candev(): populate net_device->dev_port can: gs_usb: increase max interface to U8_MAX ==================== Link: https://patch.msgid.link/20251014122140.990472-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 1a8fed52f7be14e45785e8e54d0d0b50fc17dbd8 Author: Breno Leitao Date: Tue Oct 14 02:17:25 2025 -0700 netdevsim: set the carrier when the device goes up Bringing a linked netdevsim device down and then up causes communication failure because both interfaces lack carrier. Basically a ifdown/ifup on the interface make the link broken. Commit 3762ec05a9fbda ("netdevsim: add NAPI support") added supported for NAPI, calling netif_carrier_off() in nsim_stop(). This patch re-enables the carrier symmetrically on nsim_open(), in case the device is linked and the peer is up. Signed-off-by: Breno Leitao Fixes: 3762ec05a9fbda ("netdevsim: add NAPI support") Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251014-netdevsim_fix-v2-1-53b40590dae1@debian.org Signed-off-by: Jakub Kicinski commit cf51d617c3829bd85666380be348aed71a1c44df Merge: 0c3f2e62815a43 3667e9b442b95b Author: Jakub Kicinski Date: Wed Oct 15 17:41:47 2025 -0700 Merge branch 'tls-misc-bugfixes' Sabrina Dubroca says: ==================== tls: misc bugfixes Jann Horn reported multiple bugs in kTLS. This series addresses them, and adds some corresponding selftests for those that are reproducible (and without failure injection). ==================== Link: https://patch.msgid.link/cover.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 3667e9b442b95b021189db793b9156552f918e99 Author: Sabrina Dubroca Date: Tue Oct 14 11:17:02 2025 +0200 selftests: tls: add test for short splice due to full skmsg We don't have a test triggering a partial splice caused by a full skmsg. Add one, based on a program by Jann Horn. Use MAX_FRAGS=48 to make sure the skmsg will be full for any allowed value of CONFIG_MAX_SKB_FRAGS (17..45). Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/1d129a15f526ea3602f3a2b368aa0b6f7e0d35d5.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit f95fce1e953b8a7af3fbad84aaffe92804196e2d Author: Sabrina Dubroca Date: Tue Oct 14 11:17:01 2025 +0200 selftests: net: tls: add tests for cmsg vs MSG_MORE We don't have a test to check that MSG_MORE won't let us merge records of different types across sendmsg calls. Add new tests that check: - MSG_MORE is only allowed for DATA records - a pending DATA record gets closed and pushed before a non-DATA record is processed Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/b34feeadefe8a997f068d5ed5617afd0072df3c0.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 7f846c65ca11e63d2409868ff039081f80e42ae4 Author: Sabrina Dubroca Date: Tue Oct 14 11:17:00 2025 +0200 tls: don't rely on tx_work during send() With async crypto, we rely on tx_work to actually transmit records once encryption completes. But while send() is running, both the tx_lock and socket lock are held, so tx_work_handler cannot process the queue of encrypted records, and simply reschedules itself. During a large send(), this could last a long time, and use a lot of memory. Transmit any pending encrypted records before restarting the main loop of tls_sw_sendmsg_locked. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/8396631478f70454b44afb98352237d33f48d34d.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b8a6ff84abbcbbc445463de58704686011edc8e1 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:59 2025 +0200 tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decryption can lead to various issues (UAF on the skb, writing into userspace memory after the recv() call has returned). In this case, wait for all pending decryption requests. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/b9fe61dcc07dab15da9b35cf4c7d86382a98caf2.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:58 2025 +0200 tls: always set record_type in tls_process_cmsg When userspace wants to send a non-DATA record (via the TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a previous MSG_MORE send() as a separate DATA record. If that DATA record is encrypted asynchronously, tls_handle_open_record will return -EINPROGRESS. This is currently treated as an error by tls_process_cmsg, and it will skip setting record_type to the correct value, but the caller (tls_sw_sendmsg_locked) handles that return value correctly and proceeds with sending the new message with an incorrect record_type (DATA instead of whatever was requested in the cmsg). Always set record_type before handling the open record. If tls_handle_open_record returns an error, record_type will be ignored. If it succeeds, whether with synchronous crypto (returning 0) or asynchronous (returning -EINPROGRESS), the caller will proceed correctly. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit b014a4e066c555185b7c367efacdc33f16695495 Author: Sabrina Dubroca Date: Tue Oct 14 11:16:57 2025 +0200 tls: wait for async encrypt in case of error during latter iterations of sendmsg If we hit an error during the main loop of tls_sw_sendmsg_locked (eg failed allocation), we jump to send_end and immediately return. Previous iterations may have queued async encryption requests that are still pending. We should wait for those before returning, as we could otherwise be reading from memory that userspace believes we're not using anymore, which would be a sort of use-after-free. This is similar to what tls_sw_recvmsg already does: failures during the main loop jump to the "wait for async" code, not straight to the unlock/return. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/c793efe9673b87f808d84fdefc0f732217030c52.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit ce5af41e3234425a40974696682163edfd21128c Author: Sabrina Dubroca Date: Tue Oct 14 11:16:56 2025 +0200 tls: trim encrypted message to match the plaintext on short splice During tls_sw_sendmsg_locked, we pre-allocate the encrypted message for the size we're expecting to send during the current iteration, but we may end up sending less, for example when splicing: if we're getting the data from small fragments of memory, we may fill up all the slots in the skmsg with less data than expected. In this case, we need to trim the encrypted message to only the length we actually need, to avoid pushing uninitialized bytes down the underlying TCP socket. Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/66a0ae99c9efc15f88e9e56c1f58f902f442ce86.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 0c3f2e62815a43628e748b1e4ad97a1c46cce703 Author: Alexey Simakov Date: Tue Oct 14 19:47:38 2025 +0300 tg3: prevent use of uninitialized remote_adv and local_adv variables Some execution paths that jump to the fiber_setup_done label could leave the remote_adv and local_adv variables uninitialized and then use it. Initialize this variables at the point of definition to avoid this. Fixes: 85730a631f0c ("tg3: Add SGMII phy support for 5719/5718 serdes") Co-developed-by: Alexandr Sapozhnikov Signed-off-by: Alexandr Sapozhnikov Signed-off-by: Alexey Simakov Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20251014164736.5890-1-bigalex934@gmail.com Signed-off-by: Jakub Kicinski commit bc384963bc18e4f21cf8615b57cbbc9c5e0d309a Author: Justin Iurman Date: Tue Oct 14 19:06:50 2025 +0200 MAINTAINERS: new entry for IPv6 IOAM Create a maintainer entry for IPv6 IOAM. Add myself as I authored most if not all of the IPv6 IOAM code in the kernel and actively participate in the related IETF groups. Signed-off-by: Justin Iurman Link: https://patch.msgid.link/20251014170650.27679-1-justin.iurman@uliege.be Signed-off-by: Jakub Kicinski commit 7ea30958b3054f5e488fa0b33c352723f7ab3a2a Merge: 5a6f65d1502551 7933a585d70ee4 Author: Linus Torvalds Date: Wed Oct 15 15:12:58 2025 -0700 Merge tag 'vfs-6.18-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Handle inode number mismatches in nsfs file handles - Update the comment to init_file() - Add documentation link for EBADF in the rust file code - Skip read lock assertion for read-only filesystems when using dax - Don't leak disconnected dentries during umount - Fix new coredump input pattern validation - Handle ENOIOCTLCMD conversion in vfs_fileattr_{g,s}et() correctly - Remove redundant IOCB_DIO_CALLER_COMP clearing in overlayfs * tag 'vfs-6.18-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ovl: remove redundant IOCB_DIO_CALLER_COMP clearing fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" coredump: fix core_pattern input validation vfs: Don't leak disconnected dentries on umount dax: skip read lock assertion for read-only filesystems rust: file: add intra-doc link for 'EBADF' fs: update comment in init_file() nsfs: handle inode number mismatches gracefully in file handles commit 841a8bfcbad94bb1ba60f59ce34f75259074ae0d Author: Qiuxu Zhuo Date: Sat Oct 11 15:55:19 2025 +0800 mm: prevent poison consumption when splitting THP When performing memory error injection on a THP (Transparent Huge Page) mapped to userspace on an x86 server, the kernel panics with the following trace. The expected behavior is to terminate the affected process instead of panicking the kernel, as the x86 Machine Check code can recover from an in-userspace #MC. mce: [Hardware Error]: CPU 0: Machine Check Exception: f Bank 3: bd80000000070134 mce: [Hardware Error]: RIP 10: {memchr_inv+0x4c/0xf0} mce: [Hardware Error]: TSC afff7bbff88a ADDR 1d301b000 MISC 80 PPIN 1e741e77539027db mce: [Hardware Error]: PROCESSOR 0:d06d0 TIME 1758093249 SOCKET 0 APIC 0 microcode 80000320 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel Kernel panic - not syncing: Fatal local machine check The root cause of this panic is that handling a memory failure triggered by an in-userspace #MC necessitates splitting the THP. The splitting process employs a mechanism, implemented in try_to_map_unused_to_zeropage(), which reads the pages in the THP to identify zero-filled pages. However, reading the pages in the THP results in a second in-kernel #MC, occurring before the initial memory_failure() completes, ultimately leading to a kernel panic. See the kernel panic call trace on the two #MCs. First Machine Check occurs // [1] memory_failure() // [2] try_to_split_thp_page() split_huge_page() split_huge_page_to_list_to_order() __folio_split() // [3] remap_page() remove_migration_ptes() remove_migration_pte() try_to_map_unused_to_zeropage() // [4] memchr_inv() // [5] Second Machine Check occurs // [6] Kernel panic [1] Triggered by accessing a hardware-poisoned THP in userspace, which is typically recoverable by terminating the affected process. [2] Call folio_set_has_hwpoisoned() before try_to_split_thp_page(). [3] Pass the RMP_USE_SHARED_ZEROPAGE remap flag to remap_page(). [4] Try to map the unused THP to zeropage. [5] Re-access pages in the hw-poisoned THP in the kernel. [6] Triggered in-kernel, leading to a panic kernel. In Step[2], memory_failure() sets the poisoned flag on the page in the THP by TestSetPageHWPoison() before calling try_to_split_thp_page(). As suggested by David Hildenbrand, fix this panic by not accessing to the poisoned page in the THP during zeropage identification, while continuing to scan unaffected pages in the THP for possible zeropage mapping. This prevents a second in-kernel #MC that would cause kernel panic in Step[4]. Thanks to Andrew Zaborowski for his initial work on fixing this issue. Link: https://lkml.kernel.org/r/20251015064926.1887643-1-qiuxu.zhuo@intel.com Link: https://lkml.kernel.org/r/20251011075520.320862-1-qiuxu.zhuo@intel.com Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Qiuxu Zhuo Reported-by: Farrah Chen Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Tested-by: Farrah Chen Tested-by: Qiuxu Zhuo Acked-by: Lance Yang Reviewed-by: Wei Yang Acked-by: Zi Yan Reviewed-by: Miaohe Lin Cc: Barry Song Cc: Dev Jain Cc: Jiaqi Yan Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Mariano Pache Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit 78a63493f8e352296dbc7cb7b3f4973105e8679e Author: Deepanshu Kartikey Date: Thu Oct 9 21:19:03 2025 +0530 ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters(). The problem occurs when: 1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED 2. ioctl(FITRIM) triggers ocfs2_move_extents() 3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2) 4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0) 5. The extent map cache is not invalidated after the move 6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch 7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk. Link: https://lore.kernel.org/all/20251009142917.517229-1-kartikey406@gmail.com/T/ Link: https://lkml.kernel.org/r/20251009154903.522339-1-kartikey406@gmail.com Fixes: 53069d4e7695 ("Ocfs2/move_extents: move/defrag extents within a certain range.") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com Tested-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=2959889e1f6e216585ce522f7e8bc002b46ad9e7 Reviewed-by: Mark Fasheh Reviewed-by: Joseph Qi Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit c83aab85e18103a6dc066b4939e2c92a02bb1b05 Author: Alexei Starovoitov Date: Thu Oct 9 17:15:13 2025 -0700 mm: don't spin in add_stack_record when gfp flags don't allow syzbot was able to find the following path: add_stack_record_to_list mm/page_owner.c:182 [inline] inc_stack_record_count mm/page_owner.c:214 [inline] __set_page_owner+0x2c3/0x4a0 mm/page_owner.c:333 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 alloc_pages_nolock_noprof+0x94/0x120 mm/page_alloc.c:7554 Don't spin in add_stack_record_to_list() when it is called from *_nolock() context. Link: https://lkml.kernel.org/r/CAADnVQK_8bNYEA7TJYgwTYR57=TTFagsvRxp62pFzS_z129eTg@mail.gmail.com Fixes: 97769a53f117 ("mm, bpf: Introduce try_alloc_pages() for opportunistic page allocation") Signed-off-by: Alexei Starovoitov Reported-by: syzbot+8259e1d0e3ae8ed0c490@syzkaller.appspotmail.com Reported-by: syzbot+665739f456b28f32b23d@syzkaller.appspotmail.com Acked-by: Vlastimil Babka Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 03521c892bb8d0712c23e158ae9bdf8705897df8 Author: Marek Szyprowski Date: Thu Oct 9 16:15:08 2025 +0200 dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC Commit 370645f41e6e ("dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned") introduced DMA_BOUNCE_UNALIGNED_KMALLOC feature and permitted architecture specific code configure kmalloc slabs with sizes smaller than the value of dma_get_cache_alignment(). When that feature is enabled, the physical address of some small kmalloc()-ed buffers might be not aligned to the CPU cachelines, thus not really suitable for typical DMA. To properly handle that case a SWIOTLB buffer bouncing is used, so no CPU cache corruption occurs. When that happens, there is no point reporting a false-positive DMA-API warning that the buffer is not properly aligned, as this is not a client driver fault. [m.szyprowski@samsung.com: replace is_swiotlb_allocated() with is_swiotlb_active(), per Catalin] Link: https://lkml.kernel.org/r/20251010173009.3916215-1-m.szyprowski@samsung.com Link: https://lkml.kernel.org/r/20251009141508.2342138-1-m.szyprowski@samsung.com Fixes: 370645f41e6e ("dma-mapping: force bouncing if the kmalloc() size is not cache-line-aligned") Signed-off-by: Marek Szyprowski Reviewed-by: Catalin Marinas Cc: Christoph Hellwig Cc: Inki Dae Cc: Robin Murohy Cc: "Isaac J. Manjarres" Cc: Signed-off-by: Andrew Morton commit 139e7a572af0b45f558b5e502121a768dc328ba8 Author: SeongJae Park Date: Fri Oct 3 13:14:55 2025 -0700 mm/damon/sysfs: dealloc commit test ctx always The damon_ctx for testing online DAMON parameters commit inputs is deallocated only when the test fails. This means memory is leaked for every successful online DAMON parameters commit. Fix the leak by always deallocating it. Link: https://lkml.kernel.org/r/20251003201455.41448-3-sj@kernel.org Fixes: 4c9ea539ad59 ("mm/damon/sysfs: validate user inputs from damon_sysfs_commit_input()") Signed-off-by: SeongJae Park Cc: [6.15+] Signed-off-by: Andrew Morton commit f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f Author: SeongJae Park Date: Fri Oct 3 13:14:54 2025 -0700 mm/damon/sysfs: catch commit test ctx alloc failure Patch series "mm/damon/sysfs: fix commit test damon_ctx [de]allocation". DAMON sysfs interface dynamically allocates and uses a damon_ctx object for testing if given inputs for online DAMON parameters update is valid. The object is being used without an allocation failure check, and leaked when the test succeeds. Fix the two bugs. This patch (of 2): The damon_ctx for testing online DAMON parameters commit inputs is used without its allocation failure check. This could result in an invalid memory access. Fix it by directly returning an error when the allocation failed. Link: https://lkml.kernel.org/r/20251003201455.41448-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251003201455.41448-2-sj@kernel.org Fixes: 4c9ea539ad59 ("mm/damon/sysfs: validate user inputs from damon_sysfs_commit_input()") Signed-off-by: SeongJae Park Cc: [6.15+] Signed-off-by: Andrew Morton commit c97513cddcfc235f2522617980838e500af21d01 Author: Lance Yang Date: Tue Sep 9 22:52:43 2025 +0800 hung_task: fix warnings caused by unaligned lock pointers The blocker tracking mechanism assumes that lock pointers are at least 4-byte aligned to use their lower bits for type encoding. However, as reported by Eero Tamminen, some architectures like m68k only guarantee 2-byte alignment of 32-bit values. This breaks the assumption and causes two related WARN_ON_ONCE checks to trigger. To fix this, the runtime checks are adjusted to silently ignore any lock that is not 4-byte aligned, effectively disabling the feature in such cases and avoiding the related warnings. Thanks to Geert Uytterhoeven for bisecting! Link: https://lkml.kernel.org/r/20250909145243.17119-1-lance.yang@linux.dev Fixes: e711faaafbe5 ("hung_task: replace blocker_mutex with encoded blocker") Signed-off-by: Lance Yang Reported-by: Eero Tamminen Closes: https://lore.kernel.org/lkml/CAMuHMdW7Ab13DdGs2acMQcix5ObJK0O2dG_Fxzr8_g58Rc1_0g@mail.gmail.com Reviewed-by: Masami Hiramatsu (Google) Cc: John Paul Adrian Glaubitz Cc: Anna Schumaker Cc: Boqun Feng Cc: Finn Thain Cc: Geert Uytterhoeven Cc: Ingo Molnar Cc: Joel Granados Cc: John Stultz Cc: Kent Overstreet Cc: Lance Yang Cc: Mingzhe Yang Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Tomasz Figa Cc: Waiman Long Cc: Will Deacon Cc: Yongliang Gao Cc: Signed-off-by: Andrew Morton commit 18d6b1743eafeb3fb1e0ea5a2b7fd0a773d525a8 Author: Jens Axboe Date: Wed Oct 15 13:38:53 2025 -0600 io_uring/rw: check for NULL io_br_sel when putting a buffer Both the read and write side use kiocb_done() to finish a request, and kiocb_done() will call io_put_kbuf() in case a provided buffer was used for the request. Provided buffers are not supported for writes, hence NULL is being passed in. This normally works fine, as io_put_kbuf() won't actually use the value unless REQ_F_BUFFER_RING or REQ_F_BUFFER_SELECTED is set in the request flags. But depending on compiler (or whether or not CONFIG_CC_OPTIMIZE_FOR_SIZE is set), that may be done even though the value is never used. This will then cause a NULL pointer dereference. Make it a bit more obvious and check for a NULL io_br_sel, and don't even bother calling io_put_kbuf() for that case. Fixes: 5fda51255439 ("io_uring/kbuf: switch to storing struct io_buffer_list locally") Reported-by: David Howells Tested-by: David Howells Signed-off-by: Jens Axboe commit e6416c2dfe23c9a6fec881fda22ebb9ae486cfc5 Author: Rong Zhang Date: Sat Oct 11 00:59:58 2025 +0800 x86/CPU/AMD: Prevent reset reasons from being retained across reboot The S5_RESET_STATUS register is parsed on boot and printed to kmsg. However, this could sometimes be misleading and lead to users wasting a lot of time on meaningless debugging for two reasons: * Some bits are never cleared by hardware. It's the software's responsibility to clear them as per the Processor Programming Reference (see [1]). * Some rare hardware-initiated platform resets do not update the register at all. In both cases, a previous reboot could leave its trace in the register, resulting in users seeing unrelated reboot reasons while debugging random reboots afterward. Write the read value back to the register in order to clear all reason bits since they are write-1-to-clear while the others must be preserved. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=206537#attach_303991 [ bp: Massage commit message. ] Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") Signed-off-by: Rong Zhang Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Yazen Ghannam Cc: Link: https://lore.kernel.org/all/20250913144245.23237-1-i@rong.moe/ commit 5726b68473f7153a7f6294185e5998b7e2a230a2 Author: Li Qiang Date: Wed Oct 15 15:55:30 2025 +0800 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent potential NULL pointer dereference. Fixes: cb8ea62e64020 ("ASoC: amd/sdw_utils: add sof based soundwire generic machine driver") Signed-off-by: Li Qiang Link: https://patch.msgid.link/20251015075530.146851-1-liqiang01@kylinos.cn Signed-off-by: Mark Brown commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 Author: Sharique Mohammad Date: Wed Oct 15 15:42:15 2025 +0200 ASoC: max98090/91: fixed max98091 ALSA widget powering up/down The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they are turned on or off, the required startup or shutdown sequences must be taken care by the max98090_shdn_event. Signed-off-by: Sharique Mohammad Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com Signed-off-by: Mark Brown commit fcd298fdc2a32f1d90cdf9a452c5c5fdc6e8d137 Author: Frank Li Date: Fri Oct 10 12:03:20 2025 -0400 ASoC: dt-bindings: Add compatible string fsl,imx-audio-tlv320 Add compatible string fsl,imx-audio-tlv320 to fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/imx/imx6dl-gw5903.dtb: /sound: failed to match any schema with compatible: ['fsl,imx-audio-tlv320'] Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251010160321.2130093-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit 760951dd19c2ebf55214e0cb259e4494098dfc9b Merge: 6b6e0310616345 f43579ef350052 Author: Mark Brown Date: Wed Oct 15 19:40:46 2025 +0100 spi: spi-nxp-fspi: few fix for flexspi Merge series from Haibo Chen : PATCH 1: different operations maybe require different max frequency, so add flexspi to handle such case, re-config the clock rate when new coming operation require new clock frequency. Patch 2: add workaround for erratum ERR050272. Since only add 4us dealy in nxp_fspi_dll_calibration(), so do not distinguish different platforms. Patch 3: add max frequency limitation for different sample clock source selection. Datasheet give max 66MHz for mode 0 and 166MHz for mode 3. And IC suggest to add this limitation on all SoCs for safety and stability. commit 2aab1f993c8cb753ccb3d5b848cd758e2e87d965 Author: Ankan Biswas Date: Wed Oct 15 20:50:57 2025 +0530 drm/gpuvm: Fix kernel-doc warning for drm_gpuvm_map_req.map The kernel-doc for struct drm_gpuvm_map_req.map was added as '@op_map' instead of '@map', leading to this warning during htmldocs build: WARNING: include/drm/drm_gpuvm.h:1083 struct member 'map' not described in 'drm_gpuvm_map_req' Fixes: 000a45dce7ad ("drm/gpuvm: Pass map arguments through a struct") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250821133539.03aa298e@canb.auug.org.au/ Signed-off-by: Ankan Biswas Signed-off-by: Danilo Krummrich commit d451a0e88e9fa710df33f8dd5dc7ca63e22ef211 Author: Stefan Metzmacher Date: Wed Oct 15 17:05:04 2025 +0200 smb: client: let smbd_destroy() wait for SMBDIRECT_SOCKET_DISCONNECTED We should wait for the rdma_cm to become SMBDIRECT_SOCKET_DISCONNECTED, it turns out that (at least running some xfstests e.g. cifs/001) often triggers the case where wait_event_interruptible() returns with -ERESTARTSYS instead of waiting for SMBDIRECT_SOCKET_DISCONNECTED to be reached. Or we are already in SMBDIRECT_SOCKET_DISCONNECTING and never wait for SMBDIRECT_SOCKET_DISCONNECTED. Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") Fixes: e8b3bfe9bc65 ("cifs: smbd: Don't destroy transport on RDMA disconnect") Fixes: b0aa92a229ab ("smb: client: make sure smbd_disconnect_rdma_work() doesn't run after smbd_destroy() took over") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bfdd74166a639930baaba27a8d729edaacd46907 Author: Tim Hostetler Date: Tue Oct 14 00:47:39 2025 +0000 gve: Check valid ts bit on RX descriptor before hw timestamping The device returns a valid bit in the LSB of the low timestamp byte in the completion descriptor that the driver should check before setting the SKB's hardware timestamp. If the timestamp is not valid, do not hardware timestamp the SKB. Cc: stable@vger.kernel.org Fixes: b2c7aeb49056 ("gve: Implement ndo_hwtstamp_get/set for RX timestamping") Reviewed-by: Joshua Washington Signed-off-by: Tim Hostetler Signed-off-by: Harshitha Ramamurthy Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251014004740.2775957-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 5a6f65d1502551f84c158789e5d89299c78907c7 Merge: 1f4a222b0e3345 7e85ac9da1acc5 Author: Linus Torvalds Date: Wed Oct 15 08:48:17 2025 -0700 Merge tag 'bitmap-for-v6.18-rc2' of https://github.com/norov/linux Pull bitmap fixes from Yury Norov: "A "unnecessary `unsafe`" warning fix for bitmap/rust, and one leftover patch for FIELD_PREP_WM16() conversion. - rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning (Miguel) - FIELD_PREP_WM16() rework leftover (Nicolas)" * tag 'bitmap-for-v6.18-rc2' of https://github.com/norov/linux: PM / devfreq: rockchip-dfi: switch to FIELD_PREP_WM16 macro rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning commit d9b3014a7f1425011909ad358dc0c8f187853a12 Author: Benjamin Tissoires Date: Wed Oct 8 16:06:59 2025 +0200 selftests/hid: add tests for missing release on the Dell Synaptics Add a simple test for the corner case not currently covered by the sticky fingers quirk. Because it's a corner case test, we only test this on a couple of devices, not on all of them because the value of adding the same test over and over is rather moot. Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 46f781e0d151844589dc2125c8cce3300546f92a Author: Benjamin Tissoires Date: Wed Oct 8 16:06:58 2025 +0200 HID: multitouch: fix sticky fingers The sticky fingers quirk (MT_QUIRK_STICKY_FINGERS) was only considering the case when slots were not released during the last report. This can be problematic if the firmware forgets to release a finger while others are still present. This was observed on the Synaptics DLL0945 touchpad found on the Dell XPS 9310 and the Dell Inspiron 5406. Fixes: 4f4001bc76fd ("HID: multitouch: fix rare Win 8 cases when the touch up event gets missing") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit aa4daea418ee4215dca5c8636090660c545cb233 Author: Thadeu Lima de Souza Cascardo Date: Wed Oct 8 09:40:33 2025 -0300 HID: multitouch: fix name of Stylus input devices HID_DG_PEN devices should have a suffix of "Stylus", as pointed out by commit c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN"). However, on multitouch devices, these suffixes may be overridden. Before that commit, HID_DG_PEN devices would get the "Stylus" suffix, but after that, multitouch would override them to have an "UNKNOWN" suffix. Just add HID_DG_PEN to the list of non-overriden suffixes in multitouch. Before this fix: [ 0.470981] input: ELAN9008:00 04F3:2E14 UNKNOWN as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 ELAN9008:00 04F3:2E14 UNKNOWN After this fix: [ 0.474332] input: ELAN9008:00 04F3:2E14 Stylus as /devices/pci0000:00/0000:00:15.1/i2c_designware.1/i2c-16/i2c-ELAN9008:00/0018:04F3:2E14.0001/input/input8 ELAN9008:00 04F3:2E14 Stylus Fixes: c0ee1d571626 ("HID: hid-input: Add suffix also for HID_DG_PEN") Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Mika Westerberg Signed-off-by: Jiri Kosina commit 0187c08058da3e7f11b356ac27e0c427d36f33f2 Author: Dmitry Torokhov Date: Tue Oct 14 21:28:44 2025 -0700 HID: hid-input: only ignore 0 battery events for digitizers Commit 581c4484769e ("HID: input: map digitizer battery usage") added handling of battery events for digitizers (typically for batteries presented in stylii). Digitizers typically report correct battery levels only when stylus is actively touching the surface, and in other cases they may report battery level of 0. To avoid confusing consumers of the battery information the code was added to filer out reports with 0 battery levels. However there exist other kinds of devices that may legitimately report 0 battery levels. Fix this by filtering out 0-level reports only for digitizer usages, and continue reporting them for other kinds of devices (Smart Batteries, etc). Reported-by: 卢国宏 Fixes: 581c4484769e ("HID: input: map digitizer battery usage") Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina commit 4cdde87d723a0552f475c8c6b0db472a6945125f Author: Sebastian Chlad Date: Wed Oct 15 12:33:57 2025 +0200 selftests: cgroup: Use values_close_report in test_cpu Convert test_cpu to use the newly added values_close_report() helper to print detailed diagnostics when a tolerance check fails. This provides clearer insight into deviations while run in the CI. Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 3f9c60f4d3cc3e7f4dd7cac05011ea06d512050f Author: Sebastian Chlad Date: Wed Oct 15 12:33:56 2025 +0200 selftests: cgroup: add values_close_report helper Some cgroup selftests, such as test_cpu, occasionally fail by a very small margin and if run in the CI context, it is useful to have detailed diagnostic output to understand the deviation. Introduce a values_close_report() helper which performs the same comparison as values_close(), but prints detailed information when the values differ beyond the allowed tolerance. Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 1f4a222b0e334540343fbb5d3eac4584a6bfe180 Author: Linus Torvalds Date: Wed Oct 15 07:57:28 2025 -0700 Remove long-stale ext3 defconfig option Inspired by commit c065b6046b34 ("Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs") I looked around for any other left-over EXT3 config options, and found some old defconfig files still mentioned CONFIG_EXT3_DEFAULTS_TO_ORDERED. That config option was removed a decade ago in commit c290ea01abb7 ("fs: Remove ext3 filesystem driver"). It had a good run, but let's remove it for good. Signed-off-by: Linus Torvalds commit 66f8e4df003e61b72fdc794ed0ec8378d74a9a4a Merge: 9b332cece987ee c065b6046b3493 Author: Linus Torvalds Date: Wed Oct 15 07:51:57 2025 -0700 Merge tag 'ext4_for_linus-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 bug fixes from Ted Ts'o: - Fix regression caused by removing CONFIG_EXT3_FS when testing some very old defconfigs - Avoid a BUG_ON when opening a file on a maliciously corrupted file system - Avoid mm warnings when freeing a very large orphan file metadata - Avoid a theoretical races between metadata writeback and checkpoints (it's very hard to hit in practice, since the race requires that the writeback take a very long time) * tag 'ext4_for_linus-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs ext4: free orphan info with kvfree ext4: detect invalid INLINE_DATA + EXTENTS flag combination ext4, doc: fix and improve directory hash tree description ext4: wait for ongoing I/O to complete before freeing blocks jbd2: ensure that all ongoing I/O complete before freeing blocks commit 7e85ac9da1acc591bd5269f2b890ed1994c42e96 Author: Nicolas Frattaroli Date: Mon Oct 13 09:34:04 2025 +0200 PM / devfreq: rockchip-dfi: switch to FIELD_PREP_WM16 macro The era of hand-rolled HIWORD_UPDATE macros is over, at least for those drivers that use constant masks. Like many other Rockchip drivers, rockchip-dfi brings with it its own HIWORD_UPDATE macro. This variant doesn't shift the value (and like the others, doesn't do any checking). Remove it, and replace instances of it with hw_bitfield.h's FIELD_PREP_WM16. Since FIELD_PREP_WM16 requires contiguous masks and shifts the value for us, some reshuffling of definitions needs to happen. This gives us better compile-time error checking, and in my opinion, nicer code. Tested on an RK3568 ODROID-M1 board (LPDDR4X at 1560 MHz, an RK3588 Radxa ROCK 5B board (LPDDR4X at 2112 MHz) and an RK3588 Radxa ROCK 5T board (LPDDR5 at 2400 MHz). perf measurements were consistent with the measurements of stress-ng --stream in all cases. Signed-off-by: Nicolas Frattaroli Signed-off-by: Yury Norov (NVIDIA) commit 0f5878834d6ce97426219b64c02a2c4081419d53 Author: Miguel Ojeda Date: Mon Oct 13 02:14:22 2025 +0200 rust: bitmap: clean Rust 1.92.0 `unused_unsafe` warning Starting with Rust 1.92.0 (expected 2025-12-11), Rust allows to safely take the address of a union field [1][2]: CLIPPY L rust/kernel.o error: unnecessary `unsafe` block --> rust/kernel/bitmap.rs:169:13 | 169 | unsafe { core::ptr::addr_of!(self.repr.bitmap) } | ^^^^^^ unnecessary `unsafe` block | = note: `-D unused-unsafe` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unused_unsafe)]` error: unnecessary `unsafe` block --> rust/kernel/bitmap.rs:185:13 | 185 | unsafe { core::ptr::addr_of_mut!(self.repr.bitmap) } | ^^^^^^ unnecessary `unsafe` block Thus allow both instances to clean the warning in newer compilers. Link: https://github.com/rust-lang/rust/issues/141264 [1] Link: https://github.com/rust-lang/rust/pull/141469 [2] Signed-off-by: Miguel Ojeda Reviewed-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit 20b93a0088a595bceed4a026d527cbbac4e876c5 Author: Artem Shimko Date: Wed Oct 8 12:10:57 2025 +0300 firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode The SCMI_XFER_FLAG_IS_RAW flag was being cleared prematurely in scmi_xfer_raw_put() before the transfer completion was properly acknowledged by the raw message handlers. Move the clearing of SCMI_XFER_FLAG_IS_RAW and SCMI_XFER_FLAG_CHAN_SET from scmi_xfer_raw_put() to __scmi_xfer_put() to ensure the flags remain set throughout the entire raw message processing pipeline until the transfer is returned to the free pool. Fixes: 3095a3e25d8f ("firmware: arm_scmi: Add xfer helpers to provide raw access") Suggested-by: Cristian Marussi Signed-off-by: Artem Shimko Reviewed-by: Cristian Marussi Message-Id: <20251008091057.1969260-1-a.shimko.dev@gmail.com> Signed-off-by: Sudeep Holla commit 092b9e2ce6dd63d2f36822751a51957412706986 Author: Cristian Marussi Date: Tue Oct 14 12:53:46 2025 +0100 firmware: arm_scmi: Skip RAW initialization on failure Avoid attempting to initialize RAW mode when the debug subsystem itself has failed to initialize, since doing so is pointless and emits misleading error messages. Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-3-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 289ce7e9a5e1a52ac7e522a3e389dc16be08d7a4 Author: Cristian Marussi Date: Tue Oct 14 12:53:45 2025 +0100 include: trace: Fix inflight count helper on failed initialization Add a check to the scmi_inflight_count() helper to handle the case when the SCMI debug subsystem fails to initialize. Fixes: f8e656382b4a ("include: trace: Add tracepoint support for inflight xfer count") Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-2-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 2290ab43b9d8eafb8046387f10a8dfa2b030ba46 Author: Cristian Marussi Date: Tue Oct 14 12:53:44 2025 +0100 firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the SCMI debug helpers that maintain metrics counters. Fixes: 0b3d48c4726e ("firmware: arm_scmi: Track basic SCMI communication debug metrics") Signed-off-by: Cristian Marussi Message-Id: <20251014115346.2391418-1-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit 95355766e5871e9cdc574be5a3b115392ad33aea Author: Jouni Högander Date: Mon Sep 22 13:27:25 2025 +0300 drm/i915/psr: Deactivate PSR only on LNL and when selective fetch enabled Using intel_psr_exit in frontbuffer flush on older platforms seems to be causing problems. Sending single full frame update using intel_psr_force_update is anyways more optimal compared to psr deactivate/activate -> move back to this approach on PSR1, PSR HW tracking and Panel Replay full frame update and use deactivate/activate only on LunarLake and only when selective fetch is enabled. Tested-by: Lemen Tested-by: Koos Vriezen Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14946 Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250922102725.2752742-1-jouni.hogander@intel.com (cherry picked from commit 924adb0bbdd8fef25fd229c76e3f602c3e8752ee) Signed-off-by: Rodrigo Vivi commit 437c23357d897f5b5b7d297c477da44b56654d46 Author: Pavel Begunkov Date: Wed Oct 15 13:10:31 2025 +0100 io_uring: fix unexpected placement on same size resizing There might be many reasons why a user is resizing a ring, e.g. moving to huge pages or for some memory compaction using IORING_SETUP_NO_MMAP. Don't bypass resizing, the user will definitely be surprised seeing 0 while the rings weren't actually moved to a new place. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit be7cab44ed099566c605a8dac686c3254db01b35 Author: Pavel Begunkov Date: Wed Oct 15 13:07:23 2025 +0100 io_uring: protect mem region deregistration io_create_region_mmap_safe() protects publishing of a region against concurrent mmap calls, however we should also protect against it when removing a region. There is a gap io_register_mem_region() where it safely publishes a region, but then copy_to_user goes wrong and it unsafely frees the region. Cc: stable@vger.kernel.org Fixes: 087f997870a94 ("io_uring/memmap: implement mmap for regions") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 08823e89e3e269bf4c4a20b4c24a8119920cc7a4 Author: Ming Lei Date: Wed Oct 15 18:30:39 2025 +0800 block: Remove elevator_lock usage from blkg_conf frozen operations Remove the acquisition and release of q->elevator_lock in the blkg_conf_open_bdev_frozen() and blkg_conf_exit_frozen() functions. The elevator lock is no longer needed in these code paths since commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") which introduces `disk->rqos_state_mutex` for protecting wbt state change, and not necessary to abuse elevator_lock for this purpose. This change helps to solve the lockdep warning reported from Yu Kuai[1]. Pass blktests/throtl with lockdep enabled. Links: https://lore.kernel.org/linux-block/e5e7ac3f-2063-473a-aafb-4d8d43e5576e@yukuai.org.cn/ [1] Fixes: commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") Signed-off-by: Ming Lei Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit dc96cefef0d3032c69e46a21b345c60e56b18934 Author: Yu Kuai Date: Wed Oct 15 09:48:27 2025 +0800 blk-mq: fix stale tag depth for shared sched tags in blk_mq_update_nr_requests() Commit 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") moves blk_mq_tag_update_sched_shared_tags() before q->nr_requests is updated, however, it's still using the old q->nr_requests to resize tag depth. Fix this problem by passing in expected new tag depth. Fixes: 7f2799c546db ("blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()") Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Nilay Shroff Reported-by: Chris Mason Link: https://lore.kernel.org/linux-block/20251014130507.4187235-2-clm@meta.com/ Signed-off-by: Jens Axboe commit 85d7dda5a9f665ea579741ec873a8841f37e8943 Author: Mario Limonciello (AMD) Date: Tue Sep 23 10:29:29 2025 -0500 cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate After resuming from S4, all CPUs except the boot CPU have the wrong EPP hint programmed. This is because when the CPUs were offlined the EPP value was reset to 0. This is a similar problem as fixed by commit ba3319e590571 ("cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume") and the solution is also similar. When offlining rather than reset the values to zero, reset them to match those chosen by the policy. When the CPUs are onlined again these values will be restored. Closes: https://community.frame.work/t/increased-power-usage-after-resuming-from-suspend-on-ryzen-7040-kernel-6-15-regression/74531/20?u=mario_limonciello Fixes: 608a76b65288 ("cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option") Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 6b6e03106163458716c47df2baa9ad08ed4ddb0e Author: Xianwei Zhao Date: Wed Oct 15 15:36:59 2025 +0800 spi: amlogic: fix spifc build error There is an error building when Compiler version: gcc (GCC) 14.3.0 Assembler version: GNU assembler (GNU Binutils) 2.44 " Error log: WARNING: modpost: missing MODULE_DESCRIPTION() in arch/arm/probes/kprobes/test-kprobes.o ERROR: modpost: "__ffsdi2" [drivers/spi/spi-amlogic-spifc-a4.ko] undefined! " Use __ffs API instead of __bf_shf to be safer. Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/f594c621-f9e1-49f2-af31-23fbcb176058@roeck-us.net/ Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller") Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251015-fix-spifc-a4-v1-1-08e0900e5b7e@amlogic.com Signed-off-by: Mark Brown commit d877470b59910b5c50383d634dda3782386bba51 Author: ZhangGuoDong Date: Mon Oct 13 00:17:30 2025 +0800 smb: move some duplicate definitions to common/cifsglob.h In order to maintain the code more easily, move duplicate definitions to new common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Signed-off-by: Steve French commit b0432201a11b3caaeca6c03f2b3e399275b2e489 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:30 2025 +0200 smb: client: let destroy_mr_list() keep smbdirect_mr_io memory if registered If a smbdirect_mr_io structure if still visible to callers of smbd_register_mr() we can't free the related memory when the connection is disconnected! Otherwise smbd_deregister_mr() will crash. Now we use a mutex and refcounting in order to keep the memory around if the connection is disconnected. It means smbd_deregister_mr() can be called at any later time to free the memory, which is no longer referenced by nor referencing the connection. It also means smbd_destroy() no longer needs to wait for mr_io.used.count to become 0. Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 88f170814fea74911ceab798a43cbd7c5599bed4 Author: Marios Makassikis Date: Wed Oct 15 09:25:46 2025 +0200 ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock. This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool: $ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8) The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock Adjust ksmbd_session_rpc_method() callers to take the lock when necessary. Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access") Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit 379510a815cb2e64eb0a379cb62295d6ade65df0 Author: ZhangGuoDong Date: Sun Oct 12 00:51:36 2025 +0800 smb/server: fix possible refcount leak in smb2_sess_setup() Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put(). Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6fced056d2cc8d01b326e6fcfabaacb9850b71a4 Author: ZhangGuoDong Date: Sun Oct 12 00:47:59 2025 +0800 smb/server: fix possible memory leak in smb2_read() Memory leak occurs when ksmbd_vfs_read() fails. Fix this by adding the missing kvfree(). Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5fb750e8a9ae123b2034771b864b8a21dbef65cd Author: Alexei Starovoitov Date: Tue Oct 14 17:07:00 2025 -0700 bpf: Replace bpf_map_kmalloc_node() with kmalloc_nolock() to allocate bpf_async_cb structures. The following kmemleak splat: [ 8.105530] kmemleak: Trying to color unknown object at 0xff11000100e918c0 as Black [ 8.106521] Call Trace: [ 8.106521] [ 8.106521] dump_stack_lvl+0x4b/0x70 [ 8.106521] kvfree_call_rcu+0xcb/0x3b0 [ 8.106521] ? hrtimer_cancel+0x21/0x40 [ 8.106521] bpf_obj_free_fields+0x193/0x200 [ 8.106521] htab_map_update_elem+0x29c/0x410 [ 8.106521] bpf_prog_cfc8cd0f42c04044_overwrite_cb+0x47/0x4b [ 8.106521] bpf_prog_8c30cd7c4db2e963_overwrite_timer+0x65/0x86 [ 8.106521] bpf_prog_test_run_syscall+0xe1/0x2a0 happens due to the combination of features and fixes, but mainly due to commit 6d78b4473cdb ("bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()") It's using __GFP_HIGH, which instructs slub/kmemleak internals to skip kmemleak_alloc_recursive() on allocation, so subsequent kfree_rcu()-> kvfree_call_rcu()->kmemleak_ignore() complains with the above splat. To fix this imbalance, replace bpf_map_kmalloc_node() with kmalloc_nolock() and kfree_rcu() with call_rcu() + kfree_nolock() to make sure that the objects allocated with kmalloc_nolock() are freed with kfree_nolock() rather than the implicit kfree() that kfree_rcu() uses internally. Note, the kmalloc_nolock() happens under bpf_spin_lock_irqsave(), so it will always fail in PREEMPT_RT. This is not an issue at the moment, since bpf_timers are disabled in PREEMPT_RT. In the future bpf_spin_lock will be replaced with state machine similar to bpf_task_work. Fixes: 6d78b4473cdb ("bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Reviewed-by: Shakeel Butt Acked-by: Harry Yoo Acked-by: Vlastimil Babka Cc: linux-mm@kvack.org Link: https://lore.kernel.org/bpf/20251015000700.28988-1-alexei.starovoitov@gmail.com commit d5cda96d0130effd4255f7c5e720a58760a032a4 Author: Srinivas Kandagatla Date: Wed Oct 8 15:58:01 2025 +0100 ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls Component bind callbacks already does runtime pm calls, soundwire codec also tries to do the exactly same thing resulting in Unbalanced pm_runtime_enable and disable calls. Remove the redundant calls from wcd938x-sdw driver. Reported-by: Konrad Dybcio Fixes: ebaf88c0546d ("ASoC: codecs: wcd-common: move component ops to common") Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251008145801.3479-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 57b00ab3d33d2b177bf45d568fa1e6203cd099b6 Author: Shuming Fan Date: Tue Oct 14 17:21:57 2025 +0800 ASoC: sdw_utils: add rt1321 part id to codec_info_list The SdW machine driver supports the part id rt1321 amplifier. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251014092157.2789054-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 2d8636119b92970ba135c3c4da87d24dbfdeb8ca Author: Jeongjun Park Date: Wed Oct 15 16:34:54 2025 +0900 exfat: fix out-of-bounds in exfat_nls_to_ucs2() Since the len argument value passed to exfat_ioctl_set_volume_label() from exfat_nls_to_utf16() is passed 1 too large, an out-of-bounds read occurs when dereferencing p_cstring in exfat_nls_to_ucs2() later. And because of the NLS_NAME_OVERLEN macro, another error occurs when creating a file with a period at the end using utf8 and other iocharsets. So to avoid this, you should remove the code that uses NLS_NAME_OVERLEN macro and make the len argument value be the length of the label string, but with a maximum length of FSLABEL_MAX - 1. Reported-by: syzbot+98cc76a76de46b3714d4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=98cc76a76de46b3714d4 Fixes: d01579d590f7 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL") Suggested-by: Pali Rohár Signed-off-by: Jeongjun Park Signed-off-by: Namjae Jeon commit 34cbd6e07fddf36e186c8bf26a456fb7f50af44e Author: tr1x_em Date: Thu Sep 25 09:10:03 2025 +0530 platform/x86: alienware-wmi-wmax: Add AWCC support to Dell G15 5530 Makes alienware-wmi load on G15 5530 by default Cc: stable@vger.kernel.org Signed-off-by: Saumya Reviewed-by: Kurt Borja Link: https://patch.msgid.link/20250925034010.31414-1-admin@trix.is-a.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 28412b489b088fb88dff488305fd4e56bd47f6e4 Author: Jiaming Zhang Date: Wed Oct 15 13:16:45 2025 +0800 ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed(). Fixes: 39efc9c8a973 ("ALSA: usb-audio: Fix last interface check for registration") Closes: https://lore.kernel.org/all/CANypQFYtQxHL5ghREs-BujZG413RPJGnO5TH=xjFBKpPts33tA@mail.gmail.com/ Signed-off-by: Jiaming Zhang Signed-off-by: Takashi Iwai commit f4f868baf292550acbfc35839213de9da0d9e8ab Author: Denis Benato Date: Fri Oct 3 20:49:49 2025 +0200 MAINTAINERS: add Denis Benato as maintainer for asus notebooks Add myself as maintainer for "ASUS NOTEBOOKS AND EEEPC ACPI/WMI EXTRAS DRIVERS" as suggested by Hans de Goede and Armin Wolf. Signed-off-by: Denis Benato Link: https://lore.kernel.org/all/8128cd6b-50e3-464c-90c2-781f61c3963e@gmail.com Reviewed-by: Hans de Goede Acked-by: Luke Jones Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251003184949.1083030-1-benato.denis96@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a7b4747d8e0e7871c3d4971cded1dcc9af6af9e9 Author: David Thompson Date: Mon Oct 13 15:56:05 2025 +0000 platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init The lock-related debug logic (CONFIG_LOCK_STAT) in the kernel is noting the following warning when the BlueField-3 SOC is booted: BUG: key ffff00008a3402a8 has not been registered! ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 4 PID: 592 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x1d4/0x2a0 Call trace: lockdep_init_map_type+0x1d4/0x2a0 __kernfs_create_file+0x84/0x140 sysfs_add_file_mode_ns+0xcc/0x1cc internal_create_group+0x110/0x3d4 internal_create_groups.part.0+0x54/0xcc sysfs_create_groups+0x24/0x40 device_add+0x6e8/0x93c device_register+0x28/0x40 __hwmon_device_register+0x4b0/0x8a0 devm_hwmon_device_register_with_groups+0x7c/0xe0 mlxbf_pmc_probe+0x1e8/0x3e0 [mlxbf_pmc] platform_probe+0x70/0x110 The mlxbf_pmc driver must call sysfs_attr_init() during the initialization of the "count_clock" data structure to avoid this warning. Fixes: 5efc800975d9 ("platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count") Reviewed-by: Shravan Kumar Ramani Signed-off-by: David Thompson Link: https://patch.msgid.link/20251013155605.3589770-1-davthompson@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a49c4d48c3b60926e6a8cec217bf95aa65388ecc Author: Kurt Borja Date: Tue Oct 14 05:07:27 2025 -0500 platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers Devices without the AWCC interface don't initialize `awcc`. Add a check before dereferencing it in sleep handlers. Cc: stable@vger.kernel.org Reported-by: Gal Hammer Tested-by: Gal Hammer Fixes: 07ac275981b1 ("platform/x86: alienware-wmi-wmax: Add support for manual fan control") Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251014-sleep-fix-v3-1-b5cb58da4638@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6f719373b943a955fee6fc2012aed207b65e2854 Author: Thomas Zimmermann Date: Tue Oct 14 10:46:34 2025 +0200 drm/ast: Blank with VGACR17 sync enable, always clear VGACRB6 sync off Blank the display by disabling sync pulses with VGACR17<7>. Unblank by reenabling them. This VGA setting should be supported by all Aspeed hardware. Ast currently blanks via sync-off bits in VGACRB6. Not all BMCs handle VGACRB6 correctly. After disabling sync during a reboot, some BMCs do not reenable it after the soft reset. The display output remains dark. When the display is off during boot, some BMCs set the sync-off bits in VGACRB6, so the display remains dark. Observed with Blackbird AST2500 BMCs. Clearing the sync-off bits unconditionally fixes these issues. Also do not modify VGASR1's SD bit for blanking, as it only disables GPU access to video memory. v2: - init vgacrb6 correctly (Jocelyn) Signed-off-by: Thomas Zimmermann Fixes: ce3d99c83495 ("drm: Call drm_atomic_helper_shutdown() at shutdown time for misc drivers") Tested-by: Nick Bowler Reported-by: Nick Bowler Closes: https://lore.kernel.org/dri-devel/wpwd7rit6t4mnu6kdqbtsnk5bhftgslio6e2jgkz6kgw6cuvvr@xbfswsczfqsi/ Cc: Douglas Anderson Cc: Dave Airlie Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v6.7+ Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251014084743.18242-1-tzimmermann@suse.de commit 82ebecdc74ff555daf70b811d854b1f32a296bea Author: Jaehun Gou Date: Tue Oct 14 22:01:46 2025 +0900 exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is malformed, the following system calls — SYS_openat, SYS_ftruncate, and SYS_pwrite64 — can cause the kernel to hang. Root cause analysis shows that the size validation code in exfat_find() does not check whether dentry.stream.valid_size is negative. As a result, the system calls mentioned above can succeed and eventually trigger the DoS issue. This patch adds a check for negative dentry.stream.valid_size to prevent this vulnerability. Co-developed-by: Seunghun Han Signed-off-by: Seunghun Han Co-developed-by: Jihoon Kwon Signed-off-by: Jihoon Kwon Signed-off-by: Jaehun Gou Signed-off-by: Namjae Jeon commit 7f0fddd817ba6daebea1445ae9fab4b6d2294fa8 Author: Florian Westphal Date: Mon Oct 13 20:50:52 2025 +0200 net: core: fix lockdep splat on device unregister Since blamed commit, unregister_netdevice_many_notify() takes the netdev mutex if the device needs it. If the device list is too long, this will lock more device mutexes than lockdep can handle: unshare -n \ bash -c 'for i in $(seq 1 100);do ip link add foo$i type dummy;done' BUG: MAX_LOCK_DEPTH too low! turning off the locking correctness validator. depth: 48 max: 48! 48 locks held by kworker/u16:1/69: #0: ..148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work #1: ..d40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work #2: ..bd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net #3: ..aa8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch #4: ..cb0 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify [..] Add a helper to close and then unlock a list of net_devices. Devices that are not up have to be skipped - netif_close_many always removes them from the list without any other actions taken, so they'd remain in locked state. Close devices whenever we've used up half of the tracking slots or we processed entire list without hitting the limit. Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20251013185052.14021-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit e603a342cf7ecd64ef8f36207dfe1caacb9e2583 Author: Andrii Nakryiko Date: Tue Oct 14 13:20:37 2025 -0700 selftests/bpf: make arg_parsing.c more robust to crashes We started getting a crash in BPF CI, which seems to originate from test_parse_test_list_file() test and is happening at this line: ASSERT_OK(strcmp("test_with_spaces", set.tests[0].name), "test 0 name"); One way we can crash there is if set.cnt zero, which is checked for with ASSERT_EQ() above, but we proceed after this regardless of the outcome. Instead of crashing, we should bail out with test failure early. Similarly, if parse_test_list_file() fails, we shouldn't be even looking at set, so bail even earlier if ASSERT_OK() fails. Fixes: 64276f01dce8 ("selftests/bpf: Test_progs can read test lists from file") Signed-off-by: Andrii Nakryiko Tested-by: Ihor Solodrai Link: https://lore.kernel.org/r/20251014202037.72922-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit a4bbb493a3247ef32f6191fd8b2a0657139f8e08 Author: Alison Schofield Date: Tue Oct 14 14:38:49 2025 -0700 cxl/trace: Subtract to find an hpa_alias0 in cxl_poison events Traces of cxl_poison events include an hpa_alias0 field if the poison address is in a region configured with an ELC, Extended Linear Cache. Since the ELC always comes first in the region, the calculation needs to subtract the ELC size from the calculated HPA address. Fixes: 8c520c5f1e76 ("cxl: Add extended linear cache address alias emission for cxl events") Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Signed-off-by: Dave Jiang commit df5a1f4aeb6ff5e7c5ac47d16a347f03509dd441 Author: Jonas Gorski Date: Mon Oct 13 20:03:47 2025 +0200 MAINTAINERS: add myself as maintainer for b53 I wrote the original OpenWrt driver that Florian used as the base for the dsa driver, I might as well take responsibility for it. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251013180347.133246-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 469276c06affdfd2d9e88c9f228bb81119ec1a20 Author: Ilpo Järvinen Date: Tue Oct 14 19:36:02 2025 +0300 PCI: Revert early bridge resource set up The commit a43ac325c7cb ("PCI: Set up bridge resources earlier") moved bridge window resources set up earlier than before. The change was necessary to support another change that got pulled on the last minute due to breaking s390 and other systems. The presence of valid bridge window resources earlier than before allows pci_assign_unassigned_root_bus_resources() call from pci_host_probe() assign the bridge windows. Some host bridges, however, have to wait first for the link up event before they can enumerate successfully (see e.g. qcom_pcie_global_irq_thread()) and thus the bus has not been enumerated yet while calling pci_host_probe(). Calling pci_assign_unassigned_root_bus_resources() without results from enumeration can result in sizing bridge windows with too small sizes which cannot be later corrected after the enumeration has completed because bridge windows have become pinned in place by the other resources. Interestingly, it seems pci_read_bridge_bases() is not called at all in the problematic case and the bridge window resource type setup is done by pci_bridge_check_ranges() and sizing by the usual resource fitting logic. The root problem behind all this looks pretty generic. If resource fitting is called too early, the hotplug reservation and old size lower bounding cause the bridge windows to be assigned without children but with non-zero size, which leads to these pinning problems. As such, this can likely be solved on the general level but the solution does not look trivial. As the commit a43ac325c7cb ("PCI: Set up bridge resources earlier") was prequisite for other change that did not end up into kernel yet, revert it to resolve the resource assignment failures and give time to code and test a generic solution. Fixes: a43ac325c7cb ("PCI: Set up bridge resources earlier") Reported-by: Val Packett Link: https://lore.kernel.org/r/017ff8df-511c-4da8-b3cf-edf2cb7f1a67@packett.cool Reported-by: Guenter Roeck Link: https://lore.kernel.org/r/df266709-a9b3-4fd8-af3a-c22eb3c9523a@roeck-us.net Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251014163602.17138-1-ilpo.jarvinen@linux.intel.com commit 05e63305c85c88141500f0a2fb02afcfba9396e1 Author: Andrea Righi Date: Mon Oct 13 22:36:34 2025 +0200 sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads If we load a BPF scheduler while another scheduler is already running, alloc_kick_pseqs() would be called again, overwriting the previously allocated arrays. Fix by moving the alloc_kick_pseqs() call after the scx_enable_state() check, ensuring that the arrays are only allocated when a scheduler can actually be loaded. Fixes: 14c1da3895a11 ("sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc()") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 257c4b03a2f7d8c15f79c79b09a561af9734f6c4 Author: Alison Schofield Date: Tue Oct 14 00:31:04 2025 -0700 cxl/region: Use %pa printk format to emit resource_size_t KASAN reports a stack-out-of-bounds access in validate_region_offset() while running the cxl-poison.sh unit test because the printk format specifier, %pr format, is not a match for the resource_size_t type of the variables. %pr expects struct resource pointers and attempts to dereference the structure fields, reading beyond the bounds of the stack variables. Since these messages emit an 'A exceeds B' type of message, keep the resource_size_t's and use the %pa specifier to be architecture safe. BUG: KASAN: stack-out-of-bounds in resource_string.isra.0+0xe9a/0x1690 [] Read of size 8 at addr ffff88800a7afb40 by task bash/1397 ... [] The buggy address belongs to stack of task bash/1397 [] and is located at offset 56 in frame: [] validate_region_offset+0x0/0x1c0 [cxl_core] Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset") Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Signed-off-by: Dave Jiang commit f4d027921c811ff7fc16e4d03c6bbbf4347cf37a Author: Dave Jiang Date: Fri Oct 10 13:57:55 2025 -0700 cxl: Fix match_region_by_range() to use region_res_match_cxl_range() match_region_by_range() is not using the helper function that also takes extended linear cache size into account when comparing regions. This causes a x2 region to show up as 2 partial incomplete regions rather than a single CXL region with extended linear cache support. Replace the open coded compare logic with the proper helper function for comparison. User visible impact is that when 'cxl list' is issued, no activa CXL region(s) are shown. There may be multiple idle regions present. No actual active CXL region is present in the kernel. [dj: Fix stable address] Fixes: 0ec9849b6333 ("acpi/hmat / cxl: Add extended linear cache support for CXL") Cc: stable@vger.kernel.org Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Signed-off-by: Dave Jiang commit 0f6f1982cb28abf1b8a3a8ba906e2c6ade6a70e8 Author: Dave Jiang Date: Fri Oct 10 13:57:54 2025 -0700 cxl: Set range param for region_res_match_cxl_range() as const The function takes two parameters and compares them. The second parameter should be const since no modification should be done to it. Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 2e41e5a91a37202ff6743c3ae5329e106aeb1c6c Author: Dave Jiang Date: Fri Oct 10 13:57:53 2025 -0700 cxl/acpi: Fix setup of memory resource in cxl_acpi_set_cache_size() In order to compare the resource against the HMAT memory target, the resource needs to be memory type. Change the DEFINE_RES() macro to DEFINE_RES_MEM() in order to set the correct resource type. hmat_get_extended_linear_cache_size() uses resource_contains() internally. This causes a regression for platforms with the extended linear cache enabled as the comparison always fails and the cache size is not set. User visible impact is that when 'cxl list' is issued, a CXL region with extended linear cache support will only report half the size of the actual size. And this also breaks MCE reporting of the memory region due to incorrect offset calculation for the memory. [dj: Fixup commit log suggested by djbw] [dj: Fixup stable address for cc] Fixes: 12b3d697c812 ("cxl: Remove core/acpi.c and cxl core dependency on ACPI") Cc: stable@vger.kernel.org Reviewed-by: Gregory Price Reviewed-by: Alison Schofield Reviewed-by: Dan Williams Signed-off-by: Dave Jiang commit 7f9ee5fc97e14682e36fe22ae2654c07e4998b82 Author: Shardul Bankar Date: Tue Oct 14 17:30:37 2025 +0530 bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path Fix a memory leak in bpf_prog_test_run_xdp() where the context buffer allocated by bpf_ctx_init() is not freed when the function returns early due to a data size check. On the failing path: ctx = bpf_ctx_init(...); if (kattr->test.data_size_in - meta_sz < ETH_HLEN) return -EINVAL; The early return bypasses the cleanup label that kfree()s ctx, leading to a leak detectable by kmemleak under fuzzing. Change the return to jump to the existing free_ctx label. Fixes: fe9544ed1a2e ("bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN") Reported-by: BPF Runtime Fuzzer (BRF) Signed-off-by: Shardul Bankar Signed-off-by: Martin KaFai Lau Acked-by: Jiri Olsa Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20251014120037.1981316-1-shardulsb08@gmail.com commit df90f6cd29d8c77be6de4f9adf9cbe42ce2f0016 Author: Vlastimil Babka Date: Tue Oct 14 10:40:57 2025 +0200 slab: fix clearing freelist in free_deferred_objects() defer_free() links pending objects using the slab's freelist offset which is fine as they are not free yet. free_deferred_objects() then clears this pointer to avoid confusing the debugging consistency checks that may be enabled for the cache. However, with CONFIG_SLAB_FREELIST_HARDENED, even the NULL pointer needs to be encoded appropriately using set_freepointer(), otherwise it's decoded as something else and triggers the consistency checks, as found by the kernel test robot. Use set_freepointer() to prevent the issue. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Reported-and-tested-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202510101652.7921fdc6-lkp@intel.com Acked-by: Alexei Starovoitov Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit b3fd04e23f6e4496f5a2279466a33fbdc83500f0 Author: Dragan Simic Date: Sat Sep 6 12:01:22 2025 +0200 arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic Unify the naming of the existing GPU OPP table nodes found in the RK3588 and RK3588J SoC dtsi files with the other SoC's GPU OPP nodes, following the more "modern" node naming scheme. Fixes: a7b2070505a2 ("arm64: dts: rockchip: Split GPU OPPs of RK3588 and RK3588j") Signed-off-by: Dragan Simic [opp-table also is way too generic on systems with like 4-5 opp-tables] Signed-off-by: Heiko Stuebner commit 9b332cece987ee1790b2ed4c989e28162fa47860 Merge: 5bd0116d92a784 4b47a8601b71ad Author: Linus Torvalds Date: Tue Oct 14 09:28:12 2025 -0700 Merge tag 'nfsd-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix a crasher reported by rtm@csail.mit.edu * tag 'nfsd-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Define a proc_layoutcommit for the FlexFiles layout type commit afb5f84b216d14a71e2962ed569edcea30cf9763 Author: Diederik de Haas Date: Wed Oct 8 10:21:22 2025 +0200 arm64: dts: rockchip: Drop 'rockchip,grf' prop from tsadc on rk3328 The 'rockchip,grf' property for tsadc in rk3328 wasn't actually used in the driver and is no longer allowed in the DT since commit e881662aa06a ("dt-bindings: thermal: rockchip: Tighten grf requirements") So remove that property which fixes the following DT validation issue tsadc@ff250000 (rockchip,rk3328-tsadc): rockchip,grf: False schema does not allow [[58]] Signed-off-by: Diederik de Haas Signed-off-by: Heiko Stuebner commit 05b80cd1f37db042e074ecc7ee0d39869fed2f52 Author: Alexey Charkov Date: Thu Oct 9 16:34:01 2025 +0400 arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576 Drop the top-frequency OPPs from both the LITTLE and big CPU clusters on RK3576, as neither the opensource TF-A [1] nor the recent (after v1.08) binary BL31 images provided by Rockchip expose those. This fixes the problem [2] when the cpufreq governor tries to jump directly to the highest-frequency OPP, which results in a failed SCMI call leaving the system stuck at the previous OPP before the attempted change. [1] https://github.com/ARM-software/arm-trusted-firmware/blob/master/plat/rockchip/rk3576/scmi/rk3576_clk.c#L264-L304 [2] https://lore.kernel.org/linux-rockchip/CABjd4Yz4NbqzZH4Qsed3ias56gcga9K6CmYA+BLDBxtbG915Ag@mail.gmail.com/ Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") Cc: stable@vger.kernel.org Signed-off-by: Alexey Charkov Signed-off-by: Heiko Stuebner commit e179de737d13ad99bd19ea0fafab759d4074a425 Author: Andrey Leonchikov Date: Sun Oct 12 14:33:36 2025 +0200 arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2 Fix typo into regulator GPIO definition. With current definition, PCIe doesn't start up. Valid definition is already used in "pinctrl" section, "pcie_drv" (gpio4, RK_PB1). Fixes: bfbc663d2733a ("arm64: dts: rockchip: Add BigTreeTech CB2 and Pi2") Signed-off-by: Andrey Leonchikov Signed-off-by: Heiko Stuebner commit 5bd0116d92a7849b12f0b4c8199d53aa80e449bc Merge: 3a8660878839fa e2c69490dda5d4 Author: Linus Torvalds Date: Tue Oct 14 09:15:45 2025 -0700 Merge tag 'for-linus-6.18-2' of https://github.com/cminyard/linux-ipmi Pull IPMI fixes from Corey Minyard: "A few bug fixes for patches that went in this release: a refcount error and some missing or incorrect error checks" * tag 'for-linus-6.18-2' of https://github.com/cminyard/linux-ipmi: ipmi: Fix handling of messages with provided receive message pointer mfd: ls2kbmc: check for devm_mfd_add_devices() failure mfd: ls2kbmc: Fix an IS_ERR() vs NULL check in probe() commit d425aef66e62221fa6bb0ccb94296df29e4cc107 Author: Anand Moon Date: Mon Oct 13 20:50:03 2025 +0530 arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 Enable proper pin multiplexing for the I2S1 8-channel transmit interface by adding the default pinctrl configuration which esures correct signal routing and avoids pinmux conflicts during audio playback. Changes fix the error [ 116.856643] [ T782] rockchip-pinctrl pinctrl: pin gpio1-10 already requested by affinity_hint; cannot claim for fe410000.i2s [ 116.857567] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: pin-42 (fe410000.i2s) [ 116.857618] [ T782] rockchip-pinctrl pinctrl: error -EINVAL: could not request pin 42 (gpio1-10) from group i2s1m0-sdi1 on device rockchip-pinctrl [ 116.857659] [ T782] rockchip-i2s-tdm fe410000.i2s: Error applying setting, reverse things back I2S1 on the M1 to the codec in the RK809 only uses the SCLK, LRCK, SDI0 and SDO0 signals, so limit the claimed pins to those. With this change audio output works as expected: $ aplay -l **** List of PLAYBACK Hardware Devices **** card 0: HDMI [HDMI], device 0: fe400000.i2s-i2s-hifi i2s-hifi-0 [fe400000.i2s-i2s-hifi i2s-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0 card 1: RK817 [Analog RK817], device 0: fe410000.i2s-rk817-hifi rk817-hifi-0 [fe410000.i2s-rk817-hifi rk817-hifi-0] Subdevices: 1/1 Subdevice #0: subdevice #0 Fixes: 78f858447cb7 ("arm64: dts: rockchip: Add analog audio on ODROID-M1") Cc: Aurelien Jarno Signed-off-by: Anand Moon [adapted the commit message a bit] Signed-off-by: Heiko Stuebner commit 7e091add9c433bab6912228799bf508e2414acc3 Author: Martin George Date: Mon Sep 8 22:54:57 2025 +0530 nvme-auth: update sc_c in host response The sc_c field is currently not updated in the host response to the controller challenge leading to failures while attempting secure channel concatenation. Fix this by adding a new sc_c variable to the dhchap queue context structure which is appropriately set during negotiate and then used in the host response. Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation") Signed-off-by: Martin George Signed-off-by: Prashanth Adurthi Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 52e59f7740ba23bbb664914967df9a00208ca10c Author: Pranjal Ramajor Asha Kanojiya Date: Tue Oct 7 08:18:37 2025 +0200 accel/qaic: Synchronize access to DBC request queue head & tail pointer Two threads of the same process can potential read and write parallelly to head and tail pointers of the same DBC request queue. This could lead to a race condition and corrupt the DBC request queue. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip [jhugo: Add fixes tag] Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007061837.206132-1-youssef.abdulrahman@oss.qualcomm.com commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca Author: Youssef Samir Date: Tue Oct 7 14:23:20 2025 +0200 accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dma_xfer struct. In that case, encode_addr_size_pairs() will try to access the sgt which will lead to a general protection fault. Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred. Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") Signed-off-by: Youssef Samir Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.qualcomm.com commit fd6e385528d8f85993b7bfc6430576136bb14c65 Author: Jeff Hugo Date: Tue Oct 7 13:57:50 2025 +0200 accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to queuing the buffers. We currently initialize some of the resources after queuing the buffers which creates a race between the probe() and any data that comes back from the device. If the uninitialized resources are accessed, we could see page faults. Fix the init ordering to close the race. Fixes: 5f8df5c6def6 ("accel/qaic: Add bootlog debugfs") Signed-off-by: Jeffrey Hugo Signed-off-by: Youssef Samir Reviewed-by: Jeff Hugo Reviewed-by: Carl Vanderlip Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20251007115750.332169-1-youssef.abdulrahman@oss.qualcomm.com commit c90fad3e4157f943b6d5842d3ceb20b32e566986 Author: Jacopo Mondi Date: Tue Oct 14 15:19:34 2025 +0200 media: ivtv: Fix invalid access to file * Since commit 9ba9d11544f9 ("media: ivtv: Access v4l2_fh from file") all ioctl handlers have been ported to operate on the file * first function argument. The ivtv DVB layer calls ivtv_init_on_first_open() when the driver needs to start streaming. This function calls the s_input() and s_frequency() ioctl handlers directly, but being called from the driver context, it doesn't have a valid file * to pass them. This causes the ioctl handlers to deference an invalid pointer. Fix this by moving the implementation of those ioctls to two helper functions. The ivtv_do_s_input() helper accepts a struct ivtv * as first argument, which is easily accessible in ivtv_init_on_first_open() as well as from the file * argument of the ioctl handler. The ivtv_s_frequency() takes an ivtv_stream * instead. The stream * can safely be accessed in ivtv_init_on_first_open() where it is hard-coded to the IVTV_ENC_STREAM_TYPE_MPG stream type, as well as from the ioctl handler as a valid stream type is associated to each open file handle depending on which video device node has been opened in the ivtv_open() file operation. The bug has been reported by Smatch. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aKL4OMWsESUdX8KQ@stanley.mountain/ Fixes: 9ba9d11544f9 ("media: ivtv: Access v4l2_fh from file") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Tested-by: Hans Verkuil Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 512f0b7ebbc79d97d9485cd055902d439237e91f Author: Jacopo Mondi Date: Tue Oct 14 15:19:33 2025 +0200 media: cx18: Fix invalid access to file * Sice commit 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file") all ioctl handlers have been ported to operate on the file * first function argument. The cx18 DVB layer calls cx18_init_on_first_open() when the driver needs to start streaming. This function calls the s_input(), s_std() and s_frequency() ioctl handlers directly, but being called from the driver context, it doesn't have a valid file * to pass them. This causes the ioctl handlers to deference an invalid pointer. Fix this by moving the implementation of those ioctls to functions that take a cx18 pointer instead of a file pointer, and turn the V4L2 ioctl handlers into wrappers that get the cx18 from the file. When calling from cx18_init_on_first_open(), pass the cx18 pointer directly. This allows removing the fake fh in cx18_init_on_first_open(). The bug has been reported by Smatch: --> 1223 cx18_s_input(NULL, &fh, video_input); The patch adds a new dereference of "file" but some of the callers pass a NULL pointer. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aKL4OMWsESUdX8KQ@stanley.mountain/ Fixes: 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Tested-by: Hans Verkuil Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit d41f68dff783d181a8fd462e612bda0fbab7f735 Author: Randy Dunlap Date: Mon Oct 13 20:05:52 2025 -0700 ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings Fix spelling of CIP_NO_HEADER to prevent a kernel-doc warning. Warning: amdtp-stream.h:57 Enum value 'CIP_NO_HEADER' not described in enum 'cip_flags' Warning: amdtp-stream.h:57 Excess enum value '%CIP_NO_HEADERS' description in 'cip_flags' Fixes: 3b196c394dd9f ("ALSA: firewire-lib: add no-header packet processing") Signed-off-by: Randy Dunlap Reviewed-by: Takashi Sakamoto Signed-off-by: Takashi Iwai commit 4f86eb0a38bc719ba966f155071a6f0594327f34 Author: Wang Liang Date: Mon Oct 13 16:00:39 2025 +0800 selftests: net: check jq command is supported The jq command is used in vlan_bridge_binding.sh, if it is not supported, the test will spam the following log. # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # ./vlan_bridge_binding.sh: line 51: jq: command not found # TEST: Test bridge_binding on->off when lower down [FAIL] # Got operstate of , expected 0 The rtnetlink.sh has the same problem. It makes sense to check if jq is installed before running these tests. After this patch, the vlan_bridge_binding.sh skipped if jq is not supported: # timeout set to 3600 # selftests: net: vlan_bridge_binding.sh # TEST: jq not installed [SKIP] Fixes: dca12e9ab760 ("selftests: net: Add a VLAN bridge binding selftest") Fixes: 6a414fd77f61 ("selftests: rtnetlink: Add an address proto test") Signed-off-by: Wang Liang Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20251013080039.3035898-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit 867537094124b0736ca2a40193de94fc5dc0b8d3 Author: Rob Herring (Arm) Date: Mon Oct 13 16:31:18 2025 -0500 dt-bindings: i2c: Convert apm,xgene-slimpro-i2c to DT schema Convert APM X-Gene slimpro-i2c binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 72f437e674e54f1c143dccc67e5556d8d5acb241 Author: Hans de Goede Date: Wed Oct 1 23:23:10 2025 +0200 i2c: usbio: Add ACPI device-id for MTL-CVF devices Add "INTC10D2" ACPI device-id for MTL-CVF devices, like the Dell Latitude 7450. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2368506 Signed-off-by: Hans de Goede Acked-by: Sakari Ailus Acked-by: Israel Cepeda Signed-off-by: Wolfram Sang commit ae11e08c3d0c78d08dac4cea30bf39ede2130b03 Author: Sakari Ailus Date: Fri Jul 4 10:54:15 2025 +0300 i2c: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Andi Shyti Signed-off-by: Wolfram Sang commit 17e3e88ed0b6318fde0d1c14df1a804711cab1b5 Author: Vincent Guittot Date: Wed Oct 8 15:12:14 2025 +0200 sched/fair: Fix pelt lost idle time detection The check for some lost idle pelt time should be always done when pick_next_task_fair() fails to pick a task and not only when we call it from the fair fast-path. The case happens when the last running task on rq is a RT or DL task. When the latter goes to sleep and the /Sum of util_sum of the rq is at the max value, we don't account the lost of idle time whereas we should. Fixes: 67692435c411 ("sched: Rework pick_next_task() slow-path") Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) commit ee6e44dfe6e50b4a5df853d933a96bdff5309e6e Author: Peter Zijlstra (Intel) Date: Fri Oct 10 00:17:27 2025 +0530 sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1" WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170 NIP [c0000000002b6ed8] cpudl_set+0x58/0x170 LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 Call Trace: [c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable) [c0000000002b7cb8] dl_server_timer+0x168/0x2a0 [c00000000034df84] __hrtimer_run_queues+0x1a4/0x390 [c00000000034f624] hrtimer_interrupt+0x124/0x300 [c00000000002a230] timer_interrupt+0x140/0x320 Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") This happens since: - dl_server hrtimer gets enqueued close to cpu offline, when kthread_park enqueues a fair task. - CPU goes offline and drmgr removes it from cpu_present_mask. - hrtimer fires and warning is hit. Fix it by stopping the dl_server before CPU is marked dead. [1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/ [2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr [sshegde: wrote the changelog and tested it] Fixes: 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck") Closes: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com Signed-off-by: Peter Zijlstra (Intel) Reported-by: Venkat Rao Bagalkote Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marek Szyprowski Tested-by: Shrikanth Hegde commit a7cdc2086c19e435d4cec3f9393b5f46899c0468 Author: Colin Ian King Date: Sun Sep 28 22:01:18 2025 +0100 HID: hid-debug: Fix spelling mistake "Rechargable" -> "Rechargeable" There is a spelling mistake in HID description. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Jiri Kosina commit bd5afca115f181c85f992d42a57cd497bc823ccb Author: Lorenzo Bianconi Date: Sun Oct 12 11:19:44 2025 +0200 net: airoha: Take into account out-of-order tx completions in airoha_dev_xmit() Completion napi can free out-of-order tx descriptors if hw QoS is enabled and packets with different priority are queued to same DMA ring. Take into account possible out-of-order reports checking if the tx queue is full using circular buffer head/tail pointer instead of the number of queued packets. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Suggested-by: Simon Horman Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251012-airoha-tx-busy-queue-v2-1-a600b08bab2d@kernel.org Signed-off-by: Paolo Abeni commit 295ce1eb36ae47dc862d6c8a1012618a25516208 Author: Eric Dumazet Date: Sat Oct 11 11:57:42 2025 +0000 tcp: fix tcp_tso_should_defer() vs large RTT Neal reported that using neper tcp_stream with TCP_TX_DELAY set to 50ms would often lead to flows stuck in a small cwnd mode, regardless of the congestion control. While tcp_stream sets TCP_TX_DELAY too late after the connect(), it highlighted two kernel bugs. The following heuristic in tcp_tso_should_defer() seems wrong for large RTT: delta = tp->tcp_clock_cache - head->tstamp; /* If next ACK is likely to come too late (half srtt), do not defer */ if ((s64)(delta - (u64)NSEC_PER_USEC * (tp->srtt_us >> 4)) < 0) goto send_now; If next ACK is expected to come in more than 1 ms, we should not defer because we prefer a smooth ACK clocking. While blamed commit was a step in the good direction, it was not generic enough. Another patch fixing TCP_TX_DELAY for established flows will be proposed when net-next reopens. Fixes: 50c8339e9299 ("tcp: tso: restore IW10 after TSO autosizing") Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Tested-by: Neal Cardwell Link: https://patch.msgid.link/20251011115742.1245771-1-edumazet@google.com [pabeni@redhat.com: fixed whitespace issue] Signed-off-by: Paolo Abeni commit 083a4f3f3cc7d107728c8f297e4f6276f0876b2d Author: Jonathan Denose Date: Mon Oct 13 20:54:57 2025 +0000 HID: Kconfig: Fix build error from CONFIG_HID_HAPTIC Temporarily change CONFIG_HID_HAPTIC to be bool instead of tristate, until we implement a permanent solution. Recently the CONFIG_HID_HAPTIC Kconfig option was reported as causing the following build errors: MODPOST Module.symvers ERROR: modpost: "hid_haptic_init" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_pressure_increase" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_check_pressure_unit" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_input_configured" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_input_mapping" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_feature_mapping" [drivers/hid/hid-multitouch.ko] undefined! ERROR: modpost: "hid_haptic_pressure_reset" [drivers/hid/hid-multitouch.ko] undefined! make[3]: *** [/home/thl/var/linux.dev/scripts/Makefile.modpost:147: Module.symvers] Error 1 when the kernel is compiled with the following configuration: CONFIG_HID=y CONFIG_HID_MULTITOUCH=m CONFIG_HID_HAPTIC=m To resolve this, temporarily change the CONFIG_HID_HAPTIC option to be bool, until we arrive at a permanent solution to enable CONFIG_HID_HAPTIC to be tristate. For a more detailed discussion, see [1]. [1]: https://lore.kernel.org/linux-input/auypydfkhx2eg7vp764way4batdilzc35inqda3exwzs3tk3ff@oagat6g46zto/ Signed-off-by: Jonathan Denose Signed-off-by: Jiri Kosina commit 75527d61d60d493d1eb064f335071a20ca581f54 Author: Yi Cong Date: Sat Oct 11 16:24:15 2025 +0800 r8152: add error handling in rtl8152_driver_init rtl8152_driver_init() is missing the error handling. When rtl8152_driver registration fails, rtl8152_cfgselector_driver should be deregistered. Fixes: ec51fbd1b8a2 ("r8152: add USB device driver for config selection") Cc: stable@vger.kernel.org Signed-off-by: Yi Cong Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251011082415.580740-1-yicongsrfy@163.com [pabeni@redhat.com: clarified the commit message] Signed-off-by: Paolo Abeni commit b8874720b2f33a06ff1d4cf3827e7ec1195cb360 Author: Vicki Pfau Date: Mon Oct 6 18:05:33 2025 -0700 HID: nintendo: Rate limit IMU compensation message Some controllers are very bad at updating the IMU, leading to these messages spamming the syslog. Rate-limiting them helps with this a bit. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit b73bc6a51f0c0066912c7e181acee41091c70fe6 Author: Vicki Pfau Date: Mon Oct 6 18:05:32 2025 -0700 HID: nintendo: Wait longer for initial probe Some third-party controllers, such as the PB Tails CHOC, won't always respond quickly on startup. Since this packet is needed for probe, and only once during probe, let's just wait an extra second, which makes connecting consistent. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit 1d64624243af8329b4b219d8c39e28ea448f9929 Author: Vicki Pfau Date: Mon Oct 6 18:05:31 2025 -0700 HID: core: Add printk_ratelimited variants to hid_warn() etc hid_warn_ratelimited() is needed. Add the others as part of the block. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 Author: Zqiang Date: Sat Oct 11 15:05:18 2025 +0800 usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx(). Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change") Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1e1 Suggested-by: Jakub Kicinski Signed-off-by: Zqiang Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev Signed-off-by: Paolo Abeni commit 1141ed52348d3df82d3fd2316128b3fc6203a68c Author: Oleg Makarenko Date: Mon Sep 29 18:46:11 2025 +0300 HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel This patch adds ALWAYS_POLL quirk for the VRS R295 steering wheel joystick. This device reboots itself every 8-10 seconds if it is not polled. Signed-off-by: Oleg Makarenko Signed-off-by: Jiri Kosina commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 Author: Tristan Lobb Date: Sun Sep 28 18:25:43 2025 +0200 HID: quirks: avoid Cooler Master MM712 dongle wakeup bug The Cooler Master Mice Dongle includes a vendor defined HID interface alongside its mouse interface. Not polling it will cause the mouse to stop responding to polls on any interface once woken up again after going into power saving mode. Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and the Dongle's PID. Signed-off-by: Tristan Lobb Signed-off-by: Jiri Kosina commit c5705a2a4aa35350e504b72a94b5c71c3754833c Author: Harshit Mogalapalli Date: Fri Oct 10 13:42:39 2025 -0700 Octeontx2-af: Fix missing error code in cgx_probe() When CGX fails mapping to NIX, set the error code to -ENODEV, currently err is zero and that is treated as success path. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aLAdlCg2_Yv7Y-3h@stanley.mountain/ Fixes: d280233fc866 ("Octeontx2-af: Fix NIX X2P calibration failures") Signed-off-by: Harshit Mogalapalli Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251010204239.94237-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Paolo Abeni commit 362f21536966d7039da1de762f28f4ad44565acc Author: Deepak Sharma Date: Fri Sep 26 20:28:11 2025 +0530 HID: cp2112: Add parameter validation to data length Syzkaller reported a stack OOB access in cp2112_write_req caused by lack of parameter validation for the user input in I2C SMBUS ioctl in cp2112 driver Add the parameter validation for the data->block[0] to be bounded by I2C_SMBUS_BLOCK_MAX + the additional compatibility padding [jkosina@suse.com: fix whitespace damage] Reported-by: syzbot+7617e19c8a59edfbd879@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7617e19c8a59edfbd879 Tested-by: syzbot+7617e19c8a59edfbd879@syzkaller.appspotmail.com Signed-off-by: Deepak Sharma Signed-off-by: Jiri Kosina commit 50f1f782f8d621a90108340c632bcb6ab4307d2e Author: Abhishek Tamboli Date: Wed Sep 24 10:07:20 2025 +0530 HID: intel-thc-hid: intel-quickspi: Add ARL PCI Device Id's Add the missing PCI ID for the quickspi device used on the Lenovo Yoga Pro 9i 16IAH10. Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=220567 Signed-off-by: Abhishek Tamboli Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 8fe2cd8ec84b3592b57f40b080f9d5aeebd553af Author: Even Xu Date: Fri Sep 19 15:09:39 2025 +0800 HID: intel-thc-hid: Intel-quickspi: switch first interrupt from level to edge detection The original implementation used level detection for the first interrupt after device reset to avoid potential interrupt line noise and missed interrupts during the initialization phase. However, this approach introduced unintended side effects when tested with certain touch panels, including: - Delayed hardware interrupt response - Multiple spurious interrupt triggers Switching back to edge detection for the first interrupt resolves these issues while maintaining reliable interrupt handling. Extensive testing across multiple platforms with touch panels from various vendors confirms this change introduces no regressions. [jkosina@suse.com: properly capitalize shortlog] Fixes: 9d8d51735a3a ("HID: intel-thc-hid: intel-quickspi: Add HIDSPI protocol implementation") Tested-by: Rui Zhang Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit 6c26c055523d915afb8d18e7277848eff66a3085 Author: Xinpeng Sun Date: Thu Oct 9 11:31:08 2025 +0800 HID: intel-thc-hid: intel-quicki2c: Fix wrong type casting The type definition of qcdev->i2c_max_frame_size is already u32, so remove the unnecessary type casting le16_to_cpu. Signed-off-by: Xinpeng Sun Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280841.pxmgBzKW-lkp@intel.com/ Signed-off-by: Jiri Kosina commit 48a710760e10a4f36e11233a21860796ba204b1e Merge: 7f38a148755560 3a8660878839fa Author: Thomas Zimmermann Date: Tue Oct 14 10:59:58 2025 +0200 Merge drm/drm-fixes into drm-misc-fixes Updating drm-misc-fixes to the state of v6.18-rc1. Signed-off-by: Thomas Zimmermann commit fa4f4bae893fbce8a3edfff1ab7ece0c01dc1328 Author: Adrian Hunter Date: Mon Oct 13 10:22:44 2025 +0300 perf/core: Fix MMAP2 event device with backing files Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. That causes perf to misreport the device major/minor numbers of the file system of the file, and the generation of the file, and potentially other inode details. There is an existing helper file_user_inode() for that situation. Use file_user_inode() instead of file_inode() to get the inode for MMAP2 events. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record -e cycles:u -- /root/test/merged/cat /proc/self/maps ... 55b2c91d0000-55b2c926b000 r-xp 00018000 00:1a 3419 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.004 MB perf.data (5 samples) ] # # stat /root/test/merged/cat File: /root/test/merged/cat Size: 1127792 Blocks: 2208 IO Block: 4096 regular file Device: 0,26 Inode: 3419 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2025-09-08 12:23:59.453309624 +0000 Modify: 2025-09-08 12:23:59.454309624 +0000 Change: 2025-09-08 12:23:59.454309624 +0000 Birth: 2025-09-08 12:23:59.453309624 +0000 Before: Device reported 00:02 differs from stat output and /proc/self/maps # perf script --show-mmap-events | grep /root/test/merged/cat cat 377 [-01] 243.078558: PERF_RECORD_MMAP2 377/377: [0x55b2c91d0000(0x9b000) @ 0x18000 00:02 3419 2068525940]: r-xp /root/test/merged/cat After: Device reported 00:1a is the same as stat output and /proc/self/maps # perf script --show-mmap-events | grep /root/test/merged/cat cat 362 [-01] 127.755167: PERF_RECORD_MMAP2 362/362: [0x55ba6e781000(0x9b000) @ 0x18000 00:1a 3419 0]: r-xp /root/test/merged/cat With respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12. Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org # 6.8 commit 8818f507a9391019a3ec7c57b1a32e4b386e48a5 Author: Adrian Hunter Date: Mon Oct 13 10:22:43 2025 +0300 perf/core: Fix MMAP event path names with backing files Some file systems like FUSE-based ones or overlayfs may record the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. Since commit def3ae83da02f ("fs: store real path instead of fake path in backing file f_path"), file_path() no longer returns the user file path when applied to a backing file. There is an existing helper file_user_path() for that situation. Use file_user_path() instead of file_path() to get the path for MMAP and MMAP2 events. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps ... 55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.060 MB perf.data ] # Before: File name is wrong (/cat), so decoding fails: # perf script --no-itrace --show-mmap-events cat 367 [016] 100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat ... # perf script --itrace=e | wc -l Warning: 19 instruction trace errors 19 # After: File name is correct (/root/test/merged/cat), so decoding is ok: # perf script --no-itrace --show-mmap-events cat 364 [016] 72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat # perf script --itrace=e # perf script --itrace=e | wc -l 0 # Fixes: def3ae83da02f ("fs: store real path instead of fake path in backing file f_path") Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org commit ebfc8542ad62d066771e46c8aa30f5624b89cad8 Author: Adrian Hunter Date: Mon Oct 13 10:22:42 2025 +0300 perf/core: Fix address filter match with backing files It was reported that Intel PT address filters do not work in Docker containers. That relates to the use of overlayfs. overlayfs records the backing file in struct vm_area_struct vm_file, instead of the user file that the user mmapped. In order for an address filter to match, it must compare to the user file inode. There is an existing helper file_user_inode() for that situation. Use file_user_inode() instead of file_inode() to get the inode for address filter matching. Example: Setup: # cd /root # mkdir test ; cd test ; mkdir lower upper work merged # cp `which cat` lower # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged # perf record --buildid-mmap -e intel_pt//u --filter 'filter * @ /root/test/merged/cat' -- /root/test/merged/cat /proc/self/maps ... 55d61d246000-55d61d2e1000 r-xp 00018000 00:1a 3418 /root/test/merged/cat ... [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.015 MB perf.data ] # perf buildid-cache --add /root/test/merged/cat Before: Address filter does not match so there are no control flow packets # perf script --itrace=e # perf script --itrace=b | wc -l 0 # perf script -D | grep 'TIP.PGE' | wc -l 0 # After: Address filter does match so there are control flow packets # perf script --itrace=e # perf script --itrace=b | wc -l 235 # perf script -D | grep 'TIP.PGE' | wc -l 57 # With respect to stable kernels, overlayfs mmap function ovl_mmap() was added in v4.19 but file_user_inode() was not added until v6.8 and never back-ported to stable kernels. FMODE_BACKING that it depends on was added in v6.5. This issue has gone largely unnoticed, so back-porting before v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite version, although in practice the next long term kernel is 6.12. Closes: https://lore.kernel.org/linux-perf-users/aBCwoq7w8ohBRQCh@fremen.lan Reported-by: Edd Barrett Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Acked-by: Amir Goldstein Cc: stable@vger.kernel.org # 6.8 commit 62685ab071de7c39499212bff19f1b5bc0148bc7 Author: Jiri Olsa Date: Wed Oct 1 15:24:49 2025 +0200 uprobe: Move arch_uprobe_optimize right after handlers execution It's less confusing to optimize uprobe right after handlers execution and before we do the check for changed ip register to avoid situations where changed ip register would skip uprobe optimization. Suggested-by: Linus Torvalds Signed-off-by: Jiri Olsa Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Masami Hiramatsu (Google) Acked-by: Andrii Nakryiko Acked-by: Oleg Nesterov commit 7f38a1487555604bc4e210fa7cc9b1bce981c40e Author: Alok Tiwari Date: Sun Oct 12 07:20:01 2025 -0700 drm/rockchip: vop2: use correct destination rectangle height check The vop2_plane_atomic_check() function incorrectly checks drm_rect_width(dest) twice instead of verifying both width and height. Fix the second condition to use drm_rect_height(dest) so that invalid destination rectangles with height < 4 are correctly rejected. Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") Signed-off-by: Alok Tiwari Reviewed-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251012142005.660727-1-alok.a.tiwari@oracle.com commit 2616222e423398bb374ffcb5d23dea4ba2c3e524 Author: Raju Rangoju Date: Fri Oct 10 12:21:42 2025 +0530 amd-xgbe: Avoid spurious link down messages during interface toggle During interface toggle operations (ifdown/ifup), the driver currently resets the local helper variable 'phy_link' to -1. This causes the link state machine to incorrectly interpret the state as a link change event, resulting in spurious "Link is down" messages being logged when the interface is brought back up. Preserve the phy_link state across interface toggles to avoid treating the -1 sentinel value as a legitimate link state transition. Fixes: 88131a812b16 ("amd-xgbe: Perform phy connect/disconnect at dev open/stop") Signed-off-by: Raju Rangoju Reviewed-by: Dawid Osuchowski Link: https://patch.msgid.link/20251010065142.1189310-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 2bbd38fcd29670e46c0fdb9cd0e90507a8a1bf6a Author: Mathias Nyman Date: Tue Oct 14 01:55:42 2025 +0300 xhci: dbc: enable back DbC in resume if it was enabled before suspend DbC is currently only enabled back if it's in configured state during suspend. If system is suspended after DbC is enabled, but before the device is properly enumerated by the host, then DbC would not be enabled back in resume. Always enable DbC back in resume if it's suspended in enabled, connected, or configured state Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit f3d12ec847b945d5d65846c85f062d07d5e73164 Author: Mathias Nyman Date: Tue Oct 14 01:55:41 2025 +0300 xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event DbC may add 1024 bogus bytes to the beginneing of the receiving endpoint if DbC hw triggers a STALL event before any Transfer Blocks (TRBs) for incoming data are queued, but driver handles the event after it queued the TRBs. This is possible as xHCI DbC hardware may trigger spurious STALL transfer events even if endpoint is empty. The STALL event contains a pointer to the stalled TRB, and "remaining" untransferred data length. As there are no TRBs queued yet the STALL event will just point to first TRB position of the empty ring, with '0' bytes remaining untransferred. DbC driver is polling for events, and may not handle the STALL event before /dev/ttyDBC0 is opened and incoming data TRBs are queued. The DbC event handler will now assume the first queued TRB (length 1024) has stalled with '0' bytes remaining untransferred, and copies the data This race situation can be practically mitigated by making sure the event handler handles all pending transfer events when DbC reaches configured state, and only then create dev/ttyDbC0, and start queueing transfers. The event handler can this way detect the STALL events on empty rings and discard them before any transfers are queued. This does in practice solve the issue, but still leaves a small possible gap for the race to trigger. We still need a way to distinguish spurious STALLs on empty rings with '0' bytes remaing, from actual STALL events with all bytes transmitted. Cc: stable Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Tested-by: Łukasz Bartosik Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 8607edcd1748503f4f58e66ca0216170f260c79b Author: Michal Pecio Date: Tue Oct 14 01:55:40 2025 +0300 usb: xhci-pci: Fix USB2-only root hub registration A recent change to hide USB3 root hubs of USB2-only controllers broke registration of USB2 root hubs - allow_single_roothub is set too late, and by this time xhci_run() has already deferred root hub registration until after the shared HCD is added, which will never happen. This makes such controllers unusable, but testers didn't notice since they were only bothered by warnings about empty USB3 root hubs. The bug causes problems to other people who actually use such HCs and I was able to confirm it on an ordinary HC by patching to ignore USB3 ports. Setting allow_single_roothub during early setup fixes things. Reported-by: Arisa Snowbell Closes: https://lore.kernel.org/linux-usb/CABpa4MA9unucCoKtSdzJyOLjHNVy+Cwgz5AnAxPkKw6vuox1Nw@mail.gmail.com/ Reported-by: Michal Kubecek Closes: https://lore.kernel.org/linux-usb/lnb5bum7dnzkn3fc7gq6hwigslebo7o4ccflcvsc3lvdgnu7el@fvqpobbdoapl/ Fixes: 719de070f764 ("usb: xhci-pci: add support for hosts with zero USB3 ports") Tested-by: Arisa Snowbell Tested-by: Michal Kubecek Suggested-by: Mathias Nyman Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman commit 095232711f23179053ca26bcf046ca121a91a465 Author: Francesco Valla Date: Fri Oct 3 12:33:03 2025 +0200 drm/draw: fix color truncation in drm_draw_fill24 The color parameter passed to drm_draw_fill24() was truncated to 16 bits, leading to an incorrect color drawn to the target iosys_map. Fix this behavior, widening the parameter to 32 bits. Fixes: 31fa2c1ca0b2 ("drm/panic: Move drawing functions to drm_draw") Signed-off-by: Francesco Valla Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20251003-drm_draw_fill24_fix-v1-1-8fb7c1c2a893@valla.it Signed-off-by: Jocelyn Falempe commit ca88ecdce5f51874a7c151809bd2c936ee0d3805 Author: Marc Zyngier Date: Wed Oct 8 22:35:15 2025 +0100 arm64: Revamp HCR_EL2.E2H RES1 detection We currently have two ways to identify CPUs that only implement FEAT_VHE and not FEAT_E2H0: - either they advertise it via ID_AA64MMFR4_EL1.E2H0, - or the HCR_EL2.E2H bit is RAO/WI However, there is a third category of "cpus" that fall between these two cases: on CPUs that do not implement FEAT_FGT, it is IMPDEF whether an access to ID_AA64MMFR4_EL1 can trap to EL2 when the register value is zero. A consequence of this is that on systems such as Neoverse V2, a NV guest cannot reliably detect that it is in a VHE-only configuration (E2H is writable, and ID_AA64MMFR0_EL1 is 0), despite the hypervisor's best effort to repaint the id register. Replace the RAO/WI test by a sequence that makes use of the VHE register remnapping between EL1 and EL2 to detect this situation, and work out whether we get the VHE behaviour even after having set HCR_EL2.E2H to 0. This solves the NV problem, and provides a more reliable acid test for CPUs that do not completely follow the letter of the architecture while providing a RES1 behaviour for HCR_EL2.E2H. Suggested-by: Mark Rutland Acked-by: Mark Rutland Acked-by: Catalin Marinas Reviewed-by: Oliver Upton Tested-by: Jan Kotas Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/15A85F2B-1A0C-4FA7-9FE4-EEC2203CC09E@global.cadence.com commit c065b6046b3493a878c2ceb810aed845431badb4 Author: Theodore Ts'o Date: Mon Oct 13 21:50:40 2025 -0400 Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs Commit d6ace46c82fd ("ext4: remove obsolete EXT3 config options") removed the obsolete EXT3_CONFIG options, since it had been over a decade since fs/ext3 had been removed. Unfortunately, there were a number of defconfigs that still used CONFIG_EXT3_FS which the cleanup commit didn't fix up. This led to a large number of defconfig test builds to fail. Oops. Fixes: d6ace46c82fd ("ext4: remove obsolete EXT3 config options") Signed-off-by: Theodore Ts'o commit 2c67301584f2671e320236df6bbe75ae09feb4d0 Author: Marek Vasut Date: Sat Oct 11 13:02:49 2025 +0200 net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present The driver is currently checking for PHYCR2 register presence in rtl8211f_config_init(), but it does so after accessing PHYCR2 to disable EEE. This was introduced in commit bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE"). Move the PHYCR2 presence test before the EEE disablement and simplify the code. Fixes: bfc17c165835 ("net: phy: realtek: disable PHY-mode EEE") Signed-off-by: Marek Vasut Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251011110309.12664-1-marek.vasut@mailbox.org Signed-off-by: Jakub Kicinski commit d1d5df4691e4322656024fc374d0faec4387aa0f Merge: 21f4d45eba0b2d 5feef67b646d8f Author: Jakub Kicinski Date: Mon Oct 13 17:44:51 2025 -0700 Merge branch 'intel-wired-lan-driver-updates-2025-10-01-idpf-ixgbe-ixgbevf' Jacob Keller says: ==================== Intel Wired LAN Driver Updates 2025-10-01 (idpf, ixgbe, ixgbevf) For idpf: Milena fixes a memory leak in the idpf reset logic when the driver resets with an outstanding Tx timestamp. For ixgbe and ixgbevf: Jedrzej fixes an issue with reporting link speed on E610 VFs. Jedrzej also fixes the VF mailbox API incompatibilities caused by the confusion with API v1.4, v1.5, and v1.6. The v1.4 API introduced IPSEC offload, but this was only supported on Linux hosts. The v1.5 API introduced a new mailbox API which is necessary to resolve issues on ESX hosts. The v1.6 API introduced a new link management API for E610. Jedrzej introduces a new v1.7 API with a feature negotiation which enables properly checking if features such as IPSEC or the ESX mailbox APIs are supported. This resolves issues with compatibility on different hosts, and aligns the API across hosts instead of having Linux require custom mailbox API versions for IPSEC offload. Koichiro fixes a KASAN use-after-free bug in ixgbe_remove(). ==================== Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-0-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 5feef67b646d8f5064bac288e22204ffba2b9a4a Author: Koichiro Den Date: Thu Oct 9 17:03:51 2025 -0700 ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end. KASAN report: BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] Read of size 8 at addr ffff0000adf813e0 by task bash/2095 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S 6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full) [...] Call trace: show_stack+0x30/0x90 (C) dump_stack_lvl+0x9c/0xd0 print_address_description.constprop.0+0x90/0x310 print_report+0x104/0x1f0 kasan_report+0x88/0x180 __asan_report_load8_noabort+0x20/0x30 ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe] ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe] ixgbe_remove+0x2d0/0x8c0 [ixgbe] pci_device_remove+0xa0/0x220 device_remove+0xb8/0x170 device_release_driver_internal+0x318/0x490 device_driver_detach+0x40/0x68 unbind_store+0xec/0x118 drv_attr_store+0x64/0xb8 sysfs_kf_write+0xcc/0x138 kernfs_fop_write_iter+0x294/0x440 new_sync_write+0x1fc/0x588 vfs_write+0x480/0x6a0 ksys_write+0xf0/0x1e0 __arm64_sys_write+0x70/0xc0 invoke_syscall.constprop.0+0xcc/0x280 el0_svc_common.constprop.0+0xa8/0x248 do_el0_svc+0x44/0x68 el0_svc+0x54/0x160 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 Fixes: a0285236ab93 ("ixgbe: add initial devlink support") Signed-off-by: Koichiro Den Tested-by: Rinitha S Reviewed-by: Jedrzej Jagielski Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-6-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 823be089f9c8ab136ba382b516aedd3f7ac854bd Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:50 2025 -0700 ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd Send to VF information about features supported by the PF driver. Increase API version to 1.7. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-5-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit a7075f501bd33c93570af759b6f4302ef0175168 Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:49 2025 -0700 ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API. This convention has been broken since introducing API 1.4. Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support for IPSec which is specific only for the kernel ixgbe driver. None of the rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature was introduced along with introduction of the feature itself. Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") increasing API version to 1.5 did the same - it introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in the same time not touching the version defined for the PF ixgbe driver. It led to additional discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes crashes. The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5"). As a result we have regression for IPsec support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX. To fix this mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether to set support for IPSec and ESX-specific enhanced mailbox. New mailbox op, for compatibility purposes, must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6 and doesn't incorporate features negotiate op. Features negotiation mechanism gives possibility to be extended with new features when needed in the future. Reported-by: Jacob Keller Closes: https://lore.kernel.org/intel-wired-lan/20241101-jk-ixgbevf-mailbox-v1-5-fixes-v1-0-f556dc9a66ed@intel.com/ Fixes: 0062e7cc955e ("ixgbevf: add VF IPsec offload code") Fixes: 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") Reviewed-by: Jacob Keller Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Cc: stable@vger.kernel.org Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-4-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit f7f97cbc03a470ce405d48dedb7f135713caa0fa Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:48 2025 -0700 ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation Update supported API version and provide handler for IXGBE_VF_GET_PF_LINK_STATE cmd. Simply put stored values of link speed and link_up from adapter context. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Link: https://lore.kernel.org/stable/20250828095227.1857066-3-jedrzej.jagielski%40intel.com Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-3-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 53f0eb62b4d23d40686f2dd51776b8220f2887bb Author: Jedrzej Jagielski Date: Thu Oct 9 17:03:47 2025 -0700 ixgbevf: fix getting link speed data for E610 devices E610 adapters no longer use the VFLINKS register to read PF's link speed and linkup state. As a result VF driver cannot get actual link state and it incorrectly reports 10G which is the default option. It leads to a situation where even 1G adapters print 10G as actual link speed. The same happens when PF driver set speed different than 10G. Add new mailbox operation to let the VF driver request a PF driver to provide actual link data. Update the mailbox api to v1.6. Incorporate both ways of getting link status within the legacy ixgbe_check_mac_link_vf() function. Fixes: 4c44b450c69b ("ixgbevf: Add support for Intel(R) E610 device") Co-developed-by: Andrzej Wilczynski Signed-off-by: Andrzej Wilczynski Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Cc: stable@vger.kernel.org Signed-off-by: Jedrzej Jagielski Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-2-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit a3f8c0a273120fd2638f03403e786c3de2382e72 Author: Milena Olech Date: Thu Oct 9 17:03:46 2025 -0700 idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, there may be a case where the index is requested, SKB is assigned and never consumed by PTP flows - for example due to reset during running PTP apps. Add a check in release timestamping function to verify if the SKB assigned to Tx timestamp latch was freed, and release remaining SKBs. Fixes: 4901e83a94ef ("idpf: add Tx timestamp capabilities negotiation") Signed-off-by: Milena Olech Signed-off-by: Anton Nadezhdin Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20251009-jk-iwl-net-2025-10-01-v3-1-ef32a425b92a@intel.com Signed-off-by: Jakub Kicinski commit 21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Thu Oct 9 16:02:19 2025 +0100 net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth"), ipv6 tunnel yet increases the headroom without any ceiling. Reflect ipv4 tunnel headroom adjustment limit on ipv6 version. Credits to Francesco Ruggeri, who was originally debugging this issue and wrote local Arista-specific patch and a reproducer. Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") Cc: Florian Westphal Cc: Francesco Ruggeri Signed-off-by: Dmitry Safonov Link: https://patch.msgid.link/20251009-ip6_tunnel-headroom-v2-1-8e4dbd8f7e35@arista.com Signed-off-by: Jakub Kicinski commit e4d0c909bf8328d986bf3aadba0c33a72b5ae30d Author: Kamil Horák - 2N Date: Thu Oct 9 15:06:56 2025 +0200 net: phy: bcm54811: Fix GMII/MII/MII-Lite selection The Broadcom bcm54811 is hardware-strapped to select among RGMII and GMII/MII/MII-Lite modes. However, the corresponding bit, RGMII Enable in Miscellaneous Control Register must be also set to select desired RGMII or MII(-lite)/GMII mode. Fixes: 3117a11fff5af9e7 ("net: phy: bcm54811: PHY initialization") Signed-off-by: Kamil Horák - 2N Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251009130656.1308237-2-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 70f92ab97042f243e1c8da1c457ff56b9b3e49f1 Author: Linmao Li Date: Thu Oct 9 20:25:49 2025 +0800 r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H After resume from S4 (hibernate), RTL8168H/RTL8111H truncates incoming packets. Packet captures show messages like "IP truncated-ip - 146 bytes missing!". The issue is caused by RxConfig not being properly re-initialized after resume. Re-initializing the RxConfig register before the chip re-initialization sequence avoids the truncation and restores correct packet reception. This follows the same pattern as commit ef9da46ddef0 ("r8169: fix data corruption issue on RTL8402"). Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") Signed-off-by: Linmao Li Reviewed-by: Jacob Keller Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20251009122549.3955845-1-lilinmao@kylinos.cn Signed-off-by: Jakub Kicinski commit 25718fdcbdd2dadd15fc8b684df59b43970b91ed Author: Sebastian Andrzej Siewior Date: Thu Oct 9 11:43:38 2025 +0200 net: gro_cells: Use nested-BH locking for gro_cell The gro_cell data structure is per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Add a local_lock_t to the data structure and use local_lock_nested_bh() for locking. This change adds only lockdep coverage and does not alter the functional behaviour for !PREEMPT_RT. Reported-by: syzbot+8715dd783e9b0bef43b1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c6c3b1.050a0220.2ff435.0382.GAE@google.com/ Fixes: 3253cb49cbad ("softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT") Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20251009094338.j1jyKfjR@linutronix.de Signed-off-by: Jakub Kicinski commit fcb8b32a68fd40b0440cb9468cf6f6ab9de9f3c5 Author: Ivan Vecera Date: Wed Oct 8 16:14:45 2025 +0200 dpll: zl3073x: Handle missing or corrupted flash configuration If the internal flash contains missing or corrupted configuration, basic communication over the bus still functions, but the device is not capable of normal operation (for example, using mailboxes). This condition is indicated in the info register by the ready bit. If this bit is cleared, the probe procedure times out while fetching the device state. Handle this case by checking the ready bit value in zl3073x_dev_start() and skipping DPLL device and pin registration if it is cleared. Do not report this condition as an error, allowing the devlink device to be registered and enabling the user to flash the correct configuration. Prior this patch: [ 31.112299] zl3073x-i2c 1-0070: Failed to fetch input state: -ETIMEDOUT [ 31.116332] zl3073x-i2c 1-0070: error -ETIMEDOUT: Failed to start device [ 31.136881] zl3073x-i2c 1-0070: probe with driver zl3073x-i2c failed with error -110 After this patch: [ 41.011438] zl3073x-i2c 1-0070: FW not fully ready - missing or corrupted config Fixes: 75a71ecc24125 ("dpll: zl3073x: Register DPLL devices and pins") Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251008141445.841113-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9d5c4f5c7a2c7677e1b3942772122b032c265aae Author: Jaegeuk Kim Date: Tue Oct 7 03:32:30 2025 +0000 f2fs: fix wrong block mapping for multi-devices Assuming the disk layout as below, disk0: 0 --- 0x00035abfff disk1: 0x00035ac000 --- 0x00037abfff disk2: 0x00037ac000 --- 0x00037ebfff and we want to read data from offset=13568 having len=128 across the block devices, we can illustrate the block addresses like below. 0 .. 0x00037ac000 ------------------- 0x00037ebfff, 0x00037ec000 ------- | ^ ^ ^ | fofs 0 13568 13568+128 | ------------------------------------------------------ | LBA 0x37e8aa9 0x37ebfa9 0x37ec029 --- map 0x3caa9 0x3ffa9 In this example, we should give the relative map of the target block device ranging from 0x3caa9 to 0x3ffa9 where the length should be calculated by 0x37ebfff + 1 - 0x37ebfa9. In the below equation, however, map->m_pblk was supposed to be the original address instead of the one from the target block address. - map->m_len = min(map->m_len, dev->end_blk + 1 - map->m_pblk); Cc: stable@vger.kernel.org Fixes: 71f2c8206202 ("f2fs: multidevice: support direct IO") Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1ee889fdf409ce68c1e3b62912333a5cc69acaa0 Author: Mateusz Guzik Date: Wed Oct 1 01:29:57 2025 +0200 f2fs: don't call iput() from f2fs_drop_inode() iput() calls the problematic routine, which does a ->i_count inc/dec cycle. Undoing it with iput() recurses into the problem. Note f2fs should not be playing games with the refcount to begin with, but that will be handled later. Right now solve the immediate regression. Fixes: bc986b1d756482a ("fs: stop accessing ->i_count directly in f2fs and gfs2") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509301450.138b448f-lkp@intel.com Signed-off-by: Mateusz Guzik Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d6fc45100aa8c02be3ddd16fae569b84086c15a9 Author: Hans Zhang <18255117159@163.com> Date: Fri Oct 10 22:43:07 2025 +0800 PCI: cadence: Search for MSI Capability with correct ID 907912c1daa7 ("PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets") incorrectly searched for the MSI-X Capability ID instead of the MSI Capability ID in cdns_pcie_ep_get_msi(). Search for PCI_CAP_ID_MSI, not PCI_CAP_ID_MSIX, to fix this problem. Fixes: 907912c1daa7 ("PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets") Reported-by: Sasha Levin Closes: https://lore.kernel.org/r/aOfMk9BW8BH2P30V@laps/ Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251010144307.12979-1-18255117159@163.com commit 83b0177a6c4889b3a6e865da5e21b2c9d97d0551 Author: Ingo Molnar Date: Fri May 16 15:43:04 2025 +0200 x86/mm: Fix SMP ordering in switch_mm_irqs_off() Stephen noted that it is possible to not have an smp_mb() between the loaded_mm store and the tlb_gen load in switch_mm(), meaning the ordering against flush_tlb_mm_range() goes out the window, and it becomes possible for switch_mm() to not observe a recent tlb_gen update and fail to flush the TLBs. [ dhansen: merge conflict fixed by Ingo ] Fixes: 209954cbc7d0 ("x86/mm/tlb: Update mm_cpumask lazily") Reported-by: Stephen Dolan Closes: https://lore.kernel.org/all/CAHDw0oGd0B4=uuv8NGqbUQ_ZVmSheU2bN70e4QhFXWvuAZdt2w@mail.gmail.com/ Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Signed-off-by: Dave Hansen commit f25785f9b088ed65089dd0d0034da52858417839 Author: Rik van Riel Date: Sun Oct 5 23:48:05 2025 -0400 x86/mm: Fix overflow in __cpa_addr() The change to have cpa_flush() call flush_kernel_pages() introduced a bug where __cpa_addr() can access an address one larger than the largest one in the cpa->pages array. KASAN reports the issue like this: BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline] BUG: KASAN: slab-out-of-bounds in __cpa_addr+0x1d3/0x220 arch/x86/mm/pat/set_memory.c:306 Read of size 8 at addr ffff88801f75e8f8 by task syz.0.17/5978 This bug could cause cpa_flush() to not properly flush memory, which somehow never showed any symptoms in my tests, possibly because cpa_flush() is called so rarely, but could potentially cause issues for other people. Fix the issue by directly calculating the flush end address from the start address. Fixes: 86e6815b316e ("x86/mm: Change cpa_flush() to call flush_kernel_range() directly") Reported-by: syzbot+afec6555eef563c66c97@syzkaller.appspotmail.com Signed-off-by: Rik van Riel Signed-off-by: Dave Hansen Reviewed-by: Kiryl Shutsemau Link: https://lore.kernel.org/all/68e2ff90.050a0220.2c17c1.0038.GAE@google.com/ commit a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e Author: Dave Jiang Date: Thu Oct 9 08:40:01 2025 -0700 cxl/features: Add check for no entries in cxl_feature_info cxl EDAC calls cxl_feature_info() to get the feature information and if the hardware has no Features support, cxlfs may be passed in as NULL. [ 51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 51.965571] #PF: supervisor read access in kernel mode [ 51.971559] #PF: error_code(0x0000) - not-present page [ 51.977542] PGD 17e4f6067 P4D 0 [ 51.981384] Oops: Oops: 0000 [#1] SMP NOPTI [ 51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj test+ #64 PREEMPT(voluntary) [ 51.997355] Hardware name: [ 52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core] Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if there is no cxlfs created due to no hardware support. Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") Reviewed-by: Davidlohr Bueso Reviewed-by: Alison Schofield Signed-off-by: Dave Jiang commit 8aec9dbf2db2e958de5bd20e23b8fbb8f2aa1fa6 Author: Gustavo A. R. Silva Date: Fri Oct 3 15:11:06 2025 +0100 btrfs: send: fix -Wflex-array-member-not-at-end warning in struct send_ctx The warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Fix the following warning: fs/btrfs/send.c:181:24: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] and move the declaration of send_ctx::cur_inode_path to the end. Notice that struct fs_path contains a flexible array member inline_buf, but also a padding array and a limit calculated for the usable space of inline_buf (FS_PATH_INLINE_SIZE). It is not the pattern where flexible array is in the middle of a structure and could potentially overwrite other members. Signed-off-by: Gustavo A. R. Silva Reviewed-by: David Sterba Signed-off-by: David Sterba commit e92c2941204de7b62e9c2deecfeb9eaefe54a22a Author: Dan Carpenter Date: Wed Oct 8 18:08:58 2025 +0300 btrfs: tree-checker: fix bounds check in check_inode_extref() The parentheses for the unlikely() annotation were put in the wrong place so it means that the condition is basically never true and the bounds checking is skipped. Fixes: aab9458b9f00 ("btrfs: tree-checker: add inode extref checks") Signed-off-by: Dan Carpenter Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit fec9b9d3ced39f16be8d7afdf81f4dd2653da319 Author: Miquel Sabaté Solà Date: Wed Oct 8 14:18:59 2025 +0200 btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one and there is no RAID stripe tree, then we return early with an error. Doing that, though, prevents the code from running the last calls from this function which are about freeing memory allocated during its run. Hence, in this case, instead of returning early, we set the ret value and fall through the rest of the cleanup code. Fixes: 5906333cc4af ("btrfs: zoned: don't skip block group profile checks on conventional zones") CC: stable@vger.kernel.org # 6.8+ Reviewed-by: Johannes Thumshirn Signed-off-by: Miquel Sabaté Solà Signed-off-by: David Sterba commit 8ab2fa69691b2913a67f3c54fbb991247b3755be Author: Boris Burkov Date: Tue Sep 30 21:05:17 2025 -0700 btrfs: fix incorrect readahead expansion length The intent of btrfs_readahead_expand() was to expand to the length of the current compressed extent being read. However, "ram_bytes" is *not* that, in the case where a single physical compressed extent is used for multiple file extents. Consider this case with a large compressed extent C and then later two non-compressed extents N1 and N2 written over C, leaving C1 and C2 pointing to offset/len pairs of C: [ C ] [ N1 ][ C1 ][ N2 ][ C2 ] In such a case, ram_bytes for both C1 and C2 is the full uncompressed length of C. So starting readahead in C1 will expand the readahead past the end of C1, past N2, and into C2. This will then expand readahead again, to C2_start + ram_bytes, way past EOF. First of all, this is totally undesirable, we don't want to read the whole file in arbitrary chunks of the large underlying extent if it happens to exist. Secondly, it results in zeroing the range past the end of C2 up to ram_bytes. This is particularly unpleasant with fs-verity as it can zero and set uptodate pages in the verity virtual space past EOF. This incorrect readahead behavior can lead to verity verification errors, if we iterate in a way that happens to do the wrong readahead. Fix this by using em->len for readahead expansion, not em->ram_bytes, resulting in the expected behavior of stopping readahead at the extent boundary. Reported-by: Max Chernoff Link: https://bugzilla.redhat.com/show_bug.cgi?id=2399898 Fixes: 9e9ff875e417 ("btrfs: use readahead_expand() on compressed extents") CC: stable@vger.kernel.org # 6.17 Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit a5a51bf4e9b7354ce7cd697e610d72c1b33fd949 Author: Filipe Manana Date: Wed Oct 1 11:08:13 2025 +0100 btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always expect to find block group items (either extent items or a block group item with key type BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with btrfs_search_slot_for_read(), so we assert that we found an item. However this expectation is wrong since we can have a new block group created in the current transaction which is still empty and for which we still have not added the block group's item to the extent tree, in which case we do not have any items in the extent tree associated to the block group. The insertion of a new block group's block group item in the extent tree happens at btrfs_create_pending_block_groups() when it calls the helper insert_block_group_item(). This typically is done when a transaction handle is released, committed or when running delayed refs (either as part of a transaction commit or when serving tickets for space reservation if we are low on free space). So remove the assertion at populate_free_space_tree() even when the block group tree feature is not enabled and update the comment to mention this case. Syzbot reported this with the following stack trace: BTRFS info (device loop3 state M): rebuilding free space tree assertion failed: ret == 0 :: 0, in fs/btrfs/free-space-tree.c:1115 ------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1115! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6352 Comm: syz.3.25 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:populate_free_space_tree+0x700/0x710 fs/btrfs/free-space-tree.c:1115 Code: ff ff e8 d3 (...) RSP: 0018:ffffc9000430f780 EFLAGS: 00010246 RAX: 0000000000000043 RBX: ffff88805b709630 RCX: fea61d0e2e79d000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffffc9000430f8b0 R08: ffffc9000430f4a7 R09: 1ffff92000861e94 R10: dffffc0000000000 R11: fffff52000861e95 R12: 0000000000000001 R13: 1ffff92000861f00 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f424d9fe6c0(0000) GS:ffff888125afc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd78ad212c0 CR3: 0000000076d68000 CR4: 00000000003526f0 Call Trace: btrfs_rebuild_free_space_tree+0x1ba/0x6d0 fs/btrfs/free-space-tree.c:1364 btrfs_start_pre_rw_mount+0x128f/0x1bf0 fs/btrfs/disk-io.c:3062 btrfs_remount_rw fs/btrfs/super.c:1334 [inline] btrfs_reconfigure+0xaed/0x2160 fs/btrfs/super.c:1559 reconfigure_super+0x227/0x890 fs/super.c:1076 do_remount fs/namespace.c:3279 [inline] path_mount+0xd1a/0xfe0 fs/namespace.c:4027 do_mount fs/namespace.c:4048 [inline] __do_sys_mount fs/namespace.c:4236 [inline] __se_sys_mount+0x313/0x410 fs/namespace.c:4213 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f424e39066a Code: d8 64 89 02 (...) RSP: 002b:00007f424d9fde68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f424d9fdef0 RCX: 00007f424e39066a RDX: 0000200000000180 RSI: 0000200000000380 RDI: 0000000000000000 RBP: 0000200000000180 R08: 00007f424d9fdef0 R09: 0000000000000020 R10: 0000000000000020 R11: 0000000000000246 R12: 0000200000000380 R13: 00007f424d9fdeb0 R14: 0000000000000000 R15: 00002000000002c0 Modules linked in: ---[ end trace 0000000000000000 ]--- Reported-by: syzbot+884dc4621377ba579a6f@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/68dc3dab.a00a0220.102ee.004e.GAE@google.com/ Fixes: a5ed91828518 ("Btrfs: implement the free space B-tree") CC: # 6.1.x: 1961d20f6fa8: btrfs: fix assertion when building free space tree CC: # 6.1.x Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 42d3a055d946878a327ee030f0e0c7df0f0f15c8 Author: Qu Wenruo Date: Tue Sep 30 07:54:30 2025 +0930 btrfs: do not use folio_test_partial_kmap() in ASSERT()s [BUG] Syzbot reported an ASSERT() triggered inside scrub: BTRFS info (device loop0): scrub: started on devid 1 assertion failed: !folio_test_partial_kmap(folio) :: 0, in fs/btrfs/scrub.c:697 ------------[ cut here ]------------ kernel BUG at fs/btrfs/scrub.c:697! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6077 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:scrub_stripe_get_kaddr+0x1bb/0x1c0 fs/btrfs/scrub.c:697 Call Trace: scrub_bio_add_sector fs/btrfs/scrub.c:932 [inline] scrub_submit_initial_read+0xf21/0x1120 fs/btrfs/scrub.c:1897 submit_initial_group_read+0x423/0x5b0 fs/btrfs/scrub.c:1952 flush_scrub_stripes+0x18f/0x1150 fs/btrfs/scrub.c:1973 scrub_stripe+0xbea/0x2a30 fs/btrfs/scrub.c:2516 scrub_chunk+0x2a3/0x430 fs/btrfs/scrub.c:2575 scrub_enumerate_chunks+0xa70/0x1350 fs/btrfs/scrub.c:2839 btrfs_scrub_dev+0x6e7/0x10e0 fs/btrfs/scrub.c:3153 btrfs_ioctl_scrub+0x249/0x4b0 fs/btrfs/ioctl.c:3163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- Which doesn't make much sense, as all the folios we allocated for scrub should not be highmem. [CAUSE] Thankfully syzbot has a detailed kernel config file, showing that CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is set to y. And that debug option will force all folio_test_partial_kmap() to return true, to improve coverage on highmem tests. But in our case we really just want to make sure the folios we allocated are not highmem (and they are indeed not). Such incorrect result from folio_test_partial_kmap() is just screwing up everything. [FIX] Replace folio_test_partial_kmap() to folio_test_highmem() so that we won't bother those highmem specific debuging options. Fixes: 5fbaae4b8567 ("btrfs: prepare scrub to support bs > ps cases") Reported-by: syzbot+bde59221318c592e6346@syzkaller.appspotmail.com Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7fdfd29a136a17c5c8ad9e9bbf89c48919c3d19 Author: Qu Wenruo Date: Fri Sep 26 14:20:11 2025 +0930 btrfs: only set the device specific options after devices are opened [BUG] With v6.17-rc kernels, btrfs will always set 'ssd' mount option even if the block device is not a rotating one: # cat /sys/block/sdd/queue/rotational 1 # cat /etc/fstab: LABEL=DATA2 /data2 btrfs rw,relatime,space_cache=v2,subvolid=5,subvol=/,nofail,nosuid,nodev 0 0 # mount [...] /dev/sdd on /data2 type btrfs (rw,nosuid,nodev,relatime,ssd,space_cache=v2,subvolid=5,subvol=/) [CAUSE] The 'ssd' mount option is set by set_device_specific_options(), and it expects that if there is any rotating device in the btrfs, it will set fs_devices::rotating. However after commit bddf57a70781 ("btrfs: delay btrfs_open_devices() until super block is created"), the device opening is delayed until the super block is created. But the timing of set_device_specific_options() is still left as is, this makes the function be called without any device opened. Since no device is opened, thus fs_devices::rotating will never be set, making btrfs incorrectly set 'ssd' mount option. [FIX] Only call set_device_specific_options() after btrfs_open_devices(). Also only call set_device_specific_options() after a new mount, if we're mounting a mounted btrfs, there is no need to set the device specific mount options again. Reported-by: HAN Yuwei Link: https://lore.kernel.org/linux-btrfs/C8FF75669DFFC3C5+5f93bf8a-80a0-48a6-81bf-4ec890abc99a@bupt.moe/ Fixes: bddf57a70781 ("btrfs: delay btrfs_open_devices() until super block is created") CC: stable@vger.kernel.org # 6.17 Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 53a4acbfc1de85fa637521ffab4f4e2ee03cbeeb Author: Miquel Sabaté Solà Date: Thu Sep 25 20:41:39 2025 +0200 btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl On 'btrfs_ioctl_qgroup_assign' we first duplicate the argument as provided by the user, which is kfree'd in the end. But this was not the case when allocating memory for 'prealloc'. In this case, if it somehow failed, then the previous code would go directly into calling 'mnt_drop_write_file', without freeing the string duplicated from the user space. Fixes: 4addc1ffd67a ("btrfs: qgroup: preallocate memory before adding a relation") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Boris Burkov Reviewed-by: Filipe Manana Signed-off-by: Miquel Sabaté Solà Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7e5a5983edda664e8e4bb20af17b80f5135c655c Author: Filipe Manana Date: Wed Sep 24 16:10:38 2025 +0100 btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running When starting relocation, at reloc_chunk_start(), if we happen to find the flag BTRFS_FS_RELOC_RUNNING is already set we return an error (-EINPROGRESS) to the callers, however the callers call reloc_chunk_end() which will clear the flag BTRFS_FS_RELOC_RUNNING, which is wrong since relocation was started by another task and still running. Finding the BTRFS_FS_RELOC_RUNNING flag already set is an unexpected scenario, but still our current behaviour is not correct. Fix this by never calling reloc_chunk_end() if reloc_chunk_start() has returned an error, which is what logically makes sense, since the general widespread pattern is to have end functions called only if the counterpart start functions succeeded. This requires changing reloc_chunk_start() to clear BTRFS_FS_RELOC_RUNNING if there's a pending cancel request. Fixes: 907d2710d727 ("btrfs: add cancellable chunk relocation support") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9f64b3cd051b825de0a2a9f145c8e003200cedd5 Author: Shuicheng Lin Date: Fri Oct 10 17:25:29 2025 +0000 drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled. In this case, the driver cannot receive a response from the GuC, preventing proper cleanup of exec queue resources. Fix this by directly releasing the resources when GuC is not running. Here is the failure dmesg log: " [ 468.089581] ---[ end trace 0000000000000000 ]--- [ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535) [ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535 [ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1 [ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1) [ 468.092716] ------------[ cut here ]------------ [ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe] " v2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled(). As CT may go down and come back during VF migration. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20251010172529.2967639-2-shuicheng.lin@intel.com (cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea) Signed-off-by: Lucas De Marchi commit 1852d27aa998272696680607b65a2ceac966104e Author: Vinay Belgaumkar Date: Thu Oct 9 18:10:47 2025 -0700 drm/xe: Enable media sampler power gating Where applicable, enable media sampler power gating. Also, add it to the powergate_info debugfs. v2: Remove the sampler powergate status since it is cleared quickly anyway. v3: Use vcs mask (Rodrigo) and fix the version check for media v4: Remove extra spaces v5: Media samplers are independent of vcs mask, use Media version 1255 (Matt Roper) Fixes: 38e8c4184ea0 ("drm/xe: Enable Coarse Power Gating") Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20251010011047.2047584-1-vinay.belgaumkar@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 4cbc08649a54c3d533df9832342d52d409dfbbf0) Signed-off-by: Lucas De Marchi commit 7413e9f2be6b2b0caff9c517efa123d988914bba Author: Matthew Brost Date: Thu Oct 9 06:06:29 2025 -0700 drm/xe: Handle mixed mappings and existing VRAM on atomic faults Moving to VRAM will fail if mixed mappings are present or if the page is already located in VRAM. Atomic faults that require a move to VRAM currently retry without attempting to evict mixed mappings or locate existing VRAM mappings. This patch fixes the issue by attempting to evict mixed mappings or find existing VRAM pages when a move to VRAM fails during atomic fault handling. Fixes: a9ac0fa455b0 ("drm/xe: Strict migration policy for atomic SVM faults") Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20251009130629.3531962-1-matthew.brost@intel.com (cherry picked from commit 75188605c56d10c1bd3b1cd94f4872f349c3a9c8) Signed-off-by: Lucas De Marchi commit 1117e7d1e8e66bf7e40291178b829a8513f83a7a Author: Thomas Hellström Date: Wed Sep 10 18:09:39 2025 +0200 drm/xe/migrate: Fix an error path The exhaustive eviction accidently changed an error path goto to a return. Fix this. Fixes: 59eabff2a352 ("drm/xe: Convert xe_bo_create_pin_map() for exhaustive eviction") Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250910160939.103473-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 381f1ed15159c4b3f00dd37cc70924dedebeb111) Signed-off-by: Lucas De Marchi commit d30203739be798d3de5c84db3060e96f00c54e82 Author: Lucas De Marchi Date: Thu Sep 18 13:58:57 2025 -0700 drm/xe: Move rebar to be done earlier There may be cases in which the BAR0 also needs to move to accommodate the bigger BAR2. However if it's not released, the BAR2 resize fails. During the vram probe it can't be released as it's already in use by xe_mmio for early register access. Add a new function in xe_vram and let xe_pci call it directly before even early device probe. This allows the BAR2 to resize in cases BAR0 also needs to move, assuming there aren't other reasons to hold that move: [] xe 0000:03:00.0: vgaarb: deactivate vga console [] xe 0000:03:00.0: [drm] Attempting to resize bar from 8192MiB -> 16384MiB [] xe 0000:03:00.0: BAR 0 [mem 0x83000000-0x83ffffff 64bit]: releasing [] xe 0000:03:00.0: BAR 2 [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x41ffffffff 64bit pref]: releasing [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] xe 0000:03:00.0: BAR 2 [mem 0x4000000000-0x43ffffffff 64bit pref]: assigned [] xe 0000:03:00.0: BAR 0 [mem 0x83000000-0x83ffffff 64bit]: assigned [] pcieport 0000:00:01.0: PCI bridge to [bus 01-04] [] pcieport 0000:00:01.0: bridge window [mem 0x83000000-0x840fffff] [] pcieport 0000:00:01.0: bridge window [mem 0x4000000000-0x44007fffff 64bit pref] [] pcieport 0000:01:00.0: PCI bridge to [bus 02-04] [] pcieport 0000:01:00.0: bridge window [mem 0x83000000-0x840fffff] [] pcieport 0000:01:00.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref] [] pcieport 0000:02:01.0: PCI bridge to [bus 03] [] pcieport 0000:02:01.0: bridge window [mem 0x83000000-0x83ffffff] [] pcieport 0000:02:01.0: bridge window [mem 0x4000000000-0x43ffffffff 64bit pref] [] xe 0000:03:00.0: [drm] BAR2 resized to 16384M [] xe 0000:03:00.0: [drm:xe_pci_probe [xe]] BATTLEMAGE e221:0000 dgfx:1 gfx:Xe2_HPG (20.02) ... For BMG there are additional fix needed in the PCI side, but this helps getting it to a working resize. All the rebar logic is more pci-specific than xe-specific and can be done very early in the probe sequence. In future it would be good to move it out of xe_vram.c, but this refactor is left for later. Cc: Ilpo Järvinen Cc: stable@vger.kernel.org # 6.12+ Link: https://lore.kernel.org/intel-xe/fafda2a3-fc63-ce97-d22b-803f771a4d19@linux.intel.com Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250918-xe-pci-rebar-2-v1-2-6c094702a074@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 45e33f220fd625492c11e15733d8e9b4f9db82a4) Signed-off-by: Lucas De Marchi commit 7ac74613e5f2ef3450f44fd2127198662c2563a9 Author: Matthew Brost Date: Thu Oct 9 04:06:18 2025 -0700 drm/xe: Don't allow evicting of BOs in same VM in array of VM binds An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allow_res_evict flag in the xe_bo_validate call. v2: - Invert polarity of no_res_evict (Thomas) - Add comment in code explaining issue (Thomas) Cc: stable@vger.kernel.org Reported-by: Paulo Zanoni Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6268 Fixes: 774b5fa509a9 ("drm/xe: Avoid evicting object of the same vm in none fault mode") Fixes: 77f2ef3f16f5 ("drm/xe: Lock all gpuva ops during VM bind IOCTL") Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Tested-by: Paulo Zanoni Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20251009110618.3481870-1-matthew.brost@intel.com (cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08) Signed-off-by: Lucas De Marchi commit e5ae8d1eb08a3e27fff4ae264af4c8056d908639 Author: Kenneth Graunke Date: Fri Sep 12 15:31:45 2025 -0700 drm/xe: Increase global invalidation timeout to 1000us The previous timeout of 500us seems to be too small; panning the map in the Roll20 VTT in Firefox on a KDE/Wayland desktop reliably triggered timeouts within a few seconds of usage, causing the monitor to freeze and the following to be printed to dmesg: [Jul30 13:44] xe 0000:03:00.0: [drm] *ERROR* GT0: Global invalidation timeout [Jul30 13:48] xe 0000:03:00.0: [drm] *ERROR* [CRTC:82:pipe A] flip_done timed out I haven't hit a single timeout since increasing it to 1000us even after several multi-hour testing sessions. Fixes: 0dd2dd0182bc ("drm/xe: Move DSB l2 flush to a more sensible place") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5710 Signed-off-by: Kenneth Graunke Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Reviewed-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250912223254.147940-1-kenneth@whitecape.org Signed-off-by: Lucas De Marchi (cherry picked from commit 146046907b56578263434107f5a7d5051847c459) Signed-off-by: Lucas De Marchi commit 48277906603528a1fd1946bf0f141b2fd4f84e46 Merge: 3a8660878839fa 7c3321f3d279ed Author: Martin K. Petersen Date: Mon Oct 13 15:54:13 2025 -0400 Merge branch '6.18/scsi-queue' into 6.18/scsi-fixes Pull in outstanding SCSI fixes for 6.18. Signed-off-by: Martin K. Petersen commit 93a27b5891b8194a8c083c9a80d2141d4bf47ba8 Author: Tetsuo Handa Date: Sat Sep 27 21:11:16 2025 +0900 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler Currently NETDEV_UNREGISTER event handler is not calling j1939_cancel_active_session() and j1939_sk_queue_drop_all(). This will result in these calls being skipped when j1939_sk_release() is called. And I guess that the reason syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 is caused by lack of these calls. Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can be covered by calling j1939_cancel_active_session(priv, NULL) from j1939_netdev_notify(). Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify(). Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler. Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler") Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://patch.msgid.link/3ad3c7f8-5a74-4b07-a193-cb0725823558@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit a3c35f8270c175f164dd74960c437d1edc8a291a Merge: 49836ff2f37dd6 b5746b3e8ea4a8 Author: Marc Kleine-Budde Date: Mon Oct 13 21:26:08 2025 +0200 Merge patch series "can: add Transmitter Delay Compensation (TDC) documentation" Vincent Mailhol says: TDC was added to the kernel in 2021 but I never took time to update the documentation. The year is now 2025... As we say: "better late than never"! The first patch is a small clean up which fixes an incorrect statement concerning the CAN DLC, the second patch is the real thing and adds the documentation of how to use the ip tool to configure the TDC. Link: https://patch.msgid.link/20251013-can-fd-doc-v2-0-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit b5746b3e8ea4a8a4df776e0864322028d4f5e4b1 Author: Vincent Mailhol Date: Mon Oct 13 19:10:23 2025 +0900 can: add Transmitter Delay Compensation (TDC) documentation Back in 2021, support for CAN TDC was added to the kernel in series [1] and in iproute2 in series [2]. However, the documentation was never updated. Add a new sub-section under CAN-FD driver support to document how to configure the TDC using the "ip tool". [1] add the netlink interface for CAN-FD Transmitter Delay Compensation (TDC) Link: https://lore.kernel.org/all/20210918095637.20108-1-mailhol.vincent@wanadoo.fr/ [2] iplink_can: cleaning, fixes and adding TDC support Link: https://lore.kernel.org/all/20211103164428.692722-1-mailhol.vincent@wanadoo.fr/ Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20251013-can-fd-doc-v2-2-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit c282993ccd97ad627d213645dc485086de034647 Author: Vincent Mailhol Date: Mon Oct 13 19:10:22 2025 +0900 can: remove false statement about 1:1 mapping between DLC and length The CAN-FD section of can.rst still states that there is a 1:1 mapping between the Classical CAN DLC and its length. This is only true for the DLC values up to 8. Beyond that point, the length remains at 8. For reference, the mapping between the CAN DLC and the length is given in below table [1]: DLC value CBFF and CEFF FBFF and FEFF [decimal] [byte] [byte] ---------------------------------------------- 0 0 0 1 1 1 2 2 2 3 3 3 4 4 4 5 5 5 6 6 6 7 7 7 8 8 8 9 8 12 10 8 16 11 8 20 12 8 24 13 8 32 14 8 48 15 8 64 Remove the erroneous statement. Instead just state that the length of a Classical CAN frame ranges from 0 to 8. [1] ISO 11898-1:2024, Table 5 -- DLC: coding of the four LSB Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20251013-can-fd-doc-v2-1-5d53bdc8f2ad@kernel.org Signed-off-by: Marc Kleine-Budde commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 Author: Babu Moger Date: Fri Oct 10 12:08:35 2025 -0500 x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID Users can create as many monitoring groups as the number of RMIDs supported by the hardware. However, on AMD systems, only a limited number of RMIDs are guaranteed to be actively tracked by the hardware. RMIDs that exceed this limit are placed in an "Unavailable" state. When a bandwidth counter is read for such an RMID, the hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable remains set on first read after tracking re-starts and is clear on all subsequent reads as long as the RMID is tracked. resctrl miscounts the bandwidth events after an RMID transitions from the "Unavailable" state back to being tracked. This happens because when the hardware starts counting again after resetting the counter to zero, resctrl in turn compares the new count against the counter value stored from the previous time the RMID was tracked. This results in resctrl computing an event value that is either undercounting (when new counter is more than stored counter) or a mistaken overflow (when new counter is less than stored counter). Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to zero whenever the RMID is in the "Unavailable" state to ensure accurate counting after the RMID resets to zero when it starts to be tracked again. Example scenario that results in mistaken overflow ================================================== 1. The resctrl filesystem is mounted, and a task is assigned to a monitoring group. $mount -t resctrl resctrl /sys/fs/resctrl $mkdir /sys/fs/resctrl/mon_groups/test1/ $echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 21323 <- Total bytes on domain 0 "Unavailable" <- Total bytes on domain 1 Task is running on domain 0. Counter on domain 1 is "Unavailable". 2. The task runs on domain 0 for a while and then moves to domain 1. The counter starts incrementing on domain 1. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 7345357 <- Total bytes on domain 0 4545 <- Total bytes on domain 1 3. At some point, the RMID in domain 0 transitions to the "Unavailable" state because the task is no longer executing in that domain. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes "Unavailable" <- Total bytes on domain 0 434341 <- Total bytes on domain 1 4. Since the task continues to migrate between domains, it may eventually return to domain 0. $cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes 17592178699059 <- Overflow on domain 0 3232332 <- Total bytes on domain 1 In this case, the RMID on domain 0 transitions from "Unavailable" state to active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when the counter is read and begins tracking the RMID counting from 0. Subsequent reads succeed but return a value smaller than the previously saved MSR value (7345357). Consequently, the resctrl's overflow logic is triggered, it compares the previous value (7345357) with the new, smaller value and incorrectly interprets this as a counter overflow, adding a large delta. In reality, this is a false positive: the counter did not overflow but was simply reset when the RMID transitioned from "Unavailable" back to active state. Here is the text from APM [1] available from [2]. "In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the first QM_CTR read when it begins tracking an RMID that it was not previously tracking. The U bit will be zero for all subsequent reads from that RMID while it is still tracked by the hardware. Therefore, a QM_CTR read with the U bit set when that RMID is in use by a processor can be considered 0 when calculating the difference with a subsequent read." [1] AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory Bandwidth (MBM). [ bp: Split commit message into smaller paragraph chunks for better consumption. ] Fixes: 4d05bf71f157d ("x86/resctrl: Introduce AMD QOS feature") Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Tested-by: Reinette Chatre Cc: stable@vger.kernel.org # needs adjustments for <= v6.17 Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2] commit 2b929b6eec0c7c45eb554256d349c16c0ba1df3c Author: Pauli Virtanen Date: Mon Oct 13 20:33:06 2025 +0300 ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 ID 046d:0a8f Logitech, Inc. H390 headset with microphone is reported to have muted min playback volume. Apply quirk for that. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4929 Signed-off-by: Pauli Virtanen Signed-off-by: Takashi Iwai commit 02e7567f5da023524476053a38c54f4f19130959 Author: Li Ming Date: Wed Oct 1 14:03:37 2025 +0800 cxl/port: Avoid missing port component registers setup port->nr_dports is used to represent how many dports added to the cxl port, it will increase in add_dport() when a new dport is being added to the cxl port, but it will not be reduced when a dport is removed from the cxl port. Currently, when the first dport is added to a cxl port, it will trigger component registers setup on the cxl port, the implementation is using port->nr_dports to confirm if the dport is the first dport. A corner case here is that adding dport could fail after port->nr_dports updating and before checking port->nr_dports for component registers setup. If the failure happens during the first dport attaching, it will cause that CXL subsystem has not chance to execute component registers setup for the cxl port. the failure flow like below: port->nr_dports = 0 dport 1 adding to the port: add_dport() # port->nr_dports: 1 failed on devm_add_action_or_reset() or sysfs_create_link() return error # port->nr_dports: 1 dport 2 adding to the port: add_dport() # port->nr_dports: 2 no failure skip component registers setup because of port->nr_dports is 2 The solution here is that moving component registers setup closer to add_dport(), so if add_dport() is executed correctly for the first dport, component registers setup on the port will be executed immediately after that. Fixes: f6ee24913de2 ("cxl: Move port register setup to when first dport appear") Signed-off-by: Li Ming Reviewed-by: Dave Jiang Reviewed-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang commit 14c1da3895a116f4e32c20487046655f26d3999b Author: Tejun Heo Date: Wed Oct 8 13:43:26 2025 -1000 sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() On systems with >4096 CPUs, scx_kick_cpus_pnt_seqs allocation fails during boot because it exceeds the 32,768 byte percpu allocator limit. Restructure to use DEFINE_PER_CPU() for the per-CPU pointers, with each CPU pointing to its own kvzalloc'd array. Move allocation from boot time to scx_enable() and free in scx_disable(), so the O(nr_cpu_ids^2) memory is only consumed when sched_ext is active. Use RCU to guard against racing with free. Arrays are freed via call_rcu() and kick_cpus_irq_workfn() uses rcu_dereference_bh() with a NULL check. While at it, rename to scx_kick_pseqs for brevity and update comments to clarify these are pick_task sequence numbers. v2: RCU protect scx_kick_seqs to manage kick_cpus_irq_workfn() racing against disable as per Andrea. v3: Fix bugs notcied by Andrea. Reported-by: Phil Auld Link: http://lkml.kernel.org/r/20251007133523.GA93086@pauld.westford.csb Cc: Andrea Righi Reviewed-by: Emil Tsalapatis Reviewed-by: Phil Auld Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit a8ad873113d3fe01f9b5d737d4b0570fa36826b0 Author: Emil Tsalapatis Date: Fri Oct 10 12:12:50 2025 -0700 sched_ext: defer queue_balance_callback() until after ops.dispatch The sched_ext code calls queue_balance_callback() during enqueue_task() to defer operations that drop multiple locks until we can unpin them. The call assumes that the rq lock is held until the callbacks are invoked, and the pending callbacks will not be visible to any other threads. This is enforced by a WARN_ON_ONCE() in rq_pin_lock(). However, balance_one() may actually drop the lock during a BPF dispatch call. Another thread may win the race to get the rq lock and see the pending callback. To avoid this, sched_ext must only queue the callback after the dispatch calls have completed. CPU 0 CPU 1 CPU 2 scx_balance() rq_unpin_lock() scx_balance_one() |= IN_BALANCE scx_enqueue() ops.dispatch() rq_unlock() rq_lock() queue_balance_callback() rq_unlock() [WARN] rq_pin_lock() rq_lock() &= ~IN_BALANCE rq_repin_lock() Changelog v2-> v1 (https://lore.kernel.org/sched-ext/aOgOxtHCeyRT_7jn@gpd4) - Fixed explanation in patch description (Andrea) - Fixed scx_rq mask state updates (Andrea) - Added Reviewed-by tag from Andrea Reported-by: Jakub Kicinski Signed-off-by: Emil Tsalapatis (Meta) Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a Author: Joshua Watt Date: Thu Oct 9 15:48:04 2025 -0600 NFS4: Fix state renewals missing after boot Since the last renewal time was initialized to 0 and jiffies start counting at -5 minutes, any clients connected in the first 5 minutes after a reboot would have their renewal timer set to a very long interval. If the connection was idle, this would result in the client state timing out on the server and the next call to the server would return NFS4ERR_BADSESSION. Fix this by initializing the last renewal time to the current jiffies instead of 0. Signed-off-by: Joshua Watt Signed-off-by: Anna Schumaker commit 9ff022f3820a31507cb93be6661bf5f3ca0609a4 Author: Scott Mayhew Date: Thu Oct 9 16:42:12 2025 -0400 NFS: check if suid/sgid was cleared after a write as needed I noticed xfstests generic/193 and generic/355 started failing against knfsd after commit e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE"). I ran those same tests against ONTAP (which has had write delegation support for a lot longer than knfsd) and they fail there too... so while it's a new failure against knfsd, it isn't an entirely new failure. Add the NFS_INO_REVAL_FORCED flag so that the presence of a delegation doesn't keep the inode from being revalidated to fetch the updated mode. Signed-off-by: Scott Mayhew Signed-off-by: Anna Schumaker commit 7a84394f02ab1985ebbe0a8d6f6d69bd040de4b3 Author: Joshua Watt Date: Tue Oct 7 15:22:58 2025 -0600 NFS4: Apply delay_retrans to async operations The setting of delay_retrans is applied to synchronous RPC operations because the retransmit count is stored in same struct nfs4_exception that is passed each time an error is checked. However, for asynchronous operations (READ, WRITE, LOCKU, CLOSE, DELEGRETURN), a new struct nfs4_exception is made on the stack each time the task callback is invoked. This means that the retransmit count is always zero and thus delay_retrans never takes effect. Apply delay_retrans to these operations by tracking and updating their retransmit count. Change-Id: Ieb33e046c2b277cb979caa3faca7f52faf0568c9 Signed-off-by: Joshua Watt Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 8db4a1d146f83c6bdb0f5b98c50c509ae8549827 Author: Mike Snitzer Date: Tue Oct 7 13:39:05 2025 -0400 NFSv4/flexfiles: fix to allocate mirror->dss before use Move mirror_array's dss_count initialization and dss allocation to ff_layout_alloc_mirror(), just before the loop that initializes each nfs4_ff_layout_ds_stripe's nfs_file_localio. Also handle NULL return from kcalloc() and remove one level of indent in ff_layout_alloc_mirror(). This commit fixes dangling nfsd_serv refcount issues seen when using NFS LOCALIO and then attempting to stop the NFSD service. Fixes: 20b1d75fb840 ("NFSv4/flexfiles: Add support for striped layouts") Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit efeeaac9ae9763f9c953e69633c86bc3031e39b5 Author: Tejun Heo Date: Thu Oct 9 13:56:23 2025 -1000 sched_ext: Sync error_irq_work before freeing scx_sched By the time scx_sched_free_rcu_work() runs, the scx_sched is no longer reachable. However, a previously queued error_irq_work may still be pending or running. Ensure it completes before proceeding with teardown. Fixes: bff3b5aec1b7 ("sched_ext: Move disable machinery into scx_sched") Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 927069c4ac2cd1a37efa468596fb5b8f86db9df0 Author: Jens Axboe Date: Mon Oct 13 12:05:31 2025 -0600 Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" This reverts commit 90bfb28d5fa8127a113a140c9791ea0b40ab156a. Kevin reports that this commit causes an issue for him with LVM snapshots, most likely because of turning off NOWAIT support while a snapshot is being created. This makes -EOPNOTSUPP bubble back through the completion handler, where io_uring read/write handling should just retry it. Reinstate the previous check removed by the referenced commit. Cc: stable@vger.kernel.org Fixes: 90bfb28d5fa8 ("io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()") Reported-by: Salvatore Bonaccorso Reported-by: Kevin Lumik Link: https://lore.kernel.org/io-uring/cceb723c-051b-4de2-9a4c-4aa82e1619ee@kernel.dk/ Signed-off-by: Jens Axboe commit 079ae5118e1f0dcf5b1ab68ffdb5760b06ed79a2 Author: Jonathan Kim Date: Wed Jun 18 10:31:15 2025 -0400 drm/amdkfd: fix suspend/resume all calls in mes based eviction path Suspend/resume all gangs should be done with the device lock is held. Signed-off-by: Jonathan Kim Acked-by: Alex Deucher Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 277bb0f83e98261018ddd82b7ab8154bb9b93237 Author: Jonathan Kim Date: Thu Jun 5 10:18:37 2025 -0400 drm/amdgpu: enable suspend/resume all for gfx 12 Suspend/resume all gangs has been available for GFX12 for a while now so enable it. Signed-off-by: Jonathan Kim Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 0ef930e1faca6418316e5b9a3b4d1f6ae9e5b240 Author: Jonathan Kim Date: Thu Oct 9 11:28:19 2025 -0400 drm/amdgpu: fix hung reset queue array memory allocation By design the MES will return an array result that is twice the number of hung doorbells it can report. i.e. if up k reported doorbells are supported, then the second half of the array, also of length k, holds the HQD information (type/queue/pipe) where queue 1 corresponds to index 0 and k, queue 2 corresponds to index 1 and k + 1 etc ... The driver will use the HDQ info to target queue/pipe reset for hardware scheduled user compute queues. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8745ca5efb2aad0b6591d9b8cd48573ea49c929d Author: Jonathan Kim Date: Thu Oct 9 10:48:09 2025 -0400 drm/amdgpu: fix initialization of doorbell array for detect and hang Initialized doorbells should be set to invalid rather than 0 to prevent driver from over counting hung doorbells since it checks against the invalid value to begin with. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit d0de79f66a80eeb849033fae34bd07a69ce72235 Author: Jonathan Kim Date: Thu Oct 9 10:45:42 2025 -0400 drm/amdgpu: fix gfx12 mes packet status return check GFX12 MES uses low 32 bits of status return for success (1 or 0) and high bits for debug information if low bits are 0. GFX11 MES doesn't do this so checking full 64-bit status return for 1 or 0 is still valid. Signed-off-by: Jonathan Kim Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 883f309add55060233bf11c1ea6947140372920f Author: Jesse.Zhang Date: Mon Oct 13 13:46:12 2025 +0800 drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices Previously, APU platforms (and other scenarios with uninitialized VRAM managers) triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL, but that `man->bdev` (the backing device pointer within the manager) remains uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to a kernel OOPS. 1. **amdgpu_cs.c**: Extend the existing bandwidth control check in `amdgpu_cs_get_threshold_for_moves()` to include a check for `ttm_resource_manager_used()`. If the manager is not used (uninitialized `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific logic that would trigger the NULL dereference. 2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info reporting to use a conditional: if the manager is used, return the real VRAM usage; otherwise, return 0. This avoids accessing `man->bdev` when it is NULL. 3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function) data write path. Use `ttm_resource_manager_used()` to check validity: if the manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set `fb_usage` to 0 (APUs have no discrete framebuffer to report). This approach is more robust than APU-specific checks because it: - Works for all scenarios where the VRAM manager is uninitialized (not just APUs), - Aligns with TTM's design by using its native helper function, - Preserves correct behavior for discrete GPUs (which have fully initialized `man->bdev` and pass the `ttm_resource_manager_used()` check). v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian) Reviewed-by: Christian König Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 33cc891b56b93cad1a83263eaf2e417436f70c82 Author: Christian König Date: Tue Oct 7 10:10:52 2025 +0200 drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM Otherwise accessing them can cause a crash. Signed-off-by: Christian König Tested-by: Mangesh Gadre Acked-by: Alex Deucher Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Alex Deucher commit 74de0eaa00eac2e0cbad1dda6dcf8f44ab27629e Author: Sathishkumar S Date: Fri Oct 10 23:32:40 2025 +0530 drm/amdgpu: fix bit shift logic BIT_ULL(n) sets nth bit, remove explicit shift and set the position Fixes: a7a411e24626 ("drm/amdgpu: fix shift-out-of-bounds in amdgpu_debugfs_jpeg_sched_mask_set") Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 6917112af2ba36c5f19075eb9f2933ffd07e55bf Author: Timur Kristóf Date: Mon Oct 13 08:06:42 2025 +0200 drm/amd/powerplay: Fix CIK shutdown temperature Remove extra multiplication. CIK GPUs such as Hawaii appear to use PP_TABLE_V0 in which case the shutdown temperature is hardcoded in smu7_init_dpm_defaults and is already multiplied by 1000. The value was mistakenly multiplied another time by smu7_get_thermal_temperature_range. Fixes: 4ba082572a42 ("drm/amd/powerplay: export the thermal ranges of VI asics (V2)") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1676 Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit ef38b4eab146715bc68d45029257f5e69ea3f2cd Author: Alex Deucher Date: Fri Oct 10 16:40:57 2025 -0400 drm/amdgpu: drop unused structures in amdgpu_drm.h These were never used and are duplicated with the interface that is used. Maybe leftovers from a previous revision of the patch that added them. Fixes: 90c448fef312 ("drm/amdgpu: add new AMDGPU_INFO subquery for userq objects") Reviewed-by: Prike Liang Signed-off-by: Alex Deucher commit 6df8e84aa6b5b1812cc2cacd6b3f5ccbb18cda2b Author: Gui-Dong Han Date: Wed Oct 8 03:43:27 2025 +0000 drm/amdgpu: use atomic functions with memory barriers for vm fault info The atomic variable vm_fault_info_updated is used to synchronize access to adev->gmc.vm_fault_info between the interrupt handler and get_vm_fault_info(). The default atomic functions like atomic_set() and atomic_read() do not provide memory barriers. This allows for CPU instruction reordering, meaning the memory accesses to vm_fault_info and the vm_fault_info_updated flag are not guaranteed to occur in the intended order. This creates a race condition that can lead to inconsistent or stale data being used. The previous implementation, which used an explicit mb(), was incomplete and inefficient. It failed to account for all potential CPU reorderings, such as the access of vm_fault_info being reordered before the atomic_read of the flag. This approach is also more verbose and less performant than using the proper atomic functions with acquire/release semantics. Fix this by switching to atomic_set_release() and atomic_read_acquire(). These functions provide the necessary acquire and release semantics, which act as memory barriers to ensure the correct order of operations. It is also more efficient and idiomatic than using explicit full memory barriers. Fixes: b97dfa27ef3a ("drm/amdgpu: save vm fault information for amdkfd") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit ff780f4f80323148d43198f2052c14160c8428d3 Author: Alex Deucher Date: Wed Sep 3 13:48:23 2025 -0400 drm/amdgpu: set an error on all fences from a bad context When we backup ring contents to reemit after a queue reset, we don't backup ring contents from the bad context. When we signal the fences, we should set an error on those fences as well. v2: misc cleanups v3: add locking for fence error, fix comment (Christian) v4: fix wrap around, locking (Christian) Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1f22fcb88bfef26a966e9eb242c692c6bf253d47 Author: Alex Deucher Date: Mon Sep 15 12:37:32 2025 -0400 drm/amdgpu: handle wrap around in reemit handling Compare the sequence numbers directly. Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 357d90be2c7aaa526a840cddffd2b8d676fe75a6 Author: Alex Deucher Date: Fri Sep 26 17:31:32 2025 -0400 drm/amdgpu: fix handling of harvesting for ip_discovery firmware Chips which use the IP discovery firmware loaded by the driver reported incorrect harvesting information in the ip discovery table in sysfs because the driver only uses the ip discovery firmware for populating sysfs and not for direct parsing for the driver itself as such, the fields that are used to print the harvesting info in sysfs report incorrect data for some IPs. Populate the relevant fields for this case as well. Fixes: 514678da56da ("drm/amdgpu/discovery: fix fw based ip discovery") Acked-by: Tom St Denis Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8f74c70be57527d7b79e2ecf6de1a154d148254d Author: Christian König Date: Mon Sep 22 14:18:16 2025 +0200 drm/amdgpu: block CE CS if not explicitely allowed by module option The Constant Engine found on gfx6-gfx10 HW has been a notorious source of problems. RADV never used it in the first place, radeonsi only used it for a few releases around 2017 for gfx6-gfx9 before dropping support for it as well. While investigating another problem I just recently found that submitting to the CE seems to be completely broken on gfx9 for quite a while. Since nobody complained about that problem it most likely means that nobody is using any of the affected radeonsi versions on current Linux kernels any more. So to potentially phase out the support for the CE and eliminate another source of problems block submitting CE IBs unless it is enabled again using a debug flag. Signed-off-by: Christian König Reviewed-by: Alex Deucher Acked-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5d55ed19d4190d2c210ac05ac7a53f800a8c6fe5 Author: Christian König Date: Wed Aug 27 14:47:23 2025 +0200 drm/amdgpu: remove two invalid BUG_ON()s Those can be triggered trivially by userspace. Signed-off-by: Christian König Reviewed-by: Alex Deucher Acked-by: Timur Kristóf Signed-off-by: Alex Deucher commit 7bdd91abf0cb3ea78160e2e78fb58b12f6a38d55 Author: Timur Kristóf Date: Fri Sep 26 20:26:13 2025 +0200 drm/amd: Disable ASPM on SI Enabling ASPM causes randoms hangs on Tahiti and Oland on Zen4. It's unclear if this is a platform-specific or GPU-specific issue. Disable ASPM on SI for the time being. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5c05bcf6ae7732da1bd4dc1958d527b5f07f216a Author: Timur Kristóf Date: Fri Sep 26 20:26:12 2025 +0200 drm/amd/pm: Disable MCLK switching on SI at high pixel clocks On various SI GPUs, a flickering can be observed near the bottom edge of the screen when using a single 4K 60Hz monitor over DP. Disabling MCLK switching works around this problem. Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 9858ea4c29c283f0a8a3cdbb42108d464ece90a8 Author: Matthew Schwartz Date: Thu Oct 9 14:19:00 2025 +0200 Revert "drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume" This fix regressed the original issue that commit 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") solved, so revert it until a different approach to solve the regression that it caused with AMD_PRIVATE_COLOR is found. Fixes: a490c8d77d50 ("drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4620 Cc: stable@vger.kernel.org Signed-off-by: Matthew Schwartz Signed-off-by: Alex Deucher commit 54e96258a6930909b690fd7e8889749231ba8085 Author: Tejun Heo Date: Mon Oct 6 15:35:36 2025 -1000 sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU scx_bpf_dsq_move_set_slice() and scx_bpf_dsq_move_set_vtime() take a DSQ iterator argument which has to be valid. Mark them with KF_RCU. Fixes: 4c30f5ce4f7a ("sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()") Cc: stable@vger.kernel.org # v6.12+ Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 86af6b90e0556fcefbc6e98eb78bdce90327ee76 Author: Ville Syrjälä Date: Fri Oct 3 17:57:31 2025 +0300 drm/i915/fb: Fix the set_tiling vs. addfb race, again intel_frontbuffer_get() is what locks out subsequent set_tiling changes to the bo. Thus the fence vs. modifier check must be done after intel_frontbuffer_get(), or else a concurrent set_tiling ioctl might sneak in and change the fence after the check has been done. Close the race again. See commit dd689287b977 ("drm/i915: Prevent concurrent tiling/framebuffer modifications") for the previous instance. v2: Reorder intel_user_framebuffer_destroy() to match the unwind (Jani) Cc: Jouni Högander Reviewed-by: Jani Nikula Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-3-ville.syrjala@linux.intel.com (cherry picked from commit 1d1e4ded216017f8febd91332ee337f0e0e79285) Signed-off-by: Rodrigo Vivi commit 760039c95c78490c5c66ef584fcd536797ed6a2f Author: Ville Syrjälä Date: Fri Oct 3 17:57:30 2025 +0300 drm/i915/frontbuffer: Move bo refcounting intel_frontbuffer_{get,release}() Currently xe's intel_frontbuffer implementation forgets to hold a reference on the bo. This makes the entire thing extremely fragile as the cleanup order now depends on bo references held by other things (namely intel_fb_bo_framebuffer_fini()). Move the bo refcounting to intel_frontbuffer_{get,release}() so that both i915 and xe do this the same way. I first tried to fix this by having xe do the refcounting from its intel_bo_set_frontbuffer() implementation (which is what i915 does currently), but turns out xe's drm_gem_object_free() can sleep and thus drm_gem_object_put() isn't safe to call while we hold fb_tracking.lock. Fixes: 10690b8a49bc ("drm/i915/display: Add intel_fb_bo_framebuffer_fini") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20251003145734.7634-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit eb4d490729a5fd8dc5a76d334f8d01fec7c14bbe) Signed-off-by: Rodrigo Vivi commit 1696b0cfcf004a3af34ffe4c57a14e837ef18144 Author: Zhanjun Dong Date: Mon Sep 29 11:29:04 2025 -0400 drm/i915/guc: Skip communication warning on reset in progress GuC IRQ and tasklet handler receive just single G2H message, and let other messages to be received from next tasklet. During this chained tasklet process, if reset process started, communication will be disabled. Skip warning for this condition. Fixes: 65dd4ed0f4e1 ("drm/i915/guc: Don't receive all G2H messages in irq handler") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15018 Signed-off-by: Zhanjun Dong Reviewed-by: Vinay Belgaumkar Signed-off-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250929152904.269776-1-zhanjun.dong@intel.com (cherry picked from commit 604b5ee4a653a70979ce689dbd6a5d942eb016bf) Signed-off-by: Rodrigo Vivi commit 4adc20ba95d472a919f54d441663924e33c92279 Author: Stefan Wahren Date: Sun Oct 5 13:38:16 2025 +0200 ARM: dts: broadcom: rpi: Switch to V3D firmware clock Until commit 919d6924ae9b ("clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing") the clk-raspberrypi driver wasn't able to change the state of the V3D clock. Only the clk-bcm2835 was able to do this before. After this commit both drivers were able to work against each other, which could result in a system freeze. One step to avoid this conflict is to switch all V3D consumer to the firmware clock. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/linux-arm-kernel/727aa0c8-2981-4662-adf3-69cac2da956d@samsung.com/ Fixes: 919d6924ae9b ("clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing") Signed-off-by: Stefan Wahren Co-developed-by: Melissa Wen Signed-off-by: Melissa Wen Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251005113816.6721-1-wahrenst@gmx.net Signed-off-by: Florian Fainelli commit aa960b597600bed80fe171729057dd6aa188b5b5 Author: Peter Robinson Date: Wed Sep 24 09:56:05 2025 +0100 arm64: dts: broadcom: bcm2712: Define VGIC interrupt Define the interrupt in the GICv2 for vGIC so KVM can be used, it was missed from the original upstream DTB for some reason. Signed-off-by: Peter Robinson Cc: Andrea della Porta Cc: Phil Elwell Fixes: faa3381267d0 ("arm64: dts: broadcom: Add minimal support for Raspberry Pi 5") Link: https://lore.kernel.org/r/20250924085612.1039247-1-pbrobinson@gmail.com Signed-off-by: Florian Fainelli commit 7363096a5a08f8740c9075ecfc51945375c304bc Author: Martyn Welch Date: Thu Oct 9 14:41:32 2025 +0100 Input: goodix - remove setting of RST pin to input The reset line is being set to input on non-ACPI devices apparently to save power. This isn't being done on ACPI devices as it's been found that some ACPI devices don't have a pull-up resistor fitted. This can also be the case for non-ACPI devices, resulting in: [ 941.672207] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 [ 942.696168] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 [ 945.832208] Goodix-TS 1-0014: Error reading 10 bytes from 0x814e: -110 This behaviour appears to have been initialing introduced in ec6e1b4082d9. This doesn't seem to be based on information in either the GT911 or GT9271 datasheets cited as sources of information for this change. Thus it seems likely that it is based on functionality in the Android driver which it also lists. This behaviour may be viable in very specific instances where the hardware is well known, but seems unwise in the upstream kernel where such hardware requirements can't be guaranteed. Remove this over optimisation to improve reliability on non-ACPI devices. Signed-off-by: Martyn Welch Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20251009134138.686215-1-martyn.welch@collabora.com Signed-off-by: Dmitry Torokhov commit c6d99e488117201c63efd747ce17b80687c3f5a9 Author: Hans de Goede Date: Mon Oct 13 09:15:25 2025 -0700 Input: goodix - add support for ACPI ID GDIX1003 Some newer devices use an ACPI hardware ID of GDIX1003 for their Goodix touchscreen controller, instead of GDIX1001 / GDIX1002. Add GDIX1003 to the goodix_acpi_match[] table. Reported-by: Weikang Guo Closes: https://lore.kernel.org/linux-input/20250225024409.1467040-1-guoweikang.kernel@gmail.com/ Tested-by: Weikang Guo Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20251013121022.44333-1-hansg@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 79c0a2b7abc906c7cf3c793256c6b638d7dc477f Author: Dan Carpenter Date: Sat Sep 27 15:26:34 2025 +0300 EDAC/versalnet: Fix off by one in handle_error() The priv->mci[] array has NUM_CONTROLLERS so this > comparison needs to be >= to prevent an out of bounds access. Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller") Signed-off-by: Dan Carpenter Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Yazen Ghannam commit e0b5a7967dec05144bc98125f98c47f74fd1152b Author: Oliver Upton Date: Wed Sep 24 16:51:50 2025 -0700 KVM: arm64: nv: Use FGT write trap of MDSCR_EL1 when available Marc reports that the performance of running an L3 guest has regressed by 60% as a result of setting MDCR_EL2.TDA to hide bad architecture. That's of course terrible for the single user of recursive NV ;-) While there's nothing to be done on non-FGT systems, take advantage of the precise write trap of MDSCR_EL1 and leave the rest of the debug registers untrapped. Reported-by: Marc Zyngier Signed-off-by: Oliver Upton Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit fb10ddf35c1cc3b2888a944c0a3b1aa3baea585e Author: Oliver Upton Date: Wed Sep 24 16:51:49 2025 -0700 KVM: arm64: Compute per-vCPU FGTs at vcpu_load() To date KVM has used the fine-grained traps for the sake of UNDEF enforcement (so-called FGUs), meaning the constituent parts could be computed on a per-VM basis and folded into the effective value when programmed. Prepare for traps changing based on the vCPU context by computing the whole mess of them at vcpu_load(). Aggressively inline all the helpers to preserve the build-time checks that were there before. Signed-off-by: Oliver Upton Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit 5c7cf1e44e94a5408b1b5277810502b0f82b77fe Author: Marc Zyngier Date: Mon Sep 29 17:04:57 2025 +0100 KVM: arm64: selftests: Fix misleading comment about virtual timer encoding The userspace-visible encoding for CNTV_CVAL_EL0 and CNTVCNT_EL0 have been swapped for as long as usersapce has had access to the registers. This is documented in arch/arm64/include/uapi/asm/kvm.h. Despite that, the get_reg_list test has unhelpful comments indicating the wrong register for the encoding. Replace this with definitions exposed in the include file, and a comment explaining again the brokenness. Signed-off-by: Marc Zyngier commit 4da5a9af78b74fb771a4d25dc794296d10e170b1 Author: Marc Zyngier Date: Mon Sep 29 17:04:56 2025 +0100 KVM: arm64: selftests: Add an E2H=0-specific configuration to get_reg_list Add yet another configuration, this time dealing E2H=0. Signed-off-by: Marc Zyngier commit 6418330c8478735f625398bc4e96d3ac6ce1e055 Author: Marc Zyngier Date: Mon Sep 29 17:04:55 2025 +0100 KVM: arm64: selftests: Make dependencies on VHE-specific registers explicit The hyp virtual timer registers only exist when VHE is present, Similarly, VNCR_EL2 only exists when NV2 is present. Make these dependencies explicit. Signed-off-by: Marc Zyngier commit 386aac77da112651a5cdadc4a6b29181592f5aa0 Author: Marc Zyngier Date: Mon Sep 29 17:04:54 2025 +0100 KVM: arm64: Kill leftovers of ad-hoc timer userspace access Now that the whole timer infrastructure is handled as system register accesses, get rid of the now unused ad-hoc infrastructure. Signed-off-by: Marc Zyngier commit 892f7c38ba3b7de19b3dffb8e148d5fbf1228f20 Author: Marc Zyngier Date: Mon Sep 29 17:04:53 2025 +0100 KVM: arm64: Fix WFxT handling of nested virt The spec for WFxT indicates that the parameter to the WFxT instruction is relative to the reading of CNTVCT_EL0. This means that the implementation needs to take the execution context into account, as CNTVOFF_EL2 does not always affect readings of CNTVCT_EL0 (such as when HCR_EL2.E2H is 1 and that we're in host context). This also rids us of the last instance of KVM_REG_ARM_TIMER_CNT outside of the userspace interaction code. Signed-off-by: Marc Zyngier commit c3be3a48fb18f9d243fac452e0be41469bb246b4 Author: Marc Zyngier Date: Mon Sep 29 17:04:52 2025 +0100 KVM: arm64: Move CNT*CT_EL0 userspace accessors to generic infrastructure Moving the counter registers is a bit more involved than for the control and comparator (there is no shadow data for the counter), but still pretty manageable. Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit 8af198980eff2ed2a5df3d2ee39f8c9d61f40559 Author: Marc Zyngier Date: Mon Sep 29 17:04:51 2025 +0100 KVM: arm64: Move CNT*_CVAL_EL0 userspace accessors to generic infrastructure As for the control registers, move the comparator registers to the common infrastructure. Signed-off-by: Marc Zyngier commit 09424d5d7d4e8b427ee4a737fb7765103789e08a Author: Marc Zyngier Date: Mon Sep 29 17:04:50 2025 +0100 KVM: arm64: Move CNT*_CTL_EL0 userspace accessors to generic infrastructure Remove the handling of CNT*_CTL_EL0 from guest.c, and move it to sys_regs.c, using a new TIMER_REG() definition to encapsulate it. Signed-off-by: Marc Zyngier commit 77a0c42eaf03c66936429d190bb2ea1a214bd528 Author: Marc Zyngier Date: Mon Sep 29 17:04:49 2025 +0100 KVM: arm64: Add timer UAPI workaround to sysreg infrastructure Amongst the numerous bugs that plague the KVM/arm64 UAPI, one of the most annoying thing is that the userspace view of the virtual timer has its CVAL and CNT encodings swapped. In order to reduce the amount of code that has to know about this, start by adding handling for this bug in the sys_reg code. Nothing is making use of it yet, as the code responsible for userspace interaction is catching the accesses early. Signed-off-by: Marc Zyngier commit a92d552266890f83126fdef4f777a985cc1302bd Author: Marc Zyngier Date: Mon Sep 29 17:04:48 2025 +0100 KVM: arm64: Make timer_set_offset() generally accessible Move the timer_set_offset() helper to arm_arch_timer.h, so that it is next to timer_get_offset(), and accessible by the rest of KVM. Signed-off-by: Marc Zyngier commit 8625a670afb05f1e1d69d50a74dbcc9d1b855efe Author: Marc Zyngier Date: Mon Sep 29 17:04:47 2025 +0100 KVM: arm64: Replace timer context vcpu pointer with timer_id Having to follow a pointer to a vcpu is pretty dumb, when the timers are are a fixed offset in the vcpu structure itself. Trade the vcpu pointer for a timer_id, which can then be used to compute the vcpu address as needed. Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier commit aa68975c973ed3b0bd4ff513113495588afb855c Author: Marc Zyngier Date: Mon Sep 29 17:04:46 2025 +0100 KVM: arm64: Introduce timer_context_to_vcpu() helper We currently have a vcpu pointer nested into each timer context. As we are about to remove this pointer, introduce a helper (aptly named timer_context_to_vcpu()) that returns this pointer, at least until we repaint the data structure. Signed-off-by: Marc Zyngier commit 4cab5c857d1f92b4b322e30349fdc5e2e38e7a2f Author: Marc Zyngier Date: Mon Sep 29 17:04:45 2025 +0100 KVM: arm64: Hide CNTHV_*_EL2 from userspace for nVHE guests Although we correctly UNDEF any CNTHV_*_EL2 access from the guest when E2H==0, we still expose these registers to userspace, which is a bad idea. Drop the ad-hoc UNDEF injection and switch to a .visibility() callback which will also hide the register from userspace. Fixes: 0e45981028550 ("KVM: arm64: timer: Don't adjust the EL2 virtual timer offset") Signed-off-by: Marc Zyngier commit 164ecbf73c3ea61455e07eefdad8050a7b569558 Author: Sascha Bischoff Date: Tue Oct 7 15:48:54 2025 +0000 Documentation: KVM: Update GICv3 docs for GICv5 hosts GICv5 hosts optionally include FEAT_GCIE_LEGACY, which allows them to execute GICv3-based VMs on GICv5 hardware. Update the GICv3 documentation to reflect this now that GICv3 guests are supports on compatible GICv5 hosts. Signed-off-by: Sascha Bischoff Signed-off-by: Marc Zyngier commit 3193287ddffbce29fd1a79d812f543c0fe4861d1 Author: Sascha Bischoff Date: Tue Oct 7 16:07:13 2025 +0000 KVM: arm64: gic-v3: Only set ICH_HCR traps for v2-on-v3 or v3 guests The ICH_HCR_EL2 traps are used when running on GICv3 hardware, or when running a GICv3-based guest using FEAT_GCIE_LEGACY on GICv5 hardware. When running a GICv2 guest on GICv3 hardware the traps are used to ensure that the guest never sees any part of GICv3 (only GICv2 is visible to the guest), and when running a GICv3 guest they are used to trap in specific scenarios. They are not applicable for a GICv2-native guest, and won't be applicable for a(n upcoming) GICv5 guest. The traps themselves are configured in the vGIC CPU IF state, which is stored as a union. Updating the wrong aperture of the union risks corrupting state, and therefore needs to be avoided at all costs. Bail early if we're not running a compatible guest (GICv2 on GICv3 hardware, GICv3 native, GICv3 on GICv5 hardware). Trap everything unconditionally if we're running a GICv2 guest on GICv3 hardware. Otherwise, conditionally set up GICv3-native trapping. Signed-off-by: Sascha Bischoff Signed-off-by: Marc Zyngier commit d5e6310a0d996493b1af9f3eeec418350523388b Author: Oliver Upton Date: Tue Oct 7 12:52:55 2025 -0700 KVM: arm64: selftests: Actually enable IRQs in vgic_lpi_stress vgic_lpi_stress rather hilariously leaves IRQs disabled for the duration of the test. While the ITS translation of MSIs happens regardless of this, for completeness the guest should actually handle the LPIs. Signed-off-by: Oliver Upton Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 2192d348c0aa0cc2e7249dc3709f21bfe0a0170c Author: Zenghui Yu Date: Wed Oct 8 23:45:20 2025 +0800 KVM: arm64: selftests: Allocate vcpus with correct size vcpus array contains pointers to struct kvm_vcpu {}. It is way overkill to allocate the array with (nr_cpus * sizeof(struct kvm_vcpu)). Fix the allocation by using the correct size. Signed-off-by: Zenghui Yu Signed-off-by: Marc Zyngier commit c35dd838666d47de2848639234ec32e3ba22b49f Author: Mukesh Ojha Date: Fri Oct 10 23:17:07 2025 +0530 KVM: arm64: Guard PMSCR_EL1 initialization with SPE presence check Commit efad60e46057 ("KVM: arm64: Initialize PMSCR_EL1 when in VHE") does not perform sufficient check before initializing PMSCR_EL1 to 0 when running in VHE mode. On some platforms, this causes the system to hang during boot, as EL3 has not delegated access to the Profiling Buffer to the Non-secure world, nor does it reinject an UNDEF on sysreg trap. To avoid this issue, restrict the PMSCR_EL1 initialization to CPUs that support Statistical Profiling Extension (FEAT_SPE) and have the Profiling Buffer accessible in Non-secure EL1. This is determined via a new helper `cpu_has_spe()` which checks both PMSVer and PMBIDR_EL1.P. This ensures the initialization only affects CPUs where SPE is implemented and usable, preventing boot failures on platforms where SPE is not properly configured. Fixes: efad60e46057 ("KVM: arm64: Initialize PMSCR_EL1 when in VHE") Signed-off-by: Mukesh Ojha Signed-off-by: Marc Zyngier commit 1ef0e16c3d7ca07432987840d8eef1a9ffb67dec Author: Stefan Metzmacher Date: Sun Oct 12 21:10:29 2025 +0200 smb: client: let destroy_mr_list() call ib_dereg_mr() before ib_dma_unmap_sg() This is more consistent as we call ib_dma_unmap_sg() only when the memory is no longer registered. This is the same pattern as calling ib_dma_unmap_sg() after IB_WR_LOCAL_INV. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b9c0becc2fceb53e4a958575344e92c0e4f812bb Author: Stefan Metzmacher Date: Sun Oct 12 21:10:28 2025 +0200 smb: client: call ib_dma_unmap_sg if mr->sgt.nents is not 0 This seems to be the more reliable way to check if we need to call ib_dma_unmap_sg(). Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 56c817e31acedc8a9041b181a15755e5a7b55f2b Author: Stefan Metzmacher Date: Sun Oct 12 21:10:27 2025 +0200 smb: client: improve logic in smbd_deregister_mr() - use 'mr' as variable name - style fixes This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c8478502960eb8fb9847b36a66380adf421cdc62 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:26 2025 +0200 smb: client: improve logic in smbd_register_mr() - use 'mr' as variable name - style fixes This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9bebb8924b27f06e7072f0b18a5f78cef561c810 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:25 2025 +0200 smb: client: improve logic in allocate_mr_list() - use 'mr' as variable name - use goto lables for easier cleanup - use destroy_mr_list() - style fixes - INIT_WORK(&sc->mr_io.recovery_work, smbd_mr_recovery_work) on success This will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8e128b293e2b08d4ecca7c63ed1cb5b97f30af9 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:24 2025 +0200 smb: client: let destroy_mr_list() remove locked from the list This should make sure get_mr() can't see the removed entries. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 19421ec198981f60373080af67e67b6a6fcf191e Author: Stefan Metzmacher Date: Sun Oct 12 21:10:23 2025 +0200 smb: client: let destroy_mr_list() call list_del(&mr->list) This makes the code clearer and will make further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit abe5b71c391352127925bf951f3169d205c5caa7 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:22 2025 +0200 smb: client: change smbd_deregister_mr() to return void No callers checks the return value and this makes further changes easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit e487f13cc94fa80c71f217d7b176e48fbb5d6c46 Author: Stefan Metzmacher Date: Sun Oct 12 21:10:21 2025 +0200 smb: smbdirect: introduce smbdirect_mr_io.{kref,mutex} and SMBDIRECT_MR_DISABLED This will be used in the next commits in order to improve the client code. A broken connection can just disable the smbdirect_mr_io while keeping the memory arround for the caller. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 911063b590ce77d473e92716f05f34712f97ef95 Author: Markus Elfring Date: Fri Oct 10 14:48:13 2025 +0200 smb: client: Omit one redundant variable assignment in cifs_xattr_set() The local variable “rc” is assigned a value in an if branch without using it before it is reassigned there. Thus delete this assignment statement. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit b9ce79887e270ed64ed499aa69f903cdca401c2f Author: Markus Elfring Date: Fri Oct 10 21:04:16 2025 +0200 smb: client: Return a status code only as a constant in sid_to_id() Return a status code without storing it in an intermediate variable. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit 9a7f87eb587da49993f47f44c4c5535d8de76750 Author: Zenghui Yu Date: Sun Oct 12 23:43:52 2025 +0800 KVM: arm64: selftests: Sync ID_AA64PFR1, MPIDR, CLIDR in guest We forgot to sync several registers (ID_AA64PFR1, MPIDR, CLIDR) in guest to make sure that the guest had seen the written value. Add them to the list. Signed-off-by: Zenghui Yu Reviewed-By: Ben Horgan Signed-off-by: Marc Zyngier commit 05a02490faeb952f1c8d2f5c38346fa0a717a483 Author: Osama Abdelkader Date: Tue Sep 30 16:56:21 2025 +0300 KVM: arm64: Remove unreachable break after return Remove an unnecessary 'break' statement that follows a 'return' in arch/arm64/kvm/at.c. The break is unreachable. Signed-off-by: Osama Abdelkader Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit a133052666bed0dc0b169952e9d3f9e6b2125f9a Author: Oliver Upton Date: Tue Sep 30 12:33:02 2025 -0700 KVM: selftests: Fix irqfd_test for non-x86 architectures The KVM_IRQFD ioctl fails if no irqchip is present in-kernel, which isn't too surprising as there's not much KVM can do for an IRQ if it cannot resolve a destination. As written the irqfd_test assumes that a 'default' VM created in selftests has an in-kernel irqchip created implicitly. That may be the case on x86 but it isn't necessarily true on other architectures. Add an arch predicate indicating if 'default' VMs get an irqchip and make the irqfd_test depend on it. Work around arm64 VGIC initialization requirements by using vm_create_with_one_vcpu(), ignoring the created vCPU as it isn't used for the test. Reported-by: Sebastian Ott Reported-by: Naresh Kamboju Acked-by: Sean Christopherson Fixes: 7e9b231c402a ("KVM: selftests: Add a KVM_IRQFD test to verify uniqueness requirements") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit cc4309324dc695f62d25d56c0b29805e9724170c Author: Oliver Upton Date: Tue Sep 30 16:36:20 2025 -0700 KVM: arm64: Document vCPU event ioctls as requiring init'ed vCPU KVM rejects calls to KVM_{GET,SET}_VCPU_EVENTS for an uninitialized vCPU as of commit cc96679f3c03 ("KVM: arm64: Prevent access to vCPU events before init"). Update the corresponding API documentation. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0aa1b76fe1429629215a7c79820e4b96233ac4a3 Author: Oliver Upton Date: Tue Sep 30 01:52:37 2025 -0700 KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state. Cc: stable@vger.kernel.org # 6.17 Fixes: b7b27facc7b5 ("arm/arm64: KVM: Add KVM_GET/SET_VCPU_EVENTS") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit cb49b7b8622e914171e9eb7197c006320889e0fc Author: Sean Christopherson Date: Fri Sep 26 08:58:38 2025 -0700 KVM: arm64: selftests: Track width of timer counter as "int", not "uint64_t" Store the width of arm64's timer counter as an "int", not a "uint64_t". ilog2() returns an "int", and more importantly using what is an "unsigned long" under the hood makes clang unhappy due to a type mismatch when clamping the width to a sane value. arm64/arch_timer_edge_cases.c:1032:10: error: comparison of distinct pointer types ('typeof (width) *' (aka 'unsigned long *') and 'typeof (56) *' (aka 'int *')) [-Werror,-Wcompare-distinct-pointer-types] 1032 | width = clamp(width, 56, 64); | ^~~~~~~~~~~~~~~~~~~~ tools/include/linux/kernel.h:47:45: note: expanded from macro 'clamp' 47 | #define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi) | ^~~~~~~~~~~~ tools/include/linux/kernel.h:33:17: note: expanded from macro 'max' 33 | (void) (&_max1 == &_max2); \ | ~~~~~~ ^ ~~~~~~ tools/include/linux/kernel.h:39:9: note: expanded from macro 'min' 39 | typeof(x) _min1 = (x); \ | ^ Fixes: fad4cf944839 ("KVM: arm64: selftests: Determine effective counter width in arch_timer_edge_cases") Cc: Sebastian Ott Signed-off-by: Sean Christopherson Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 890c608b4d5e6a616693da92a2d4e7de4ab9e6c5 Author: Oliver Upton Date: Fri Sep 26 15:44:54 2025 -0700 KVM: arm64: selftests: Test effective value of HCR_EL2.AMO A defect against the architecture now allows an implementation to treat AMO as 1 when HCR_EL2.{E2H, TGE} = {1, 0}. KVM now takes advantage of this interpretation to address a quality of emulation issue w.r.t. SError injection. Add a corresponding test case and expect a pending SError to be taken. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a46c09b382eea3f9e3d16576096b987a2171fcca Author: Oliver Upton Date: Fri Sep 26 15:42:46 2025 -0700 KVM: arm64: Use the in-context stage-1 in __kvm_find_s1_desc_level() Running the external_aborts selftest at EL2 leads to an ugly splat due to the stage-1 MMU being disabled for the walked context, owing to the fact that __kvm_find_s1_desc_level() is hardcoded to the EL1&0 regime. Select the appropriate translation regime for the stage-1 walk based on the current vCPU context. Fixes: b8e625167a32 ("KVM: arm64: Add S1 IPA to page table level walker") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 9a1950f97741a23fc68a7b2cfd487e059d389be5 Author: Marc Zyngier Date: Fri Sep 26 12:41:08 2025 -0700 KVM: arm64: nv: Don't advance PC when pending an SVE exception Jan reports that running a nested guest on Neoverse-V2 leads to a WARN in the host due to simultaneously pending an exception and PC increment after an access to ZCR_EL2. Returning true from a sysreg accessor is an indication that the sysreg instruction has been retired. Of course this isn't the case when we've pended a synchronous SVE exception for the guest. Fix the return value and let the exception propagate to the guest as usual. Reported-by: Jan Kotas Closes: https://lore.kernel.org/kvmarm/865xd61tt5.wl-maz@kernel.org/ Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit ed25dcfbc4327570b28f0328a8e17d121434c0ea Author: Oliver Upton Date: Fri Sep 26 12:41:07 2025 -0700 KVM: arm64: nv: Don't treat ZCR_EL2 as a 'mapped' register Unlike the other mapped EL2 sysregs ZCR_EL2 isn't guaranteed to be resident when a vCPU is loaded as it actually follows the SVE context. As such, the contents of ZCR_EL1 may belong to another guest if the vCPU has been preempted before reaching sysreg emulation. Unconditionally use the in-memory value of ZCR_EL2 and switch to the memory-only accessors. The in-memory value is guaranteed to be valid as fpsimd_lazy_switch_to_{guest,host}() will restore/save the register appropriately. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 8735696acea24ac1f9d4490992418c71941ca68c Author: Mattijs Korpershoek Date: Thu Oct 9 09:10:38 2025 +0200 spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER In csqspi_probe(), when cqspi_request_mmap_dma() returns -EPROBE_DEFER, we handle the error by jumping to probe_setup_failed. In that label, we call pm_runtime_disable(), even if we never called pm_runtime_enable() before. Because of this, the driver cannot probe: [ 2.690018] cadence-qspi 47040000.spi: No Rx DMA available [ 2.699735] spi-nor spi0.0: resume failed with -13 [ 2.699741] spi-nor: probe of spi0.0 failed with error -13 Only call pm_runtime_disable() if it was enabled by adding a new label to handle cqspi_request_mmap_dma() failures. Fixes: b07f349d1864 ("spi: spi-cadence-quadspi: Fix pm runtime unbalance") Signed-off-by: Mattijs Korpershoek Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251009-cadence-quadspi-fix-pm-runtime-v2-1-8bdfefc43902@kernel.org Signed-off-by: Mark Brown commit f43579ef3500527649b1c233be7cf633806353aa Author: Haibo Chen Date: Mon Sep 22 16:47:15 2025 +0800 spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection For different sample clock source selection, the max frequency flexspi supported are different. For mode 0, max frequency is 66MHz. For mode 3, the max frequency is 166MHz. Refer to 3.9.9 FlexSPI timing parameters on page 65. https://www.nxp.com/docs/en/data-sheet/IMX8MNCEC.pdf Though flexspi maybe still work under higher frequency, but can't guarantee the stability. IC suggest to add this limitation on all SoCs which contain flexspi. Fixes: c07f27032317 ("spi: spi-nxp-fspi: add the support for sample data from DQS pad") Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-3-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit b93b4269791fdebbac2a9ad26f324dc2abb9e60f Author: Han Xu Date: Mon Sep 22 16:47:14 2025 +0800 spi: spi-nxp-fspi: add extra delay after dll locked Due to the erratum ERR050272, the DLL lock status register STS2 [xREFLOCK, xSLVLOCK] bit may indicate DLL is locked before DLL is actually locked. Add an extra 4us delay as a workaround. refer to ERR050272, on Page 20. https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf Fixes: 99d822b3adc4 ("spi: spi-nxp-fspi: use DLL calibration when clock rate > 100MHz") Signed-off-by: Han Xu Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-2-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit a89103f67112453fa36c9513e951c19eed9d2d92 Author: Haibo Chen Date: Mon Sep 22 16:47:13 2025 +0800 spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate Current operation contain the max_freq, so new coming operation may use new clock rate, need to re-config the clock rate to match the requirement. Fixes: 26851cf65ffc ("spi: nxp-fspi: Support per spi-mem operation frequency switches") Signed-off-by: Haibo Chen Link: https://patch.msgid.link/20250922-fspi-fix-v1-1-ff4315359d31@nxp.com Signed-off-by: Mark Brown commit 4f38da1f027ea2c9f01bb71daa7a299c191b6940 Merge: 18a5f1af596e6b 3a8660878839fa Author: Mark Brown Date: Mon Oct 13 13:32:13 2025 +0100 spi: Merge up v6.18-rc1 Ensure my CI has a sensible baseline. commit ee70bacef1c6050e4836409927294d744dbcfa72 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:27 2025 +0300 ASoC: nau8821: Avoid unnecessary blocking in IRQ handler The interrupt handler offloads the microphone detection logic to nau8821_jdet_work(), which implies a sleep operation. However, before being able to process any subsequent hotplug event, the interrupt handler needs to wait for any prior scheduled work to complete. Move the sleep out of jdet_work by converting it to a delayed work. This eliminates the undesired blocking in the interrupt handler when attempting to cancel a recently scheduled work item and should help reducing transient input reports that might confuse user-space. Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-5-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 2b4eda7bf7d8a4e2f7575a98f55d8336dec0f302 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:26 2025 +0300 ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit Stress testing the audio jack hotplug handling on a few Steam Deck units revealed that the debounce circuit is responsible for having a negative impact on the detection reliability, e.g. in some cases the ejection interrupt is not fired, while in other instances it goes into a kind of invalid state and generates a flood of misleading interrupts. Add new entries to the DMI table introduced via commit 1bc40efdaf4a ("ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect") and extend the quirk logic to allow bypassing the debounce circuit used for jack detection on Valve Steam Deck LCD and OLED models. While at it, rename existing NAU8821_JD_ACTIVE_HIGH quirk bitfield to NAU8821_QUIRK_JD_ACTIVE_HIGH. This should help improve code readability by differentiating from similarly named register bits. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-4-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit a698679fe8b0fec41d1fb9547a53127a85c1be92 Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:25 2025 +0300 ASoC: nau8821: Consistently clear interrupts before unmasking The interrupt handler attempts to perform some IRQ status clear operations *after* rather than *before* unmasking and enabling interrupts. This is a rather fragile approach since it may generally lead to missing IRQ requests or causing spurious interrupts. Make use of the nau8821_irq_status_clear() helper instead of manipulating the related register directly and ensure any interrupt clearing is performed *after* the target interrupts are disabled/masked and *before* proceeding with additional interrupt unmasking/enablement operations. This also implicitly drops the redundant clear operation of the ejection IRQ in the interrupt handler, since nau8821_eject_jack() has been already responsible for clearing all active interrupts. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Fixes: 2551b6e89936 ("ASoC: nau8821: Add headset button detection") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-3-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 9273aa85b35cc02d0953a1ba3b7bd694e5a2c10e Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:24 2025 +0300 ASoC: nau8821: Generalize helper to clear IRQ status Instead of adding yet another utility function for dealing with the interrupt clearing register, generalize nau8821_int_status_clear_all() by renaming it to nau8821_irq_status_clear(), whilst introducing a second parameter to allow restricting the operation scope to a single interrupt instead of the whole range of active IRQs. While at it, also fix a spelling typo in the comment block. Note this is mainly a prerequisite for subsequent patches aiming to address some deficiencies in the implementation of the interrupt handler. Thus the presence of the Fixes tag below is intentional, to facilitate backporting. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-2-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 6e54919cb541fdf1063b16f3254c28d01bc9e5ff Author: Cristian Ciocaltea Date: Fri Oct 3 21:03:23 2025 +0300 ASoC: nau8821: Cancel jdet_work before handling jack ejection The microphone detection work scheduled by a prior jack insertion interrupt may still be in a pending state or under execution when a jack ejection interrupt has been fired. This might lead to a racing condition or nau8821_jdet_work() completing after nau8821_eject_jack(), which will override the currently disconnected state of the jack and incorrectly report the headphone or the headset as being connected. Cancel any pending jdet_work or wait for its execution to finish before attempting to handle the ejection interrupt. Proceed similarly before launching the eject handler as a consequence of detecting an invalid insert interrupt. Fixes: aab1ad11d69f ("ASoC: nau8821: new driver") Signed-off-by: Cristian Ciocaltea Link: https://patch.msgid.link/20251003-nau8821-jdet-fixes-v1-1-f7b0e2543f09@collabora.com Signed-off-by: Mark Brown commit 7e8242405b94ceac6db820de7d4fd9318cbc1219 Author: Bean Huo Date: Wed Oct 1 08:08:03 2025 +0200 rpmb: move rpmb_frame struct and constants to common header Move struct rpmb_frame and RPMB operation constants from MMC block driver to include/linux/rpmb.h for reuse across different RPMB implementations (UFS, NVMe, etc.). Signed-off-by: Bean Huo Reviewed-by: Avri Altman Acked-by: Jens Wiklander Reviewed-by: Bart Van Assche Signed-off-by: Ulf Hansson commit 518919276c4119e34e24334003af70ab12477f00 Author: Louis-Alexis Eyraud Date: Fri Oct 3 15:48:49 2025 +0200 pinctrl: mediatek: mt8189: align register base names to dt-bindings ones The mt8189-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8189_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8189-pinctrl" dt-bindings, leading to possible dtbs check issues. The mt8189_pinctrl_register_base_names entry order is also different. So, align all mt8189_pinctrl_register_base_names entry names and order on dt-bindings. Fixes: a3fe1324c3c5 ("pinctrl: mediatek: Add pinctrl driver for mt8189") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Linus Walleij commit 404ee89b4008cf2130554dac2c64cd8412601356 Author: Louis-Alexis Eyraud Date: Fri Oct 3 16:00:28 2025 +0200 pinctrl: mediatek: mt8196: align register base names to dt-bindings ones The mt8196-pinctrl driver requires to probe that a device tree uses in the device node the same names than mt8196_pinctrl_register_base_names array. But they are not matching the required ones in the "mediatek,mt8196-pinctrl" dt-bindings, leading to possible dtbs check issues. So, align all mt8196_pinctrl_register_base_names entries on dt-bindings ones. Fixes: f7a29377c253 ("pinctrl: mediatek: Add pinctrl driver on mt8196") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Linus Walleij commit 6370a996f308ea3276030769b7482b346e7cc7c1 Author: Christophe Leroy Date: Thu Oct 9 19:03:13 2025 +0200 ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec The gain ranges specified in Renesas IDT821034 codec documentation are [-3dB;+13dB] in the transmit path (ADC) and [-13dB;+3dB] in the receive path (DAC). Allthough the registers allow programming values outside those ranges, the signal S/N and distorsion are only guaranteed in the specified ranges. Set ranges to the specified ones. Fixes: e51166990e81 ("ASoC: codecs: Add support for the Renesas IDT821034 codec") Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/2bd547194f3398e6182f770d7d6be711c702b4b2.1760029099.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit 7e6cfa3e94cf8278ee3170dc0b81fc6db1287e28 Author: Baojun Xu Date: Thu Oct 2 15:29:25 2025 +0800 ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx Update ti,tas2781.yaml for adding TAS5802/TAS5815/TAS5828. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251002072925.26242-2-baojun.xu@ti.com Signed-off-by: Mark Brown commit 53a3c6e222836a23e8e0693395584aefc456dca6 Author: Baojun Xu Date: Thu Oct 2 15:29:24 2025 +0800 ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver TAS5802/TAS5815/TAS5828 has on-chip DSP without current/voltage feedback. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251002072925.26242-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit dee4ef0ebe4dee655657ead30892aeca16462823 Author: Le Qi Date: Thu Oct 9 17:06:19 2025 +0800 ASoC: qcom: sc8280xp: Add support for QCS615 Add compatible for sound card on QCS615 boards. Signed-off-by: Le Qi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251009090619.1097388-3-le.qi@oss.qualcomm.com Signed-off-by: Mark Brown commit 6079165e6e027c03e06556ff3df0ed03a34d68f0 Author: Le Qi Date: Thu Oct 9 17:06:18 2025 +0800 ASoC: dt-bindings: qcom,sm8250: Add QCS615 sound card Add bindings for QCS615 sound card, which looks fully compatible with existing SM8250. Signed-off-by: Le Qi Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251009090619.1097388-2-le.qi@oss.qualcomm.com Signed-off-by: Mark Brown commit 11fb1a82aefa6f7fea6ac82334edb5639b9927df Author: Sudeep Holla Date: Tue Sep 23 16:09:27 2025 +0100 firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor FF-A v1.2 introduced 16 byte IMPLEMENTATION DEFINED value in the endpoint memory access descriptor to allow any sender could to specify an its any custom value for each receiver. Also this value must be specified by the receiver when retrieving the memory region. The sender must ensure it informs the receiver of this value via an IMPLEMENTATION DEFINED mechanism such as a partition message. So the FF-A driver can use the message interfaces to communicate the value and set the same in the ffa_mem_region_attributes structures when using the memory interfaces. The driver ensure that the size of the endpoint memory access descriptors is set correctly based on the FF-A version. Fixes: 9fac08d9d985 ("firmware: arm_ffa: Upgrade FF-A version to v1.2 in the driver") Reported-by: Lixiang Mao Tested-by: Lixiang Mao Message-Id: <20250923150927.1218364-1-sudeep.holla@arm.com> Signed-off-by: Sudeep Holla commit 7557f189942571821a09879edfcdfdafefe4d67f Author: Kriish Sharma Date: Fri Oct 3 18:08:49 2025 +0000 binder: Fix missing kernel-doc entries in binder.c Fix several kernel-doc warnings in `drivers/android/binder.c` caused by undocumented struct members and function parameters. In particular, add missing documentation for the `@thread` parameter in binder_free_buf_locked(). Signed-off-by: Kriish Sharma Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit b5ce7a5cc50f4c283d0bfa5cc24fe864cb9a3400 Author: Alice Ryhl Date: Tue Oct 7 09:39:53 2025 +0000 rust_binder: report freeze notification only when fully frozen Binder only sends out freeze notifications when ioctl_freeze() completes and the process has become fully frozen. However, if a freeze notification is registered during the freeze operation, then it registers an initial state of 'frozen'. This is a problem because if the freeze operation fails, then the listener is not told about that state change, leading to lost updates. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit 99559e5bb4c6795824b6531ad61519c1d9500079 Author: Alice Ryhl Date: Tue Oct 7 09:39:52 2025 +0000 rust_binder: don't delete FreezeListener if there are pending duplicates When userspace issues commands to a freeze listener, it identifies it using a cookie. Normally this cookie uniquely identifies a freeze listener, but when userspace clears a listener with the intent of deleting it, it's allowed to "regret" clearing it and create a new freeze listener for the same node using the same cookie. (IMO this was an API mistake, but userspace relies on it.) Currently if the active freeze listener gets fully deleted while there are still pending duplicates, then the code incorrectly deletes the pending duplicates too. To fix this, do not delete the entry if there are still pending duplicates. Since the current data structure requires a main freeze listener, we convert one pending duplicate into the primary listener in this scenario. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit bfe144da06b002cccf314769c45ecccb69501c48 Author: Alice Ryhl Date: Tue Oct 7 09:39:51 2025 +0000 rust_binder: freeze_notif_done should resend if wrong state Consider the following scenario: 1. A freeze notification is delivered to thread 1. 2. The process becomes frozen or unfrozen. 3. The message for step 2 is delivered to thread 2 and ignored because there is already a pending notification from step 1. 4. Thread 1 acknowledges the notification from step 1. In this case, step 4 should ensure that the message ignored in step 3 is resent as it can now be delivered. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit c7c090af371775106360c9e7a7c35b718311c3f9 Author: Alice Ryhl Date: Thu Oct 2 09:25:29 2025 +0000 rust_binder: remove warning about orphan mappings This condition occurs if a thread dies while processing a transaction. We should not print anything in this scenario. Signed-off-by: Alice Ryhl Reviewed-by: Joel Fernandes Acked-by: Carlos Llamas Signed-off-by: Greg Kroah-Hartman commit 7e69a24b6b35d4ffd54dd702047a01f5858b3e45 Author: Miguel Ojeda Date: Wed Sep 24 15:05:10 2025 +0200 rust_binder: clean `clippy::mem_replace_with_default` warning Clippy reports: error: replacing a value of type `T` with `T::default()` is better expressed using `core::mem::take` --> drivers/android/binder/node.rs:690:32 | 690 | _unused_capacity = mem::replace(&mut inner.freeze_list, KVVec::new()); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: consider using: `core::mem::take(&mut inner.freeze_list)` | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#mem_replace_with_default = note: `-D clippy::mem-replace-with-default` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(clippy::mem_replace_with_default)]` The suggestion seems fine, thus apply it. Signed-off-by: Miguel Ojeda Signed-off-by: Greg Kroah-Hartman commit b1aabb8ef09b4cf0cc0c92ca9dfd19482f3192c1 Author: Ma Ke Date: Tue Sep 23 09:36:03 2025 +0800 staging: gpib: Fix device reference leak in fmh_gpib driver The fmh_gpib driver contains a device reference count leak in fmh_gpib_attach_impl() where driver_find_device() increases the reference count of the device by get_device() when matching but this reference is not properly decreased. Add put_device() in fmh_gpib_detach(), which ensures that the reference count of the device is correctly managed. Found by code review. Cc: stable Fixes: 8e4841a0888c ("staging: gpib: Add Frank Mori Hess FPGA PCI GPIB driver") Signed-off-by: Ma Ke Reviewed-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman commit aaf2af1ed147ef49be65afb541a67255e9f60d15 Author: Dave Penkler Date: Sun Sep 28 13:33:59 2025 +0200 staging: gpib: Return -EINTR on device clear When the ATN (Attention) line is asserted during a read we get a NIUSB_ATN_STATE_ERROR during a read. For the controller to send a device clear it asserts ATN. Normally this is an error but in the case of a device clear it should be regarded as an interrupt. Return -EINTR when the Device Clear Active State (DCAS) is entered else signal an error with dev_dbg with status instead of just dev_err. Signed-off-by: Dave Penkler Cc: stable Signed-off-by: Greg Kroah-Hartman commit 92a2b74a6b5a5d9b076cd9aa75e63c6461cbd073 Author: Dave Penkler Date: Sun Sep 28 13:33:58 2025 +0200 staging: gpib: Fix sending clear and trigger events This driver was not sending device clear or trigger events when the board entered the DCAS or DTAS state respectively in device mode. DCAS is the Device Clear Active State which is entered on receiving a selective device clear message (SDC) or universal device clear message (DCL) from the controller in charge. DTAS is the Device Trigger Active State which is entered on receiving a group execute trigger (GET) message from the controller. In order for an application, implementing a particular device, to detect when one of these states is entered the driver needs to send the appropriate event. Send the appropriate gpib_event when DCAS or DTAS is set in the reported status word. This sets the DCAS or DTAS bits in the board's status word which can be monitored by the application. Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver") Cc: stable Tested-by: Dave Penkler Signed-off-by: Dave Penkler Signed-off-by: Greg Kroah-Hartman commit d3c4c1f29aadccf2f43530bfa1e60a6d8030fd4a Author: Dave Penkler Date: Sun Sep 28 11:18:18 2025 +0200 staging: gpib: Fix no EOI on 1 and 2 byte writes EOI (End Or Identify) is a hardware line on the GPIB bus that can be asserted with the last byte of a message to indicate the end of the transfer to the receiving device. In this driver, a write with send_eoi true is done in 3 parts: Send first byte directly Send remaining but 1 bytes using the fifo Send the last byte directly with EOI asserted The first byte in a write is always sent by writing to the tms9914 chip directly to setup for the subsequent fifo transfer. We were not checking for a 1 byte write with send_eoi true resulting in EOI not being asserted. Since the fifo transfer was not executed (fifotransfersize == 0) the retval in the test after the fifo transfer code was still 1 from the preceding direct write. This caused it to return without executing the final direct write which would have sent an unsollicited extra byte. For a 2 byte message the first byte was sent directly. But since the fifo transfer was not executed (fifotransfersize == 1) and the retval in the test after the fifo transfer code was still 1 from the preceding first byte write it returned before the final direct byte write with send_eoi true. The second byte was then sent as a separate 1 byte write to complete the 2 byte write count again without EOI being asserted as above. Only send the first byte directly if more than 1 byte is to be transferred with send_eoi true. Also check for retval < 0 for the error return in case the fifo code is not used (1 or 2 byte message with send_eoi true). Fixes: 09a4655ee1eb ("staging: gpib: Add HP/Agilent/Keysight 8235xx PCI GPIB driver") Cc: stable Tested-by: Dave Penkler Signed-off-by: Dave Penkler Signed-off-by: Greg Kroah-Hartman commit 66233e583d1e00b1742d1ba36ae31568109ba6bd Author: Shenghao Ding Date: Mon Oct 13 12:35:55 2025 +0800 ALSA: hda/tas2781: Set tas2781_hda::tasdevice_priv::chip_id as TAS5825 in case of tas5825 The software reset for TAS5825 is different form other chips, as it will set as 0x11 instead of 0x1 during reset in the tasdevice_reset(). So set tas2781_hda::tasdevice_priv::chip_id as TAS5825, tasdevice_reset() can work correctly. Fixes: 7ceb69ca82b1 ("ASoC: tas2781: Add tas2118, tas2x20, tas5825 support") Signed-off-by: Shenghao Ding Signed-off-by: Takashi Iwai commit e2cc390a6629c76924a2740c54b144b9b28fca59 Author: David Lechner Date: Fri Oct 10 15:24:31 2025 -0500 iio: adc: ad7124: fix temperature channel Fix temperature channel not working due to gain and offset not being initialized. For channels other than the voltage ones calibration is skipped (which is OK). However that results in the calibration register values tracked in st->channels[i].cfg all being zero. These zeros are later written to hardware before a measurement is made which caused the raw temperature readings to be always 8388608 (0x800000). To fix it, we just make sure the gain and offset values are set to the default values and still return early without doing an internal calibration. While here, add a comment explaining why we don't bother calibrating the temperature channel. Fixes: 47036a03a303 ("iio: adc: ad7124: Implement internal calibration at probe time") Reviewed-by: Marcelo Schmitt Signed-off-by: David Lechner Reviewed-by: Uwe Kleine-König Cc: Signed-off-by: Jonathan Cameron commit 21553258b94861a73d7f2cf15469d69240e1170d Author: Christophe JAILLET Date: Fri Oct 10 20:58:48 2025 +0200 iio:common:ssp_sensors: Fix an error handling path ssp_probe() If an error occurs after a successful mfd_add_devices() call, it should be undone by a corresponding mfd_remove_devices() call, as already done in the remove function. Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver") Signed-off-by: Christophe JAILLET Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit bd886cdcbf9e746f61c74035a3acd42e9108e115 Author: David Lechner Date: Fri Oct 10 10:44:45 2025 -0500 iio: adc: ad7280a: fix ad7280_store_balance_timer() Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places. iio_str_to_fixpoint() has a bit of an unintuitive API where the fract_mult parameter is the multiplier of the first decimal place as if it was already an integer. So to get 3 decimal places, fract_mult must be 100 rather than 1000. Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 3db847df994d475db7812dde90376f2848bcd30a Author: Nuno Sá Date: Tue Oct 7 10:15:23 2025 +0100 iio: buffer-dmaengine: enable .get_dma_dev() Wire up the .get_dma_dev() callback to use the DMA buffer infrastructure's implementation. This ensures that DMABUF operations use the correct DMA device for mapping, which is essential for proper operation on systems where memory is mapped above the 32-bit range. Without this callback, the core would fall back to using the IIO device's parent, which may not have the appropriate DMA mask configuration for high memory access. Fixes: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API") Reviewed-by: David Lechner Signed-off-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 Author: Nuno Sá Date: Tue Oct 7 10:15:22 2025 +0100 iio: buffer-dma: support getting the DMA channel Implement the .get_dma_dev() callback for DMA buffers by returning the device that owns the DMA channel. This allows the core DMABUF infrastructure to properly map DMA buffers using the correct device, avoiding the need for bounce buffers on systems where memory is mapped above the 32-bit range. The function returns the DMA queue's device, which is the actual device responsible for DMA operations in buffer-dma implementations. Cc: stable@vger.kernel.org Reviewed-by: David Lechner Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron commit a514bb109eada64f798f1c86c17182229cc20fe7 Author: Nuno Sá Date: Tue Oct 7 10:15:21 2025 +0100 iio: buffer: support getting dma channel from the buffer Add a new buffer accessor .get_dma_dev() in order to get the struct device responsible for actually providing the dma channel. We cannot assume that we can use the parent of the IIO device for mapping the DMA buffer. This becomes important on systems (like the Xilinx/AMD zynqMP Ultrascale) where memory (or part of it) is mapped above the 32 bit range. On such systems and given that a device by default has a dma mask of 32 bits we would then need to rely on bounce buffers (to swiotlb) for mapping memory above the dma mask limit. In the process, add an iio_buffer_get_dma_dev() helper function to get the proper DMA device. Cc: stable@vger.kernel.org Reviewed-by: David Lechner Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 0bf1bfde53b30da7fd7f4a6c3db5b8e77888958d Author: Achim Gratz Date: Sun Sep 28 19:26:28 2025 +0200 iio: pressure: bmp280: correct meas_time_us calculation Correction of meas_time_us initialization based on an observation and partial patch by David Lechner. The constant part of the measurement time (as described in the datasheet and implemented in the BM(P/E)2 Sensor API) was apparently forgotten (it was already correctly applied for the BMP380) and is now used. There was also another thinko in bmp280_wait_conv: data->oversampling_humid can actually have a value of 0 (for an oversampling_ratio of 1), so it can not be used to detect the presence of the humidity measurement capability. Use data->chip_info->oversampling_humid_avail instead, which is NULL for chips that cannot measure humidity and therefore must skip that part of the calculation. Closes: https://lore.kernel.org/linux-iio/875xgfg0wz.fsf@Gerda.invalid/ Fixes: 26ccfaa9ddaa ("iio: pressure: bmp280: Use sleep and forced mode for oneshot captures") Suggested-by: David Lechner Tested-by: Achim Gratz Signed-off-by: Achim Gratz Cc: Signed-off-by: Jonathan Cameron commit 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de Author: Olivier Moysan Date: Thu Oct 2 13:22:49 2025 +0200 iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling Initially st,adc-alt-channel property was defined as an enum in the DFSDM binding. The DFSDM binding has been changed to use the new IIO backend framework, along with the adoption of IIO generic channels. In this new binding st,adc-alt-channel is defined as a boolean property, but it is still handled has an enum in DFSDM driver. Fix st,adc-alt-channel property handling in DFSDM driver. Fixes: 3208fa0cd919 ("iio: adc: stm32-dfsdm: adopt generic channels bindings") Signed-off-by: Olivier Moysan Reviewed-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron commit 632757312d7eb320b66ca60e0cfe098ec53cee08 Author: David Lechner Date: Fri Sep 19 15:50:34 2025 -0500 iio: adc: ad7380: fix SPI offload trigger rate Add a special case to double the SPI offload trigger rate when all channels of a single-ended chip are enabled in a buffered read. The single-ended chips in the AD738x family can only do simultaneous sampling of half their channels and have a multiplexer to allow reading the other half. To comply with the IIO definition of sampling_frequency, we need to trigger twice as often when the sequencer is enabled to so that both banks can be read in a single sample period. Fixes: bbeaec81a03e ("iio: ad7380: add support for SPI offload") Signed-off-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 9b45744bf09fc2a3287e05287141d6e123c125a7 Author: ChiYuan Huang Date: Thu Sep 18 11:10:59 2025 +0800 iio: adc: rtq6056: Correct the sign bit index The vshunt/current reported register is a signed 16bit integer. The sign bit index should be '15', not '16'. Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support") Reported-by: Andy Hsu Signed-off-by: ChiYuan Huang Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit ffc74ad539136ae9e16f7b5f2e4582e88018cd49 Author: Marcelo Schmitt Date: Thu Sep 18 14:37:27 2025 -0300 iio: adc: ad4030: Fix _scale value for common-mode channels Previously, the driver always used the amount of precision bits of differential input channels to provide the scale to mV. Though, differential and common-mode voltage channels have different amount of precision bits and the correct number of precision bits must be considered to get to a proper mV scale factor for each one. Use channel specific number of precision bits to provide the correct scale value for each channel. Fixes: de67f28abe58 ("iio: adc: ad4030: check scan_type for error") Fixes: 949abd1ca5a4 ("iio: adc: ad4030: add averaging support") Signed-off-by: Marcelo Schmitt Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 51cb04abd39097209b871e95ffa7e8584ce7dcba Author: Krishna Kurapati Date: Mon Oct 13 09:29:20 2025 +0530 dt-bindings: usb: qcom,snps-dwc3: Fix bindings for X1E80100 Add the missing multiport controller binding to target list. Fix minItems for interrupt-names to avoid the following error on High Speed controller: usb@a200000: interrupt-names: ['dwc_usb3', 'pwr_event', 'dp_hs_phy_irq', 'dm_hs_phy_irq'] is too short Fixes: 6e762f7b8edc ("dt-bindings: usb: Introduce qcom,snps-dwc3") Cc: stable@vger.kernel.org Signed-off-by: Krishna Kurapati Reviewed-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman commit dddc0f71485f1f29f236e387632181bcc09019a0 Author: Peter Robinson Date: Mon Oct 6 22:39:52 2025 +0100 usb: misc: Add x86 dependency for Intel USBIO driver The Intel USBIO driver is x86 only, other architectures have ACPI so add an appropriate depenecy plus compile test. Fixes: 121a0f839dbb3 ("usb: misc: Add Intel USBIO bridge driver") Signed-off-by: Peter Robinson Reviewed-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit bd8c3ce6d7a205b3ba3ef9815db4c6932290ec59 Author: Neil Armstrong Date: Tue Sep 30 19:17:21 2025 +0200 dt-bindings: usb: switch: split out ports definition The ports definition currently defined in the usb-switch.yaml fits standards devices which are either recipient of altmode muxing and orientation switching events or an element of the USB Super Speed data lanes. This doesn't necessarely fit combo PHYs like the Qualcomm USB3/DP Combo which has a different ports representation. Move the ports definition to a separate usb-switch-ports.yaml and reference it next to the usb-switch.yaml, except for the Qualcomm USB3/DP Combo PHY bindings. Reported-by: Rob Herring Closes: https://lore.kernel.org/all/175462129176.394940.16810637795278334342.robh@kernel.org/ Fixes: 3bad7fe22796 ("dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp: Reference usb-switch.yaml to allow mode-switch") Signed-off-by: Neil Armstrong Reviewed-by: Rob Herring (Arm) Signed-off-by: Greg Kroah-Hartman commit 2758246d287549e1088eae350654160cbf4d424f Author: Christophe JAILLET Date: Mon Sep 29 20:28:50 2025 +0200 usb: dwc3: Don't call clk_bulk_disable_unprepare() twice devm_clk_bulk_get_all_enabled() is used in the probe, so clk_bulk_disable_unprepare() should not be called explicitly in the remove function. Fixes: e0b6dc00c701 ("usb: dwc3: add generic driver to support flattened") Signed-off-by: Christophe JAILLET Acked-by: Thinh Nguyen Signed-off-by: Greg Kroah-Hartman commit 268eb6fb908bc82ce479e4dba9a2cad11f536c9c Author: Xu Yang Date: Fri Sep 19 14:25:34 2025 +0800 dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp Only i.MX8MP need dma-range property to let USB controller work properly. Remove dma-range from required list and add limitation for imx8mp. Fixes: d2a704e29711 ("dt-bindings: usb: dwc3-imx8mp: add imx8mp dwc3 glue bindings") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Greg Kroah-Hartman commit 5ec6f9434225e18496a393f920b03eb46d67d71d Author: Takashi Iwai Date: Mon Oct 13 09:26:49 2025 +0200 ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6 HP ZBook 17 G6 with SSID 103c:860c requires a similar workaround as its 15-inch model in order to make the speaker and mute LED working. Add the corresponding quirk entry to address it. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220372 Cc: Signed-off-by: Takashi Iwai commit 12d724f2852d094d68dccaf5101e0ef89a971cde Author: Damien Le Moal Date: Thu Oct 9 19:46:00 2025 +0900 ata: libata-core: relax checks in ata_read_log_directory() Commit 6d4405b16d37 ("ata: libata-core: Cache the general purpose log directory") introduced caching of a device general purpose log directory to avoid repeated access to this log page during device scan. This change also added a check on this log page to verify that the log page version is 0x0001 as mandated by the ACS specifications. And it turns out that some devices do not bother reporting this version, instead reporting a version 0, resulting in error messages such as: ata6.00: Invalid log directory version 0x0000 and to the device being marked as not supporting the general purpose log directory log page. Since before commit 6d4405b16d37 the log page version check did not exist and things were still working correctly for these devices, relax ata_read_log_directory() version check and only warn about the invalid log page version number without disabling access to the log directory page. Fixes: 6d4405b16d37 ("ata: libata-core: Cache the general purpose log directory") Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220635 Signed-off-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 109ff654934a4752f8875ded672efd1fbfe4d31d Author: Dharma Balasubiramani Date: Mon Oct 6 16:21:50 2025 +0530 counter: microchip-tcb-capture: Allow shared IRQ for multi-channel TCBs Mark the interrupt as IRQF_SHARED to permit multiple counter channels to share the same TCB IRQ line. Each Timer/Counter Block (TCB) instance shares a single IRQ line among its three internal channels. When multiple counter channels (e.g., counter@0 and counter@1) within the same TCB are enabled, the second call to devm_request_irq() fails because the IRQ line is already requested by the first channel. Cc: stable@vger.kernel.org Fixes: e5d581396821 ("counter: microchip-tcb-capture: Add IRQ handling") Signed-off-by: Dharma Balasubiramani Reviewed-by: Kamel Bouhara Reviewed-by: Bence Csókás Link: https://lore.kernel.org/r/20251006-microchip-tcb-v1-1-09c19181bb4a@microchip.com Signed-off-by: William Breathitt Gray commit 0843ba458439f38efdc14aa359c14ad0127edb01 Author: Sourabh Jain Date: Wed Oct 8 08:59:34 2025 +0530 powerpc/fadump: skip parameter area allocation when fadump is disabled Fadump allocates memory to pass additional kernel command-line argument to the fadump kernel. However, this allocation is not needed when fadump is disabled. So avoid allocating memory for the additional parameter area in such cases. Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") Reviewed-by: Hari Bathini Signed-off-by: Sourabh Jain Fixes: f4892c68ecc1 ("powerpc/fadump: allocate memory for additional parameters early") Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251008032934.262683-1-sourabhjain@linux.ibm.com commit 2743cf75f7c92d2a0a4acabd7aef1c17d98fe123 Author: Nam Cao Date: Wed Oct 8 08:13:59 2025 +0000 powerpc, ocxl: Fix extraction of struct xive_irq_data Commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers") changed xive_irq_data to be stashed to chip_data instead of handler_data. However, multiple places are still attempting to read xive_irq_data from handler_data and get a NULL pointer deference bug. Update them to read xive_irq_data from chip_data. Non-XIVE files which touch xive_irq_data seem quite strange to me, especially the ocxl driver. I think there ought to be an alternative platform-independent solution, instead of touching XIVE's data directly. Therefore, I think this whole thing should be cleaned up. But perhaps I just misunderstand something. In any case, this cleanup would not be trivial; for now, just get things working again. Fixes: cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers") Reported-by: Ritesh Harjani (IBM) Closes: https://lore.kernel.org/linuxppc-dev/68e48df8.170a0220.4b4b0.217d@mx.google.com/ Signed-off-by: Nam Cao Reviewed-by: Ganesh Goudar Acked-by: Andrew Donnellan # ocxl Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251008081359.1382699-1-namcao@linutronix.de commit ef3e73a917ec7d080e0fb0e4015098a4fb0f1cff Author: Nam Cao Date: Fri Oct 10 12:03:07 2025 +0000 powerpc/pseries/msi: Fix NULL pointer dereference at irq domain teardown pseries_msi_ops_teardown() reads pci_dev* from msi_alloc_info_t. However, pseries_msi_ops_prepare() does not populate this structure, thus it is all zeros. Consequently, pseries_msi_ops_teardown() triggers a NULL pointer dereference crash. struct pci_dev is available in struct irq_domain. Read it there instead. Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/linuxppc-dev/878d7651-433a-46fe-a28b-1b7e893fcbe0@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote Signed-off-by: Nam Cao Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251010120307.3281720-1-namcao@linutronix.de commit 39dec6cd888bde4171bd4b8fcf45f73ab684404d Author: Markus Elfring Date: Wed Oct 1 21:09:00 2025 +0200 smb: server: Use common error handling code in smb_direct_rdma_xmit() Add two jump targets so that a bit of exception handling can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Reviewed-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0b4b77eff5f8cd9be062783a1c1e198d46d0a753 Author: Nicolas Dichtel Date: Fri Oct 10 16:18:59 2025 +0200 doc: fix seg6_flowlabel path This sysctl is not per interface; it's global per netns. Fixes: 292ecd9f5a94 ("doc: move seg6_flowlabel to seg6-sysctl.rst") Reported-by: Philippe Guibert Signed-off-by: Nicolas Dichtel Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3a8660878839faadb4f1a6dd72c3179c1df56787 Author: Linus Torvalds Date: Sun Oct 12 13:42:36 2025 -0700 Linux 6.18-rc1 commit 3dd7b8123544402be76bea82af43d2de4b9226d8 Merge: 8765f467912ff0 a8482d2c9071d7 Author: Linus Torvalds Date: Sun Oct 12 13:27:56 2025 -0700 Merge tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "One revert because of a regression in the I2C core which has sadly not showed up during its time in -next" * tag 'i2c-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: Revert "i2c: boardinfo: Annotate code used in init phase only" commit 68a052239fc4b351e961f698b824f7654a346091 Author: Jakub Kicinski Date: Thu Oct 9 13:56:29 2025 -0700 selftests: drv-net: update remaining Python init files Convert remaining __init__ files similar to what we did in commit b615879dbfea ("selftests: drv-net: make linters happy with our imports") Signed-off-by: Jakub Kicinski Signed-off-by: Stanislav Fomichev Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 65946eac6d888d50ae527c4e5c237dbe5cc3a2f2 Author: Yeounsu Moon Date: Fri Oct 10 00:57:16 2025 +0900 net: dlink: handle dma_map_single() failure properly There is no error handling for `dma_map_single()` failures. Add error handling by checking `dma_mapping_error()` and freeing the `skb` using `dev_kfree_skb()` (process context) when it fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yeounsu Moon Tested-on: D-Link DGE-550T Rev-A3 Suggested-by: Simon Horman Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 3abc0e55ea1fa2250e52bc860e8f24b2b9a2093a Author: Rex Lu Date: Thu Oct 9 08:29:34 2025 +0200 net: mtk: wed: add dma mask limitation and GFP_DMA32 for device with more than 4GB DRAM Limit tx/rx buffer address to 32-bit address space for board with more than 4GB DRAM. Fixes: 804775dfc2885 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") Fixes: 6757d345dd7db ("net: ethernet: mtk_wed: introduce hw_rro support for MT7988") Tested-by: Daniel Pawlik Tested-by: Matteo Croce Signed-off-by: Rex Lu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit d5d790ba1558dbb8d179054f514476e2ee970b8e Author: Bhanu Seshu Kumar Valluri Date: Thu Oct 9 11:00:09 2025 +0530 net: usb: lan78xx: Fix lost EEPROM write timeout error(-ETIMEDOUT) in lan78xx_write_raw_eeprom The function lan78xx_write_raw_eeprom failed to properly propagate EEPROM write timeout errors (-ETIMEDOUT). In the timeout fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error saved in ret. As a result, callers could mistakenly treat EEPROM write operation as successful even though the EEPROM write had actually timed out with no or partial data write. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM write timeout error saved in ret to the caller. Suggested-by: Oleksij Rempel Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") cc: stable@vger.kernel.org Signed-off-by: Bhanu Seshu Kumar Valluri Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8765f467912ff0d4832eeaf26ae573792da877e7 Merge: 67029a49db6c1f f75e07bf5226da Author: Linus Torvalds Date: Sun Oct 12 08:45:52 2025 -0700 Merge tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Skip interrupt ID 0 in sifive-plic during suspend/resume because ID 0 is reserved and accessing reserved register space could result in undefined behavior - Fix a function's retval check in aspeed-scu-ic * tag 'irq_urgent_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume irqchip/aspeed-scu-ic: Fix an IS_ERR() vs NULL check commit 67029a49db6c1f21106a1b5fcdd0ea234a6e0711 Merge: c04022dccb2f9c 54b91e54b113d4 Author: Linus Torvalds Date: Sat Oct 11 16:06:04 2025 -0700 Merge tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "The previous fix to trace_marker required updating trace_marker_raw as well. The difference between trace_marker_raw from trace_marker is that the raw version is for applications to write binary structures directly into the ring buffer instead of writing ASCII strings. This is for applications that will read the raw data from the ring buffer and get the data structures directly. It's a bit quicker than using the ASCII version. Unfortunately, it appears that our test suite has several tests that test writes to the trace_marker file, but lacks any tests to the trace_marker_raw file (this needs to be remedied). Two issues came about the update to the trace_marker_raw file that syzbot found: - Fix tracing_mark_raw_write() to use per CPU buffer The fix to use the per CPU buffer to copy from user space was needed for both the trace_maker and trace_maker_raw file. The fix for reading from user space into per CPU buffers properly fixed the trace_marker write function, but the trace_marker_raw file wasn't fixed properly. The user space data was correctly written into the per CPU buffer, but the code that wrote into the ring buffer still used the user space pointer and not the per CPU buffer that had the user space data already written. - Stop the fortify string warning from writing into trace_marker_raw After converting the copy_from_user_nofault() into a memcpy(), another issue appeared. As writes to the trace_marker_raw expects binary data, the first entry is a 4 byte identifier. The entry structure is defined as: struct { struct trace_entry ent; int id; char buf[]; }; The size of this structure is reserved on the ring buffer with: size = sizeof(*entry) + cnt; Then it is copied from the buffer into the ring buffer with: memcpy(&entry->id, buf, cnt); This use to be a copy_from_user_nofault(), but now converting it to a memcpy() triggers the fortify-string code, and causes a warning. The allocated space is actually more than what is copied, as the cnt used also includes the entry->id portion. Allocating sizeof(*entry) plus cnt is actually allocating 4 bytes more than what is needed. Change the size function to: size = struct_size(entry, buf, cnt - sizeof(entry->id)); And update the memcpy() to unsafe_memcpy()" * tag 'trace-v6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Stop fortify-string from warning in tracing_mark_raw_write() tracing: Fix tracing_mark_raw_write() to use buf and not ubuf commit c04022dccb2f9cf2b1cfe65807149500d1fc080a Merge: 98906f9d850e48 b0f2942a16017f Author: Linus Torvalds Date: Sat Oct 11 15:47:12 2025 -0700 Merge tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix UAPI types check in headers_check.pl - Only enable -Werror for hostprogs with CONFIG_WERROR / W=e - Ignore fsync() error when output of gen_init_cpio is a pipe - Several little build fixes for recent modules.builtin.modinfo series * tag 'kbuild-fixes-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Use '--strip-unneeded-symbol' for removing module device table symbols s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections kbuild: Add '.rel.*' strip pattern for vmlinux kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux gen_init_cpio: Ignore fsync() returning EINVAL on pipes scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs kbuild: uapi: Strip comments before size type check commit a8482d2c9071d75c920eba0db36428898250ea57 Author: Wolfram Sang Date: Sat Oct 11 12:31:53 2025 +0200 Revert "i2c: boardinfo: Annotate code used in init phase only" This reverts commit 1a2b423be6a89dd07d5fc27ea042be68697a6a49 because we got a regression report and need time to find out the details. Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/r/29ec0082-4dd4-4120-acd2-44b35b4b9487@oss.qualcomm.com Signed-off-by: Wolfram Sang commit 98906f9d850e4882004749eccb8920649dc98456 Merge: 2a6edd867b155c 9db26d5855d037 Author: Linus Torvalds Date: Sat Oct 11 11:56:47 2025 -0700 Merge tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "This cycle, we have a new RTC driver, for the SpacemiT P1. The optee driver gets alarm support. We also get a fix for a race condition that was fairly rare unless while stress testing the alarms. Subsystem: - Fix race when setting alarm - Ensure alarm irq is enabled when UIE is enabled - remove unneeded 'fast_io' parameter in regmap_config New driver: - SpacemiT P1 RTC Drivers: - efi: Remove wakeup functionality - optee: add alarms support - s3c: Drop support for S3C2410 - zynqmp: Restore alarm functionality after kexec transition" * tag 'rtc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (29 commits) rtc: interface: Ensure alarm irq is enabled when UIE is enabled rtc: tps6586x: Fix initial enable_irq/disable_irq balance rtc: cpcap: Fix initial enable_irq/disable_irq balance rtc: isl12022: Fix initial enable_irq/disable_irq balance rtc: interface: Fix long-standing race when setting alarm rtc: pcf2127: fix watchdog interrupt mask on pcf2131 rtc: zynqmp: Restore alarm functionality after kexec transition rtc: amlogic-a4: Optimize global variables rtc: sd2405al: Add I2C address. rtc: Kconfig: move symbols to proper section rtc: optee: make optee_rtc_pm_ops static rtc: optee: Fix error code in optee_rtc_read_alarm() rtc: optee: fix error code in probe() dt-bindings: rtc: Convert apm,xgene-rtc to DT schema rtc: spacemit: support the SpacemiT P1 RTC rtc: optee: add alarm related rtc ops to optee rtc driver rtc: optee: remove unnecessary memory operations rtc: optee: fix memory leak on driver removal rtc: x1205: Fix Xicor X1205 vendor prefix dt-bindings: rtc: Fix Xicor X1205 vendor prefix ... commit 2a6edd867b155cb5c391a32a66ce7e5d2cdcb531 Merge: 9591fdb0611dcc 558ae4579810fa Author: Linus Torvalds Date: Sat Oct 11 11:49:00 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Fixes only in drivers (ufs, mvsas, qla2xxx, target) that came in just before or during the merge window. The most important one is the qla2xxx which reverts a conversion to fix flexible array member warnings, that went up in this merge window but which turned out on further testing to be causing data corruption" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS scsi: ufs: sysfs: Make HID attributes visible scsi: mvsas: Fix use-after-free bugs in mvs_work_queue scsi: ufs: core: Fix PM QoS mutex initialization scsi: ufs: core: Fix runtime suspend error deadlock Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue" scsi: target: target_core_configfs: Add length check to avoid buffer overflow commit 9591fdb0611dccdeeeeacb99d89f0098737d209b Merge: 2f0a7504530c24 4a1e02b15ac174 Author: Linus Torvalds Date: Sat Oct 11 11:19:16 2025 -0700 Merge tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull more x86 updates from Borislav Petkov: - Remove a bunch of asm implementing condition flags testing in KVM's emulator in favor of int3_emulate_jcc() which is written in C - Replace KVM fastops with C-based stubs which avoids problems with the fastop infra related to latter not adhering to the C ABI due to their special calling convention and, more importantly, bypassing compiler control-flow integrity checking because they're written in asm - Remove wrongly used static branches and other ugliness accumulated over time in hyperv's hypercall implementation with a proper static function call to the correct hypervisor call variant - Add some fixes and modifications to allow running FRED-enabled kernels in KVM even on non-FRED hardware - Add kCFI improvements like validating indirect calls and prepare for enabling kCFI with GCC. Add cmdline params documentation and other code cleanups - Use the single-byte 0xd6 insn as the official #UD single-byte undefined opcode instruction as agreed upon by both x86 vendors - Other smaller cleanups and touchups all over the place * tag 'x86_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) x86,retpoline: Optimize patch_retpoline() x86,ibt: Use UDB instead of 0xEA x86/cfi: Remove __noinitretpoline and __noretpoline x86/cfi: Add "debug" option to "cfi=" bootparam x86/cfi: Standardize on common "CFI:" prefix for CFI reports x86/cfi: Document the "cfi=" bootparam options x86/traps: Clarify KCFI instruction layout compiler_types.h: Move __nocfi out of compiler-specific header objtool: Validate kCFI calls x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y x86/fred: Play nice with invoking asm_fred_entry_from_kvm() on non-FRED hardware x86/fred: Install system vector handlers even if FRED isn't fully enabled x86/hyperv: Use direct call to hypercall-page x86/hyperv: Clean up hv_do_hypercall() KVM: x86: Remove fastops KVM: x86: Convert em_salc() to C KVM: x86: Introduce EM_ASM_3WCL KVM: x86: Introduce EM_ASM_1SRC2 KVM: x86: Introduce EM_ASM_2CL KVM: x86: Introduce EM_ASM_2W ... commit 2f0a7504530c24f55daec7d2364d933bb1a1fa68 Merge: 6bb71f0fe57bb7 c6c973dbfa5e34 Author: Linus Torvalds Date: Sat Oct 11 10:51:14 2025 -0700 Merge tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - Simplify inline asm flag output operands now that the minimum compiler version supports the =@ccCOND syntax - Remove a bunch of AS_* Kconfig symbols which detect assembler support for various instruction mnemonics now that the minimum assembler version supports them all - The usual cleanups all over the place * tag 'x86_cleanups_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/asm: Remove code depending on __GCC_ASM_FLAG_OUTPUTS__ x86/sgx: Use ENCLS mnemonic in x86/mtrr: Remove license boilerplate text with bad FSF address x86/asm: Use RDPKRU and WRPKRU mnemonics in x86/idle: Use MONITORX and MWAITX mnemonics in x86/entry/fred: Push __KERNEL_CS directly x86/kconfig: Remove CONFIG_AS_AVX512 crypto: x86 - Remove CONFIG_AS_VPCLMULQDQ crypto: X86 - Remove CONFIG_AS_VAES crypto: x86 - Remove CONFIG_AS_GFNI x86/kconfig: Drop unused and needless config X86_64_SMP commit 6bb71f0fe57bb77ca484352a66aeb02e3a8ce697 Merge: fbde105f132f30 fd6db58867924d Author: Linus Torvalds Date: Sat Oct 11 10:40:24 2025 -0700 Merge tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "A NULL pointer deref hotfix" * tag 'slab-for-6.18-rc1-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: fix barn NULL pointer dereference on memoryless nodes commit fbde105f132f30aff25f3acb1c287e95d5452c9c Merge: ae13bd23102805 ffce84bccb4d95 Author: Linus Torvalds Date: Sat Oct 11 10:31:38 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Finish constification of 1st parameter of bpf_d_path() (Rong Tao) - Harden userspace-supplied xdp_desc validation (Alexander Lobakin) - Fix metadata_dst leak in __bpf_redirect_neigh_v{4,6}() (Daniel Borkmann) - Fix undefined behavior in {get,put}_unaligned_be32() (Eric Biggers) - Use correct context to unpin bpf hash map with special types (KaFai Wan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add test for unpinning htab with internal timer struct bpf: Avoid RCU context warning when unpinning htab with internal structs xsk: Harden userspace-supplied xdp_desc validation bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} libbpf: Fix undefined behavior in {get,put}_unaligned_be32() bpf: Finish constification of 1st parameter of bpf_d_path() commit ae13bd23102805383bf04f26e0b043f3d02c9b15 Merge: 971370a88c3b1b 90eb9ae35727a6 Author: Linus Torvalds Date: Sat Oct 11 10:27:52 2025 -0700 Merge tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more updates from Andrew Morton: "Just one series here - Mike Rappoport has taught KEXEC handover to preserve vmalloc allocations across handover" * tag 'mm-nonmm-stable-2025-10-10-15-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt kho: add support for preserving vmalloc allocations kho: replace kho_preserve_phys() with kho_preserve_pages() kho: check if kho is finalized in __kho_preserve_order() MAINTAINERS, .mailmap: update Umang's email address commit 971370a88c3b1be1144c11468b4c84e3ed17af6d Merge: 0739473694c487 f52ce0ea90c83a Author: Linus Torvalds Date: Sat Oct 11 10:14:55 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "7 hotfixes. All 7 are cc:stable and all 7 are for MM. All singletons, please see the changelogs for details" * tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: hugetlb: avoid soft lockup when mprotect to large memory area fsnotify: pass correct offset to fsnotify_mmap_perm() mm/ksm: fix flag-dropping behavior in ksm_madvise mm/damon/vaddr: do not repeat pte_offset_map_lock() until success mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage mm/thp: fix MTE tag mismatch when replacing zero-filled subpages memcg: skip cgroup_file_notify if spinning is not allowed commit db74b04edce1bc86b9a5acc724c7ca06f427ab60 Author: Marek Vasut Date: Sat Oct 11 12:59:53 2025 +0200 drm/bridge: lt9211: Drop check for last nibble of version register There is now a new LT9211 rev. U5, which reports chip ID 0x18 0x01 0xe4 . The previous LT9211 reported chip ID 0x18 0x01 0xe3 , which is what the driver checks for right now. Since there is a possibility there will be yet another revision of the LT9211 in the future, drop the last version nibble check to allow all future revisions of the chip to work with this driver. This fix makes LT9211 rev. U5 work with this driver. Fixes: 8ce4129e3de4 ("drm/bridge: lt9211: Add Lontium LT9211 bridge driver") Signed-off-by: Marek Vasut Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251011110017.12521-1-marek.vasut@mailbox.org Signed-off-by: Dmitry Baryshkov commit 54b91e54b113d4f15ab023a44f508251db6e22e7 Author: Steven Rostedt Date: Sat Oct 11 11:20:32 2025 -0400 tracing: Stop fortify-string from warning in tracing_mark_raw_write() The way tracing_mark_raw_write() records its data is that it has the following structure: struct { struct trace_entry; int id; char buf[]; }; But memcpy(&entry->id, buf, size) triggers the following warning when the size is greater than the id: ------------[ cut here ]------------ memcpy: detected field-spanning write (size 6) of single field "&entry->id" at kernel/trace/trace.c:7458 (size 4) WARNING: CPU: 7 PID: 995 at kernel/trace/trace.c:7458 write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0 Modules linked in: CPU: 7 UID: 0 PID: 995 Comm: bash Not tainted 6.17.0-test-00007-g60b82183e78a-dirty #211 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:write_raw_marker_to_buffer.isra.0+0x1f9/0x2e0 Code: 04 00 75 a7 b9 04 00 00 00 48 89 de 48 89 04 24 48 c7 c2 e0 b1 d1 b2 48 c7 c7 40 b2 d1 b2 c6 05 2d 88 6a 04 01 e8 f7 e8 bd ff <0f> 0b 48 8b 04 24 e9 76 ff ff ff 49 8d 7c 24 04 49 8d 5c 24 08 48 RSP: 0018:ffff888104c3fc78 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 1ffffffff6b363b4 RDI: 0000000000000001 RBP: ffff888100058a00 R08: ffffffffb041d459 R09: ffffed1020987f40 R10: 0000000000000007 R11: 0000000000000001 R12: ffff888100bb9010 R13: 0000000000000000 R14: 00000000000003e3 R15: ffff888134800000 FS: 00007fa61d286740(0000) GS:ffff888286cad000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560d28d509f1 CR3: 00000001047a4006 CR4: 0000000000172ef0 Call Trace: tracing_mark_raw_write+0x1fe/0x290 ? __pfx_tracing_mark_raw_write+0x10/0x10 ? security_file_permission+0x50/0xf0 ? rw_verify_area+0x6f/0x4b0 vfs_write+0x1d8/0xdd0 ? __pfx_vfs_write+0x10/0x10 ? __pfx_css_rstat_updated+0x10/0x10 ? count_memcg_events+0xd9/0x410 ? fdget_pos+0x53/0x5e0 ksys_write+0x182/0x200 ? __pfx_ksys_write+0x10/0x10 ? do_user_addr_fault+0x4af/0xa30 do_syscall_64+0x63/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa61d318687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffd87fe0120 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa61d286740 RCX: 00007fa61d318687 RDX: 0000000000000006 RSI: 0000560d28d509f0 RDI: 0000000000000001 RBP: 0000560d28d509f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000006 R13: 00007fa61d4715c0 R14: 00007fa61d46ee80 R15: 0000000000000000 ---[ end trace 0000000000000000 ]--- This is because fortify string sees that the size of entry->id is only 4 bytes, but it is writing more than that. But this is OK as the dynamic_array is allocated to handle that copy. The size allocated on the ring buffer was actually a bit too big: size = sizeof(*entry) + cnt; But cnt includes the 'id' and the buffer data, so adding cnt to the size of *entry actually allocates too much on the ring buffer. Change the allocation to: size = struct_size(entry, buf, cnt - sizeof(entry->id)); and the memcpy() to unsafe_memcpy() with an added justification. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20251011112032.77be18e4@gandalf.local.home Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) commit 77908b81766781dfcd086878aefc29f5db8dae6a Author: Cryolitia PukNgae Date: Sat Oct 11 17:51:18 2025 +0800 ALSA: usb-audio: apply quirk for Huawei Technologies Co., Ltd. CM-Q3 There're several different actual hardwares sold by Huawei, using the same USB ID 12d1:3a07. The first one we found, having a volume control named "Headset Playback Volume", reports a min value -15360, and will mute iff setting it to -15360. It can be simply fixed by quirk flag MIXER_PLAYBACK_MIN_MUTE, which we have already submitted previously.[1] The second one we found today, having a volume control named "PCM Playback Volume", reports its min -11520 and res 256, and will mute when less than -11008. Because of the already existing quirk flag, we can just set its min to -11264, and the new minimum value will still not be available to userspace, so that userspace's minimum will be the correct -11008. 1. https://lore.kernel.org/all/20250903-sound-v1-3-d4ca777b8512@uniontech.com/ Tested-by: Guoli An Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit fd6db58867924d2bfbc4ece4b0092f697f9fc31c Author: Vlastimil Babka Date: Sat Oct 11 10:45:41 2025 +0200 slab: fix barn NULL pointer dereference on memoryless nodes Phil reported a boot failure once sheaves become used in commits 59faa4da7cd4 ("maple_tree: use percpu sheaves for maple_node_cache") and 3accabda4da1 ("mm, vma: use percpu sheaves for vm_area_struct cache"): BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 21 UID: 0 PID: 818 Comm: kworker/u398:0 Not tainted 6.17.0-rc3.slab+ #5 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.26.0 07/30/2025 RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0 Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 <4c> 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89 RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300 RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388 R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0 R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0 FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0 Call Trace: ? srso_return_thunk+0x5/0x5f ? vm_area_alloc+0x1e/0x60 kmem_cache_alloc_noprof+0x4ec/0x5b0 vm_area_alloc+0x1e/0x60 create_init_stack_vma+0x26/0x210 alloc_bprm+0x139/0x200 kernel_execve+0x4a/0x140 call_usermodehelper_exec_async+0xd0/0x190 ? __pfx_call_usermodehelper_exec_async+0x10/0x10 ret_from_fork+0xf0/0x110 ? __pfx_call_usermodehelper_exec_async+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Modules linked in: CR2: 0000000000000040 ---[ end trace 0000000000000000 ]--- RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0 Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 <4c> 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89 RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300 RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388 R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0 R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0 FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x36a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- And noted "this is an AMD EPYC 7401 with 8 NUMA nodes configured such that memory is only on 2 of them." # numactl --hardware available: 8 nodes (0-7) node 0 cpus: 0 8 16 24 32 40 48 56 64 72 80 88 node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 2 10 18 26 34 42 50 58 66 74 82 90 node 1 size: 31584 MB node 1 free: 30397 MB node 2 cpus: 4 12 20 28 36 44 52 60 68 76 84 92 node 2 size: 0 MB node 2 free: 0 MB node 3 cpus: 6 14 22 30 38 46 54 62 70 78 86 94 node 3 size: 0 MB node 3 free: 0 MB node 4 cpus: 1 9 17 25 33 41 49 57 65 73 81 89 node 4 size: 0 MB node 4 free: 0 MB node 5 cpus: 3 11 19 27 35 43 51 59 67 75 83 91 node 5 size: 32214 MB node 5 free: 31625 MB node 6 cpus: 5 13 21 29 37 45 53 61 69 77 85 93 node 6 size: 0 MB node 6 free: 0 MB node 7 cpus: 7 15 23 31 39 47 55 63 71 79 87 95 node 7 size: 0 MB node 7 free: 0 MB Linus decoded the stacktrace to get_barn() and get_node() and determined that kmem_cache->node[numa_mem_id()] is NULL. The problem is due to a wrong assumption that memoryless nodes only exist on systems with CONFIG_HAVE_MEMORYLESS_NODES, where numa_mem_id() points to the nearest node that has memory. SLUB has been allocating its kmem_cache_node structures only on nodes with memory and so it does with struct node_barn. For kmem_cache_node, get_partial_node() checks if get_node() result is not NULL, which I assumed was for protection from a bogus node id passed to kmalloc_node() but apparently it's also for systems where numa_mem_id() (used when no specific node is given) might return a memoryless node. Fix the sheaves code the same way by checking the result of get_node() and bailing out if it's NULL. Note that cpus on such memoryless nodes will have degraded sheaves performance, which can be improved later, preferably by making numa_mem_id() work properly on such systems. Fixes: 2d517aa09bbc ("slab: add opt-in caching layer of percpu sheaves") Reported-and-tested-by: Phil Auld Closes: https://lore.kernel.org/all/20251010151116.GA436967@pauld.westford.csb/ Analyzed-by: Linus Torvalds Link: https://lore.kernel.org/all/CAHk-%3Dwg1xK%2BBr%3DFJ5QipVhzCvq7uQVPt5Prze6HDhQQ%3DQD_BcQ@mail.gmail.com/ Signed-off-by: Vlastimil Babka commit 30b3211aa24161856134b2c2ea2ab1c6eb534b36 Author: Stuart Hayhurst Date: Sat Oct 11 00:28:29 2025 +0100 ALSA: hda/intel: Add MSI X870E Tomahawk to denylist This motherboard uses USB audio instead, causing this driver to complain about "no codecs found!". Add it to the denylist to silence the warning. Signed-off-by: Stuart Hayhurst Cc: Signed-off-by: Takashi Iwai commit 1cf11d80db5df805b538c942269e05a65bcaf5bc Author: Denis Arefev Date: Thu Oct 9 13:50:47 2025 +0300 ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced. The call stack leading to the error looks like this: hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference Add IS_ERR() check to prevent the crash. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ae7abe36e352 ("ALSA: hda/realtek: Add CS35L41 support for Thinkpad laptops") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Signed-off-by: Takashi Iwai commit 8527bbb33936340525a3504a00932b2f8fd75754 Author: Denis Arefev Date: Tue Oct 7 10:38:31 2025 +0300 ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 447106e92a0c ("ALSA: hda: cs35l41: Support mute notifications for CS35L41 HDA") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Signed-off-by: Takashi Iwai commit bda745ee8fbb63330d8f2f2ea4157229a5df959e Author: Steven Rostedt Date: Fri Oct 10 23:51:42 2025 -0400 tracing: Fix tracing_mark_raw_write() to use buf and not ubuf The fix to use a per CPU buffer to read user space tested only the writes to trace_marker. But it appears that the selftests are missing tests to the trace_maker_raw file. The trace_maker_raw file is used by applications that writes data structures and not strings into the file, and the tools read the raw ring buffer to process the structures it writes. The fix that reads the per CPU buffers passes the new per CPU buffer to the trace_marker file writes, but the update to the trace_marker_raw write read the data from user space into the per CPU buffer, but then still used then passed the user space address to the function that records the data. Pass in the per CPU buffer and not the user space address. TODO: Add a test to better test trace_marker_raw. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20251011035243.386098147@kernel.org Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") Reported-by: syzbot+9a2ede1643175f350105@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e973f5.050a0220.1186a4.0010.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) commit 852947be66b826c3d0ba328e19a3559fdf7ac726 Author: Paul Walmsley Date: Fri Oct 10 15:50:24 2025 -0600 riscv: kprobes: convert one final __ASSEMBLY__ to __ASSEMBLER__ Per the reasoning in commit f811f58597ac ("riscv: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers"), convert one last remaining instance of __ASSEMBLY__ in the arch/riscv kprobes code. This entered the tree from patches that were sent before Thomas' changes; and when I reviewed the kprobes patches before queuing them, I missed this instance. Cc: Nam Cao Cc: Thomas Huth Link: https://lore.kernel.org/linux-riscv/16b74b63-f223-4f0b-b6e5-31cea5e620b4@redhat.com/ Link: https://lore.kernel.org/linux-riscv/20250606070952.498274-1-thuth@redhat.com/ Signed-off-by: Paul Walmsley commit b0f2942a16017f88395d768afedd7373860968ce Author: Nathan Chancellor Date: Fri Oct 10 14:49:27 2025 -0700 kbuild: Use '--strip-unneeded-symbol' for removing module device table symbols After commit 5ab23c7923a1 ("modpost: Create modalias for builtin modules"), relocatable RISC-V kernels with CONFIG_KASAN=y start failing when attempting to strip the module device table symbols: riscv64-linux-objcopy: not stripping symbol `__mod_device_table__kmod_irq_starfive_jh8100_intc__of__starfive_intc_irqchip_match_table' because it is named in a relocation make[4]: *** [scripts/Makefile.vmlinux:97: vmlinux] Error 1 The relocation appears to come from .LASANLOC5 in .data.rel.local: $ llvm-objdump --disassemble-symbols=.LASANLOC5 --disassemble-all -r drivers/irqchip/irq-starfive-jh8100-intc.o drivers/irqchip/irq-starfive-jh8100-intc.o: file format elf64-littleriscv Disassembly of section .data.rel.local: 0000000000000180 <.LASANLOC5>: ... 1d0: 0000 unimp 00000000000001d0: R_RISCV_64 __mod_device_table__kmod_irq_starfive_jh8100_intc__of__starfive_intc_irqchip_match_table ... This section appears to come from GCC for including additional information about global variables that may be protected by KASAN. There appears to be no way to opt out of the generation of these symbols through either a flag or attribute. Attempting to remove '.LASANLOC*' with '--strip-symbol' results in the same error as above because these symbols may refer to (thus have relocation between) each other. Avoid this build breakage by switching to '--strip-unneeded-symbol' for removing __mod_device_table__ symbols, as it will only remove the symbol when there is no relocation pointing to it. While this may result in a little more bloat in the symbol table in certain configurations, it is not as bad as outright build failures. Fixes: 5ab23c7923a1 ("modpost: Create modalias for builtin modules") Reported-by: Charles Mirabile Closes: https://lore.kernel.org/20251007011637.2512413-1-cmirabil@redhat.com/ Suggested-by: Alexey Gladkov Tested-by: Nicolas Schier Signed-off-by: Nathan Chancellor commit 505f5224b197b77169c977e747cbc18b222f85f9 Author: Sean Christopherson Date: Fri Oct 3 16:26:06 2025 -0700 KVM: selftests: Verify that reads to inaccessible guest_memfd VMAs SIGBUS Expand the guest_memfd negative testcases for overflow and MAP_PRIVATE to verify that reads to inaccessible memory also get a SIGBUS. Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: Lisa Wang Tested-by: Lisa Wang Link: https://lore.kernel.org/r/20251003232606.4070510-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 19942d4fd9cf022b28a9afb432a6338dcf96fc2f Author: Sean Christopherson Date: Fri Oct 3 16:26:05 2025 -0700 KVM: selftests: Verify that faulting in private guest_memfd memory fails Add a guest_memfd testcase to verify that faulting in private memory gets a SIGBUS. For now, test only the case where memory is private by default since KVM doesn't yet support in-place conversion. Deliberately run the CoW test with and without INIT_SHARED set as KVM should disallow MAP_PRIVATE regardless of whether the memory itself is private from a CoCo perspective. Cc: Ackerley Tng Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-13-seanjc@google.com Signed-off-by: Sean Christopherson commit f91187c0ecc6358ccecf533c5fcc6b7dbb4735cb Author: Sean Christopherson Date: Fri Oct 3 16:26:04 2025 -0700 KVM: selftests: Add wrapper macro to handle and assert on expected SIGBUS Extract the guest_memfd test's SIGBUS handling functionality into a common TEST_EXPECT_SIGBUS() macro in anticipation of adding more SIGBUS testcases. Eating a SIGBUS isn't terrible difficult, but it requires a non-trivial amount of boilerplate code, and using a macro allows selftests to print out the exact action that failed to generate a SIGBUS without the developer needing to remember to add a useful error message. Explicitly mark the SIGBUS handler as "used", as gcc-14 at least likes to discard the function before linking. Opportunistically use TEST_FAIL(...) instead of TEST_ASSERT(false, ...), and fix the write path of the guest_memfd test to use the local "val" instead of hardcoding the literal value a second time. Suggested-by: Ackerley Tng Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: Lisa Wang Tested-by: Lisa Wang Link: https://lore.kernel.org/r/20251003232606.4070510-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 505c953009ec8260870d41ef8109bb4c7e208e6f Author: Sean Christopherson Date: Fri Oct 3 16:26:03 2025 -0700 KVM: selftests: Isolate the guest_memfd Copy-on-Write negative testcase Move the guest_memfd Copy-on-Write (CoW) testcase to its own function to better separate positive testcases from negative testcases. No functional change intended. Suggested-by: Ackerley Tng Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 61cee97f40180312dcca9580a5be0b0aa2217f6e Author: Sean Christopherson Date: Fri Oct 3 16:26:02 2025 -0700 KVM: selftests: Add wrappers for mmap() and munmap() to assert success Add and use wrappers for mmap() and munmap() that assert success to reduce a significant amount of boilerplate code, to ensure all tests assert on failure, and to provide consistent error messages on failure. No functional change intended. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-10-seanjc@google.com Signed-off-by: Sean Christopherson commit df0d9923f7055169cb01b050236e5a9a2b36db02 Author: Ackerley Tng Date: Fri Oct 3 16:26:01 2025 -0700 KVM: selftests: Add test coverage for guest_memfd without GUEST_MEMFD_FLAG_MMAP If a VM type supports KVM_CAP_GUEST_MEMFD_MMAP, the guest_memfd test will run all test cases with GUEST_MEMFD_FLAG_MMAP set. This leaves the code path for creating a non-mmap()-able guest_memfd on a VM that supports mappable guest memfds untested. Refactor the test to run the main test suite with a given set of flags. Then, for VM types that support the mappable capability, invoke the test suite twice: once with no flags, and once with GUEST_MEMFD_FLAG_MMAP set. This ensures both creation paths are properly exercised on capable VMs. Run test_guest_memfd_flags() only once per VM type since it depends only on the set of valid/supported flags, i.e. iterating over an arbitrary set of flags is both unnecessary and wrong. Signed-off-by: Ackerley Tng [sean: use double-underscores for the inner helper] Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 21d602ed616aebae4de568be55db65a1f5a3be10 Author: Sean Christopherson Date: Fri Oct 3 16:26:00 2025 -0700 KVM: selftests: Create a new guest_memfd for each testcase Refactor the guest_memfd selftest to improve test isolation by creating a a new guest_memfd for each testcase. Currently, the test reuses a single guest_memfd instance for all testcases, and thus creates dependencies between tests, e.g. not truncating folios from the guest_memfd instance at the end of a test could lead to unexpected results (see the PUNCH_HOLE purging that needs to done by in-flight the NUMA testcases[1]). Invoke each test via a macro wrapper to create and close a guest_memfd to cut down on the boilerplate copy+paste needed to create a test. Link: https://lore.kernel.org/all/20250827175247.83322-10-shivankg@amd.com Reported-by: Ackerley Tng Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 3a6c08538c742624c60cb6a53dd61eb025e0d1e1 Author: Sean Christopherson Date: Fri Oct 3 16:25:59 2025 -0700 KVM: selftests: Stash the host page size in a global in the guest_memfd test Use a global variable to track the host page size in the guest_memfd test so that the information doesn't need to be constantly passed around. The state is purely a reflection of the underlying system, i.e. can't be set by the test and is constant for a given invocation of the test, and thus explicitly passing the host page size to individual testcases adds no value, e.g. doesn't allow testing different combinations. Making page_size a global will simplify an upcoming change to create a new guest_memfd instance per testcase. No functional change intended. Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: David Hildenbrand Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Link: https://lore.kernel.org/r/20251003232606.4070510-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 44c6cb9fe9888b371e31165b2854bd0f4e2787d4 Author: Sean Christopherson Date: Fri Oct 3 16:25:58 2025 -0700 KVM: guest_memfd: Allow mmap() on guest_memfd for x86 VMs with private memory Allow mmap() on guest_memfd instances for x86 VMs with private memory as the need to track private vs. shared state in the guest_memfd instance is only pertinent to INIT_SHARED. Doing mmap() on private memory isn't terrible useful (yet!), but it's now possible, and will be desirable when guest_memfd gains support for other VMA-based syscalls, e.g. mbind() to set NUMA policy. Lift the restriction now, before MMAP support is officially released, so that KVM doesn't need to add another capability to enumerate support for mmap() on private memory. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 9aef71c892a55e004419923ba7129abe3e58d9f1 Author: Sean Christopherson Date: Fri Oct 3 16:25:57 2025 -0700 KVM: Explicitly mark KVM_GUEST_MEMFD as depending on KVM_GENERIC_MMU_NOTIFIER Add KVM_GENERIC_MMU_NOTIFIER as a dependency for selecting KVM_GUEST_MEMFD, as guest_memfd relies on kvm_mmu_invalidate_{begin,end}(), which are defined if and only if the generic mmu_notifier implementation is enabled. The missing dependency is currently benign as s390 is the only KVM arch that doesn't utilize the generic mmu_notifier infrastructure, and s390 doesn't currently support guest_memfd. Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5d3341d684be80892d8f6f9812f90f9274b81177 Author: Sean Christopherson Date: Fri Oct 3 16:25:56 2025 -0700 KVM: guest_memfd: Invalidate SHARED GPAs if gmem supports INIT_SHARED When invalidating gmem ranges, e.g. in response to PUNCH_HOLE, process all possible range types (PRIVATE vs. SHARED) for the gmem instance. Since since guest_memfd doesn't yet support in-place conversions, simply pivot on INIT_SHARED as a gmem instance can currently only have private or shared memory, not both. Failure to mark shared GPAs for invalidation is benign in the current code base, as only x86's TDX consumes KVM_FILTER_{PRIVATE,SHARED}, and TDX doesn't yet support INIT_SHARED with guest_memfd. However, invalidating only private GPAs is conceptually wrong and a lurking bug, e.g. could result in missed invalidations if ARM starts filtering invalidations based on attributes. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Reviewed-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-4-seanjc@google.com Signed-off-by: Sean Christopherson commit fe2bf6234e947bf5544db6d386af1df2a8db80f3 Author: Sean Christopherson Date: Fri Oct 3 16:25:55 2025 -0700 KVM: guest_memfd: Add INIT_SHARED flag, reject user page faults if not set Add a guest_memfd flag to allow userspace to state that the underlying memory should be configured to be initialized as shared, and reject user page faults if the guest_memfd instance's memory isn't shared. Because KVM doesn't yet support in-place private<=>shared conversions, all guest_memfd memory effectively follows the initial state. Alternatively, KVM could deduce the initial state based on MMAP, which for all intents and purposes is what KVM currently does. However, implicitly deriving the default state based on MMAP will result in a messy ABI when support for in-place conversions is added. For x86 CoCo VMs, which don't yet support MMAP, memory is currently private by default (otherwise the memory would be unusable). If MMAP implies memory is shared by default, then the default state for CoCo VMs will vary based on MMAP, and from userspace's perspective, will change when in-place conversion support is added. I.e. to maintain guest<=>host ABI, userspace would need to immediately convert all memory from shared=>private, which is both ugly and inefficient. The inefficiency could be avoided by adding a flag to state that memory is _private_ by default, irrespective of MMAP, but that would lead to an equally messy and hard to document ABI. Bite the bullet and immediately add a flag to control the default state so that the effective behavior is explicit and straightforward. Fixes: 3d3a04fad25a ("KVM: Allow and advertise support for host mmap() on guest_memfd files") Cc: David Hildenbrand Reviewed-by: Fuad Tabba Tested-by: Fuad Tabba Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-3-seanjc@google.com Signed-off-by: Sean Christopherson commit d2042d8f96ddefdeee823737f813efe3ab4b4e8d Author: Sean Christopherson Date: Fri Oct 3 16:25:54 2025 -0700 KVM: Rework KVM_CAP_GUEST_MEMFD_MMAP into KVM_CAP_GUEST_MEMFD_FLAGS Rework the not-yet-released KVM_CAP_GUEST_MEMFD_MMAP into a more generic KVM_CAP_GUEST_MEMFD_FLAGS capability so that adding new flags doesn't require a new capability, and so that developers aren't tempted to bundle multiple flags into a single capability. Note, kvm_vm_ioctl_check_extension_generic() can only return a 32-bit value, but that limitation can be easily circumvented by adding e.g. KVM_CAP_GUEST_MEMFD_FLAGS2 in the unlikely event guest_memfd supports more than 32 flags. Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20251003232606.4070510-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 034417c1439a533a315562a57bd340d963eaac6b Author: Dapeng Mi Date: Fri Oct 10 08:52:39 2025 +0800 KVM: x86/pmu: Don't try to get perf capabilities for hybrid CPUs Explicitly zero kvm_host_pmu instead of attempting to get the perf PMU capabilities when running on a hybrid CPU to avoid running afoul of perf's sanity check. ------------[ cut here ]------------ WARNING: arch/x86/events/core.c:3089 at perf_get_x86_pmu_capability+0xd/0xc0, Call Trace: kvm_x86_vendor_init+0x1b0/0x1a40 [kvm] vmx_init+0xdb/0x260 [kvm_intel] vt_init+0x12/0x9d0 [kvm_intel] do_one_initcall+0x60/0x3f0 do_init_module+0x97/0x2b0 load_module+0x2d08/0x2e30 init_module_from_file+0x96/0xe0 idempotent_init_module+0x117/0x330 __x64_sys_finit_module+0x73/0xe0 Always read the capabilities for non-hybrid CPUs, i.e. don't entirely revert to reading capabilities if and only if KVM wants to use a PMU, as it may be useful to have the host PMU capabilities available, e.g. if only or debug. Reported-by: Chaitanya Kumar Borah Closes: https://lore.kernel.org/all/70b64347-2aca-4511-af78-a767d5fa8226@intel.com/ Fixes: 51f34b1e650f ("KVM: x86/pmu: Snapshot host (i.e. perf's) reported PMU capabilities") Suggested-by: Sean Christopherson Signed-off-by: Dapeng Mi Link: https://lore.kernel.org/r/20251010005239.146953-1-dapeng1.mi@linux.intel.com [sean: rework changelog, call out hybrid CPUs in shortlog] Signed-off-by: Sean Christopherson commit 0739473694c4878513031006829f1030ec850bc2 Merge: 284fc30e66e602 32058c38d3b79a Author: Linus Torvalds Date: Fri Oct 10 14:06:02 2025 -0700 Merge tag 'for-6.18/hpfs-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull hpfs updates from Mikulas Patocka: - Avoid -Wflex-array-member-not-at-end warnings - Replace simple_strtoul with kstrtoint - Fix error code for new_inode() failure * tag 'for-6.18/hpfs-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink hpfs: Replace simple_strtoul with kstrtoint in hpfs_parse_param fs: hpfs: Avoid multiple -Wflex-array-member-not-at-end warnings commit 284fc30e66e602a5df58393860f67477d6a79339 Merge: 1e5d41b981bc55 c4b6ddcf01f63a Author: Linus Torvalds Date: Fri Oct 10 14:02:14 2025 -0700 Merge tag 'drm-next-2025-10-11-1' of https://gitlab.freedesktop.org/drm/kernel Pull more drm fixes from Dave Airlie: "Just the follow up fixes for rc1 from the next branch, amdgpu and xe mostly with a single v3d fix in there. amdgpu: - DC DCE6 fixes - GPU reset fixes - Secure diplay messaging cleanup - MES fix - GPUVM locking fixes - PMFW messaging cleanup - PCI US/DS switch handling fix - VCN queue reset fix - DC FPU handling fix - DCN 3.5 fix - DC mirroring fix amdkfd: - Fix kfd process ref leak - mmap write lock handling fix - Fix comments in IOCTL xe: - Fix build with clang 16 - Fix handling of invalid configfs syntax usage and spell out the expected syntax in the documentation - Do not try late bind firmware when running as VF since it shouldn't handle firmware loading - Fix idle assertion for local BOs - Fix uninitialized variable for late binding - Do not require perfmon_capable to expose free memory at page granularity. Handle it like other drm drivers do - Fix lock handling on suspend error path - Fix I2C controller resume after S3 v3d: - fix fence locking" * tag 'drm-next-2025-10-11-1' of https://gitlab.freedesktop.org/drm/kernel: (34 commits) drm/amd/display: Incorrect Mirror Cositing drm/amd/display: Enable Dynamic DTBCLK Switch drm/amdgpu: Report individual reset error drm/amdgpu: partially revert "revert to old status lock handling v3" drm/amd/display: Fix unsafe uses of kernel mode FPU drm/amd/pm: Disable VCN queue reset on SMU v13.0.6 due to regression drm/amdgpu: Fix general protection fault in amdgpu_vm_bo_reset_state_machine drm/amdgpu: Check swus/ds for switch state save drm/amdkfd: Fix two comments in kfd_ioctl.h drm/amd/pm: Avoid interface mismatch messaging drm/amdgpu: Merge amdgpu_vm_set_pasid into amdgpu_vm_init drm/amd/amdgpu: Fix the mes version that support inv_tlbs drm/amd: Check whether secure display TA loaded successfully drm/amdkfd: Fix mmap write lock not release drm/amdkfd: Fix kfd process ref leaking when userptr unmapping drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O. drm/amd/display: Disable scaling on DCE6 for now drm/amd/display: Properly disable scaling on DCE6 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs ... commit 1e5d41b981bc550f41b198706e259a45686f3b5a Merge: f76b1683d16dcd 5ca5f00a167cdd Author: Linus Torvalds Date: Fri Oct 10 13:59:38 2025 -0700 Merge tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Some fixes leftover from our fixes branch, just nouveau and vmwgfx: nouveau: - Return errno code from TTM move helper vmwgfx: - Fix null-ptr access in cursor code - Fix UAF in validation - Use correct iterator in validation" * tag 'drm-fixes-2025-10-11' of https://gitlab.freedesktop.org/drm/kernel: drm/nouveau: fix bad ret code in nouveau_bo_move_prep drm/vmwgfx: Fix copy-paste typo in validation drm/vmwgfx: Fix Use-after-free in validation drm/vmwgfx: Fix a null-ptr access in the cursor snooper commit 971843c511c3c2f6eda96c6b03442913bfee6148 Author: Jan Kara Date: Tue Oct 7 15:49:37 2025 +0200 ext4: free orphan info with kvfree Orphan info is now getting allocated with kvmalloc_array(). Free it with kvfree() instead of kfree() to avoid complaints from mm. Reported-by: Chris Mason Fixes: 0a6ce20c1564 ("ext4: verify orphan file size is not too big") Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Message-ID: <20251007134936.7291-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b Author: Deepanshu Kartikey Date: Tue Sep 30 16:58:10 2025 +0530 ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set: EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15: comm syz.0.17: corrupted extent tree: lblk 0 < prev 66 Investigation revealed that the inode has both flags set: DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1 This is an invalid combination since an inode should have either: - INLINE_DATA: data stored directly in the inode - EXTENTS: data stored in extent-mapped blocks Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode. Cc: stable@kernel.org Reported-and-tested-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308 Suggested-by: Zhang Yi Signed-off-by: Deepanshu Kartikey Reviewed-by: Zhang Yi Message-ID: <20250930112810.315095-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o commit 5ca5f00a167cdd28bcfeeae6ddd370b13ac00a2a Merge: e5f0a698b34ed7 e4bea919584ff2 Author: Dave Airlie Date: Sat Oct 11 06:17:06 2025 +1000 Merge tag 'drm-misc-fixes-2025-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: nouveau: - Return errno code from TTM move helper vmwgfx: - Fix null-ptr access in cursor code - Fix UAF in validation - Use correct iterator in validation Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251009120004.GA17570@linux.fritz.box commit f76b1683d16dcd5299a9b67d8ef45fe8d29cb2e6 Merge: 8bd9238e511d02 ce740955b23876 Author: Linus Torvalds Date: Fri Oct 10 13:05:40 2025 -0700 Merge tag 'devicetree-fixes-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Allow child nodes on renesas-bsc bus binding - Drop node name pattern on allwinner,sun50i-a64-de2 bus binding - Switch DT patchwork to kernel.org from ozlabs.org - Fix some typos in docs and bindings - Fix reference count in PCI node unittest * tag 'devicetree-fixes-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: bus: renesas-bsc: allow additional properties dt-bindings: bus: allwinner,sun50i-a64-de2: don't check node names MAINTAINERS: Move DT patchwork to kernel.org of: unittest: Fix device reference count leak in of_unittest_pci_node_verify of: doc: Fix typo in doc comments. dt-bindings: mmc: Correct typo "upto" to "up to" commit ce740955b238761ec1d8cf0590d7e6802d3a813a Author: Wolfram Sang Date: Thu Oct 9 20:34:53 2025 +0200 dt-bindings: bus: renesas-bsc: allow additional properties Allow additional properties to enable devices attached to the bus. Fixes warnings like these: arch/arm/boot/dts/renesas/sh73a0-kzm9g.dtb: bus@fec10000 (renesas,bsc-sh73a0): Unevaluated properties are not allowed ('ethernet@10000000' was unexpected) arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dtb: bus@fec10000 (renesas,bsc-r8a73a4): Unevaluated properties are not allowed ('ethernet@8000000', 'flash@0' were unexpected) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Rob Herring (Arm) commit f7045387a6816d51d462447af4522785e1c7251c Author: Wolfram Sang Date: Thu Oct 9 20:37:43 2025 +0200 dt-bindings: bus: allwinner,sun50i-a64-de2: don't check node names Node names are already and properly checked by the core schema. No need to do it again. Signed-off-by: Wolfram Sang [robh: Also drop [A-F] in unit address] Signed-off-by: Rob Herring (Arm) commit 8bd9238e511d02831022ff0270865c54ccc482d6 Merge: 91b436fc925ca5 d74d6c0e98958a Author: Linus Torvalds Date: Fri Oct 10 11:30:19 2025 -0700 Merge tag 'ceph-for-6.18-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: - some messenger improvements (Eric and Max) - address an issue (also affected userspace) of incorrect permissions being granted to users who have access to multiple different CephFS instances within the same cluster (Kotresh) - a bunch of assorted CephFS fixes (Slava) * tag 'ceph-for-6.18-rc1' of https://github.com/ceph/ceph-client: ceph: add bug tracking system info to MAINTAINERS ceph: fix multifs mds auth caps issue ceph: cleanup in ceph_alloc_readdir_reply_buffer() ceph: fix potential NULL dereference issue in ceph_fill_trace() libceph: add empty check to ceph_con_get_out_msg() libceph: pass the message pointer instead of loading con->out_msg libceph: make ceph_con_get_out_msg() return the message pointer ceph: fix potential race condition on operations with CEPH_I_ODIRECT flag ceph: refactor wake_up_bit() pattern of calling ceph: fix potential race condition in ceph_ioctl_lazyio() ceph: fix overflowed constant issue in ceph_do_objects_copy() ceph: fix wrong sizeof argument issue in register_session() ceph: add checking of wait_for_completion_killable() return value ceph: make ceph_start_io_*() killable libceph: Use HMAC-SHA256 library instead of crypto_shash commit 91b436fc925ca58625e4230f53238e955223c385 Merge: 917167ed1211b7 b30c32c784bf29 Author: Linus Torvalds Date: Fri Oct 10 11:23:57 2025 -0700 Merge tag 'v6.18-rc-part2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: - fix i_size in fallocate - two truncate fixes - utime fix - minor cleanups - SMB1 fixes - improve error check in read - improve perf of copy file_range (copy_chunk) * tag 'v6.18-rc-part2-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal version number cifs: Add comments for DeletePending assignments in open functions cifs: Add fallback code path for cifs_mkdir_setinfo() cifs: Allow fallback code in smb_set_file_info() also for directories cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points smb: client: remove cfids_invalidation_worker smb: client: remove redudant assignment in cifs_strict_fsync() smb: client: fix race with fallocate(2) and AIO+DIO smb: client: fix missing timestamp updates after utime(2) smb: client: fix missing timestamp updates after ftruncate(2) smb: client: fix missing timestamp updates with O_TRUNC cifs: Fix copy_to_iter return value check smb: client: batch SRV_COPYCHUNK entries to cut round trips smb: client: Omit an if branch in smb2_find_smb_tcon() smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message() smb: client: Use common code in cifs_do_create() smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() smb: client: Return a status code only as a constant in cifs_spnego_key_instantiate() smb: client: Use common code in cifs_lookup() smb: client: Reduce the scopes for a few variables in two functions commit 917167ed1211b7037534b6e6d7815778b57d310b Merge: 1b1391b9c4bfad 4c8bad3ed035ab Author: Linus Torvalds Date: Fri Oct 10 11:20:19 2025 -0700 Merge tag 'xtensa-20251010' of https://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - minor cleanups * tag 'xtensa-20251010' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: use HZ_PER_MHZ in platform_calibrate_ccount xtensa: simdisk: add input size check in proc_write_simdisk commit 1b1391b9c4bfadcaeb89a87edf6c3520dd349e35 Merge: eba41c0173c8c2 455281c0ef4e2c Author: Linus Torvalds Date: Fri Oct 10 10:37:13 2025 -0700 Merge tag 'block-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Don't include __GFP_NOWARN for loop worker allocation, as it already uses GFP_NOWAIT which has __GFP_NOWARN set already - Small series cleaning up the recent bio_iov_iter_get_pages() changes - loop fix for leaking the backing reference file, if validation fails - Update of a comment pertaining to disk/partition stat locking * tag 'block-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: loop: remove redundant __GFP_NOWARN flag block: move bio_iov_iter_get_bdev_pages to block/fops.c iomap: open code bio_iov_iter_get_bdev_pages block: rename bio_iov_iter_get_pages_aligned to bio_iov_iter_get_pages block: remove bio_iov_iter_get_pages block: Update a comment of disk statistics loop: fix backing file reference leak on validation error commit 4b471b736ea1ce08113a12bd7dcdaea621b0f65f Author: Zeno Endemann Date: Thu Sep 25 17:24:33 2025 +0200 ext4, doc: fix and improve directory hash tree description Some of the details about how directory hash trees work were confusing or outright wrong, this patch should fix those. A note on dx_tail's dt_reserved member, as far as I can tell the kernel never sets this explicitly, so its content is apparently left-overs from what was there before (for the dx_root I've seen remnants of a ext4_dir_entry_tail struct from when the dir was not yet a hash dir). Signed-off-by: Zeno Endemann Message-ID: <20250925152435.22749-1-zeno.endemann@mailbox.org> Signed-off-by: Theodore Ts'o commit 328a782cb138029182e521c08f50eb1587db955d Author: Zhang Yi Date: Tue Sep 16 17:33:37 2025 +0800 ext4: wait for ongoing I/O to complete before freeing blocks When freeing metadata blocks in nojournal mode, ext4_forget() calls bforget() to clear the dirty flag on the buffer_head and remvoe associated mappings. This is acceptable if the metadata has not yet begun to be written back. However, if the write-back has already started but is not yet completed, ext4_forget() will have no effect. Subsequently, ext4_mb_clear_bb() will immediately return the block to the mb allocator. This block can then be reallocated immediately, potentially causing an data corruption issue. Fix this by clearing the buffer's dirty flag and waiting for the ongoing I/O to complete, ensuring that no further writes to stale data will occur. Fixes: 16e08b14a455 ("ext4: cleanup clean_bdev_aliases() calls") Cc: stable@kernel.org Reported-by: Gao Xiang Closes: https://lore.kernel.org/linux-ext4/a9417096-9549-4441-9878-b1955b899b4e@huaweicloud.com/ Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250916093337.3161016-3-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit eba41c0173c8c27702b720730ed9d399088409f0 Merge: 8cc8ea228c4199 e9a9dcb4ccb324 Author: Linus Torvalds Date: Fri Oct 10 10:25:24 2025 -0700 Merge tag 'io_uring-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fixup indentation in the UAPI header - Two fixes for zcrx. One fixes receiving too much in some cases, and the other deals with not correctly incrementing the source in the fallback copy loop - Fix for a race in the IORING_OP_WAITID command, where there was a small window where the request would be left on the wait_queue_head list even though it was being canceled/completed - Update liburing git URL in the kernel tree * tag 'io_uring-6.18-20251009' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/zcrx: increment fallback loop src offset io_uring/zcrx: fix overshooting recv limit io_uring: use tab indentation for IORING_SEND_VECTORIZED comment io_uring/waitid: always prune wait queue entry in io_waitid_wait() io_uring: update liburing git URL commit cfc584537150484874e10ec4e59ad2ecbae46bfe Merge: 38492c5743f8b7 9338d660b79a0d Author: Nathan Chancellor Date: Fri Oct 10 10:22:28 2025 -0700 Merge patch series "kbuild: Fixes for fallout from recent modules.builtin.modinfo series" This is a series to address some problems that were exposed by the recent modules.builtin.modinfo series that landed in commit c7d3dd9163e6 ("Merge patch series "Add generated modalias to modules.builtin.modinfo""). The third patch is not directly related to the aforementioned series, as the warning it fixes happens prior to the series but commit 8d18ef04f940 ("s390: vmlinux.lds.S: Reorder sections") from the series creates conflicts in this area, so I included it here. Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-0-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f Author: Nathan Chancellor Date: Wed Oct 8 15:46:46 2025 -0700 s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections When building s390 defconfig with binutils older than 2.32, there are several warnings during the final linking stage: s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment binutils commit afca762f598 ("S/390: Improve partial relro support for 64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the warning. The :NONE in the .vmlinux.info output section description changes the segment for subsequent allocated sections. Move .vmlinux.info right above the discards section to place all other sections in the previously defined segment, .data. Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1] Acked-by: Alexander Gordeev Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 8ec3af916fe3954381cf3555ea03dc5adf4d0e8e Author: Nathan Chancellor Date: Wed Oct 8 15:46:45 2025 -0700 kbuild: Add '.rel.*' strip pattern for vmlinux Prior to binutils commit c12d9fa2afe ("Support objcopy --remove-section=.relaFOO") [1] in 2.32, stripping relocation sections required the trailing period (i.e., '.rel.*') to work properly. After commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped"), there is an error with binutils 2.31.1 or earlier because these sections are not properly removed: s390-linux-objcopy: st6tO8Ev: symbol `.modinfo' required but not present s390-linux-objcopy:st6tO8Ev: no symbols Add the old pattern to resolve this issue (along with a comment to allow cleaning this when binutils 2.32 or newer is the minimum supported version). While the aforementioned kbuild change exposes this, the pattern was originally changed by commit 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly"), where it would still be incorrect with binutils older than 2.32. Fixes: 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7 [1] Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/CA+G9fYvVktRhFtZXdNgVOL8j+ArsJDpvMLgCitaQvQmCx=hwOQ@mail.gmail.com/ Acked-by: Ard Biesheuvel Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-2-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit 4b47a3aefb29c523ca66f0d28de8db15a10f9352 Author: Nathan Chancellor Date: Wed Oct 8 15:46:44 2025 -0700 kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux Commit 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped") removed the pattern to avoid stripping .rela.dyn sections added by commit e9d86b8e17e7 ("scripts: Do not strip .rela.dyn section"). Restore it so that .rela.dyn sections remain in the final vmlinux. Fixes: 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped") Acked-by: Ard Biesheuvel Acked-by: Alexey Gladkov Acked-by: Nicolas Schier Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-1-9fc776c5887c@kernel.org Signed-off-by: Nathan Chancellor commit ffce84bccb4d95c7922b44897b6f0ffcda5061b7 Merge: 07ca98f906a403 accb9a7e87f096 Author: Alexei Starovoitov Date: Fri Oct 10 10:10:09 2025 -0700 Merge branch 'bpf-avoid-rcu-context-warning-when-unpinning-htab-with-internal-structs' KaFai Wan says: ==================== bpf: Avoid RCU context warning when unpinning htab with internal structs This small patchset is about avoid RCU context warning when unpinning htab with internal structs (timer, workqueue, or task_work). v3: - fix nit (Yonghong Song) - add Acked-by: Yonghong Song v2: - rename bpf_free_inode() to bpf_destroy_inode() (Andrii) https://lore.kernel.org/all/20251007012235.755853-1-kafai.wan@linux.dev/ v1: https://lore.kernel.org/all/20251003084528.502518-1-kafai.wan@linux.dev/ --- ==================== Link: https://patch.msgid.link/20251008102628.808045-1-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit accb9a7e87f096a12eb21256107b9c8e343f8019 Author: KaFai Wan Date: Wed Oct 8 18:26:27 2025 +0800 selftests/bpf: Add test for unpinning htab with internal timer struct Add test to verify that unpinning hash tables containing internal timer structures does not trigger context warnings. Each subtest (timer_prealloc and timer_no_prealloc) can trigger the context warning when unpinning, but the warning cannot be triggered twice within a short time interval (a HZ), which is expected behavior. Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251008102628.808045-3-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 4f375ade6aa9f37fd72d7a78682f639772089eed Author: KaFai Wan Date: Wed Oct 8 18:26:26 2025 +0800 bpf: Avoid RCU context warning when unpinning htab with internal structs When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered: BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ... The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms: 1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context. 2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations. However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule. Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning. Reported-by: Le Chen Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/ Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Suggested-by: Alexei Starovoitov Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 3c652c3a71de1d30d72dc82c3bead8deb48eb749 Author: Zhang Yi Date: Tue Sep 16 17:33:36 2025 +0800 jbd2: ensure that all ongoing I/O complete before freeing blocks When releasing file system metadata blocks in jbd2_journal_forget(), if this buffer has not yet been checkpointed, it may have already been written back, currently be in the process of being written back, or has not yet written back. jbd2_journal_forget() calls jbd2_journal_try_remove_checkpoint() to check the buffer's status and add it to the current transaction if it has not been written back. This buffer can only be reallocated after the transaction is committed. jbd2_journal_try_remove_checkpoint() attempts to lock the buffer and check its dirty status while holding the buffer lock. If the buffer has already been written back, everything proceeds normally. However, there are two issues. First, the function returns immediately if the buffer is locked by the write-back process. It does not wait for the write-back to complete. Consequently, until the current transaction is committed and the block is reallocated, there is no guarantee that the I/O will complete. This means that ongoing I/O could write stale metadata to the newly allocated block, potentially corrupting data. Second, the function unlocks the buffer as soon as it detects that the buffer is still dirty. If a concurrent write-back occurs immediately after this unlocking and before clear_buffer_dirty() is called in jbd2_journal_forget(), data corruption can theoretically still occur. Although these two issues are unlikely to occur in practice since the undergoing metadata writeback I/O does not take this long to complete, it's better to explicitly ensure that all ongoing I/O operations are completed. Fixes: 597599268e3b ("jbd2: discard dirty data when forgetting an un-journalled buffer") Cc: stable@kernel.org Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250916093337.3161016-2-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 07ca98f906a403637fc5e513a872a50ef1247f3b Author: Alexander Lobakin Date: Wed Oct 8 18:56:59 2025 +0200 xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit. desc->len close to ``U32_MAX`` with a non-zero pool->tx_metadata_len can cause positive integer overflow and wraparound, the same way low enough desc->addr with a non-zero pool->tx_metadata_len can cause negative integer overflow. Both scenarios can then pass the validation successfully. This doesn't happen with valid XSk applications, but can be used to perform attacks. Always promote desc->len to ``u64`` first to exclude positive overflows of it. Use explicit check_{add,sub}_overflow() when validating desc->addr (which is ``u64`` already). bloat-o-meter reports a little growth of the code size: add/remove: 0/0 grow/shrink: 2/1 up/down: 60/-16 (44) Function old new delta xskq_cons_peek_desc 299 330 +31 xsk_tx_peek_release_desc_batch 973 1002 +29 xsk_generic_xmit 3148 3132 -16 but hopefully this doesn't hurt the performance much. Fixes: 341ac980eab9 ("xsk: Support tx_metadata_len") Cc: stable@vger.kernel.org # 6.8+ Signed-off-by: Alexander Lobakin Reviewed-by: Jason Xing Reviewed-by: Maciej Fijalkowski Link: https://lore.kernel.org/r/20251008165659.4141318-1-aleksander.lobakin@intel.com Signed-off-by: Alexei Starovoitov commit 8cc8ea228c4199482cf087fc6ed2d6e31b7a49e2 Merge: fdfa38e95e1229 f4edb5c52c93b1 Author: Linus Torvalds Date: Fri Oct 10 10:01:55 2025 -0700 Merge tag 'parisc-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Minor enhancements and fixes, specifically: - report emulation and alignment faults via perf - add initial kernel-side support for perf_events - small initialization fixes in the parisc firmware layer - adjust TC* constants and avoid referencing termio structs to avoid userspace build errors" * tag 'parisc-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix iodc and device path return values on old machines parisc: Firmware: Fix returned path for PDC_MODULE_FIND on older machines parisc: Add initial kernel-side perf_event support parisc: Report software alignment faults via perf parisc: Report emulation faults via perf parisc: don't reference obsolete termio struct for TC* constants parisc: Remove spurious if statement from raw_copy_from_user() commit fdfa38e95e1229ec2fb2f18540987c97f861d470 Merge: 06a88f47990974 ca7a2317993efa Author: Linus Torvalds Date: Fri Oct 10 09:55:19 2025 -0700 Merge tag 'sound-fix-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few more small fixes for 6.18-rc1. Most of changes are about ASoC Intel and SOF drivers, while a few other device-specific fixes are found for HD-audio, USB-audio, ASoC RT722VB and Meson" * tag 'sound-fix-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: rt722: add settings for rt722VB ASoC: meson: aiu-encoder-i2s: fix bit clock polarity ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user ALSA: hda/tas2781: Enable init_profile_id for device initialization ALSA: emu10k1: Fix typo in docs ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel ASoC: SOF: ipc4-pcm: do not report invalid delay values ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down ALSA: hda/hdmi: Add pin fix for HP ProDesk model commit 4b47a8601b71ad98833b447d465592d847b4dc77 Author: Chuck Lever Date: Thu Sep 11 11:12:06 2025 -0400 NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout. Reported-by: Robert Morris Closes: https://lore.kernel.org/linux-nfs/152f99b2-ba35-4dec-93a9-4690e625dccd@oracle.com/T/#t Cc: Thomas Haynes Cc: stable@vger.kernel.org Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server") Signed-off-by: Chuck Lever commit 06a88f47990974f1322c2bf2e8c5125f8a2f69fe Merge: 9976831f401eeb 15df28699b28d6 Author: Linus Torvalds Date: Fri Oct 10 09:36:23 2025 -0700 Merge tag 'fbdev-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Beside the usual bunch of smaller bug fixes, the majority of changes were by Zsolt Kajtar to improve the s3fb driver. Bug fixes: - Bounds checking to fix vmalloc-out-of-bounds (Albin Babu Varghese) - Fix logic error in "offb" name match (Finn Thain) - simplefb: Fix use after free in (Janne Grunau) - s3fb: Various fixes and powersave improvements (Zsolt Kajtar) Enhancements & code cleanups: - Various fixes in the documentation (Bagas Sanjaya) - Use string choices helpers (Chelsy Ratnawat) - xenfb: Use vmalloc_array to simplify code (Qianfeng Rong) - mb862xxfb: use signed type for error codes (Qianfeng Rong) - Make drivers depend on LCD_CLASS_DEVICE (Thomas Zimmermann) - radeonfb: Remove stale product link in Kconfig (Sukrut Heroorkar)" * tag 'fbdev-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Fix logic error in "offb" name match fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds fbdev: Make drivers depend on LCD_CLASS_DEVICE fbdev: radeonfb: Remove stale product link in Kconfig Documentation: fb: Retitle driver docs Documentation: fb: ep93xx: Demote section headings Documentation: fb: Split toctree fbdev: simplefb: Fix use after free in simplefb_detach_genpds() fbdev: s3fb: Revert mclk stop in suspend fbdev: mb862xxfb: Use int type to store negative error codes fbdev: Use string choices helpers fbdev: core: Fix ubsan warning in pixel_to_pat fbdev: s3fb: Implement 1 and 2 BPP modes, improve 4 BPP fbdev: s3fb: Implement powersave for S3 FB fbdev: xenfb: Use vmalloc_array to simplify code commit 9976831f401eeb302d699b2d37624153d7cd2892 Merge: dcf50ca7823506 b5f8aa8d4bde0c Author: Linus Torvalds Date: Fri Oct 10 09:22:39 2025 -0700 Merge tag 'gpio-fixes-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - add a missing ACPI ID for MTL-CVF devices in gpio-usbio - mark the gpio-wcd934x controller as "sleeping" as it uses a mutex for locking internally * tag 'gpio-fixes-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: wcd934x: mark the GPIO controller as sleeping gpio: usbio: Add ACPI device-id for MTL-CVF devices commit dcf50ca7823506fb3f20b8ffd3f928003cddaeed Merge: aac31903329ba7 006824a1cb3bd4 Author: Linus Torvalds Date: Fri Oct 10 09:18:19 2025 -0700 Merge tag 'ntb-6.18' of https://github.com/jonmason/ntb Pull NTB updates from Jon Mason: - Add support for Renesas R-Car and allow arbitrary BAR mapping in EPF - Update ntb_hw_amd to support the latest generation secondary topology and add a new maintainer - Fix a bug by adding a mutex to ensure `link_event_callback` executes sequentially * tag 'ntb-6.18' of https://github.com/jonmason/ntb: NTB: epf: Add Renesas rcar support NTB: epf: Allow arbitrary BAR mapping ntb: Add mutex to make link_event_callback executed linearly. MAINTAINERS: Update for the NTB AMD driver maintainer ntb_hw_amd: Update amd_ntb_get_link_status to support latest generation secondary topology commit aac31903329ba73ef24674df78252b6610cc9d60 Merge: 0ae452440cb9fe eb4faf6343889f Author: Linus Torvalds Date: Fri Oct 10 09:13:11 2025 -0700 Merge tag 'i2c-for-6.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: - Second part of rtl9300 updates since dependencies are in now: - general cleanups - implement block read/write support - add RTL9310 support - DT schema conversion of hix5hd2 binding - namespace cleanup for i2c-algo-pca - minor simplification for mt65xx * tag 'i2c-for-6.18-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: hisilicon,hix5hd2: convert to DT schema i2c: mt65xx: convert set_speed function to void i2c: rename wait_for_completion callback to wait_for_completion_cb i2c: rtl9300: add support for RTL9310 I2C controller dt-bindings: i2c: realtek,rtl9301-i2c: extend for RTL9310 support i2c: rtl9300: use scoped guard instead of explicit lock/unlock i2c: rtl9300: separate xfer configuration and execution i2c: rtl9300: do not set read mode on every transfer i2c: rtl9300: move setting SCL frequency to config_io i2c: rtl9300: rename internal sda_pin to sda_num dt-bindings: i2c: realtek,rtl9301-i2c: fix wording and typos i2c: rtl9300: use regmap fields and API for registers i2c: rtl9300: Implement I2C block read and write commit b30c32c784bf29735dabff15443a5feeafd26d1c Author: Steve French Date: Sat Oct 4 19:50:31 2025 -0500 cifs: update internal version number to 2.57 Signed-off-by: Steve French commit 0ae452440cb9fee9079dc925f40cd824c1a9de2a Merge: 84d4e8b613e073 6bb73db6948c2d Author: Linus Torvalds Date: Fri Oct 10 08:56:16 2025 -0700 Merge tag 'v6.18-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix bug in crypto_skcipher that breaks the new ti driver - Check for invalid assoclen in essiv * tag 'v6.18-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: essiv - Check ssize for decryption and in-place encryption crypto: skcipher - Fix reqsize handling commit 84d4e8b613e073d9dfde782c471aedbcefdede6c Merge: 5472d60c129f75 a29ad21b988652 Author: Linus Torvalds Date: Fri Oct 10 08:34:11 2025 -0700 Merge tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: - Disable TCG_TPM2_HMAC from defconfig It causes performance issues, and breaks some atypical configurations. - simplify code using the new crypto library - misc fixes and cleanups * tag 'tpmdd-next-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Prevent local DOS via tpm/tpm0/ppi/*operations tpm: use a map for tpm2_calc_ordinal_duration() tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single tpm: Use HMAC-SHA256 library instead of open-coded HMAC tpm: Compare HMAC values in constant time tpm: Disable TPM2_TCG_HMAC by default commit dc6b724974018c1b3b6fd704899782da3f12f145 Author: Rob Herring (Arm) Date: Fri Oct 10 08:04:46 2025 -0500 MAINTAINERS: Move DT patchwork to kernel.org The ozlabs.org PW instance is slow due to being geographically far away from any of the maintainers and seems to have gotten slower as of late (AI scrapers perhaps). The kernel.org PW also has some additional features (i.e. pwbot) we want to use. DT core patches also go into PW, so add the PW link for it. Signed-off-by: Rob Herring (Arm) commit 7933a585d70ee496fa341b50b8b0a95b131867ff Author: Seong-Gwang Heo Date: Thu Oct 9 13:41:48 2025 +0800 ovl: remove redundant IOCB_DIO_CALLER_COMP clearing The backing_file_write_iter() function, which is called immediately after this code, already contains identical logic to clear the IOCB_DIO_CALLER_COMP flag along with the same explanatory comment. There is no need to duplicate this operation in the overlayfs code. Signed-off-by: Seong-Gwang Heo Fixes: a6293b3e285c ("fs: factor out backing_file_{read,write}_iter() helpers") Acked-by: Miklos Szeredi Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b2796286a6d5f47bf271739c9e589f3a98835a25 Merge: a779e27f24aeb6 d90ad28e8aa482 Author: Christian Brauner Date: Fri Oct 10 13:44:09 2025 +0200 Merge patch series "Fix to EOPNOTSUPP double conversion in ioctl_setflags()" Andrey Albershteyn says: Revert original double conversion patch from ENOIOCTLCMD to EOPNOSUPP for vfs_fileattr_get and vfs_fileattr_set. Instead, convert ENOIOCTLCMD only where necessary. To: linux-api@vger.kernel.org To: linux-fsdevel@vger.kernel.org To: linux-kernel@vger.kernel.org To: linux-xfs@vger.kernel.org, Cc: "Jan Kara" Cc: "Jiri Slaby" Cc: "Christian Brauner" Cc: "Arnd Bergmann" * patches from https://lore.kernel.org/20251008-eopnosupp-fix-v1-0-5990de009c9f@kernel.org: fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" Signed-off-by: Christian Brauner commit d90ad28e8aa482e397150e22f3762173d918a724 Author: Andrey Albershteyn Date: Wed Oct 8 14:44:18 2025 +0200 fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls These syscalls call to vfs_fileattr_get/set functions which return ENOIOCTLCMD if filesystem doesn't support setting file attribute on an inode. For syscalls EOPNOTSUPP would be more appropriate return error. Signed-off-by: Andrey Albershteyn Reviewed-by: Jan Kara Reviewed-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 4dd5b5ac089bb6ea719b7ffb748707ac9cbce4e4 Author: Andrey Albershteyn Date: Wed Oct 8 14:44:17 2025 +0200 Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" This reverts commit 474b155adf3927d2c944423045757b54aa1ca4de. This patch caused regression in ioctl_setflags(). Underlying filesystems use EOPNOTSUPP to indicate that flag is not supported. This error is also gets converted in ioctl_setflags(). Therefore, for unsupported flags error changed from EOPNOSUPP to ENOIOCTLCMD. Link: https://lore.kernel.org/linux-xfs/a622643f-1585-40b0-9441-cf7ece176e83@kernel.org/ Signed-off-by: Andrey Albershteyn Signed-off-by: Christian Brauner commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 Author: Bartosz Golaszewski Date: Wed Sep 24 16:51:29 2025 +0200 gpio: wcd934x: mark the GPIO controller as sleeping The slimbus regmap passed to the GPIO driver down from MFD does not use fast_io. This means a mutex is used for locking and thus this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true. Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller") Signed-off-by: Bartosz Golaszewski commit f3426ac54c42c3260096ddc50b5470eb179fb06a Author: Ivan Vecera Date: Wed Oct 8 16:14:18 2025 +0200 dpll: zl3073x: Increase maximum size of flash utility Newer firmware bundles contain a flash utility whose size exceeds the currently allowed limit. Increase the maximum allowed size to accommodate the newer utility version. Without this patch: # devlink dev flash i2c/1-0070 file fw_nosplit_v3.hex Failed to load firmware Flashing failed Error: zl3073x: FW load failed: [utility] component is too big (11000 bytes) Fixes: ca017409da694 ("dpll: zl3073x: Add firmware loading functionality") Suggested-by: Prathosh Satish Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251008141418.841053-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit a29ad21b988652dc60aa99c6d3b1e3d52dc69c30 Author: Denis Aleksandrov Date: Mon Sep 15 17:08:29 2025 -0400 tpm: Prevent local DOS via tpm/tpm0/ppi/*operations Reads on tpm/tpm0/ppi/*operations can become very long on misconfigured systems. Reading the TPM is a blocking operation, thus a user could effectively trigger a DOS. Resolve this by caching the results and avoiding the blocking operations after the first read. [ jarkko: fixed atomic sleep: sed -i 's/spin_/mutex_/g' drivers/char/tpm/tpm_ppi.c sed -i 's/DEFINE_SPINLOCK/DEFINE_MUTEX/g' drivers/char/tpm/tpm_ppi.c ] Signed-off-by: Denis Aleksandrov Reported-by: Jan Stancek Closes: https://lore.kernel.org/linux-integrity/20250915210829.6661-1-daleksan@redhat.com/T/#u Suggested-by: Jarkko Sakkinen Reviewed-by: Paul Menzel Signed-off-by: Jarkko Sakkinen commit 207696b17f38e869e59889b44d395ab24bb678d3 Author: Jarkko Sakkinen Date: Thu Sep 18 22:30:18 2025 +0300 tpm: use a map for tpm2_calc_ordinal_duration() The current shenanigans for duration calculation introduce too much complexity for a trivial problem, and further the code is hard to patch and maintain. Address these issues with a flat look-up table, which is easy to understand and patch. If leaf driver specific patching is required in future, it is easy enough to make a copy of this table during driver initialization and add the chip parameter back. 'chip->duration' is retained for TPM 1.x. As the first entry for this new behavior address TCG spec update mentioned in this issue: https://github.com/raspberrypi/linux/issues/7054 Therefore, for TPM_SelfTest the duration is set to 3000 ms. This does not categorize a as bug, given that this is introduced to the spec after the feature was originally made. Reviewed-by: Serge Hallyn Signed-off-by: Jarkko Sakkinen commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 Author: Gunnar Kudrjavets Date: Thu Sep 18 18:49:40 2025 +0300 tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single The tpm_tis_write8() call specifies arguments in wrong order. Should be (data, addr, value) not (data, value, addr). The initial correct order was changed during the major refactoring when the code was split. Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") Signed-off-by: Gunnar Kudrjavets Reviewed-by: Justinien Bouron Reviewed-by: Jarkko Sakkinen Reviewed-by: Paul Menzel Signed-off-by: Jarkko Sakkinen commit 64a7cfbcf548bb955220c15c39531befe0611475 Author: Eric Biggers Date: Fri Aug 1 14:24:22 2025 -0700 tpm: Use HMAC-SHA256 library instead of open-coded HMAC Now that there are easy-to-use HMAC-SHA256 library functions, use these in tpm2-sessions.c instead of open-coding the HMAC algorithm. Note that the new implementation correctly handles keys longer than 64 bytes (SHA256_BLOCK_SIZE), whereas the old implementation handled such keys incorrectly. But it doesn't appear that such keys were being used. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2c2615c8423890b5ef8e0a186b65607ef5fdeda1 Author: Eric Biggers Date: Fri Aug 1 14:24:21 2025 -0700 tpm: Compare HMAC values in constant time In tpm_buf_check_hmac_response(), compare the HMAC values in constant time using crypto_memneq() instead of in variable time using memcmp(). This is worthwhile to follow best practices and to be consistent with MAC comparisons elsewhere in the kernel. However, in this driver the side channel seems to have been benign: the HMAC input data is guaranteed to always be unique, which makes the usual MAC forgery via timing side channel not possible. Specifically, the HMAC input data in tpm_buf_check_hmac_response() includes the "our_nonce" field, which was generated by the kernel earlier, remains under the control of the kernel, and is unique for each call to tpm_buf_check_hmac_response(). Signed-off-by: Eric Biggers Signed-off-by: Jarkko Sakkinen commit 4bddf4587c131d7b8ce8952cd32b284dcda0dd1f Author: Jarkko Sakkinen Date: Mon Aug 25 23:32:23 2025 +0300 tpm: Disable TPM2_TCG_HMAC by default After reading all the feedback, right now disabling the TPM2_TCG_HMAC is the right call. Other views discussed: A. Having a kernel command-line parameter or refining the feature otherwise. This goes to the area of improvements. E.g., one example is my own idea where the null key specific code would be replaced with a persistent handle parameter (which can be *unambigously* defined as part of attestation process when done correctly). B. Removing the code. I don't buy this because that is same as saying that HMAC encryption cannot work at all (if really nitpicking) in any form. Also I disagree on the view that the feature could not be refined to something more reasoable. Also, both A and B are worst options in terms of backporting. Thuss, this is the best possible choice. Cc: stable@vger.kernel.or # v6.10+ Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation") Suggested-by: Chris Fenner Signed-off-by: Jarkko Sakkinen commit fa9fe8715055f8b9bcee38904065b2f1eb9197f0 Author: Pali Rohár Date: Sun Jun 1 18:01:54 2025 +0200 cifs: Add comments for DeletePending assignments in open functions On more places is set DeletePending member to 0. Add comments why is 0 the correct value. Paths in DELETE_PENDING state cannot be opened by new calls. So if the newly issued open for that path succeed then it means that the path cannot be in DELETE_PENDING state. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 92210ccd877ba577585e420c99cff2b51c4c9fe2 Author: Pali Rohár Date: Mon Dec 30 22:18:53 2024 +0100 cifs: Add fallback code path for cifs_mkdir_setinfo() Use SMBSetInformation() as a fallback function (when CIFSSMBSetPathInfo() fails) which can set attribudes on the directory, including changing read-only attribute. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 88cae132dc0539ad188b787d32a7df4e16b5c1af Author: Pali Rohár Date: Mon Dec 30 21:21:31 2024 +0100 cifs: Allow fallback code in smb_set_file_info() also for directories On NT systems, it is possible to do SMB open call also for directories. Open argument CREATE_NOT_DIR disallows opening directories. So in fallback code path in smb_set_file_info() remove CREATE_NOT_DIR restriction to allow it also for directories. Similar fallback is implemented also in CIFSSMBSetPathInfoFB() function and this function already allows to call operation for directories. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 Author: Pali Rohár Date: Sat Jun 7 18:11:10 2025 +0200 cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points EA $LXMOD is required for WSL non-symlink reparse points. Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1") Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 7882d2c45ccba538cddb0615a893a008dd2efcde Author: Thomas Weißschuh Date: Thu Oct 9 11:18:48 2025 +0200 riscv: Respect dependencies of ARCH_HAS_ELF_CORE_EFLAGS This kconfig symbol has dependencies and is only selectable if those dependencies are also enabled. Respect the dependencies. Fixes the following warning when configuring an 'allnoconfig': WARNING: unmet direct dependencies detected for ARCH_HAS_ELF_CORE_EFLAGS Depends on [n]: BINFMT_ELF [=n] && ELF_CORE [=y] Selected by [y]: - RISCV [=y] Fixes: 8c94db0ae97c ("binfmt_elf: preserve original ELF e_flags for core dumps") Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20251009-riscv-elf-core-eflags-v1-1-e9b45ab6b36d@linutronix.de Signed-off-by: Paul Walmsley commit 69a8b62a7aa1e54ff7623064f6507fa29c1d0d4e Author: Han Gao Date: Wed Sep 10 19:24:01 2025 +0800 riscv: acpi: avoid errors caused by probing DT devices when ACPI is used Similar to the ARM64 commit 3505f30fb6a9s ("ARM64 / ACPI: If we chose to boot from acpi then disable FDT"), let's not do DT hardware probing if ACPI is enabled in early boot. This avoids errors caused by repeated driver probing. Signed-off-by: Han Gao Link: https://lore.kernel.org/r/20250910112401.552987-1-rabenda.cn@gmail.com [pjw@kernel.org: cleaned up patch description and subject] Signed-off-by: Paul Walmsley commit 9e68bd803fac49274fde914466fd3b07c4d602c8 Author: Fabian Vogt Date: Wed Sep 10 17:25:13 2025 +0200 riscv: kprobes: Fix probe address validation When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192", arch_check_kprobe would start iterating all instructions starting from _text until the probed address. Not only is this very inefficient, but literal values in there (e.g. left by function patching) are misinterpreted in a way that causes a desync. Fix this by doing it like x86: start the iteration at the closest preceding symbol instead of the given starting point. Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position") Signed-off-by: Fabian Vogt Signed-off-by: Marvin Friedrich Acked-by: Guo Ren Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad Signed-off-by: Paul Walmsley commit c199745d3ac3f836515a5734a6ca5c6f55a8809b Author: Florian Schmaus Date: Mon Oct 6 11:37:42 2025 +0200 riscv: entry: fix typo in comment 'instruciton' -> 'instruction' Fix a typo in a comment in the RISC-V entry.S. Signed-off-by: Florian Schmaus Link: https://lore.kernel.org/r/20251006093742.53925-1-flo@geekplace.eu [pjw@kernel.org: wrote a basic patch description] Signed-off-by: Paul Walmsley commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb Author: Danil Skrebenkov Date: Fri Sep 19 16:28:46 2025 +0300 RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors openSBI v1.7 adds harts checks for ipi operations. Especially it adds comparison between hmask passed as an argument from linux and mask of online harts (from openSBI side). If they don't fit each other the error occurs. When cpu is offline, cpu_online_mask is explicitly cleared in __cpu_disable. However, there is no explicit clearing of mm_cpumask. mm_cpumask is used for rfence operations that call openSBI RFENCE extension which uses ipi to remote harts. If hart is offline there may be error if mask of linux is not as mask of online harts in openSBI. this patch adds explicit clearing of mm_cpumask for offline hart. Signed-off-by: Danil Skrebenkov Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru [pjw@kernel.org: rewrote subject line for clarity] Signed-off-by: Paul Walmsley commit 781380d2cdef34559a0125ca6464b90bfc01594f Author: Miquel Sabaté Solà Date: Mon Sep 15 16:32:52 2025 +0200 riscv: kgdb: Ensure that BUFMAX > NUMREGBYTES The current value of BUFMAX is similar as in other architectures, but as per documentation on KGDB (see 'Documentation/process/debugging/kgdb.rst'), BUFMAX has to be larger than NUMREGBYTES. Some NUMREGBYTES architectures (e.g. powerpc or hexagon) actually define BUFMAX in relation to NUMREGBYTES, and thus this condition is always guaranteed. Since 2048 is a value that is generally accepted on all architectures, and that is larger than the current value of NUMREGBYTES, we can keep this value in arch/riscv, but we can at least add an 'static_assert' as an extra measure just in case NUMREGBYTES changes in the future for some unforseen reason. Signed-off-by: Miquel Sabaté Solà Link: https://lore.kernel.org/r/20250915143252.154955-1-mikisabate@gmail.com Signed-off-by: Paul Walmsley commit 812258ff4166bcd41c7d44707e0591f9ae32ac8c Author: Conor Dooley Date: Mon Sep 8 14:12:35 2025 +0100 rust: cfi: only 64-bit arm and x86 support CFI_CLANG The kernel uses the standard rustc targets for non-x86 targets, and out of those only 64-bit arm's target has kcfi support enabled. For x86, the custom 64-bit target enables kcfi. The HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC config option that allows CFI_CLANG to be used in combination with RUST does not check whether the rustc target supports kcfi. This breaks the build on riscv (and presumably 32-bit arm) when CFI_CLANG and RUST are enabled at the same time. Ordinarily, a rustc-option check would be used to detect target support but unfortunately rustc-option filters out the target for reasons given in commit 46e24a545cdb4 ("rust: kasan/kbuild: fix missing flags on first build"). As a result, if the host supports kcfi but the target does not, e.g. when building for riscv on x86_64, the build would remain broken. Instead, make HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC depend on the only two architectures where the target used supports it to fix the build. CC: stable@vger.kernel.org Fixes: ca627e636551e ("rust: cfi: add support for CFI_CLANG with Rust") Signed-off-by: Conor Dooley Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250908-distill-lint-1ae78bcf777c@spud Signed-off-by: Paul Walmsley commit 15df28699b28d6b49dc305040c4e26a9553df07a Author: Finn Thain Date: Thu Oct 9 09:56:25 2025 +1100 fbdev: Fix logic error in "offb" name match A regression was reported to me recently whereby /dev/fb0 had disappeared from a PowerBook G3 Series "Wallstreet". The problem shows up when the "video=ofonly" parameter is passed to the kernel, which is what the bootloader does when "no video driver" is selected. The cause of the problem is the "offb" string comparison, which got mangled when it got refactored. Fix it. Cc: stable@vger.kernel.org Fixes: 93604a5ade3a ("fbdev: Handle video= parameter in video/cmdline.c") Reported-and-tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: Helge Deller commit f4edb5c52c93b1bc676064472fb517566a3e2129 Author: Helge Deller Date: Thu Oct 9 23:37:28 2025 +0200 parisc: Fix iodc and device path return values on old machines Older machines may not fully initialize the return values when asking for IODC and device path data when building the inventory. Work around possible firmware leaks by proper initialization of the variables. Signed-off-by: Helge Deller commit 44ac7f5c6d4c7fd62784bb2700245dbc4ac7e102 Author: Helge Deller Date: Thu Oct 9 23:33:34 2025 +0200 parisc: Firmware: Fix returned path for PDC_MODULE_FIND on older machines Older machines (like my 715/64) don't correctly initialize the device path when returning from the PDC_MODULE_FIND firmware call. Work around that shortcoming by initializing the path with the known values. Signed-off-by: Helge Deller commit 9db26d5855d0374d4652487bfb5aacf40821c469 Author: Esben Haabendal Date: Fri May 16 09:23:39 2025 +0200 rtc: interface: Ensure alarm irq is enabled when UIE is enabled When setting a normal alarm, user-space is responsible for using RTC_AIE_ON/RTC_AIE_OFF to control if alarm irq should be enabled. But when RTC_UIE_ON is used, interrupts must be enabled so that the requested irq events are generated. When RTC_UIE_OFF is used, alarm irq is disabled if there are no other alarms queued, so this commit brings symmetry to that. Signed-off-by: Esben Haabendal Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-5-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 1502fe0e97be01d18f2b30fd7fe29bb39def0e7d Author: Esben Haabendal Date: Fri May 16 09:23:38 2025 +0200 rtc: tps6586x: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize irq_en accordingly to avoid causing an unbalanced enable warning. Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-4-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit e0762fd26ad68f0232979e742e080d73a1388ead Author: Esben Haabendal Date: Fri May 16 09:23:37 2025 +0200 rtc: cpcap: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize alarm_enabled accordingly to avoid causing an unbalanced enable warning. Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-3-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 9ffe06b6ccd7a8eaa31d31625db009ea26a22a3c Author: Esben Haabendal Date: Fri May 16 09:23:36 2025 +0200 rtc: isl12022: Fix initial enable_irq/disable_irq balance Interrupts are automatically enabled when requested, so we need to initialize irq_enabled accordingly to avoid causing an unbalanced enable warning. Fixes: c62d658e5253 ("rtc: isl12022: Add alarm support") Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-2-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit 795cda8338eab036013314dbc0b04aae728880ab Author: Esben Haabendal Date: Fri May 16 09:23:35 2025 +0200 rtc: interface: Fix long-standing race when setting alarm As described in the old comment dating back to commit 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") from 2010, we have been living with a race window when setting alarm with an expiry in the near future (i.e. next second). With 1 second resolution, it can happen that the second ticks after the check for the timer having expired, but before the alarm is actually set. When this happen, no alarm IRQ is generated, at least not with some RTC chips (isl12022 is an example of this). With UIE RTC timer being implemented on top of alarm irq, being re-armed every second, UIE will occasionally fail to work, as an alarm irq lost due to this race will stop the re-arming loop. For now, I have limited the additional expiry check to only be done for alarms set to next seconds. I expect it should be good enough, although I don't know if we can now for sure that systems with loads could end up causing the same problems for alarms set 2 seconds or even longer in the future. I haven't been able to reproduce the problem with this check in place. Cc: stable@vger.kernel.org Signed-off-by: Esben Haabendal Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-1-3de8e530a39e@geanix.com Signed-off-by: Alexandre Belloni commit c4b6ddcf01f63a710c24a128d134d3fa51978d6c Merge: 73bc073d4270b6 d07e142641417e Author: Dave Airlie Date: Fri Oct 10 06:57:28 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-10-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-10-09: amdgpu: - DC DCE6 fixes - GPU reset fixes - Secure diplay messaging cleanup - MES fix - GPUVM locking fixes - PMFW messaging cleanup - PCI US/DS switch handling fix - VCN queue reset fix - DC FPU handling fix - DCN 3.5 fix - DC mirroring fix amdkfd: - Fix kfd process ref leak - mmap write lock handling fix - Fix comments in IOCTL Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20251009162915.981503-1-alexander.deucher@amd.com commit 5472d60c129f75282d94ae5ad072ee6dfb7c7246 Merge: 80b7065ec19485 64cf7d058a005c Author: Linus Torvalds Date: Thu Oct 9 12:18:22 2025 -0700 Merge tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing clean up and fixes from Steven Rostedt: - Have osnoise tracer use memdup_user_nul() The function osnoise_cpus_write() open codes a kmalloc() and then a copy_from_user() and then adds a nul byte at the end which is the same as simply using memdup_user_nul(). - Fix wakeup and irq tracers when failing to acquire calltime When the wakeup and irq tracers use the function graph tracer for tracing function times, it saves a timestamp into the fgraph shadow stack. It is possible that this could fail to be stored. If that happens, it exits the routine early. These functions also disable nesting of the operations by incremeting the data "disable" counter. But if the calltime exits out early, it never increments the counter back to what it needs to be. Since there's only a couple of lines of code that does work after acquiring the calltime, instead of exiting out early, reverse the if statement to be true if calltime is acquired, and place the code that is to be done within that if block. The clean up will always be done after that. - Fix ring_buffer_map() return value on failure of __rb_map_vma() If __rb_map_vma() fails in ring_buffer_map(), it does not return an error. This means the caller will be working against a bad vma mapping. Have ring_buffer_map() return an error when __rb_map_vma() fails. - Fix regression of writing to the trace_marker file A bug fix was made to change __copy_from_user_inatomic() to copy_from_user_nofault() in the trace_marker write function. The trace_marker file is used by applications to write into it (usually with a file descriptor opened at the start of the program) to record into the tracing system. It's usually used in critical sections so the write to trace_marker is highly optimized. The reason for copying in an atomic section is that the write reserves space on the ring buffer and then writes directly into it. After it writes, it commits the event. The time between reserve and commit must have preemption disabled. The trace marker write does not have any locking nor can it allocate due to the nature of it being a critical path. Unfortunately, converting __copy_from_user_inatomic() to copy_from_user_nofault() caused a regression in Android. Now all the writes from its applications trigger the fault that is rejected by the _nofault() version that wasn't rejected by the _inatomic() version. Instead of getting data, it now just gets a trace buffer filled with: tracing_mark_write: To fix this, on opening of the trace_marker file, allocate per CPU buffers that can be used by the write call. Then when entering the write call, do the following: preempt_disable(); cpu = smp_processor_id(); buffer = per_cpu_ptr(cpu_buffers, cpu); do { cnt = nr_context_switches_cpu(cpu); migrate_disable(); preempt_enable(); ret = copy_from_user(buffer, ptr, size); preempt_disable(); migrate_enable(); } while (!ret && cnt != nr_context_switches_cpu(cpu)); if (!ret) ring_buffer_write(buffer); preempt_enable(); This works similarly to seqcount. As it must enabled preemption to do a copy_from_user() into a per CPU buffer, if it gets preempted, the buffer could be corrupted by another task. To handle this, read the number of context switches of the current CPU, disable migration, enable preemption, copy the data from user space, then immediately disable preemption again. If the number of context switches is the same, the buffer is still valid. Otherwise it must be assumed that the buffer may have been corrupted and it needs to try again. Now the trace_marker write can get the user data even if it has to fault it in, and still not grab any locks of its own. * tag 'trace-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Have trace_marker use per-cpu data to read user space ring buffer: Propagate __rb_map_vma return value to caller tracing: Fix irqoff tracers on failure of acquiring calltime tracing: Fix wakeup tracers on failure of acquiring calltime tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul commit 80b7065ec19485943fa00d60f27b447c3f17069c Merge: 18a7e218cfcdca 528f218b31aac4 Author: Linus Torvalds Date: Thu Oct 9 11:56:59 2025 -0700 Merge tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "A bunch of unrelated fixes: - polling fix for trans fd that ought to have been fixed otherwise back in March, but apparently came back somewhere else... - USB transport buffer overflow fix - Some dentry lifetime rework to handle metadata update for currently opened files in uncached mode, or inode type change in cached mode - a double-put on invalid flush found by syzbot - and finally /sys/fs/9p/caches not advancing buffer and overwriting itself for large contents Thanks to everyone involved!" * tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux: 9p: sysfs_init: don't hardcode error to ENOMEM 9p: fix /sys/fs/9p/caches overwriting itself 9p: clean up comment typos 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN net/9p: fix double req put in p9_fd_cancelled net/9p: Fix buffer overflow in USB transport layer fs/9p: Add p9_debug(VFS) in d_revalidate fs/9p: Invalidate dentry if inode type change detected in cached mode fs/9p: Refresh metadata in d_revalidate for uncached mode too commit 18a7e218cfcdca6666e1f7356533e4c988780b57 Merge: 9361cace0d0795 fea8cdf6738a8b Author: Linus Torvalds Date: Thu Oct 9 11:13:08 2025 -0700 Merge tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter. Current release - regressions: - mlx5: fix pre-2.40 binutils assembler error Current release - new code bugs: - net: psp: don't assume reply skbs will have a socket - eth: fbnic: fix missing programming of the default descriptor Previous releases - regressions: - page_pool: fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches - tcp: - take care of zero tp->window_clamp in tcp_set_rcvlowat() - don't call reqsk_fastopen_remove() in tcp_conn_request() - eth: - ice: release xa entry on adapter allocation failure - usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Previous releases - always broken: - netfilter: validate objref and objrefmap expressions - sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - eth: - mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - mlx5: prevent tunnel mode conflicts between FDB and NIC IPsec tables - ocelot: fix use-after-free caused by cyclic delayed work Misc: - add support for MediaTek PCIe 5G HP DRMR-H01" * tag 'net-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits) net: airoha: Fix loopback mode configuration for GDM2 port selftests: drv-net: pp_alloc_fail: add necessary optoins to config selftests: drv-net: pp_alloc_fail: lower traffic expectations selftests: drv-net: fix linter warnings in pp_alloc_fail eth: fbnic: fix reporting of alloc_failed qstats selftests: drv-net: xdp: add test for interface level qstats selftests: drv-net: xdp: rename netnl to ethnl eth: fbnic: fix saving stats from XDP_TX rings on close eth: fbnic: fix accounting of XDP packets eth: fbnic: fix missing programming of the default descriptor selftests: netfilter: query conntrack state to check for port clash resolution selftests: netfilter: nft_fib.sh: fix spurious test failures bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() netfilter: nft_objref: validate objref and objrefmap expressions net: pse-pd: tps23881: Fix current measurement scaling net/mlx5: fix pre-2.40 binutils assembler error net/mlx5e: Do not fail PSP init on missing caps net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock ... commit 9361cace0d07954ad8f2345c057976ab1bf44488 Merge: f6db358deaeafd deabb34b66b96c Author: Linus Torvalds Date: Thu Oct 9 10:51:43 2025 -0700 Merge tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Alexander Gordeev: - Compile the decompressor with -Wno-pointer-sign flag to avoid a clang warning - Fix incomplete conversion to flag output macros in __xsch(), to avoid always zero return value instead of the expected condition code - Remove superfluous newlines from inline assemblies to improve compiler inlining decisions - Expose firmware provided UID Checking state in sysfs regardless of the device presence or state - CIO does not unregister subchannels when the attached device is invalid or unavailable. Update the purge function to remove I/O subchannels if the device number is found on cio_ignore list - Consolidate PAI crypto allocation and cleanup paths - The uv_get_secret_metadata() function has been removed some few months ago, remove also the function mention it in a comment * tag 's390-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/uv: Fix comment of uv_find_secret() function s390/pai_crypto: Consolidate PAI crypto allocation and cleanup paths s390/cio: Update purge function to unregister the unused subchannels s390/pci: Expose firmware provided UID Checking state in sysfs s390: Remove superfluous newlines from inline assemblies s390/cio/ioasm: Fix __xsch() condition code handling s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR commit f6db358deaeafd9830c8bcba8f76f55f8a14b059 Merge: ec714e371f22f7 f7dfa0f31b13ee Author: Linus Torvalds Date: Thu Oct 9 10:33:50 2025 -0700 Merge tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fixes for several corner cases in error paths and debugging options, related to the new kmalloc_nolock() functionality (Kuniyuki Iwashima, Ran Xiaokai) * tag 'slab-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slub: Don't call lockdep_unregister_key() for immature kmem_cache. slab: Fix using this_cpu_ptr() in preemptible context slab: Add allow_spin check to eliminate kmemleak warnings commit 7ae6152b78316319b9c935eb17c863fbebf54ea6 Author: Enzo Matsumiya Date: Sat Oct 4 19:56:36 2025 -0500 smb: client: remove cfids_invalidation_worker We can do the same cleanup on laundromat. On invalidate_all_cached_dirs(), run laundromat worker with 0 timeout and flush it for immediate + sync cleanup. Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit be3898a395f830ef7eaff70df557f57315c61c81 Author: Paulo Alcantara Date: Thu Oct 9 12:41:16 2025 -0300 smb: client: remove redudant assignment in cifs_strict_fsync() Remove redudant assignment of @rc as it will be overwritten by the following cifs_file_flush() call. Reported-by: Steve French Addresses-Coverity: 1665925 Fixes: 210627b0aca9 ("smb: client: fix missing timestamp updates with O_TRUNC") Signed-off-by: Paulo Alcantara (Red Hat) Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit dba9f997c9d9a1cade05d006ed0429a63a4eed32 Author: Paulo Alcantara Date: Tue Oct 7 16:23:25 2025 -0300 smb: client: fix race with fallocate(2) and AIO+DIO AIO+DIO may extend the file size, hence we need to make sure ->i_size is stable across the entire fallocate(2) operation, otherwise it would become a truncate and then inode size reduced back down when it finishes. Fix this by calling netfs_wait_for_outstanding_io() right after acquiring ->i_rwsem exclusively in cifs_fallocate() and then guarantee a stable ->i_size across fallocate(2). Also call netfs_wait_for_outstanding_io() after truncating pagecache to avoid any potential races with writeback. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Fixes: 210627b0aca9 ("smb: client: fix missing timestamp updates with O_TRUNC") Cc: Frank Sorenson Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 Author: Paulo Alcantara Date: Tue Oct 7 16:23:24 2025 -0300 smb: client: fix missing timestamp updates after utime(2) Don't reuse open handle when changing timestamps to prevent the server from disabling automatic timestamp updates as per MS-FSA 2.1.4.17. ---8<--- import os import time filename = '/mnt/foo' def print_stat(prefix): st = os.stat(filename) print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old') os.utime(fd, None) time.sleep(2) os.write(fd, b'foo') os.close(fd) time.sleep(2) print_stat('new') ---8<--- Before patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025 After patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025 new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025 Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible") Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 57ce9f7793b714fb14a97d502ce926162c3b96b1 Author: Paulo Alcantara Date: Tue Oct 7 16:23:23 2025 -0300 smb: client: fix missing timestamp updates after ftruncate(2) Mask off ATTR_MTIME|ATTR_CTIME bits on ATTR_SIZE (e.g. ftruncate(2)) to prevent the client from sending set info calls and then disabling automatic timestamp updates on server side as per MS-FSA 2.1.4.17. ---8<--- import os import time filename = '/mnt/foo' def print_stat(prefix): st = os.stat(filename) print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime)) fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644) print_stat('old') os.ftruncate(fd, 10) time.sleep(2) os.write(fd, b'foo') os.close(fd) time.sleep(2) print_stat('new') ---8<--- Before patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 13:47:03 2025 Fri Oct 3 13:47:03 2025 new : Fri Oct 3 13:47:00 2025 Fri Oct 3 13:47:03 2025 After patch: $ mount.cifs //srv/share /mnt -o ... $ python3 run.py old : Fri Oct 3 13:48:39 2025 Fri Oct 3 13:48:39 2025 new : Fri Oct 3 13:48:41 2025 Fri Oct 3 13:48:41 2025 Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 110fee6b9bb58a5c50047fc2594d415f741b591e Author: Paulo Alcantara Date: Tue Oct 7 16:23:22 2025 -0300 smb: client: fix missing timestamp updates with O_TRUNC Don't call ->set_file_info() on open handle to prevent the server from stopping [cm]time updates automatically as per MS-FSA 2.1.4.17. Fix this by checking for ATTR_OPEN bit earlier in cifs_setattr() to prevent ->set_file_info() from being called when opening a file with O_TRUNC. Do the truncation in ->open() instead. This also saves two roundtrips when opening a file with O_TRUNC and there are currently no open handles to be reused. Before patch: $ mount.cifs //srv/share /mnt -o ... $ cd /mnt $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo old: 2025-10-03 13:26:23.151030500 -0300 2025-10-03 13:26:23.151030500 -0300 new: 2025-10-03 13:26:23.151030500 -0300 2025-10-03 13:26:23.151030500 -0300 After patch: $ mount.cifs //srv/share /mnt -o ... $ cd /mnt $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo $ exec 3>foo; stat -c 'old: %z %y' foo; sleep 2; echo test >&3; exec 3>&-; sleep 2; stat -c 'new: %z %y' foo old: 2025-10-03 13:28:13.911933800 -0300 2025-10-03 13:28:13.911933800 -0300 new: 2025-10-03 13:28:26.647492700 -0300 2025-10-03 13:28:26.647492700 -0300 Reported-by: Frank Sorenson Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 Author: Fushuai Wang Date: Tue Oct 7 16:26:03 2025 +0800 cifs: Fix copy_to_iter return value check The return value of copy_to_iter() function will never be negative, it is the number of bytes copied, or zero if nothing was copied. Update the check to treat 0 as an error, and return -1 in that case. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Acked-by: Tom Talpey Reviewed-by: David Howells Signed-off-by: Fushuai Wang Signed-off-by: Steve French commit 68d2e2ca1cba9259e943bcd188671b619b9770b4 Author: Henrique Carvalho Date: Fri Oct 3 23:11:43 2025 -0300 smb: client: batch SRV_COPYCHUNK entries to cut round trips smb2_copychunk_range() used to send a single SRV_COPYCHUNK per SRV_COPYCHUNK_COPY IOCTL. Implement variable Chunks[] array in struct copychunk_ioctl and fill it with struct copychunk (MS-SMB2 2.2.31.1.1), bounded by server-advertised limits. This reduces the number of IOCTL requests for large copies. While we are at it, rename a couple variables to follow the terminology used in the specification. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 1643cd51ba975f484a09bed42d1a2014c42c9e6d Author: Markus Elfring Date: Thu Oct 9 17:00:13 2025 +0200 smb: client: Omit an if branch in smb2_find_smb_tcon() Statements from an if branch and the end of this function implementation were equivalent. Thus delete duplicate source code. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit bb642e2d300ee27dcede65cda7ffc47a7047bd69 Author: Amit Chaudhary Date: Fri Sep 26 12:08:22 2025 -0700 nvme-multipath: Skip nr_active increments in RETRY disposition For queue-depth I/O policy, this patch fixes unbalanced I/Os across nvme multipaths. Issue Description: The RETRY disposition incorrectly increments ns->ctrl->nr_active counter and reinitializes iostat start-time. In such cases nr_active counter never goes back to zero until that path disconnects and reconnects. Such a path is not chosen for new I/Os if multiple RETRY cases on a given a path cause its queue-depth counter to be artificially higher compared to other paths. This leads to unbalanced I/Os across paths. The patch skips incrementing nr_active if NVME_MPATH_CNT_ACTIVE is already set. And it skips restarting io stats if NVME_MPATH_IO_STATS is already set. base-commit: e989a3da2d371a4b6597ee8dee5c72e407b4db7a Fixes: d4d957b53d91eeb ("nvme-multipath: support io stats on the mpath device") Signed-off-by: Amit Chaudhary Reviewed-by: Randy Jennings Signed-off-by: Keith Busch commit e07e10ae83bdf429f59c8c149173a8c4f29c481e Author: Ketil Johnsen Date: Wed Oct 8 12:51:11 2025 +0200 drm/panthor: Ensure MCU is disabled on suspend Currently the Panthor driver needs the GPU to be powered down between suspend and resume. If this is not done, then the MCU_CONTROL register will be preserved as AUTO, which again will cause a premature FW boot on resume. The FW will go directly into fatal state in this case. This case needs to be handled as there is no guarantee that the GPU will be powered down after the suspend callback on all platforms. The fix is to call panthor_fw_stop() in "pre-reset" path to ensure the MCU_CONTROL register is cleared (set DISABLE). This matches well with the already existing call to panthor_fw_start() from the "post-reset" path. Signed-off-by: Ketil Johnsen Acked-by: Boris Brezillon Reviewed-by: Steven Price Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20251008105112.4077015-1-ketil.johnsen@arm.com commit eb4faf6343889fcd7edba3deeae49fc5a06531fd Author: Kael D'Alcamo Date: Wed Oct 8 22:04:27 2025 +0200 dt-bindings: i2c: hisilicon,hix5hd2: convert to DT schema Convert the Devicetree binding documentation for hisilicon,hix5hd2-i2c from plain text to DT binding schema. Signed-off-by: Kael D'Alcamo Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 434689e971955f487355b3f01e84ee269032bc87 Author: Hans de Goede Date: Wed Oct 1 23:24:16 2025 +0200 gpio: usbio: Add ACPI device-id for MTL-CVF devices Add "INTC10D1" ACPI device-id for MTL-CVF devices, like the Dell Latitude 7450. Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2368506 Signed-off-by: Hans de Goede Acked-by: Israel Cepeda Acked-by: Sakari Ailus Signed-off-by: Bartosz Golaszewski commit fea8cdf6738a8b25fccbb7b109b440795a0892cb Author: Lorenzo Bianconi Date: Wed Oct 8 11:27:43 2025 +0200 net: airoha: Fix loopback mode configuration for GDM2 port Add missing configuration for loopback mode in airhoha_set_gdm2_loopback routine. Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251008-airoha-loopback-mode-fix-v2-1-045694fe7f60@kernel.org Signed-off-by: Paolo Abeni commit e6cc7ac0d420a7782cdb6d926245abf40f943f24 Merge: 2854378a00e887 5d683e550540b7 Author: Paolo Abeni Date: Thu Oct 9 11:10:03 2025 +0200 Merge branch 'eth-fbnic-fix-xdp_tx-and-xdp-vs-qstats' Jakub Kicinski says: ==================== eth: fbnic: fix XDP_TX and XDP vs qstats Fix XDP_TX hangs and adjust the XDP statistics to match the definition of qstats. The three problems are somewhat distinct. XDP_TX hangs is a simple coding bug (patch 1). The accounting of XDP packets is all over the place. Fix it to obey qstat rules (packets seen by XDP always counted as Rx packets). Patch 2 fixes the basic accounting, patch 3 touches up saving the stats when rings are freed. Patch 6 corrects reporting of alloc_fail stats which prevented the pp_alloc_fail test from passing. Patches 4, 5, 7, 8, 9 add or fix related test cases. v2: - [patch 2] remove now unnecessary byte adjustment - [patch 8] use seen_fails more v1: https://lore.kernel.org/20251003233025.1157158-1-kuba@kernel.org Testing on fbnic below: $ ./tools/testing/selftests/drivers/net/hw/pp_alloc_fail.py TAP version 13 1..1 fbnic-err: bad MMIO read address 0x80074 fbnic-err: bad MMIO read address 0x80074 # Seen: pkts:20605 fails:40 (pass thrs:12) # ethtool -G change retval: success ok 1 pp_alloc_fail.test_pp_alloc # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 $ ./tools/testing/selftests/drivers/net/xdp.py TAP version 13 1..13 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_sb ok 6 xdp.test_xdp_native_tx_mb # Failed run: pkt_sz 2048, offset 1. Last successful run: pkt_sz 1024, offset 256. Reason: Adjustment failed ok 7 xdp.test_xdp_native_adjst_tail_grow_data ok 8 xdp.test_xdp_native_adjst_tail_shrnk_data # Failed run: pkt_sz 512, offset -256. Last successful run: pkt_sz 512, offset -128. Reason: Adjustment failed ok 9 xdp.test_xdp_native_adjst_head_grow_data # Failed run: pkt_sz (2048) > HDS threshold (1536) and offset 64 > 48 ok 10 xdp.test_xdp_native_adjst_head_shrnk_data ok 11 xdp.test_xdp_native_qstats_pass ok 12 xdp.test_xdp_native_qstats_drop ok 13 xdp.test_xdp_native_qstats_tx # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0 ==================== Link: https://patch.msgid.link/20251007232653.2099376-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 5d683e550540b7afd813ae45e9f727245bd26fe3 Author: Jakub Kicinski Date: Tue Oct 7 16:26:53 2025 -0700 selftests: drv-net: pp_alloc_fail: add necessary optoins to config Add kernel config for error injection as needed by pp_alloc_fail.py Reviewed-by: Simon Horman Fixes: 9da271f825e4 ("selftests: drv-net-hw: add test for memory allocation failures with page pool") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-10-kuba@kernel.org Signed-off-by: Paolo Abeni commit fbb467f0ed95853ff0f1a20f8d53e8c0eccc2ddb Author: Jakub Kicinski Date: Tue Oct 7 16:26:52 2025 -0700 selftests: drv-net: pp_alloc_fail: lower traffic expectations Lower the expected level of traffic in the pp_alloc_fail test and calculate failure counter thresholds based on the traffic rather than using a fixed constant. We only have "QEMU HW" in NIPA right now, and the test (due to debug dependencies) only works on debug kernels in the first place. We need some place for it to pass otherwise it seems to be bit rotting. So lower the traffic threshold so that it passes on QEMU and with a debug kernel... Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-9-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0be740fb22da998bfc61b932796ee39099694a81 Author: Jakub Kicinski Date: Tue Oct 7 16:26:51 2025 -0700 selftests: drv-net: fix linter warnings in pp_alloc_fail Fix linter warnings, it's a bit hard to check for new ones otherwise. W0311: Bad indentation. Found 16 spaces, expected 12 (bad-indentation) C0114: Missing module docstring (missing-module-docstring) W1514: Using open without explicitly specifying an encoding (unspecified-encoding) C0116: Missing function or method docstring (missing-function-docstring) Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-8-kuba@kernel.org Signed-off-by: Paolo Abeni commit 2eecd3a41e67c03e52905c42a1e19cc6266a608a Author: Jakub Kicinski Date: Tue Oct 7 16:26:50 2025 -0700 eth: fbnic: fix reporting of alloc_failed qstats Rx processing under normal circumstances has 3 rings - 2 buffer rings (heads, payloads) and a completion ring. All the rings have a struct fbnic_ring. Make sure we expose alloc_failed counter from the buffer rings, previously only the alloc_failed from the completion ring was reported, even tho all ring types may increment this counter (buffer rings in __fbnic_fill_bdq()). This makes the pp_alloc_fail.py test pass, it expects the qstat to be incrementing as page pool injections happen. Reviewed-by: Simon Horman Fixes: 67dc4eb5fc92 ("eth: fbnic: report software Rx queue stats") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-7-kuba@kernel.org Signed-off-by: Paolo Abeni commit 27ba92560bcc8a121214a22a55217ba54696495c Author: Jakub Kicinski Date: Tue Oct 7 16:26:49 2025 -0700 selftests: drv-net: xdp: add test for interface level qstats Send a non-trivial number of packets and make sure that they are counted correctly in qstats. Per qstats specification XDP is the first layer of the stack so we should see Rx and Tx counters go up for packets which went thru XDP. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 1ad3f62089af2bae95f7c49909c4065f8b1dc4b6 Author: Jakub Kicinski Date: Tue Oct 7 16:26:48 2025 -0700 selftests: drv-net: xdp: rename netnl to ethnl Test uses "netnl" for the ethtool family which is quite confusing (one would expect netdev family would use this name). No functional changes. Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit 858b78b24af288bd1143f73aed4e29803ebe8d15 Author: Jakub Kicinski Date: Tue Oct 7 16:26:47 2025 -0700 eth: fbnic: fix saving stats from XDP_TX rings on close When rings are freed - stats get added to the device level stat structs. Save the stats from the XDP_TX ring just as Tx stats. Previously they would be saved to Rx and Tx stats. So we'd not see XDP_TX packets as Rx during runtime but after an down/up cycle the packets would appear in stats. Correct the helper used by ethtool code which does a runtime config switch. Reviewed-by: Simon Horman Fixes: 5213ff086344 ("eth: fbnic: Collect packet statistics for XDP") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 613e9e8dcb7e2523943d3cf965f3183c54b32adb Author: Jakub Kicinski Date: Tue Oct 7 16:26:46 2025 -0700 eth: fbnic: fix accounting of XDP packets Make XDP-handled packets appear in the Rx stats. The driver has been counting XDP_TX packets on the Tx ring, but there wasn't much accounting on the Rx side (the Rx bytes appear to be incremented on XDP_TX but XDP_DROP / XDP_ABORT are only counted as Rx drops). Counting XDP_TX packets (not just bytes) in Rx stats looks like a simple bug of omission. The XDP_DROP handling appears to be intentional. Whether XDP_DROP packets should be counted in interface-level Rx stats is a bit unclear historically. When we were defining qstats, however, we clarified based on operational experience that in this context: name: rx-packets doc: | Number of wire packets successfully received and passed to the stack. For drivers supporting XDP, XDP is considered the first layer of the stack, so packets consumed by XDP are still counted here. fbnic does not obey this requirement. Since XDP support has been added in current release cycle, instead of splitting interface and qstat handling - make them both follow the qstat definition. Another small tweak here is that we count bytes as received on the wire rather than post-XDP bytes (xdp_get_buff_len() vs skb->len). Reviewed-by: Simon Horman Fixes: 5213ff086344 ("eth: fbnic: Collect packet statistics for XDP") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit 7e617d57f2a2f0cc3c5d91b5594df7fd1f2e4459 Author: Jakub Kicinski Date: Tue Oct 7 16:26:45 2025 -0700 eth: fbnic: fix missing programming of the default descriptor XDP_TX typically uses no offloads. To optimize XDP we added a "default descriptor" feature to the chip, which allows us to send XDP frames with just the buffer descriptors (DMA address + length). All the metadata descriptors are derived from the queue config. Commit under Fixes missed adding setting the defaults up when transplanting the code from the prototype driver. Importantly after reset the "request completion" bit is not set. Packets still get sent but there's no completion, so ring is not cleaned up. We can send one ring's worth of packets and then will start dropping all frames that got the XDP_TX action from the XDP prog. Reviewed-by: Simon Horman Fixes: 168deb7b31b2 ("eth: fbnic: Add support for XDP_TX action") Signed-off-by: Jakub Kicinski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251007232653.2099376-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 49836ff2f37dd6d52bfe3153c0bcbd96025a6100 Author: Marc Kleine-Budde Date: Thu Oct 9 08:25:36 2025 +0200 can: m_can: replace Dong Aisheng's old email address Dong Aisheng's old Freescale email is not valid anymore and bounces, replace it by the new NXP one. Reviewed-by: Dong Aisheng Link: https://patch.msgid.link/20251009-m_can-update-email-address-v1-1-30a268587f69@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 2854378a00e8872507a19cb1eb88517fc9584bc5 Merge: 2c95a756e0cfc1 e84945bdc619ed Author: Paolo Abeni Date: Thu Oct 9 10:07:44 2025 +0200 Merge tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Fix crash (call recursion) when nftables synproxy extension is used in an object map. When this feature was added in v5.4 the required hook call validation was forgotten. Fix from Fernando Fernandez Mancera. 2) bridge br_vlan_fill_forward_path_pvid uses incorrect rcu_dereference_protected(); we only have rcu read lock but not RTNL. Fix from Eric Woudstra. Last two patches address flakes in two existing selftests. netfilter pull request nf-25-10-08 * tag 'nf-25-10-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: query conntrack state to check for port clash resolution selftests: netfilter: nft_fib.sh: fix spurious test failures bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() netfilter: nft_objref: validate objref and objrefmap expressions ==================== Link: https://patch.msgid.link/20251008125942.25056-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f Author: Herbert Xu Date: Wed Oct 8 15:54:20 2025 +0800 crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. Reported-by: Muhammad Alifa Ramdhan Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") Signed-off-by: Herbert Xu commit ec714e371f22f716a04e6ecb2a24988c92b26911 Merge: 37bfdbc11b2451 f3b601f900902a Author: Linus Torvalds Date: Wed Oct 8 19:24:24 2025 -0700 Merge tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Arnaldo Carvalho de Melo: - Extended 'perf annotate' with DWARF type information (--code-with-type) integration in the TUI, including a 'T' hotkey to toggle it - Enhanced 'perf bench mem' with new mmap() workloads and control over page/chunk sizes - Fix 'perf stat' error handling to correctly display unsupported events - Improved support for Clang cross-compilation - Refactored LLVM and Capstone disasm for modularity - Introduced the :X modifier to exclude an event from automatic regrouping - Adjusted KVM sampling defaults to use the "cycles" event to prevent failures - Added comprehensive support for decoding PowerPC Dispatch Trace Log (DTL) - Updated Arm SPE tracing logic for better analysis of memory and snoop details - Synchronized Intel PMU events and metrics with TMA 5.1 across multiple processor generations - Converted dependencies like libperl and libtracefs to be opt-in - Handle more Rust symbols in kallsyms ('N', debugging) - Improve the python binding to allow for python based tools to use more of the libraries, add a 'ilist' utility to test those new bindings - Various 'perf test' fixes - Kan Liang no longer a perf tools reviewer * tag 'perf-tools-for-v6.18-1-2025-10-08' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (192 commits) perf tools: Fix arm64 libjvmti build by generating unistd_64.h perf tests: Don't retest sections in "Object code reading" perf docs: Document building with Clang perf build: Support build with clang perf test coresight: Dismiss clang warning for unroll loop thread perf test coresight: Dismiss clang warning for thread loop perf test coresight: Dismiss clang warning for memcpy thread perf build: Disable thread safety analysis for perl header perf build: Correct CROSS_ARCH for clang perf python: split Clang options when invoking Popen tools build: Align warning options with perf perf disasm: Remove unused evsel from 'struct annotate_args' perf srcline: Fallback between addr2line implementations perf disasm: Make ins__scnprintf() and ins__is_nop() static perf dso: Clean up read_symbol() error handling perf dso: Support BPF programs in dso__read_symbol() perf dso: Move read_symbol() from llvm/capstone to dso perf llvm: Reduce LLVM initialization perf check: Add libLLVM feature perf parse-events: Fix parsing of >30kb event strings ... commit 37bfdbc11b245119210ac9924a192aec8bd07d16 Merge: cd5a0afbdf8033 a154f141604aca Author: Linus Torvalds Date: Wed Oct 8 18:51:00 2025 -0700 Merge tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Fix a resource lookup regression that broke enumeration of hotplugged Thunderbolt devices on several platforms (Yangyu Chen) * tag 'pci-v6.18-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Fix regression in pci_bus_distribute_available_resources() commit 64cf7d058a005c5c31eb8a0b741f35dc12915d18 Author: Steven Rostedt Date: Wed Oct 8 12:45:10 2025 -0400 tracing: Have trace_marker use per-cpu data to read user space It was reported that using __copy_from_user_inatomic() can actually schedule. Which is bad when preemption is disabled. Even though there's logic to check in_atomic() is set, but this is a nop when the kernel is configured with PREEMPT_NONE. This is due to page faulting and the code could schedule with preemption disabled. Link: https://lore.kernel.org/all/20250819105152.2766363-1-luogengkun@huaweicloud.com/ The solution was to change the __copy_from_user_inatomic() to copy_from_user_nofault(). But then it was reported that this caused a regression in Android. There's several applications writing into trace_marker() in Android, but now instead of showing the expected data, it is showing: tracing_mark_write: After reverting the conversion to copy_from_user_nofault(), Android was able to get the data again. Writes to the trace_marker is a way to efficiently and quickly enter data into the Linux tracing buffer. It takes no locks and was designed to be as non-intrusive as possible. This means it cannot allocate memory, and must use pre-allocated data. A method that is actively being worked on to have faultable system call tracepoints read user space data is to allocate per CPU buffers, and use them in the callback. The method uses a technique similar to seqcount. That is something like this: preempt_disable(); cpu = smp_processor_id(); buffer = this_cpu_ptr(&pre_allocated_cpu_buffers, cpu); do { cnt = nr_context_switches_cpu(cpu); migrate_disable(); preempt_enable(); ret = copy_from_user(buffer, ptr, size); preempt_disable(); migrate_enable(); } while (!ret && cnt != nr_context_switches_cpu(cpu)); if (!ret) ring_buffer_write(buffer); preempt_enable(); It's a little more involved than that, but the above is the basic logic. The idea is to acquire the current CPU buffer, disable migration, and then enable preemption. At this moment, it can safely use copy_from_user(). After reading the data from user space, it disables preemption again. It then checks to see if there was any new scheduling on this CPU. If there was, it must assume that the buffer was corrupted by another task. If there wasn't, then the buffer is still valid as only tasks in preemptable context can write to this buffer and only those that are running on the CPU. By using this method, where trace_marker open allocates the per CPU buffers, trace_marker writes can access user space and even fault it in, without having to allocate or take any locks of its own. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Luo Gengkun Cc: Wattson CI Cc: Linus Torvalds Link: https://lore.kernel.org/20251008124510.6dba541a@gandalf.local.home Fixes: 3d62ab32df065 ("tracing: Fix tracing_marker may trigger page fault during preempt_disable") Reported-by: Runping Lai Tested-by: Runping Lai Closes: https://lore.kernel.org/linux-trace-kernel/20251007003417.3470979-2-runpinglai@google.com/ Signed-off-by: Steven Rostedt (Google) commit de4cbd704731778a2dc833ce5a24b38e5d672c05 Author: Ankit Khushwaha Date: Wed Oct 8 22:55:16 2025 +0530 ring buffer: Propagate __rb_map_vma return value to caller The return value from `__rb_map_vma()`, which rejects writable or executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being ignored. As a result the caller of `__rb_map_vma` always returned 0 even when the mapping had actually failed, allowing it to proceed with an invalid VMA. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008172516.20697-1-ankitkhushwaha.linux@gmail.com Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions") Reported-by: syzbot+ddc001b92c083dbf2b97@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb Signed-off-by: Ankit Khushwaha Signed-off-by: Steven Rostedt (Google) commit d74d6c0e98958aa0bdb6f0a93258a856bda58b97 Author: Viacheslav Dubeyko Date: Tue Sep 2 13:09:58 2025 -0700 ceph: add bug tracking system info to MAINTAINERS This patch adds information about Ceph bug tracking system. [ idryomov: add the same for RBD, don't mention include/linux/ceph/ again ] Signed-off-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit a154f141604acacc0ec64a445d8058a045c308ef Author: Yangyu Chen Date: Wed Oct 8 22:36:52 2025 +0800 PCI: Fix regression in pci_bus_distribute_available_resources() The refactoring in 4292a1e45fd4 ("PCI: Refactor distributing available memory to use loops") switched pci_bus_distribute_available_resources() to operate on an array of bridge windows. That accidentally looked up bus resources via pci_bus_resource_n() and then passed those pointers to helper routines that expect the resource to belong to the device. As soon as we execute that code, pci_resource_num() warned because the resource wasn't in the bridge's resource array. This happens on my AMD Strix Halo machine with Thunderbolt device; the error message is shown below: WARNING: CPU: 6 PID: 272 at drivers/pci/pci.h:471 pci_bus_distribute_available_resources+0x6ad/0x6d0 CPU: 6 UID: 0 PID: 272 Comm: irq/33-pciehp Not tainted 6.17.0+ #1 PREEMPT(voluntary) Hardware name: PELADN YO Series/YO1, BIOS 1.04 05/15/2025 RIP: 0010:pci_bus_distribute_available_resources+0x6ad/0x6d0 Call Trace: pci_bus_distribute_available_resources+0x590/0x6d0 pci_bridge_distribute_available_resources+0x62/0xb0 pci_assign_unassigned_bridge_resources+0x65/0x1b0 pciehp_configure_device+0x92/0x160 pciehp_handle_presence_or_link_change+0x1b5/0x350 pciehp_ist+0x147/0x1c0 Fix the regression by always fetching the resource directly from the bridge with pci_resource_n(bridge, PCI_BRIDGE_RESOURCES + i). This restores the original behaviour while keeping the refactored structure. Then we can successfully assign resources to the Thunderbolt device. Fixes: 4292a1e45fd4 ("PCI: Refactor distributing available memory to use loops") Reported-by: Kenneth R. Crudup Closes: https://lore.kernel.org/r/dd551b81-9e81-480b-aab3-7cf8b8bbc1d0@panix.com Signed-off-by: Yangyu Chen [bhelgaas: trim timestamps, etc from commit log] Signed-off-by: Bjorn Helgaas Tested-By: Kenneth R. Crudup Link: https://lore.kernel.org/r/F833CC81-7C60-48FC-A31C-B9999DCC6FA2@icloud.com Link: https://patch.msgid.link/tencent_8C54420E1B0FF8D804C1B4651DF970716309@qq.com commit 22c73d52a6d05c5a2053385c0d6cd9984732799d Author: Kotresh HR Date: Thu Sep 11 15:02:35 2025 +0530 ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'. But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below. 5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin $echo "data" > /kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1 For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below. v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning [ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ] Link: https://tracker.ceph.com/issues/72167 Signed-off-by: Kotresh HR Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit c66120c84295a0495eb46dcfba829457acd6ef7d Author: Viacheslav Dubeyko Date: Tue Sep 2 12:08:45 2025 -0700 ceph: cleanup in ceph_alloc_readdir_reply_buffer() The Coverity Scan service has reported potential issue in ceph_alloc_readdir_reply_buffer() [1]. If order could be negative one, then it expects the issue in the logic: num_entries = (PAGE_SIZE << order) / size; Technically speaking, this logic [2] should prevent from making the order variable negative: if (!rinfo->dir_entries) return -ENOMEM; However, the allocation logic requires some cleanup. This patch makes sure that calculated bytes count will never exceed ULONG_MAX before get_order() calculation. And it adds the checking of order variable on negative value to guarantee that second half of the function's code will never operate by negative value of order variable even if something will be wrong or to be changed in the first half of the function's logic. v2 Alex Markuze suggested to add unlikely() macro for introduced condition checks. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1198252 [2] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/mds_client.c#L2553 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 98a2850de49c10a1a09642e17978b925f95e6029 Author: Viacheslav Dubeyko Date: Thu Aug 28 11:44:42 2025 -0700 ceph: fix potential NULL dereference issue in ceph_fill_trace() The Coverity Scan service has detected a potential dereference of an explicit NULL value in ceph_fill_trace() [1]. The variable in is declared in the beggining of ceph_fill_trace() [2]: struct inode *in = NULL; However, the initialization of the variable is happening under condition [3]: if (rinfo->head->is_target) { in = req->r_target_inode; } Potentially, if rinfo->head->is_target == FALSE, then in variable continues to be NULL and later the dereference of NULL value could happen in ceph_fill_trace() logic [4,5]: else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP || req->r_op == CEPH_MDS_OP_MKSNAP) && test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) && !test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) { ihold(in); err = splice_dentry(&req->r_dentry, in); if (err < 0) goto done; } This patch adds the checking of in variable for NULL value and it returns -EINVAL error code if it has NULL value. v2 Alex Markuze suggested to add unlikely macro in the checking condition. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1141197 [2] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1522 [3] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1629 [4] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1745 [5] https://elixir.bootlin.com/linux/v6.17-rc3/source/fs/ceph/inode.c#L1777 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 6140f1d43ba9425dc55b12bdfd8877b0c5118d9a Author: Max Kellermann Date: Wed Aug 6 11:48:55 2025 +0200 libceph: add empty check to ceph_con_get_out_msg() This moves the list_empty() checks from the two callers (v1 and v2) into the base messenger.c library. Now the v1/v2 specializations do not need to know about con->out_queue; that implementation detail is now hidden behind the ceph_con_get_out_msg() function. [ idryomov: instead of changing prepare_write_message() to return a bool, move ceph_con_get_out_msg() call out to arrive to the same pattern as in messenger_v2.c ] Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 7399212dcf64d90a6ab239bdd98bd325d922fc7e Author: Max Kellermann Date: Wed Aug 6 11:48:54 2025 +0200 libceph: pass the message pointer instead of loading con->out_msg This pointer is in a register anyway, so let's use that instead of reloading from memory everywhere. [ idryomov: formatting ] Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 59699a5a7114f09f890e86c09a6b32afb5eaa64c Author: Max Kellermann Date: Wed Aug 6 11:48:53 2025 +0200 libceph: make ceph_con_get_out_msg() return the message pointer The caller in messenger_v1.c loads it anyway, so let's keep the pointer in the register instead of reloading it from memory. This eliminates a tiny bit of unnecessary overhead. Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit fbeafe782bd986bf75544526fb9c0284e045e0a4 Author: Viacheslav Dubeyko Date: Wed Jul 16 11:40:49 2025 -0700 ceph: fix potential race condition on operations with CEPH_I_ODIRECT flag The Coverity Scan service has detected potential race conditions in ceph_block_o_direct(), ceph_start_io_read(), ceph_block_buffered(), and ceph_start_io_direct() [1 - 4]. The CID 1590942, 1590665, 1589664, 1590377 contain explanation: "The value of the shared data will be determined by the interleaving of thread execution. Thread shared data is accessed without holding an appropriate lock, possibly causing a race condition (CWE-366)". This patch reworks the pattern of accessing/modification of CEPH_I_ODIRECT flag by means of adding smp_mb__before_atomic() before reading the status of CEPH_I_ODIRECT flag and smp_mb__after_atomic() after clearing set/clear this flag. Also, it was reworked the pattern of using of ci->i_ceph_lock in ceph_block_o_direct(), ceph_start_io_read(), ceph_block_buffered(), and ceph_start_io_direct() methods. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590942 [2] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590665 [3] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1589664 [4] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1590377 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 53db6f25ee47cb1265141d31562604e56146919a Author: Viacheslav Dubeyko Date: Tue Jul 8 12:20:57 2025 -0700 ceph: refactor wake_up_bit() pattern of calling The wake_up_bit() is called in ceph_async_unlink_cb(), wake_async_create_waiters(), and ceph_finish_async_create(). It makes sense to switch on clear_bit() function, because it makes the code much cleaner and easier to understand. More important rework is the adding of smp_mb__after_atomic() memory barrier after the bit modification and before wake_up_bit() call. It can prevent potential race condition of accessing the modified bit in other threads. Luckily, clear_and_wake_up_bit() already implements the required functionality pattern: static inline void clear_and_wake_up_bit(int bit, unsigned long *word) { clear_bit_unlock(bit, word); /* See wake_up_bit() for which memory barrier you need to use. */ smp_mb__after_atomic(); wake_up_bit(word, bit); } Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 Author: Viacheslav Dubeyko Date: Fri Jun 13 11:31:08 2025 -0700 ceph: fix potential race condition in ceph_ioctl_lazyio() The Coverity Scan service has detected potential race condition in ceph_ioctl_lazyio() [1]. The CID 1591046 contains explanation: "Check of thread-shared field evades lock acquisition (LOCK_EVASION). Thread1 sets fmode to a new value. Now the two threads have an inconsistent view of fmode and updates to fields correlated with fmode may be lost. The data guarded by this critical section may be read while in an inconsistent state or modified by multiple racing threads. In ceph_ioctl_lazyio: Checking the value of a thread-shared field outside of a locked region to determine if a locked operation involving that thread shared field has completed. (CWE-543)". The patch places fi->fmode field access under ci->i_ceph_lock protection. Also, it introduces the is_file_already_lazy variable that is set under the lock and it is checked later out of scope of critical section. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 5b2d1377d6cc4147492780b0bd95fb9c4cb28d1b Author: Viacheslav Dubeyko Date: Fri Jun 6 12:05:45 2025 -0700 ceph: fix overflowed constant issue in ceph_do_objects_copy() The Coverity Scan service has detected overflowed constant issue in ceph_do_objects_copy() [1]. The CID 1624308 defect contains explanation: "The overflowed value due to arithmetic on constants is too small or unexpectedly negative, causing incorrect computations. Expression bytes, which is equal to -95, where ret is known to be equal to -95, underflows the type that receives it, an unsigned integer 64 bits wide. In ceph_do_objects_copy: Integer overflow occurs in arithmetic on constant operands (CWE-190)". The patch changes the type of bytes variable from size_t to ssize_t with the goal of to be capable to receive negative values. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1624308 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit 1ed4471a4ee6cfa902467332042158ca5ef8ad24 Author: Viacheslav Dubeyko Date: Fri Jun 6 12:05:21 2025 -0700 ceph: fix wrong sizeof argument issue in register_session() The Coverity Scan service has detected the wrong sizeof argument in register_session() [1]. The CID 1598909 defect contains explanation: "The wrong sizeof value is used in an expression or as argument to a function. The result is an incorrect value that may cause unexpected program behaviors. In register_session: The sizeof operator is invoked on the wrong argument (CWE-569)". The patch introduces a ptr_size variable that is initialized by sizeof(struct ceph_mds_session *). And this variable is used instead of sizeof(void *) in the code. [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1598909 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit b7ed1e29cfe773d648ca09895b92856bd3a2092d Author: Viacheslav Dubeyko Date: Fri Jun 6 12:04:32 2025 -0700 ceph: add checking of wait_for_completion_killable() return value The Coverity Scan service has detected the calling of wait_for_completion_killable() without checking the return value in ceph_lock_wait_for_completion() [1]. The CID 1636232 defect contains explanation: "If the function returns an error value, the error value may be mistaken for a normal value. In ceph_lock_wait_for_completion(): Value returned from a function is not checked for errors before being used. (CWE-252)". The patch adds the checking of wait_for_completion_killable() return value and return the error code from ceph_lock_wait_for_completion(). [1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Alex Markuze Signed-off-by: Ilya Dryomov commit fa073039466f16141807a0f32840ecdceb00e22a Author: Max Kellermann Date: Fri Dec 6 17:50:14 2024 +0100 ceph: make ceph_start_io_*() killable This allows killing processes that wait for a lock when one process is stuck waiting for the Ceph server. This is similar to the NFS commit 38a125b31504 ("fs/nfs/io: make nfs_start_io_*() killable"). [ idryomov: drop comment on include, formatting ] Signed-off-by: Max Kellermann Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 27c0a7b05d13a0dc54ed0b95fc12218210fdea1a Author: Eric Biggers Date: Thu Jul 31 12:02:27 2025 -0700 libceph: Use HMAC-SHA256 library instead of crypto_shash Use the HMAC-SHA256 library functions instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit cd5a0afbdf8033dc83786315d63f8b325bdba2fd Merge: ed4d6e92463e8d 3f39f56520374c Author: Linus Torvalds Date: Wed Oct 8 11:44:21 2025 -0700 Merge tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - Qualcomm: add Glymur CPUCP mailbox binding - Xilinx Zynq: misc cleanup - MediaTek: - add new GPUEB mailbox driver - cmdq: remove pm_runtime calls from send_data - gce: make clock-names optional - misc: - change mailbox-altera maintainer - remove redundant 'fast_io' in regmap_config - mhuv3: Remove no_free_ptr * tag 'mailbox-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() mailbox: add MediaTek GPUEB IPI mailbox dt-bindings: mailbox: Add MT8196 GPUEB Mailbox mailbox: zynqmp-ipi: Fix SGI cleanup on unbind mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call mailbox: remove unneeded 'fast_io' parameter in regmap_config dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding MAINTAINERS: Change mailbox-altera maintainer mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer commit ed4d6e92463e8dfe6dfb971f8edc6b5d9ea18722 Merge: 99cedb6b8f4101 451bb963289818 Author: Linus Torvalds Date: Wed Oct 8 11:22:27 2025 -0700 Merge tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio Pull more VFIO updates from Alex Williamson: - Optimizations for DMA map and unmap opertions through the type1 vfio IOMMU backend. This uses various means of batching and hints from the mm structures to improve efficiency and therefore performance, resulting in a significant speedup for huge page use cases (Li Zhe) - Expose supported device migration features through debugfs (Cédric Le Goater) * tag 'vfio-v6.18-rc1-pt2' of https://github.com/awilliam/linux-vfio: vfio: Dump migration features under debugfs vfio/type1: optimize vfio_unpin_pages_remote() vfio/type1: introduce a new member has_rsvd for struct vfio_dma vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() vfio/type1: optimize vfio_pin_pages_remote() mm: introduce num_pages_contiguous() commit 99cedb6b8f4101e2780f10b9e76d2f346a1e4316 Merge: 7c8dcac8d72da9 8b87f67b4c8745 Author: Linus Torvalds Date: Wed Oct 8 09:44:38 2025 -0700 Merge tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - Conversions to yaml/json schema and fixes for input-related device tree bindings - New drivers: - Awinic AW86927 haptic chip - Hynitron CST816x series controller - Himax HX852x(ES) touchscreen controller - Fix uinput to not leak kernel memory via a gap in uinput_ff_upload_compat structure - Prevent overflow in pressure calculation in tsc2007 driver causing phantom touches - Make the Atmel maxTouch driver support generic touchscreen configuration (flip, rotate, etc) - Drop support for platform data in tca8418_keypad, pxa27x-keypad, spear-keyboard and twl4030_keypad drivers, they all now rely on generic device properties for configuration - Other assorted changes and fixes * tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits) Input: atmel_mxt_ts - allow reset GPIO to sleep Input: aw86927 - fix error code in probe() Input: psxpad-spi - add a check for the return value of spi_setup() Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Input: aw86927 - add driver for Awinic AW86927 dt-bindings: input: Add Awinic AW86927 dt-bindings: touchscreen: remove touchscreen.txt dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node dt-bindings: touchscreen: convert eeti bindings to json schema Input: pm8941-pwrkey - disable wakeup for resin by default dt-bindings: input: pm8941-pwrkey: Document wakeup-source property Input: add driver for Hynitron CST816x series dt-bindings: input: touchscreen: add hynitron cst816x series Input: imx6ul_tsc - set glitch threshold by DTS property dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold dt-bindings: touchscreen: add debounce-delay-us property Input: ps2-gpio - fix typo Input: atmel_mxt_ts - add support for generic touchscreen configurations dt-bindings: input: maxtouch: add common touchscreen properties dt-bindings: touchscreen: convert zet6223 bindings to json schema ... commit 7c8dcac8d72da94328f4de7bf98320b75710da1f Merge: 0d97f2067c166e c0d36727bf39bb Author: Linus Torvalds Date: Wed Oct 8 09:38:31 2025 -0700 Merge tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix zstd regression - Ensure ti driver algorithm are set as async - Revert patch disabling SHA1 in FIPS mode - Fix RNG set_ent null-pointer dereference * tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: rng - Ensure set_ent is always present Revert "crypto: testmgr - desupport SHA-1 for FIPS 140" crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos crypto: zstd - Fix compression bug caused by truncation commit c834a97962c708ff5bb8582ca76b0e1225feb675 Author: Steven Rostedt Date: Wed Oct 8 11:49:43 2025 -0400 tracing: Fix irqoff tracers on failure of acquiring calltime The functions irqsoff_graph_entry() and irqsoff_graph_return() both call func_prolog_dec() that will test if the data->disable is already set and if not, increment it and return. If it was set, it returns false and the caller exits. The caller of this function must decrement the disable counter, but misses doing so if the calltime fails to be acquired. Instead of exiting out when calltime is NULL, change the logic to do the work if it is not NULL and still do the clean up at the end of the function if it is NULL. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008114943.6f60f30f@gandalf.local.home Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph") Reported-by: Sasha Levin Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-2-sashal@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit 4f7bf54b07e5acf79edd58dafede4096854776cd Author: Steven Rostedt Date: Wed Oct 8 11:48:35 2025 -0400 tracing: Fix wakeup tracers on failure of acquiring calltime The functions wakeup_graph_entry() and wakeup_graph_return() both call func_prolog_preempt_disable() that will test if the data->disable is already set and if not, increment it and disable preemption. If it was set, it returns false and the caller exits. The caller of this function must decrement the disable counter, but misses doing so if the calltime fails to be acquired. Instead of exiting out when calltime is NULL, change the logic to do the work if it is not NULL and still do the clean up at the end of the function if it is NULL. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251008114835.027b878a@gandalf.local.home Fixes: a485ea9e3ef3 ("tracing: Fix irqsoff and wakeup latency tracers when using function graph") Reported-by: Sasha Levin Closes: https://lore.kernel.org/linux-trace-kernel/20251006175848.1906912-1-sashal@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit f0c029d2ff42499a62c873c14428f02bf94c28af Author: Thorsten Blum Date: Wed Oct 1 15:09:07 2025 +0200 tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user_nul Replace kmalloc() followed by copy_from_user() with memdup_user_nul() to simplify and improve osnoise_cpus_write(). Remove the manual NUL-termination. No functional changes intended. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20251001130907.364673-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Signed-off-by: Steven Rostedt (Google) commit e9a9dcb4ccb32446165800a9d83058e95c4833d2 Author: Pavel Begunkov Date: Wed Oct 8 13:39:01 2025 +0100 io_uring/zcrx: increment fallback loop src offset Don't forget to adjust the source offset in io_copy_page(), otherwise it'll be copying into the same location in some cases for highmem setups. Fixes: e67645bb7f3f4 ("io_uring/zcrx: prepare fallback for larger pages") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 Author: Pavel Begunkov Date: Wed Oct 8 13:38:06 2025 +0100 io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow. Reported-and-tested-by: Matthias Jasny Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests") Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 455281c0ef4e2cabdfe2e8b83fa6010d5210811c Author: Pedro Demarchi Gomes Date: Tue Oct 7 15:12:05 2025 -0300 loop: remove redundant __GFP_NOWARN flag GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Pedro Demarchi Gomes Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit deabb34b66b96c941ac0b3d01a6a6804c3274a78 Author: Thomas Huth Date: Thu Oct 2 17:54:23 2025 +0200 s390/uv: Fix comment of uv_find_secret() function The uv_get_secret_metadata() function has been removed some months ago, so we should not mention it in the comment anymore. Fixes: a42831f0b74dc ("s390/uv: Remove uv_get_secret_metadata function") Signed-off-by: Thomas Huth Acked-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit ca7a2317993efa26eb2100a1523548f1b3a07af0 Merge: f4ace70faa8ff2 a27539810e1e61 Author: Takashi Iwai Date: Wed Oct 8 13:52:14 2025 +0200 Merge tag 'asoc-fix-v6.18-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A small pile of fixes, almost all for the Intel and SOF code surrounding management of the host buffer. We've also got one fix for Meson and new device IDs and quirk supporting the RT722VB. commit e84945bdc619ed4243ba4298dbb8ca2062026474 Author: Florian Westphal Date: Thu Oct 2 15:05:41 2025 +0200 selftests: netfilter: query conntrack state to check for port clash resolution Jakub reported this self test flaking occasionally (fails, but passes on re-run) on debug kernels. This is because the test checks for elapsed time to determine if both connections were established in parallel. Rework this to no longer depend on timing. Use busywait helper to check that both sockets have moved to established state and then query the conntrack engine for the two entries. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/ Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux") Signed-off-by: Florian Westphal commit a126ab6b26f107f4eb100c8c77e9f10b706f26e6 Author: Florian Westphal Date: Thu Oct 2 15:00:06 2025 +0200 selftests: netfilter: nft_fib.sh: fix spurious test failures Jakub reports spurious failure of nft_fib.sh test. This is caused by a subtle bug inherited when i moved faulty ping from one test case to another. nft_fib.sh not only checks that the fib expression matched, it also records the number of matches and then validates we have the expected count. When I did this it was under the assumption that we would have 0 to n matching packets. In case of the failure, the entry has n+1 matching packets. This happens because ping_unreachable helper uses "ping -c 1 -w 1", instead of the intended "-W". -w alters the meaning of -c (count), namely, its then treated as number of wanted *replies* instead of "number of packets to send". So, in some cases, ping -c 1 -w 1 ends up sending two packets which then makes the test fail due to the higher-than-expected packet count. Fix the actual bug (s/-w/-W) and also change the error handling: 1. Show the number of expected packets in the error message 2. Always try to delete the key from the set. Else, later test that makes sure we don't have unexpected keys in there will always fail as well. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netfilter-devel/20250927090709.0b3cd783@kernel.org/ Fixes: 98287045c979 ("selftests: netfilter: move fib vrf test to nft_fib.sh") Signed-off-by: Florian Westphal commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 Author: Eric Woudstra Date: Tue Oct 7 10:15:01 2025 +0200 bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 7 locks held by socat/410: #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0 #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830 [..] #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440 Call Trace: lockdep_rcu_suspicious.cold+0x4f/0xb1 br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge] br_fill_forward_path+0x7a/0x4d0 [bridge] Use to correct helper, non _rcu variant requires RTNL mutex. Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices") Signed-off-by: Eric Woudstra Signed-off-by: Florian Westphal commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 Author: Fernando Fernandez Mancera Date: Wed Oct 8 12:08:16 2025 +0200 netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error: synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") Reported-by: Georg Pfuetzenreuter Closes: https://bugzilla.suse.com/1250237 Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit ca965a70ea57cd12f19a422a28a97aab5e1d031b Merge: a12f0bc764da37 a9e30a22d6f23a Author: Marc Kleine-Budde Date: Wed Oct 8 10:19:46 2025 +0200 Merge patch series "can: m_can: fix pm_runtime and CAN state handling" Marc Kleine-Budde says: The first patch fixes a pm_runtime imbalance in the m_can_platform driver. The rest of this series fixes the CAN state handling in the m_can driver: - add the missing state transition from "Error Warning" back to "Error Active" (patch 2) - address the fact that in some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the CAN state and CAN error counters over an internal reset cycle. Set the correct CAN state during ifup and system resume (patches 3+4) Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-0-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a9e30a22d6f23a2684c248871cad4c3061181639 Author: Marc Kleine-Budde Date: Tue Aug 12 16:58:31 2025 +0200 can: m_can: fix CAN state in system PM A suspend/resume cycle on a down interface results in the interface coming up in Error Active state. A suspend/resume cycle on an Up interface will always result in Error Active state, regardless of the actual CAN state. During suspend, only set running interfaces to CAN_STATE_SLEEPING. During resume only touch the CAN state of running interfaces. For wakeup sources, set the CAN state depending on the Protocol Status Regitser (PSR), for non wakeup source interfaces m_can_start() will do the same. Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-4-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 4942c42fe1849e6d68dfb5b36ccba344a9fac016 Author: Marc Kleine-Budde Date: Wed Aug 6 18:24:12 2025 +0200 can: m_can: m_can_chip_config(): bring up interface in correct state In some SoCs (observed on the STM32MP15) the M_CAN IP core keeps the CAN state and CAN error counters over an internal reset cycle. An external reset is not always possible, due to the shared reset with the other CAN core. This caused the core not always be in Error Active state when bringing up the controller. Instead of always setting the CAN state to Error Active in m_can_chip_config(), fix this by reading and decoding the Protocol Status Regitser (PSR) and set the CAN state accordingly. Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-3-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3d9db29b45f970d81acf61cf91a65442efbeb997 Author: Marc Kleine-Budde Date: Wed Aug 6 16:56:15 2025 +0200 can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active The CAN Error State is determined by the receive and transmit error counters. The CAN error counters decrease when reception/transmission is successful, so that a status transition back to the Error Active status is possible. This transition is not handled by m_can_handle_state_errors(). Add the missing detection of the Error Active state to m_can_handle_state_errors() and extend the handling of this state in m_can_handle_state_change(). Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") Fixes: cd0d83eab2e0 ("can: m_can: m_can_handle_state_change(): fix state change") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-2-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit ba569fb07a7e9e9b71e9282e27e993ba859295c2 Author: Marc Kleine-Budde Date: Wed Aug 6 17:46:32 2025 +0200 can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() Commit 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") moved the PM runtime enable from the m_can core driver into the m_can_platform. That patch forgot to move the pm_runtime_disable() to m_can_plat_remove(), so that unloading the m_can_platform driver causes an "Unbalanced pm_runtime_enable!" error message. Add the missing pm_runtime_disable() to m_can_plat_remove() to fix the problem. Cc: Patrik Flykt Fixes: 227619c3ff7c ("can: m_can: move runtime PM enable/disable to m_can_platform") Reviewed-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20250929-m_can-fix-state-handling-v4-1-682b49b49d9a@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a12f0bc764da3781da2019c60826f47a6d7ed64f Author: Celeste Liu Date: Tue Sep 30 14:53:39 2025 +0800 can: gs_usb: gs_make_candev(): populate net_device->dev_port The gs_usb driver supports USB devices with more than 1 CAN channel. In old kernel before 3.15, it uses net_device->dev_id to distinguish different channel in userspace, which was done in commit acff76fa45b4 ("can: gs_usb: gs_make_candev(): set netdev->dev_id"). But since 3.15, the correct way is populating net_device->dev_port. And according to documentation, if network device support multiple interface, lack of net_device->dev_port SHALL be treated as a bug. Fixes: acff76fa45b4 ("can: gs_usb: gs_make_candev(): set netdev->dev_id") Cc: stable@vger.kernel.org Signed-off-by: Celeste Liu Link: https://patch.msgid.link/20250930-gs-usb-populate-net_device-dev_port-v1-1-68a065de6937@coelacanthus.name Signed-off-by: Marc Kleine-Budde commit 2a27f6a8fb5722223d526843040f747e9b0e8060 Author: Celeste Liu Date: Tue Sep 30 19:34:28 2025 +0800 can: gs_usb: increase max interface to U8_MAX This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD converter[1]. The original developers may have only 3 interfaces device to test so they write 3 here and wait for future change. During the HSCanT development, we actually used 4 interfaces, so the limitation of 3 is not enough now. But just increase one is not future-proofed. Since the channel index type in gs_host_frame is u8, just make canch[] become a flexible array with a u8 index, so it naturally constraint by U8_MAX and avoid statically allocate 256 pointer for every gs_usb device. [1]: https://github.com/cherry-embedded/HSCanT-hardware Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Reported-by: Runcheng Lu Cc: stable@vger.kernel.org Reviewed-by: Vincent Mailhol Signed-off-by: Celeste Liu Link: https://patch.msgid.link/20250930-gs-usb-max-if-v5-1-863330bf6666@coelacanthus.name Signed-off-by: Marc Kleine-Budde commit 229c586b5e86979badb7cb0d38717b88a9e95ddd Author: T Pratham Date: Tue Oct 7 19:27:51 2025 +0530 crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for ahash and acomp from the commit description as subsequent commits add necessary changes in these alg frameworks. However, this is being recommended for use in all crypto algs [1] instead of setting reqsize using crypto_*_set_reqsize(). Using cra_reqsize in skcipher algorithms, hence, causes memory corruptions and crashes as the underlying functions in the algorithm framework have not been updated to set the reqsize properly from cra_reqsize. [2] Add proper set_reqsize calls in the skcipher init function to properly initialize reqsize for these algorithms in the framework. [1]: https://lore.kernel.org/linux-crypto/aCL8BxpHr5OpT04k@gondor.apana.org.au/ [2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b Fixes: afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)") Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit 8b87f67b4c87452e21721887fa8dec1f4c6b2b7c Merge: 30989f67650cbf c7866ee0a9ddd9 Author: Dmitry Torokhov Date: Tue Oct 7 21:53:13 2025 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.18 merge window. commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 Author: Marek Vasut Date: Sun Oct 5 04:33:10 2025 +0200 Input: atmel_mxt_ts - allow reset GPIO to sleep The reset GPIO is not toggled in any critical section where it couldn't sleep, allow the reset GPIO to sleep. This allows the driver to operate reset GPIOs connected to I2C GPIO expanders. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20251005023335.166483-1-marek.vasut@mailbox.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 2c95a756e0cfc19af6d0b32b0c6cf3bada334998 Author: Thomas Wismer Date: Mon Oct 6 22:40:29 2025 +0200 net: pse-pd: tps23881: Fix current measurement scaling The TPS23881 improves on the TPS23880 with current sense resistors reduced from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the current measurement. However, the latest TPS23881 data sheet from May 2023 still shows the scaling of the TPS23880 model. Fixes: 7f076ce3f1733 ("net: pse-pd: tps23881: Add support for power limit and measurement features") Signed-off-by: Thomas Wismer Acked-by: Kory Maincent Link: https://patch.msgid.link/20251006204029.7169-2-thomas@wismer.xyz Signed-off-by: Jakub Kicinski commit e475fa420e6c53a5023e89dbf0d51bd027b5a776 Author: Arnd Bergmann Date: Mon Oct 6 13:56:34 2025 +0200 net/mlx5: fix pre-2.40 binutils assembler error Old binutils versions require a slightly stricter syntax for the .arch_extension directive and fail with the extra semicolon: /tmp/cclfMnj9.s:656: Error: unknown architectural extension `simd;' Drop the semicolon to make it work with all supported toolchain version. Link: https://lore.kernel.org/all/20251001163655.GA370262@ax162/ Reported-by: Paolo Abeni Reported-by: Naresh Kamboju Suggested-by: Nathan Chancellor Fixes: fd8c8216648c ("net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs") Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Reviewed-by: Patrisious Haddad Link: https://patch.msgid.link/20251006115640.497169-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 0d97f2067c166eb495771fede9f7b73999c67f66 Merge: a8cdf51cda30f7 9aa791c8d7bfc4 Author: Linus Torvalds Date: Tue Oct 7 16:20:19 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM development updates from Russell King: - Use string choices helpers - Add support for HAVE_FUNCTION_GRAPH_FREGS * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9457/1: ftrace: Implement HAVE_FUNCTION_GRAPH_FREGS ARM: 9456/1: mm: fault: use string choices helper ARM: 9454/1: kernel: bios32: use string choices helper ARM: 9451/1: mm: l2x0: use string choices helper commit f52ce0ea90c83a28904c7cc203a70e6434adfecb Author: Yang Shi Date: Mon Sep 29 13:24:02 2025 -0700 mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace:   mte_clear_page_tags+0x14/0x24   set_huge_pte_at+0x25c/0x280   hugetlb_change_protection+0x220/0x430   change_protection+0x5c/0x8c   mprotect_fixup+0x10c/0x294   do_mprotect_pkey.constprop.0+0x2e0/0x3d4   __arm64_sys_mprotect+0x24/0x44   invoke_syscall+0x50/0x160   el0_svc_common+0x48/0x144   do_el0_svc+0x30/0xe0   el0_svc+0x30/0xf0   el0t_64_sync_handler+0xc4/0x148   el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup. Link: https://lkml.kernel.org/r/20250929202402.1663290-1-yang@os.amperecomputing.com Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages") Signed-off-by: Yang Shi Tested-by: Carl Worth Reviewed-by: Christoph Lameter (Ampere) Reviewed-by: Catalin Marinas Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Anshuman Khandual Reviewed-by: Dev Jain Cc: Muchun Song Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 28bba2c2935e219d6cb6946e16b9a0b7c47913be Author: Ryan Roberts Date: Fri Oct 3 16:52:36 2025 +0100 fsnotify: pass correct offset to fsnotify_mmap_perm() fsnotify_mmap_perm() requires a byte offset for the file about to be mmap'ed. But it is called from vm_mmap_pgoff(), which has a page offset. Previously the conversion was done incorrectly so let's fix it, being careful not to overflow on 32-bit platforms. Discovered during code review. Link: https://lkml.kernel.org/r/20251003155238.2147410-1-ryan.roberts@arm.com Fixes: 066e053fe208 ("fsnotify: add pre-content hooks on mmap()") Signed-off-by: Ryan Roberts Reviewed-by: Kiryl Shutsemau Cc: Amir Goldstein Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Author: Jakub Acs Date: Wed Oct 1 09:03:52 2025 +0000 mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 [ 44.617726] Call Trace: [ 44.617926] [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro. Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel] Link: https://lore.kernel.org/oe-kbuild-all/202510030449.VfSaAjvd-lkp@intel.com/ Link: https://lkml.kernel.org/r/20251001090353.57523-2-acsjakub@amazon.de Fixes: 7677f7fd8be7 ("userfaultfd: add minor fault registration mode") Signed-off-by: Jakub Acs Signed-off-by: Miguel Ojeda Acked-by: David Hildenbrand Acked-by: SeongJae Park Tested-by: Alice Ryhl Tested-by: Miguel Ojeda Cc: Xu Xin Cc: Chengming Zhou Cc: Peter Xu Cc: Axel Rasmussen Cc: Signed-off-by: Andrew Morton commit b93af2cc8e036754c0d9970d9ddc47f43cc94b9f Author: SeongJae Park Date: Mon Sep 29 17:44:09 2025 -0700 mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address space operation set implementation (vaddr) calls pte_offset_map_lock() inside the page table walk callback function. This is for reading and writing page table accessed bits. If pte_offset_map_lock() fails, it retries by returning the page table walk callback function with ACTION_AGAIN. pte_offset_map_lock() can continuously fail if the target is a pmd migration entry, though. Hence it could cause an infinite page table walk if the migration cannot be done until the page table walk is finished. This indeed caused a soft lockup when CPU hotplugging and DAMON were running in parallel. Avoid the infinite loop by simply not retrying the page table walk. DAMON is promising only a best-effort accuracy, so missing access to such pages is no problem. Link: https://lkml.kernel.org/r/20250930004410.55228-1-sj@kernel.org Fixes: 7780d04046a2 ("mm/pagewalkers: ACTION_AGAIN if pte_offset_map_lock() fails") Signed-off-by: SeongJae Park Reported-by: Xinyu Zheng Closes: https://lore.kernel.org/20250918030029.2652607-1-zhengxinyu6@huawei.com Acked-by: Hugh Dickins Cc: [6.5+] Signed-off-by: Andrew Morton commit 9658d698a8a83540bf6a6c80d13c9a61590ee985 Author: Lance Yang Date: Tue Sep 30 16:10:40 2025 +0800 mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage When splitting an mTHP and replacing a zero-filled subpage with the shared zeropage, try_to_map_unused_to_zeropage() currently drops several important PTE bits. For userspace tools like CRIU, which rely on the soft-dirty mechanism for incremental snapshots, losing the soft-dirty bit means modified pages are missed, leading to inconsistent memory state after restore. As pointed out by David, the more critical uffd-wp bit is also dropped. This breaks the userfaultfd write-protection mechanism, causing writes to be silently missed by monitoring applications, which can lead to data corruption. Preserve both the soft-dirty and uffd-wp bits from the old PTE when creating the new zeropage mapping to ensure they are correctly tracked. Link: https://lkml.kernel.org/r/20250930081040.80926-1-lance.yang@linux.dev Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Lance Yang Suggested-by: David Hildenbrand Suggested-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Dev Jain Acked-by: Zi Yan Reviewed-by: Liam R. Howlett Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Mathew Brost Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Usama Arif Cc: Vlastimil Babka Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 1ce6473d17e78e3cb9a40147658231731a551828 Author: Lance Yang Date: Mon Sep 22 10:14:58 2025 +0800 mm/thp: fix MTE tag mismatch when replacing zero-filled subpages When both THP and MTE are enabled, splitting a THP and replacing its zero-filled subpages with the shared zeropage can cause MTE tag mismatch faults in userspace. Remapping zero-filled subpages to the shared zeropage is unsafe, as the zeropage has a fixed tag of zero, which may not match the tag expected by the userspace pointer. KSM already avoids this problem by using memcmp_pages(), which on arm64 intentionally reports MTE-tagged pages as non-identical to prevent unsafe merging. As suggested by David[1], this patch adopts the same pattern, replacing the memchr_inv() byte-level check with a call to pages_identical(). This leverages existing architecture-specific logic to determine if a page is truly identical to the shared zeropage. Having both the THP shrinker and KSM rely on pages_identical() makes the design more future-proof, IMO. Instead of handling quirks in generic code, we just let the architecture decide what makes two pages identical. [1] https://lore.kernel.org/all/ca2106a3-4bb2-4457-81af-301fd99fbef4@redhat.com Link: https://lkml.kernel.org/r/20250922021458.68123-1-lance.yang@linux.dev Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp") Signed-off-by: Lance Yang Reported-by: Qun-wei Lin Closes: https://lore.kernel.org/all/a7944523fcc3634607691c35311a5d59d1a3f8d4.camel@mediatek.com Suggested-by: David Hildenbrand Acked-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Usama Arif Reviewed-by: Catalin Marinas Reviewed-by: Wei Yang Cc: Alistair Popple Cc: andrew.yang Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: Charlie Jenkins Cc: Chinwen Chang Cc: Dev Jain Cc: Domenico Cerasuolo Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Johannes Weiner Cc: Joshua Hahn Cc: Kairui Song Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Rakie Kim Cc: Rik van Riel Cc: Roman Gushchin Cc: Ryan Roberts Cc: Samuel Holland Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit fcc0669c5aa681994c507b50f1c706c969d99730 Author: Shakeel Butt Date: Mon Sep 22 15:02:03 2025 -0700 memcg: skip cgroup_file_notify if spinning is not allowed Generally memcg charging is allowed from all the contexts including NMI where even spinning on spinlock can cause locking issues. However one call chain was missed during the addition of memcg charging from any context support. That is try_charge_memcg() -> memcg_memory_event() -> cgroup_file_notify(). The possible function call tree under cgroup_file_notify() can acquire many different spin locks in spinning mode. Some of them are cgroup_file_kn_lock, kernfs_notify_lock, pool_workqeue's lock. So, let's just skip cgroup_file_notify() from memcg charging if the context does not allow spinning. Alternative approach was also explored where instead of skipping cgroup_file_notify(), we defer the memcg event processing to irq_work [1]. However it adds complexity and it was decided to keep things simple until we need more memcg events with !allow_spinning requirement. Link: https://lore.kernel.org/all/5qi2llyzf7gklncflo6gxoozljbm4h3tpnuv4u4ej4ztysvi6f@x44v7nz2wdzd/ [1] Link: https://lkml.kernel.org/r/20250922220203.261714-1-shakeel.butt@linux.dev Fixes: 3ac4638a734a ("memcg: make memcg_rstat_updated nmi safe") Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Closes: https://lore.kernel.org/all/20250905061919.439648-1-yepeilin@google.com/ Cc: Alexei Starovoitov Cc: Johannes Weiner Cc: Kumar Kartikeya Dwivedi Cc: Muchun Song Cc: Peilin Ye Cc: Roman Gushchin Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton commit 90eb9ae35727a662789c850efaf225ffe5511fae Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:58 2025 +0300 lib/test_kho: use kho_preserve_vmalloc instead of storing addresses in fdt KHO test stores physical addresses of the preserved folios directly in fdt. Use kho_preserve_vmalloc() instead of it and kho_restore_vmalloc() to retrieve the addresses after kexec. This makes the test more scalable from one side and adds tests coverage for kho_preserve_vmalloc() from the other. Link: https://lkml.kernel.org/r/20250921054458.4043761-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit a667300bd53f272a3055238bcefe108f88836270 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:57 2025 +0300 kho: add support for preserving vmalloc allocations A vmalloc allocation is preserved using binary structure similar to global KHO memory tracker. It's a linked list of pages where each page is an array of physical address of pages in vmalloc area. kho_preserve_vmalloc() hands out the physical address of the head page to the caller. This address is used as the argument to kho_vmalloc_restore() to restore the mapping in the vmalloc address space and populate it with the preserved pages. [pasha.tatashin@soleen.com: free chunks using free_page() not kfree()] Link: https://lkml.kernel.org/r/mafs0a52idbeg.fsf@kernel.org [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20250921054458.4043761-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Signed-off-by: Andrew Morton commit 8375b76517cb52bac0903071feedc218c45d74d2 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:56 2025 +0300 kho: replace kho_preserve_phys() with kho_preserve_pages() to make it clear that KHO operates on pages rather than on a random physical address. The kho_preserve_pages() will be also used in upcoming support for vmalloc preservation. Link: https://lkml.kernel.org/r/20250921054458.4043761-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Reviewed-by: Jason Gunthorpe Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 469661d0d3a55a7ba1e7cb847c26baf78cace086 Author: Mike Rapoport (Microsoft) Date: Sun Sep 21 08:44:55 2025 +0300 kho: check if kho is finalized in __kho_preserve_order() Patch series "kho: add support for preserving vmalloc allocations", v5. Following the discussion about preservation of memfd with LUO [1] these patches add support for preserving vmalloc allocations. Any KHO uses case presumes that there's a data structure that lists physical addresses of preserved folios (and potentially some additional metadata). Allowing vmalloc preservations with KHO allows scalable preservation of such data structures. For instance, instead of allocating array describing preserved folios in the fdt, memfd preservation can use vmalloc: preserved_folios = vmalloc_array(nr_folios, sizeof(*preserved_folios)); memfd_luo_preserve_folios(preserved_folios, folios, nr_folios); kho_preserve_vmalloc(preserved_folios, &folios_info); This patch (of 4): Instead of checking if kho is finalized in each caller of __kho_preserve_order(), do it in the core function itself. Link: https://lkml.kernel.org/r/20250921054458.4043761-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20250921054458.4043761-2-rppt@kernel.org Link: https://lore.kernel.org/all/20250807014442.3829950-30-pasha.tatashin@soleen.com [1] Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit fa02d505a3ef7c5c55b7b2aee1df2bdc178ce1ad Author: Umang Jain Date: Mon Sep 29 13:10:24 2025 +0530 MAINTAINERS, .mailmap: update Umang's email address Map my new professional email address in .mailmap and also update the IMX283 driver entry with the same. At the same time, update my role to a reviewer for the IMX283 driver. Link: https://lkml.kernel.org/r/20250929074025.84407-1-uajain@igalia.com Signed-off-by: Umang Jain Signed-off-by: Andrew Morton commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 Author: Shuhao Fu Date: Wed Oct 8 00:17:09 2025 +0800 drm/nouveau: fix bad ret code in nouveau_bo_move_prep In `nouveau_bo_move_prep`, if `nouveau_mem_map` fails, an error code should be returned. Currently, it returns zero even if vmm addr is not correctly mapped. Cc: stable@vger.kernel.org Reviewed-by: Petr Vorel Signed-off-by: Shuhao Fu Fixes: 9ce523cc3bf2 ("drm/nouveau: separate buffer object backing memory from nvkm structures") Signed-off-by: Danilo Krummrich commit a8cdf51cda30f7461a98af821e8a28c5cb5f8878 Merge: 16d1ba7c9675ee b157dd228cf0ee Author: Linus Torvalds Date: Tue Oct 7 13:04:44 2025 -0700 Merge tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - tools headers: rename missed CONFIG_CFI_CLANG in merge (Carlos Llamas) - kconfig: Avoid prompting for transitional symbols * tag 'hardening-fix1-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: tools headers: kcfi: rename missed CONFIG_CFI_CLANG kconfig: Avoid prompting for transitional symbols commit 16d1ba7c9675ee16e0f7fb22d51cd2898aab625d Merge: fdb8d00af919d2 16abbabc004bed Author: Linus Torvalds Date: Tue Oct 7 12:48:06 2025 -0700 Merge tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two small fixes for the recently performed code refactoring (Shigeru Yoshida) and missing handling of direction parameter in DMA debug code (Petr Tesarik)" * tag 'dma-mapping-6.18-2025-10-07' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: fix direction in dma_alloc direction traces kmsan: fix kmsan_handle_dma() to avoid false positives commit 4468490251c0392e0c87a3f1c1c1585a89f6ffa6 Author: Markus Elfring Date: Tue Oct 7 18:25:27 2025 +0200 smb: client: Return directly after a failed genlmsg_new() in cifs_swn_send_register_message() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Return directly after a call of the function “genlmsg_new” failed at the beginning. * Delete the label “fail” which became unnecessary with this refactoring. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit fdb8d00af919d2403a9e40261cf3f78f0fd75212 Merge: fbd2e22716d30d 10df039834f84a Author: Linus Torvalds Date: Tue Oct 7 12:13:26 2025 -0700 Merge tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small nvmem and fastrpc fixes that missed the cut-off to get into 6.17-final, due to me being slow in getting them out, my fault, not the maintainers of these subsystems :( Anyway, better late than never. Changes included in here are: - nvmem fix for automatic module loading - fastrpc driver fixes for reported issues All of these have been in linux-next for weeks (4?) with no reported issues" * tag 'char-misc-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc: fastrpc: Skip reference for DMA handles misc: fastrpc: fix possible map leak in fastrpc_put_args misc: fastrpc: Fix fastrpc_map_lookup operation misc: fastrpc: Save actual DMA size in fastrpc_map structure nvmem: layouts: fix automatic module loading commit fbd2e22716d30d77a35affd6493f4bd74fe2e961 Merge: 3d15d6c1b3dd9e 82a051e2553b9e Author: Linus Torvalds Date: Tue Oct 7 11:41:06 2025 -0700 Merge tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some staging driver fixes that missed 6.17-final due to my travel schedule. They fix a number of reported issues in the axis-fifo driver, one of which was just independently discovered by someone else today so someone is looking at this code. All of these fixes have been in linux-next for many weeks with no reported issues" * tag 'staging-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: axis-fifo: flush RX FIFO on read errors staging: axis-fifo: fix TX handling on copy_from_user() failure staging: axis-fifo: fix maximum TX packet length check commit 3d15d6c1b3dd9eda173d474db82daf093afa4562 Merge: 56019d4ff8dd5e a699213d4e6ef4 Author: Linus Torvalds Date: Tue Oct 7 11:36:01 2025 -0700 Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty driver fix from Greg KH: "Here is a single driver fix for the qcom_geni_serial driver. It has been in my tree for weeks, but missed being sent to you for 6.17-final due to travel on my side. This fixes a reported regression for this driver that prevents 6.17 from working properly on this platform. It has been in linux-next for many weeks with no reported issues" * tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: qcom-geni: Fix blocked task commit ce47f7498598f4cf8729a6b93722c98814385e78 Author: Markus Elfring Date: Sun Oct 5 20:36:33 2025 +0200 smb: client: Use common code in cifs_do_create() Use a label once more so that a bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Acked-by: Enzo Matsumiya Reviewed-by: David Howells Signed-off-by: Steve French commit 56019d4ff8dd5ef16915c2605988c4022a46019c Merge: 89b59f0979926f dea00c204e7e99 Author: Linus Torvalds Date: Tue Oct 7 11:18:54 2025 -0700 Merge tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "Fix RZ/G3E driver introduction fall-out (Geert Uytterhoeven) and improve the compilation and installation of the thermal library for user space (Emil Dahl Juhl and Sascha Hauer)" * tag 'thermal-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: tools: lib: thermal: expose thermal_exit symbols tools: lib: thermal: don't preserve owner in install tools: lib: thermal: use pkg-config to locate libnl3 thermal: renesas: Fix RZ/G3E fall-out commit d07e142641417e67f3bfc9d8ba3da8a69c39cfcd Author: Jesse Agate Date: Fri Jun 13 14:20:53 2025 -0400 drm/amd/display: Incorrect Mirror Cositing [WHY] hinit/vinit are incorrect in the case of mirroring. [HOW] Cositing sign must be flipped when image is mirrored in the vertical or horizontal direction. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Samson Tam Signed-off-by: Jesse Agate Signed-off-by: Brendan Leder Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 5949e7c4890c3cf65e783c83c355b95e21f10dba Author: Fangzhi Zuo Date: Wed Sep 24 14:37:01 2025 -0400 drm/amd/display: Enable Dynamic DTBCLK Switch [WHAT] Since dcn35, DTBCLK can be disabled when no DP2 sink connected for power saving purpose. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 2e97663760e5fb7ee14f399c68e57b894f01e505 Author: Lijo Lazar Date: Mon Oct 6 10:39:03 2025 +0530 drm/amdgpu: Report individual reset error If reinitialization of one of the GPUs fails after reset, it logs failure on all subsequent GPUs eventhough they have resumed successfully. A sample log where only device at 0000:95:00.0 had a failure - amdgpu 0000:15:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:65:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:75:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:85:00.0: amdgpu: GPU reset(19) succeeded! amdgpu 0000:95:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:e5:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:f5:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:05:00.0: amdgpu: GPU reset(19) failed amdgpu 0000:15:00.0: amdgpu: GPU reset end with ret = -5 To avoid confusion, report the error for each device separately and return the first error as the overall result. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a107aeb6a2150dd552673caefc771e2222d584de Author: Christian König Date: Mon Oct 6 12:45:25 2025 +0200 drm/amdgpu: partially revert "revert to old status lock handling v3" The CI systems are pointing out list corruptions, so we still need to fix something here. Keep the asserts, but revert the lock changes for now. Fixes: 59e4405e9ee2 ("drm/amdgpu: revert to old status lock handling v3") Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ddbfac152830e38d488ff8e45ab7eaf5d72f8527 Author: Ard Biesheuvel Date: Thu Oct 2 23:00:45 2025 +0200 drm/amd/display: Fix unsafe uses of kernel mode FPU The point of isolating code that uses kernel mode FPU in separate compilation units is to ensure that even implicit uses of, e.g., SIMD registers for spilling occur only in a context where this is permitted, i.e., from inside a kernel_fpu_begin/end block. This is important on arm64, which uses -mgeneral-regs-only to build all kernel code, with the exception of such compilation units where FP or SIMD registers are expected to be used. Given that the compiler may invent uses of FP/SIMD anywhere in such a unit, none of its code may be accessible from outside a kernel_fpu_begin/end block. This means that all callers into such compilation units must use the DC_FP start/end macros, which must not occur there themselves. For robustness, all functions with external linkage that reside there should call dc_assert_fp_enabled() to assert that the FPU context was set up correctly. Fix this for the DCN35, DCN351 and DCN36 implementations. Cc: Austin Zheng Cc: Jun Lei Cc: Harry Wentland Cc: Leo Li Cc: Rodrigo Siqueira Cc: Alex Deucher Cc: "Christian König" Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Ard Biesheuvel Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher commit bd8acfcfce7d711372c2c45f4c5e24ea650c26bf Author: Jesse.Zhang Date: Sat Oct 4 22:39:24 2025 +0800 drm/amd/pm: Disable VCN queue reset on SMU v13.0.6 due to regression Disable VCN reset capability for the program 4 as it's causing regressions. Fixes: 9d20f37a106f ("drm/amd/pm: Add VCN reset support for SMU v13.0.6") Reviewed-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8d557eab3a396c5c0068d7b4ad920f2bf261e484 Author: Jesse.Zhang Date: Mon Sep 29 16:44:28 2025 +0800 drm/amdgpu: Fix general protection fault in amdgpu_vm_bo_reset_state_machine After GPU reset with VRAM loss, a general protection fault occurs during user queue restoration when accessing vm_bo->vm after spinlock release in amdgpu_vm_bo_reset_state_machine. The root cause is that vm_bo points to the last entry from the list_for_each_entry loop, but this becomes invalid after the spinlock is released. Accessing vm_bo->vm at this point leads to memory corruption. Crash log shows: [ 326.981811] Oops: general protection fault, probably for non-canonical address 0x4156415741e58ac8: 0000 [#1] SMP NOPTI [ 326.981820] CPU: 13 UID: 0 PID: 1035 Comm: kworker/13:3 Tainted: G E 6.16.0+ #25 PREEMPT(voluntary) [ 326.981826] Tainted: [E]=UNSIGNED_MODULE [ 326.981827] Hardware name: Gigabyte Technology Co., Ltd. X870E AORUS PRO ICE/X870E AORUS PRO ICE, BIOS F3i 12/19/2024 [ 326.981831] Workqueue: events amdgpu_userq_restore_worker [amdgpu] [ 326.981999] RIP: 0010:amdgpu_vm_assert_locked+0x16/0x70 [amdgpu] [ 326.982094] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 ff 74 45 48 8b 87 80 03 00 00 48 85 c0 74 40 <48> 8b b8 80 01 00 00 48 85 ff 74 3b 8b 05 0c b7 0e f0 85 c0 75 05 [ 326.982098] RSP: 0018:ffffaa91c2a6bc20 EFLAGS: 00010206 [ 326.982100] RAX: 4156415741e58948 RBX: ffff9e8f013e8330 RCX: 0000000000000000 [ 326.982102] RDX: 0000000000000005 RSI: 000000001d254e88 RDI: ffffffffc144814a [ 326.982104] RBP: ffffaa91c2a6bc68 R08: 0000004c21a25674 R09: 0000000000000001 [ 326.982106] R10: 0000000000000001 R11: dccaf3f2f82863fc R12: ffff9e8f013e8000 [ 326.982108] R13: ffff9e8f013e8000 R14: 0000000000000000 R15: ffff9e8f09980000 [ 326.982110] FS: 0000000000000000(0000) GS:ffff9e9e79995000(0000) knlGS:0000000000000000 [ 326.982112] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 326.982114] CR2: 000055ed6c9caa80 CR3: 0000000797060000 CR4: 0000000000750ef0 [ 326.982116] PKRU: 55555554 Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 9b608fe94870fe46bd2c41fcda99e74dabd6bbc6 Author: Lijo Lazar Date: Mon Sep 29 17:59:26 2025 +0530 drm/amdgpu: Check swus/ds for switch state save For saving switch state, check if the GPU is having SWUS/DS architecture. Otherwise, skip saving. Reported-by: Roman Elshin Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4602 Fixes: 1dd2fa0e00f1 ("drm/amdgpu: Save and restore switch state") Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1f086d2508ebe494d13fd587d1f5e2b908379efc Author: Felix Kuehling Date: Fri Oct 3 16:05:46 2025 -0400 drm/amdkfd: Fix two comments in kfd_ioctl.h Queue read and write pointers are "to KFD", not "from KFD". Suggested-by: Robert Liu Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Reviewed-by: Robert Liu Signed-off-by: Alex Deucher commit 4538a93bbbf104d7b7ce769bec48ff360bce583b Author: Lijo Lazar Date: Fri Sep 19 11:04:44 2025 +0530 drm/amd/pm: Avoid interface mismatch messaging PMFW interface version is not used by some IP implementations like SMU v13.0.6/12, instead rely on PMFW version checks. Avoid the log if interface version is not used. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit b809ca91a5b7eccba065460200512f83cc87987a Author: Jesse.Zhang Date: Thu Sep 25 18:02:18 2025 +0800 drm/amdgpu: Merge amdgpu_vm_set_pasid into amdgpu_vm_init As KFD no longer uses a separate PASID, the global amdgpu_vm_set_pasid()function is no longer necessary. Merge its functionality directly intoamdgpu_vm_init() to simplify code flow and eliminate redundant locking. v2: remove superflous check adjust amdgpu_vm_fin and remove amdgpu_vm_set_pasid (Chritian) v3: drop amdgpu_vm_assert_locked (Chritian) Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4614 Fixes: 59e4405e9ee2 ("drm/amdgpu: revert to old status lock handling v3") Reviewed-by: Christian König Suggested-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8dbac5cf8bd55a01a8a0e792a6ed866856506f60 Author: Shaoyun Liu Date: Wed Sep 24 21:40:57 2025 -0400 drm/amd/amdgpu: Fix the mes version that support inv_tlbs MES version 0x83 is not stable to use the inv_tlbs API. Defer it to 0x84 vertsion. Fixes: 85442bac8466 ("drm/amd/amdgpu: Fix the mes version that support inv_tlbs") Signed-off-by: Shaoyun Liu Reviewed-by: Michael Chen Signed-off-by: Alex Deucher commit c760bcda83571e07b72c10d9da175db5051ed971 Author: Mario Limonciello Date: Thu Sep 25 14:10:57 2025 -0500 drm/amd: Check whether secure display TA loaded successfully [Why] Not all renoir hardware supports secure display. If the TA is present but the feature isn't supported it will fail to load or send commands. This shows ERR messages to the user that make it seems like there is a problem. [How] Check the resp_status of the context to see if there was an error before trying to send any secure display commands. Reviewed-by: Alex Deucher Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1415 Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 7574f30337e19045f03126b4c51f525b84e5049e Author: Philip Yang Date: Mon Sep 15 15:57:32 2025 -0400 drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svm_range_restore_pages calls mmap_read_unlock then returns. This causes deadlock and system hangs later because mmap read or write lock cannot be taken. Downgrade mmap write lock to read lock if draining retry fault fix this bug. Signed-off-by: Philip Yang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 58e6fc2fb94f0f409447e5d46cf6a417b6397fbc Author: Philip Yang Date: Tue May 27 11:09:53 2025 -0400 drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid hold the kfd process reference to ensure it doesn't get destroyed while sending the segfault event to user space. Calling kfd_lookup_process_by_pid as function parameter leaks the kfd process refcount and miss the NULL pointer check if app process is already destroyed. Fixes: 2d274bf7099b ("amd/amdkfd: Trigger segfault for early userptr unmmapping") Signed-off-by: Philip Yang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 0c6734288566f9642037882c4cb1684d5ecc6b57 Author: Heng Zhou Date: Fri Sep 26 11:07:44 2025 +0800 drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O. There is some probability that reset workqueue is blocked by KIQ I/O for 10+ seconds after gpu hangs. So we need to add a in_reset check during each KIQ register poll. Signed-off-by: Heng Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 0e190a0446ec517666dab4691b296a9b758e590f Author: Timur Kristóf Date: Thu Sep 25 20:45:25 2025 +0200 drm/amd/display: Disable scaling on DCE6 for now Scaling doesn't work on DCE6 at the moment, the current register programming produces incorrect output when using fractional scaling (between 100-200%) on resolutions higher than 1080p. Disable it until we figure out how to program it properly. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit a7dc87f3448bea5ebe054f14e861074b9c289c65 Author: Timur Kristóf Date: Thu Sep 25 20:45:24 2025 +0200 drm/amd/display: Properly disable scaling on DCE6 SCL_SCALER_ENABLE can be used to enable/disable the scaler on DCE6. Program it to 0 when scaling isn't used, 1 when used. Additionally, clear some other registers when scaling is disabled and program the SCL_UPDATE register as recommended. This fixes visible glitches for users whose BIOS sets up a mode with scaling at boot, which DC was unable to clean up. Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c Author: Timur Kristóf Date: Thu Sep 25 20:45:23 2025 +0200 drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 Previously, the code would set a bit field which didn't exist on DCE6 so it would be effectively a no-op. Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c Author: Timur Kristóf Date: Thu Sep 25 20:45:22 2025 +0200 drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs Without these, it's impossible to program these registers. Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 Author: Alex Deucher Date: Thu Sep 25 20:45:21 2025 +0200 drm/amdgpu: Add additional DCE6 SCL registers Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)") Signed-off-by: Alex Deucher commit f7dfa0f31b13ee5f2ba598cdfcab9a831ed8a6b8 Author: Kuniyuki Iwashima Date: Tue Oct 7 05:25:33 2025 +0000 slub: Don't call lockdep_unregister_key() for immature kmem_cache. syzbot reported the lockdep splat below in __kmem_cache_release(). [0] The problem is that __kmem_cache_release() could be called from do_kmem_cache_create() before init_kmem_cache_cpus() registers the lockdep key. Let's perform lockdep_unregister_key() only when init_kmem_cache_cpus() has been done, which we can determine by checking s->cpu_slab [0]: WARNING: CPU: 1 PID: 6128 at kernel/locking/lockdep.c:6606 lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Modules linked in: CPU: 1 UID: 0 PID: 6128 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Code: 50 e4 0f 48 3b 44 24 10 0f 84 26 fe ff ff e8 bd cd 17 09 e8 e8 ce 17 09 41 f7 c7 00 02 00 00 74 bd fb 40 84 ed 75 bc eb cd 90 <0f> 0b 90 e9 19 ff ff ff 90 0f 0b 90 e9 2a ff ff ff 48 c7 c7 d0 ac RSP: 0018:ffffc90003e870d0 EFLAGS: 00010002 RAX: eb1525397f5bdf00 RBX: ffff88803c121148 RCX: 1ffff920007d0dfc RDX: 0000000000000000 RSI: ffffffff8acb1500 RDI: ffffffff8b1dd0e0 RBP: 00000000ffffffea R08: ffffffff8eb5aa37 R09: 1ffffffff1d6b546 R10: dffffc0000000000 R11: fffffbfff1d6b547 R12: 0000000000000000 R13: ffff88814d1b8900 R14: 0000000000000000 R15: 0000000000000203 FS: 00007f773f75e6c0(0000) GS:ffff88812712f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdaea3af52 CR3: 000000003a5ca000 CR4: 00000000003526f0 Call Trace: __kmem_cache_release+0xe3/0x1e0 mm/slub.c:7696 do_kmem_cache_create+0x74e/0x790 mm/slub.c:8575 create_cache mm/slab_common.c:242 [inline] __kmem_cache_create_args+0x1ce/0x330 mm/slab_common.c:340 nfsd_file_cache_init+0x1d6/0x530 fs/nfsd/filecache.c:816 nfsd_startup_generic fs/nfsd/nfssvc.c:282 [inline] nfsd_startup_net fs/nfsd/nfssvc.c:377 [inline] nfsd_svc+0x393/0x900 fs/nfsd/nfssvc.c:786 nfsd_nl_threads_set_doit+0x84a/0x960 fs/nfsd/nfsctl.c:1639 genl_family_rcv_msg_doit+0x212/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:742 ____sys_sendmsg+0x508/0x820 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f77400eeec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f773f75e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f7740345fa0 RCX: 00007f77400eeec9 RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000006 RBP: 00007f7740171f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7740346038 R14: 00007f7740345fa0 R15: 00007ffce616f8d8 [alexei.starovoitov@gmail.com: simplify the fix] Link: https://lore.kernel.org/all/20251007052534.2776661-1-kuniyu@google.com/ Fixes: 83382af9ddc3 ("slab: Make slub local_(try)lock more precise for LOCKDEP") Reported-by: syzbot+a6f4d69b9b23404bbabf@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e4a3d1.a00a0220.298cc0.0471.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Vlastimil Babka commit 610cb23bcc75bcd9fead3e41cbd867cccd0eb229 Author: Helge Deller Date: Tue Oct 7 17:08:16 2025 +0200 parisc: Add initial kernel-side perf_event support Signed-off-by: Helge Deller commit 38492c5743f8b7213ca86f0cd72ea625af35d5ef Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Tue Oct 7 04:46:47 2025 +0100 gen_init_cpio: Ignore fsync() returning EINVAL on pipes The reproducer: echo | ./usr/gen_init_cpio /dev/stdin > /dev/null fsync() on a pipe fd returns -EINVAL, which makes gen_init_cpio fail. Ignore -EINVAL from fsync(). Fixes: ae18b94099b0 ("gen_init_cpio: support -o parameter") Cc: David Disseldorp Cc: Nicolas Schier Signed-off-by: Dmitry Safonov Reviewed-by: David Disseldorp Link: https://patch.msgid.link/20251007-gen_init_cpio-pipe-v2-1-b098ab94b58a@arista.com Signed-off-by: Nathan Chancellor commit 7ded7d37e5f5b36b4acd74380156cf07b6640c5b Author: Nathan Chancellor Date: Mon Oct 6 14:39:56 2025 -0700 scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W=e for hostprogs Commit 27758d8c2583 ("kbuild: enable -Werror for hostprogs") unconditionally enabled -Werror for the compiler, assembler, and linker when building the host programs, as the build footprint of the host programs is small (thus risk of build failures from warnings are low) and that stage of the build may not have Kconfig values (thus CONFIG_WERROR could not be used as a precondition). While turning warnings into errors unconditionally happens in a few places within the kernel, it can be disruptive to people who may be building with newer compilers, such as while doing a bisect. While it is possible to avoid this behavior by passing HOSTCFLAGS=-w or HOSTCFLAGS=-Wno-error, it may not be the most intuitive for regular users not intimately familiar with Kbuild. Avoid being disruptive to the entire build by depending on the explicit opt-in of CONFIG_WERROR or W=e to enable -Werror and the like while building the host programs. While this means there is a small portion of the build that does not have -Werror enabled (namely scripts/kconfig/* and scripts/basic/fixdep), it is better than not having it altogether. Fixes: 27758d8c2583 ("kbuild: enable -Werror for hostprogs") Acked-by: Miguel Ojeda Reported-by: Askar Safin Closes: https://lore.kernel.org/20251005011100.1035272-1-safinaskar@gmail.com/ Reviewed-by: Thomas Weißschuh Tested-by: Miguel Ojeda # Rust Link: https://patch.msgid.link/20251006-kbuild-hostprogs-werror-fix-v1-1-23cf1ffced5c@kernel.org Signed-off-by: Nathan Chancellor commit 89b59f0979926fb22ae7ecb8f4a1b5ecdb04b3d4 Merge: abdf766d149c51 dd68fd72e516d5 Author: Linus Torvalds Date: Tue Oct 7 09:45:07 2025 -0700 Merge tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These fix a driver bug, clean up two pieces of code and improve the fwnode API consistency: - Add missing synchronization between interface updates in the ACPI battery driver (Rafael Wysocki) - Remove open coded check for cpu_feature_enabled() from acpi_processor_power_init_bm_check() (Mario Limonciello) - Remove redundant rcu_read_lock/unlock() under spinlock from ghes_notify_hed() in the ACPI APEI support code (pengdonglin) - Make the .get_next_child_node() callback in the ACPI fwnode backend skip ACPI devices that are not present for consistency with the analogous callback in the OF fwnode backend (Sakari Ailus)" * tag 'acpi-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: property: Return present device nodes only on fwnode interface ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock ACPI: battery: Add synchronization between interface updates x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() commit abdf766d149c51fb256118f73be947d7a82f702e Merge: 522ba450b56fff 53d4d315d4f7f1 Author: Linus Torvalds Date: Tue Oct 7 09:39:51 2025 -0700 Merge tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These are cpufreq fixes and cleanups on top of the material merged previously, a power management core code fix and updates of the runtime PM framework including unit tests, documentation updates and introduction of auto-cleanup macros for runtime PM "resume and get" and "get without resuming" operations. Specifics: - Make cpufreq drivers setting the default CPU transition latency to CPUFREQ_ETERNAL specify a proper default transition latency value instead which addresses a regression introduced during the 6.6 cycle that broke CPUFREQ_ETERNAL handling (Rafael Wysocki) - Make the cpufreq CPPC driver use a proper transition delay value when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency() to indicate an error condition (Rafael Wysocki) - Make cppc_get_transition_latency() return a negative error code to indicate error conditions instead of using CPUFREQ_ETERNAL for this purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael Wysocki, Gopi Krishna Menon) - Fix device leak in the mediatek cpufreq driver (Johan Hovold) - Set target frequency on all CPUs sharing a policy during frequency updates in the tegra186 cpufreq driver and make it initialize all cores to max frequencies (Aaron Kling) - Rust cpufreq helper cleanup (Thorsten Blum) - Make pm_runtime_put*() family of functions return 1 when the given device is already suspended which is consistent with the documentation (Brian Norris) - Add basic kunit tests for runtime PM API contracts and update return values in kerneldoc comments for the runtime PM API (Brian Norris, Dan Carpenter) - Add auto-cleanup macros for runtime PM "resume and get" and "get without resume" operations, use one of them in the PCI core and drop the existing "free" macro introduced for similar purpose, but somewhat cumbersome to use (Rafael Wysocki) - Make the core power management code avoid waiting on device links marked as SYNC_STATE_ONLY which is consistent with the handling of those device links elsewhere (Pin-yen Lin)" * tag 'pm-6.18-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: docs/zh_CN: Fix malformed table docs/zh_TW: Fix malformed table PM: runtime: Fix error checking for kunit_device_register() PM: runtime: Introduce one more usage counter guard cpufreq: Drop unused symbol CPUFREQ_ETERNAL ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() PCI/sysfs: Use runtime PM guard macro for auto-cleanup PM: runtime: Add auto-cleanup macros for "resume and get" operations cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure PM: sleep: Do not wait on SYNC_STATE_ONLY device links PM: runtime: Update kerneldoc return codes PM: runtime: Make put{,_sync}() return 1 when already suspended PM: runtime: Add basic kunit tests for API contracts commit 522ba450b56fff29f868b1552bdc2965f55de7ed Merge: 971199ad2a0f1b 112104e2b72c5c Author: Linus Torvalds Date: Tue Oct 7 09:28:37 2025 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "There's a bunch of patches here across drivers/clk/ to migrate drivers to use struct clk_ops::determine_rate() instead of the round_rate() one so that we can remove the round_rate clk_op entirely. Brian has taken up that task which nobody else has wanted to do for close to a decade. Thanks Brian! This is all prerequisite work to get to the real task of improving the clk rate setting process. Once we have determine_rate() used everywhere, we'll be able to do things like chain the rate request structs in linked lists to order the rate setting operations or add more parameters without having to change every clk driver in existence. It's also nice to not have multiple ways to do something which just causes confusion for clk driver authors. Overall I'm glad this is getting done. Beyond this change we also have a tweak to the clk_lookup() function in the core framework to use hashing on the clk name instead of a clk tree walk with string comparisons. We _still_ rely on the clk name to be unique, because historically we've used globally unique strings to describe the clk tree topology. This tree walk becomes increasingly slow as more clks are added to the system. Searching from the roots for a duplicate is simple but pretty dumb and it wastes boot time so we're using a hash table as an improvement. Ideally we wouldn't rely on the strings to be unique at all, relegating them to simply debug information, but that is future work that will likely require some sort of Kconfig knob indicating strings aren't used for topology description. Outside of the core framework changes we have the usual new SoC support and fixes to clk drivers for things that were discovered once the clks were used by consumer drivers. Nothing in particular is jumping out at me in the "misc" pile, except maybe the Amlogic driver that has gone through a refactoring. That series got a fix from testing in -next though so it seems likely that things have been getting good test coverage for a couple weeks already" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (299 commits) clk: microchip: core: remove duplicate roclk_determine_rate() reset: aspeed: register AST2700 reset auxiliary bus device dt-bindings: clock: ast2700: modify soc0/1 clock define clk: tegra: do not overallocate memory for bpmp clocks clk: ep93xx: Use int type to store negative error codes clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: loongson2: Add clock definitions for Loongson-2K0300 SoC clk: loongson2: Avoid hardcoding firmware name of the reference clock clk: loongson2: Allow zero divisors for dividers clk: loongson2: Support scale clocks with an alternative mode clk: loongson2: Allow specifying clock flags for gate clock dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible clk: clocking-wizard: Fix output clock register offset for Versal platforms clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() clk: mmp: pxa1908: Instantiate power driver through auxiliary bus clk: s2mps11: add support for S2MPG10 PMIC clock dt-bindings: clock: samsung,s2mps11: add s2mpg10 dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings clk: stm32: introduce clocks for STM32MP21 platform dt-bindings: stm32: add STM32MP21 clocks and reset bindings ... commit 1bcc3f87912779f66cdf1789a066046536ca6ccc Author: Yan Zhao Date: Wed Sep 24 10:42:55 2025 -0700 KVM: selftests: Test prefault memory during concurrent memslot removal Expand the prefault memory selftest to add a regression test for a KVM bug where KVM's retry logic would result in (breakable) deadlock due to the memslot deletion waiting on prefaulting to release SRCU, and prefaulting waiting on the memslot to fully disappear (KVM uses a two-step process to delete memslots, and KVM x86 retries page faults if a to-be-deleted, a.k.a. INVALID, memslot is encountered). To exercise concurrent memslot remove, spawn a second thread to initiate memslot removal at roughly the same time as prefaulting. Test memslot removal for all testcases, i.e. don't limit concurrent removal to only the success case. There are essentially three prefault scenarios (so far) that are of interest: 1. Success 2. ENOENT due to no memslot 3. EAGAIN due to INVALID memslot For all intents and purposes, #1 and #2 are mutually exclusive, or rather, easier to test via separate testcases since writing to non-existent memory is trivial. But for #3, making it mutually exclusive with #1 _or_ #2 is actually more complex than testing memslot removal for all scenarios. The only requirement to let memslot removal coexist with other scenarios is a way to guarantee a stable result, e.g. that the "no memslot" test observes ENOENT, not EAGAIN, for the final checks. So, rather than make memslot removal mutually exclusive with the ENOENT scenario, simply restore the memslot and retry prefaulting. For the "no memslot" case, KVM_PRE_FAULT_MEMORY should be idempotent, i.e. should always fail with ENOENT regardless of how many times userspace attempts prefaulting. Pass in both the base GPA and the offset (instead of the "full" GPA) so that the worker can recreate the memslot. Signed-off-by: Yan Zhao Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250924174255.2141847-1-seanjc@google.com Signed-off-by: Sean Christopherson commit e2080b70c5851a132547bec3bd7dde847e649678 Author: Markus Elfring Date: Tue Oct 7 17:45:28 2025 +0200 smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() Use two additional labels so that another bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit 0a98b40b8fe1bdebf3cb78924cef60af322c4437 Author: Markus Elfring Date: Tue Oct 7 16:32:25 2025 +0200 smb: client: Return a status code only as a constant in cifs_spnego_key_instantiate() * Return a status code without storing it in an intermediate variable. * Delete the local variable “ret” and the label “error” which became unnecessary with this refactoring. Signed-off-by: Markus Elfring Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 912b9fd7c7775060900ad315f0ceb616f9381bc3 Author: Helge Deller Date: Tue Oct 7 16:57:33 2025 +0200 parisc: Report software alignment faults via perf Signed-off-by: Helge Deller commit 6fb2e09c3abca500ad3ef88afdd291515323d668 Author: Helge Deller Date: Tue Oct 7 16:56:48 2025 +0200 parisc: Report emulation faults via perf Signed-off-by: Helge Deller commit 971199ad2a0f1b2fbe14af13369704aff2999988 Merge: 221533629550e9 f620d66af31658 Author: Linus Torvalds Date: Tue Oct 7 08:59:25 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Preserve old 'tt_core' UAPI for Hisilicon L3C PMU driver - Ensure linear alias of kprobes instruction page is not writable - Fix kernel stack unwinding from BPF - Fix build warnings from the Fujitsu uncore PMU documentation - Fix hang with deferred 'struct page' initialisation and MTE - Consolidate KPTI page-table re-writing code * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Do not flag the zero page as PG_mte_tagged docs: perf: Fujitsu: Fix htmldocs build warnings and errors arm64: mm: Move KPTI helpers to mmu.c tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 arm64: kprobes: call set_memory_rox() for kprobe page drivers/perf: hisi: Add tt_core_deprecated for compatibility commit 221533629550e920580ab428f13ffebf54063b95 Merge: c746c3b5169831 b595edcb24727e Author: Linus Torvalds Date: Tue Oct 7 08:40:15 2025 -0700 Merge tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Unify guest entry code for KVM and MSHV (Sean Christopherson) - Switch Hyper-V MSI domain to use msi_create_parent_irq_domain() (Nam Cao) - Add CONFIG_HYPERV_VMBUS and limit the semantics of CONFIG_HYPERV (Mukesh Rathor) - Add kexec/kdump support on Azure CVMs (Vitaly Kuznetsov) - Deprecate hyperv_fb in favor of Hyper-V DRM driver (Prasanna Kumar T S M) - Miscellaneous enhancements, fixes and cleanups (Abhishek Tiwari, Alok Tiwari, Nuno Das Neves, Wei Liu, Roman Kisel, Michael Kelley) * tag 'hyperv-next-signed-20251006' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: hyperv: Remove the spurious null directive line MAINTAINERS: Mark hyperv_fb driver Obsolete fbdev/hyperv_fb: deprecate this in favor of Hyper-V DRM driver Drivers: hv: Make CONFIG_HYPERV bool Drivers: hv: Add CONFIG_HYPERV_VMBUS option Drivers: hv: vmbus: Fix typos in vmbus_drv.c Drivers: hv: vmbus: Fix sysfs output format for ring buffer index Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() x86/hyperv: Switch to msi_create_parent_irq_domain() mshv: Use common "entry virt" APIs to do work in root before running guest entry: Rename "kvm" entry code assets to "virt" to genericize APIs entry/kvm: KVM: Move KVM details related to signal/-EINTR into KVM proper mshv: Handle NEED_RESCHED_LAZY before transferring to guest x86/hyperv: Add kexec/kdump support on Azure CVMs Drivers: hv: Simplify data structures for VMBus channel close message Drivers: hv: util: Cosmetic changes for hv_utils_transport.c mshv: Add support for a new parent partition configuration clocksource: hyper-v: Skip unnecessary checks for the root partition hyperv: Add missing field to hv_output_map_device_interrupt commit 3f39f56520374cf56872644acf9afcc618a4b674 Author: Jason-JH Lin Date: Fri Aug 29 17:15:58 2025 +0800 mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit() (mailbox.c). This caused lockdep warnings such as "sleeping function called from invalid context" when running with lockdebug enabled. The BUG report: BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1 Hardware name: Google Ciri sku0/unprovisioned board (DT) Workqueue: imgsys_runner imgsys_runner_func Call trace: dump_backtrace+0x100/0x120 show_stack+0x20/0x2c dump_stack_lvl+0x84/0xb4 dump_stack+0x18/0x48 __might_resched+0x354/0x4c0 __might_sleep+0x98/0xe4 __pm_runtime_resume+0x70/0x124 cmdq_mbox_send_data+0xe4/0xb1c msg_submit+0x194/0x2dc mbox_send_message+0x190/0x330 imgsys_cmdq_sendtask+0x1618/0x2224 imgsys_runner_func+0xac/0x11c process_one_work+0x638/0xf84 worker_thread+0x808/0xcd0 kthread+0x24c/0x324 ret_from_fork+0x10/0x20 Additionally, pm_runtime_put_autosuspend() should be invoked from the GCE IRQ handler to ensure the hardware has actually completed its work. To resolve these issues, remove the pm_runtime calls from cmdq_mbox_send_data() and delegate power management responsibilities to the client driver. Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend") Signed-off-by: Jason-JH Lin Signed-off-by: Jassi Brar commit b157dd228cf0ee24b2414712abd82bd3a8d5b009 Author: Carlos Llamas Date: Mon Oct 6 22:51:32 2025 +0000 tools headers: kcfi: rename missed CONFIG_CFI_CLANG Commit 23ef9d439769 ("kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI") missed one instance of CONFIG_CFI_CLANG. Rename it to match the original kernel header. This addresses the following build warning: Warning: Kernel ABI header differences: diff -u tools/include/linux/cfi_types.h include/linux/cfi_types.h Cc: Kees Cook Fixes: a5ba183bdeee ("Merge tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux") Reviewed-by: Nathan Chancellor Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20251006225148.1636486-1-cmllamas@google.com Signed-off-by: Kees Cook commit 0902b3cb23ce7f436bddbdf6ba7b1ed427b36bd9 Author: Kees Cook Date: Tue Sep 30 08:45:19 2025 -0700 kconfig: Avoid prompting for transitional symbols The "transitional" symbol keyword, while working with the "olddefconfig" target, was prompting during "oldconfig". This occurred because these symbols were not being marked as user-defined when they received values from transitional symbols that had user values. The "olddefconfig" target explicitly doesn't prompt for anything, so this deficiency wasn't noticed. The issue manifested when a symbol's value came from a transitional symbol's user value but the receiving symbol wasn't marked with SYMBOL_DEF_USER. Thus the "oldconfig" logic would then prompt for these symbols unnecessarily. Check after value calculation whether a symbol without a user value gets its value from a single transitional symbol that does have a user value. In such cases, mark the receiving symbol as user-defined to prevent prompting. Update regression tests to verify that symbols with transitional defaults are not prompted in "oldconfig", except when conditional defaults evaluate to 'no' and should legitimately be prompted. Build tested with "make testconfig". Reported-by: Linus Torvalds Closes: https://lore.kernel.org/lkml/CAHk-=wgZjUk4Cy2XgNkTrQoO8XCmNUHrTe5D519Fij1POK+3qw@mail.gmail.com/ Fixes: f9afce4f32e9 ("kconfig: Add transitional symbol attribute for migration support") Cc: Vegard Nossum Link: https://lore.kernel.org/r/20250930154514.it.623-kees@kernel.org Signed-off-by: Kees Cook commit 8ec5a066f88f89bd52094ba18792b34c49dcd55a Author: Sam James Date: Wed Oct 1 23:58:40 2025 +0100 parisc: don't reference obsolete termio struct for TC* constants Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead. This fixes building Python for example, which falls over like: ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' Link: https://bugs.gentoo.org/961769 Link: https://bugs.gentoo.org/962600 Co-authored-by: Stian Halseth Cc: stable@vger.kernel.org Signed-off-by: Sam James Signed-off-by: Helge Deller commit 16794e524d310780163fdd49d0bf7fac30f8dbc8 Author: John David Anglin Date: Tue Aug 5 11:35:30 2025 -0400 parisc: Remove spurious if statement from raw_copy_from_user() Accidently introduced in commit 91428ca9320e. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Fixes: 91428ca9320e ("parisc: Check region is readable by user in raw_copy_from_user()") Cc: stable@vger.kernel.org # v5.12+ commit 506aa235f6e0baa00bf792df82a5e9f618b7a5d8 Author: Christoph Hellwig Date: Tue Oct 7 11:06:28 2025 +0200 block: move bio_iov_iter_get_bdev_pages to block/fops.c Keep bio_iov_iter_get_bdev_pages local with the callers, as blindly looking at the bdev logical block size is often not the best idea unless on a block device. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit cb6d51a4115781fd9de6108932e866a332e38406 Author: Christoph Hellwig Date: Tue Oct 7 11:06:27 2025 +0200 iomap: open code bio_iov_iter_get_bdev_pages Prepare for passing different alignments, and to retired bio_iov_iter_get_bdev_pages as a global helper. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit 82dd5d763c9b718e2d655b9565e0a06a91bb83dc Author: Christoph Hellwig Date: Tue Oct 7 11:06:26 2025 +0200 block: rename bio_iov_iter_get_pages_aligned to bio_iov_iter_get_pages Now that the bio_iov_iter_get_pages is free again, use it instead of the more complicated now. Also drop the unused export. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit 1ed06c83506ecaaf1836ddeb7c65772ff86d8d53 Author: Christoph Hellwig Date: Tue Oct 7 11:06:25 2025 +0200 block: remove bio_iov_iter_get_pages Switch the only caller to bio_iov_iter_get_pages, and explain why it does not have any alignment requirements. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Keith Busch Reviewed-by: Qu Wenruo Signed-off-by: Jens Axboe commit beb97995b97532e1f215e3295e6843e59862f94b Author: Haiyue Wang Date: Tue Oct 7 14:18:18 2025 +0800 io_uring: use tab indentation for IORING_SEND_VECTORIZED comment Be consistent with tab style of "liburing/src/include/liburing/io_uring.h". Signed-off-by: Haiyue Wang Signed-off-by: Jens Axboe commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f Author: Jens Axboe Date: Tue Oct 7 07:46:00 2025 -0600 io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback. Cc: stable@vger.kernel.org Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Reported-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Tested-by: syzbot+b9e83021d9c642a33d8c@syzkaller.appspotmail.com Link: https://lore.kernel.org/io-uring/68e5195e.050a0220.256323.001f.GAE@google.com/ Signed-off-by: Jens Axboe commit 18a5f1af596e6ba22cd40ada449063041f3ce6d4 Author: Artem Shimko Date: Tue Oct 7 13:11:33 2025 +0300 spi: dw-mmio: add error handling for reset_control_deassert() Currently reset_control_deassert() is called without checking its return value. This can lead to silent failures when reset deassertion fails. Add proper error handling to: 1. Check the return value of reset_control_deassert() 2. Return the error to the caller 3. Provide meaningful error message using dev_err_probe() This ensures that reset-related failures are properly reported during probe and helps with debugging reset issues. Signed-off-by: Artem Shimko Link: https://patch.msgid.link/20251007101134.1912895-1-a.shimko.dev@gmail.com Signed-off-by: Mark Brown commit a27539810e1e61efcfdeb51777ed875dc61e9d49 Author: Shuming Fan Date: Tue Oct 7 16:09:50 2025 +0800 ASoC: rt722: add settings for rt722VB This patch adds settings for RT722VB. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251007080950.1999411-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 Author: Valerio Setti Date: Tue Oct 7 00:12:19 2025 +0200 ASoC: meson: aiu-encoder-i2s: fix bit clock polarity According to I2S specs audio data is sampled on the rising edge of the clock and it can change on the falling one. When operating in normal mode this SoC behaves the opposite so a clock polarity inversion is required in this case. This was tested on an OdroidC2 (Amlogic S905 SoC) board. Signed-off-by: Valerio Setti Reviewed-by: Jerome Brunet Tested-by: Jerome Brunet Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com Signed-off-by: Mark Brown commit f4ace70faa8ff2890774bac86762e036a3651066 Author: Pedro Demarchi Gomes Date: Tue Oct 7 09:00:57 2025 -0300 ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user Replace kmalloc_array() followed by copy_from_user() with memdup_array_user() to improve and simplify fcp_ioctl_set_meter_map(). No functional changes intended. Signed-off-by: Pedro Demarchi Gomes Signed-off-by: Takashi Iwai commit 7ddb711b6e0d33e0a673b49f69dff0d950ed60b9 Author: Shenghao Ding Date: Tue Oct 7 18:37:08 2025 +0800 ALSA: hda/tas2781: Enable init_profile_id for device initialization Optimize the time consumption of profile switching, init_profile saves the common settings of different profiles, such as the dsp coefficients, etc, which can greatly reduce the profile switching time comsumption and remove the repetitive settings. Fixes: e83dcd139e77 ("ASoC: tas2781: Add keyword "init" in profile section") Signed-off-by: Shenghao Ding Signed-off-by: Takashi Iwai commit e2c69490dda5d4c9f1bfbb2898989c8f3530e354 Author: Guenter Roeck Date: Mon Oct 6 13:18:57 2025 -0700 ipmi: Fix handling of messages with provided receive message pointer Prior to commit b52da4054ee0 ("ipmi: Rework user message limit handling"), i_ipmi_request() used to increase the user reference counter if the receive message is provided by the caller of IPMI API functions. This is no longer the case. However, ipmi_free_recv_msg() is still called and decreases the reference counter. This results in the reference counter reaching zero, the user data pointer is released, and all kinds of interesting crashes are seen. Fix the problem by increasing user reference counter if the receive message has been provided by the caller. Fixes: b52da4054ee0 ("ipmi: Rework user message limit handling") Reported-by: Eric Dumazet Cc: Eric Dumazet Cc: Greg Thelen Signed-off-by: Guenter Roeck Message-ID: <20251006201857.3433837-1-linux@roeck-us.net> Signed-off-by: Corey Minyard commit a779e27f24aeb679969ddd1fdd7f636e22ddbc1e Author: Christian Brauner Date: Tue Oct 7 11:32:42 2025 +0200 coredump: fix core_pattern input validation In be1e0283021e ("coredump: don't pointlessly check and spew warnings") we tried to fix input validation so it only happens during a write to core_pattern. This would avoid needlessly logging a lot of warnings during a read operation. However the logic accidently got inverted in this commit. Fix it so the input validation only happens on write and is skipped on read. Fixes: be1e0283021e ("coredump: don't pointlessly check and spew warnings") Fixes: 16195d2c7dd2 ("coredump: validate socket name as it is written") Reviewed-by: Jan Kara Reported-by: Yu Watanabe Signed-off-by: Christian Brauner commit 56094ad3eaa21e6621396cc33811d8f72847a834 Author: Jan Kara Date: Thu Oct 2 17:55:07 2025 +0200 vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. Reported-by: syzbot+1d79ebe5383fc016cf07@syzkaller.appspotmail.com Fixes: f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Christian Brauner commit 943af6478807fc8dc37196e4fd080b98aa61aeec Merge: 3d3c4cd5c62f24 8e87b3edd0784e Author: Paolo Abeni Date: Tue Oct 7 13:00:00 2025 +0200 Merge branch 'mlx5-misc-fixes-2025-10-05' Tariq Toukan says: ==================== mlx5 misc fixes 2025-10-05 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1759652999-858513-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 8e87b3edd0784e534d9ad1e0a24577b759045cbe Author: Cosmin Ratiu Date: Sun Oct 5 11:29:59 2025 +0300 net/mlx5e: Do not fail PSP init on missing caps PSP support requires a set of cap bits to be set, otherwise an init error is logged. But logging an error when PSP cannot be initialized is too much, and not in line with other features. If a feature cannot be initialized because it is not supported, that's not an error. An error should only be printed when the feature cannot be initialized because of an actual error. Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality") Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 Author: Carolina Jubran Date: Sun Oct 5 11:29:58 2025 +0300 net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed When configuring IPsec packet offload in tunnel mode, the driver tries to create tunnel reformat objects unconditionally. This is incorrect, because tunnel mode is only permitted under specific encapsulation settings, and that decision is already made when the flow table is created. The offending commit attempted to block this case in the state add path, but the check there happens too late and does not prevent the reformat from being configured. Fix by taking short reservations for both the eswitch mode and the encap at the start of state setup. This preserves the block ordering (mode --> encap) used later: the mode is blocked during RX/TX get, and the encap is blocked during flow-table creation. This lets us fail early if either reservation cannot be obtained, it means a mode transition is underway or a conflicting configuration already owns encap. If both succeed, the flow-table path later takes the ownership and the reservations are released on exit. Fixes: 146c196b60e4 ("net/mlx5e: Create IPsec table with tunnel support only when encap is disabled") Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 7593439c13933164f701eed9c83d89358f203469 Author: Carolina Jubran Date: Sun Oct 5 11:29:57 2025 +0300 net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables When creating IPsec flow tables with tunnel mode enabled, the driver uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation conflicts across different domains (NIC_RX/NIC_TX and FDB), since the firmware doesn’t allow both at the same time. Currently, the driver attempts to reserve tunnel mode unconditionally for both NIC and FDB IPsec tables. This can lead to conflicting tunnel mode setups, for example, if a flow table was created in the FDB domain with tunnel offload enabled, and we later try to create another one in the NIC, or vice versa. To resolve this, adjust the blocking logic so that tunnel mode is only reserved by NIC flows. This ensures that tunnel offload is exclusively used in either the NIC or the FDB, and avoids unintended offload conflicts. Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode") Signed-off-by: Carolina Jubran Reviewed-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759652999-858513-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit dd68fd72e516d57e7f2e502113c9345a3bc277db Merge: 679a16399af080 5b87014e999903 399dbcadc01ebf c7bc7e9070d6bd d9f866b2bb3eec Author: Rafael J. Wysocki Date: Tue Oct 7 12:59:50 2025 +0200 Merge branches 'acpi-x86', 'acpi-battery', 'acpi-apei' and 'acpi-property' Merge an x86 cleanup related to ACPI, an ACPI battery driver fix, an ACPI APEI cleanup, and an ACPI device properties handling update for 6.18-rc1: - Remove open coded check for cpu_feature_enabled() from acpi_processor_power_init_bm_check() (Mario Limonciello) - Add missing synchronization between interface updates in the ACPI battery driver (Rafael Wysocki) - Remove redundant rcu_read_lock/unlock() under spinlock from ghes_notify_hed() in the ACPI APEI support code (pengdonglin) - Make the .get_next_child_node() callback in the ACPI fwnode backend skip ACPI devices that are not present for consistency with the analogous callback in the OF fwnode backend (Sakari Ailus) * acpi-x86: x86/acpi/cstate: Remove open coded check for cpu_feature_enabled() * acpi-battery: ACPI: battery: Add synchronization between interface updates * acpi-apei: ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock * acpi-property: ACPI: property: Return present device nodes only on fwnode interface commit 154d1e7ad9e5ce4b2aaefd3862b3dba545ad978d Author: Yuezhang Mo Date: Tue Sep 30 13:42:57 2025 +0800 dax: skip read lock assertion for read-only filesystems The commit 168316db3583("dax: assert that i_rwsem is held exclusive for writes") added lock assertions to ensure proper locking in DAX operations. However, these assertions trigger false-positive lockdep warnings since read lock is unnecessary on read-only filesystems(e.g., erofs). This patch skips the read lock assertion for read-only filesystems, eliminating the spurious warnings while maintaining the integrity checks for writable filesystems. Fixes: 168316db3583 ("dax: assert that i_rwsem is held exclusive for writes") Signed-off-by: Yuezhang Mo Reviewed-by: Friendy Su Reviewed-by: Daniel Palmer Reviewed-by: Gao Xiang Signed-off-by: Christian Brauner commit d68a29a6a229f8b4f3b19dbcd0bb02881316d642 Author: Tong Li Date: Tue Sep 30 19:02:58 2025 +0800 rust: file: add intra-doc link for 'EBADF' The `BadFdError` doc comment mentions the `EBADF` constant but does not currently provide a navigation target for readers of the generated docs. Turning the references into intra-doc links matches the rest of the module and makes the documentation easier to explore. Suggested-by: Onur Özkan Link: https://github.com/Rust-for-Linux/linux/issues/1186 Signed-off-by: Tong Li Reviewed-by: Onur Özkan Signed-off-by: Christian Brauner commit deafd21efdd106f9744e2339e0c70c0f4ba565c3 Author: Zhou Yuhang Date: Wed Sep 24 20:21:39 2025 +0800 fs: update comment in init_file() The f_count member in struct file has been replaced by f_ref, so update f_count to f_ref in the comment. Signed-off-by: Zhou Yuhang Signed-off-by: Christian Brauner commit 15623c860c93aac71d22e7bedb7661ff2d3418de Author: Deepanshu Kartikey Date: Mon Sep 29 11:02:05 2025 +0200 nsfs: handle inode number mismatches gracefully in file handles Replace VFS_WARN_ON_ONCE() with graceful error handling when file handles contain inode numbers that don't match the actual namespace inode. This prevents userspace from triggering kernel warnings by providing malformed file handles to open_by_handle_at(). The issue occurs when userspace provides a file handle with valid namespace type and ID that successfully locates a namespace, but specifies an incorrect inode number. Previously, this would trigger VFS_WARN_ON_ONCE() when comparing the real inode number against the provided value. Since file handle data is user-controllable, inode number mismatches should be treated as invalid input rather than kernel consistency errors. Handle this case by returning NULL to indicate the file handle is invalid, rather than warning about what is essentially user input validation. Reported-by: syzbot+9eefe09bedd093f156c2@syzkaller.appspotmail.com Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Deepanshu Kartikey Signed-off-by: Christian Brauner commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a Author: Oleksij Rempel Date: Sun Oct 5 10:12:03 2025 +0200 net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before. Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC") Reported-by: Hubert Wiśniewski Closes: https://lore.kernel.org/all/DCGHG5UJT9G3.2K1GHFZ3H87T0@gmail.com Tested-by: Hubert Wiśniewski Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20251005081203.3067982-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 53d4d315d4f7f17882ef11db49b06ca6b0be8ff7 Merge: 05f084d24e098d 7e8f305a081e22 Author: Rafael J. Wysocki Date: Tue Oct 7 12:31:46 2025 +0200 Merge branch 'pm-cpufreq' Merge cpufreq fixes and cleanups, mostly on top of those fixes, for 6.18-rc1: - Make cpufreq drivers setting the default CPU transition latency to CPUFREQ_ETERNAL specify a proper default transition latency value instead which addresses a regression introduced during the 6.6 cycle that broke CPUFREQ_ETERNAL handling (Rafael Wysocki) - Make the cpufreq CPPC driver use a proper transition delay value when CPUFREQ_ETERNAL is returned by cppc_get_transition_latency() to indicate an error condition (Rafael Wysocki) - Make cppc_get_transition_latency() return a negative error code to indicate error conditions instead of using CPUFREQ_ETERNAL for this purpose and drop CPUFREQ_ETERNAL that has no other users (Rafael Wysocki, Gopi Krishna Menon) - Fix device leak in the mediatek cpufreq driver (Johan Hovold) - Set target frequency on all CPUs sharing a policy during frequency updates in the tegra186 cpufreq driver and make it initialize all cores to max frequencies (Aaron Kling) - Rust cpufreq helper cleanup (Thorsten Blum) * pm-cpufreq: docs/zh_CN: Fix malformed table docs/zh_TW: Fix malformed table cpufreq: Drop unused symbol CPUFREQ_ETERNAL ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure commit 05f084d24e098d93c7b0803e32b9be9fff6ef490 Merge: 991053178e08fb 632d31067be2f4 92158fae2ed986 Author: Rafael J. Wysocki Date: Tue Oct 7 12:20:36 2025 +0200 Merge branches 'pm-core' and 'pm-runtime' Merge runtime PM framework updates and a core power management code fix for 6.18-rc1: - Make pm_runtime_put*() family of functions return 1 when the given device is already suspended which is consistent with the documentation (Brian Norris) - Add basic kunit tests for runtime PM API contracts and update return values in kerneldoc coments for the runtime PM API (Brian Norris, Dan Carpenter) - Add auto-cleanup macros for runtime PM "resume and get" and "get without resume" operations, use one of them in the PCI core and drop the existing "free" macro introduced for similar purpose, but somewhat cumbersome to use (Rafael Wysocki) - Make the core power management code avoid waiting on device links marked as SYNC_STATE_ONLY which is consistent with the handling of those device links elsewhere (Pin-yen Lin) * pm-core: PM: sleep: Do not wait on SYNC_STATE_ONLY device links * pm-runtime: PM: runtime: Fix error checking for kunit_device_register() PM: runtime: Introduce one more usage counter guard PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() PCI/sysfs: Use runtime PM guard macro for auto-cleanup PM: runtime: Add auto-cleanup macros for "resume and get" operations PM: runtime: Update kerneldoc return codes PM: runtime: Make put{,_sync}() return 1 when already suspended PM: runtime: Add basic kunit tests for API contracts commit b615879dbfea6cf1236acbc3f2fb25ae84e07071 Author: Jakub Kicinski Date: Fri Oct 3 09:47:48 2025 -0700 selftests: drv-net: make linters happy with our imports Linters are still not very happy with our __init__ files, which was pointed out in recent review (see Link). We have previously started importing things one by one to make linters happy with the test files (which import from __init__). But __init__ file itself still makes linters unhappy. To clean it up I believe we must completely remove the wildcard imports, and assign the imported modules to __all__. hds.py needs to be fixed because it seems to be importing the Python standard random from lib.net. We can't use ksft_pr() / ktap_result() in case importing from net.lib fails. Linters complain that those helpers themselves may not have been imported. Link: https://lore.kernel.org/9d215979-6c6d-4e9b-9cdd-39cff595866e@redhat.com Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251003164748.860042-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit c9d1b0b54258ba13b567dd116ead3c7c30cba7d8 Author: Daniel Machon Date: Fri Oct 3 14:35:59 2025 +0200 net: sparx5/lan969x: fix flooding configuration on bridge join/leave The sparx5 driver programs UC/MC/BC flooding in sparx5_update_fwd() by unconditionally applying bridge_fwd_mask to all flood PGIDs. Any bridge topology change that triggers sparx5_update_fwd() (for example enslaving another port) therefore reinstalls flooding in hardware for already bridged ports, regardless of their per-port flood flags. This results in clobbering of the flood masks, and desynchronization between software and hardware: the bridge still reports “flood off” for the port, but hardware has flooding enabled due to unconditional PGID reprogramming. Steps to reproduce: $ ip link add br0 type bridge $ ip link set br0 up $ ip link set eth0 master br0 $ ip link set eth0 up $ bridge link set dev eth0 flood off $ ip link set eth1 master br0 $ ip link set eth1 up At this point, flooding is silently re-enabled for eth0. Software still shows “flood off” for eth0, but hardware has flooding enabled. To fix this, flooding is now set explicitly during bridge join/leave, through sparx5_port_attr_bridge_flags(): On bridge join, UC/MC/BC flooding is enabled by default. On bridge leave, UC/MC/BC flooding is disabled. sparx5_update_fwd() no longer touches the flood PGIDs, clobbering the flood masks, and desynchronizing software and hardware. Initialization of the flooding PGIDs have been moved to sparx5_start(). This is required as flooding PGIDs defaults to 0x3fffffff in hardware and the initialization was previously handled in sparx5_update_fwd(), which was removed. With this change, user-configured flooding flags persist across bridge updates and are no longer overridden by sparx5_update_fwd(). Fixes: d6fce5141929 ("net: sparx5: add switching support") Signed-off-by: Daniel Machon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251003-fix-flood-fwd-v1-1-48eb478b2904@microchip.com Signed-off-by: Paolo Abeni commit 4dc8b26a3ac2cb79f19f252d9077696d3ef0823a Author: Maxime Chevallier Date: Fri Oct 3 09:03:06 2025 +0200 net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions When accessing an MDIO register using single-byte smbus accesses, we have to perform 2 consecutive operations targeting the same address, first accessing the MSB then the LSB of the 16 bit register: read_1_byte(addr); <- returns MSB of register at address 'addr' read_1_byte(addr); <- returns LSB Some PHY devices present in SFP such as the Broadcom 5461 don't like seeing foreign i2c transactions in-between these 2 smbus accesses, and will return the MSB a second time when trying to read the LSB : read_1_byte(addr); <- returns MSB i2c_transaction_for_other_device_on_the_bus(); read_1_byte(addr); <- returns MSB again Given the already fragile nature of accessing PHYs/SFPs with single-byte smbus accesses, it's safe to say that this Broadcom PHY may not be the only one acting like this. Let's therefore hold the i2c bus lock while performing our smbus transactions to avoid interleaved accesses. Fixes: d4bd3aca33c2 ("net: mdio: mdio-i2c: Add support for single-byte SMBus operations") Signed-off-by: Maxime Chevallier Reviewed-by: Kory Maincent Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251003070311.861135-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni commit f75e07bf5226da640fa99a0594687c780d9bace4 Author: Lucas Zampieri Date: Tue Sep 23 15:43:19 2025 +0100 irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume According to the PLIC specification[1], global interrupt sources are assigned small unsigned integer identifiers beginning at the value 1. An interrupt ID of 0 is reserved to mean "no interrupt". The current plic_irq_resume() and plic_irq_suspend() functions incorrectly start the loop from index 0, which accesses the register space for the reserved interrupt ID 0. Change the loop to start from index 1, skipping the reserved interrupt ID 0 as per the PLIC specification. This prevents potential undefined behavior when accessing the reserved register space during suspend/resume cycles. Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation") Co-developed-by: Jia Wang Signed-off-by: Jia Wang Co-developed-by: Charles Mirabile Signed-off-by: Charles Mirabile Signed-off-by: Lucas Zampieri Signed-off-by: Thomas Gleixner Link: https://github.com/riscv/riscv-plic-spec/releases/tag/1.0.0 commit 196754c2a04a8ba682b00ea7c818897295c98967 Author: Dan Carpenter Date: Sat Sep 27 15:26:05 2025 +0300 irqchip/aspeed-scu-ic: Fix an IS_ERR() vs NULL check of_iomap() doesn't return error pointers, it returns NULL. Fix the error checking to check for NULL pointers. Fixes: 86cd4301c285 ("irqchip/aspeed-scu-ic: Refactor driver to support variant-based initialization") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner commit 23f3770e1a53e6c7a553135011f547209e141e72 Author: Daniel Borkmann Date: Fri Oct 3 09:34:18 2025 +0200 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Reported-by: Yusuke Suzuki Reported-by: Julian Wiedmann Signed-off-by: Daniel Borkmann Cc: Martin KaFai Lau Cc: Jakub Kicinski Cc: Jordan Rife Reviewed-by: Simon Horman Reviewed-by: Jordan Rife Reviewed-by: Jakub Kicinski Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 7c3321f3d279eda7f7d622312ffdbb889f3bec97 Author: Jingyi Wang Date: Wed Sep 24 16:29:01 2025 -0700 scsi: ufs: phy: dt-bindings: Add QMP UFS PHY compatible for Kaanapali Document the QMP UFS PHY compatible for Qualcomm Kaanapali to support physical layer functionality for UFS found on the SoC. Use fallback to indicate the compatibility of the QMP UFS PHY on the Kaanapali with that on the SM8750. Signed-off-by: Jingyi Wang Acked-by: Konrad Dybcio Signed-off-by: Martin K. Petersen commit 6dfc353af575e33c94f5d740f7b0569fa9b784d9 Author: Nitin Rawat Date: Wed Sep 24 16:29:00 2025 -0700 scsi: ufs: qcom: dt-bindings: Document the Kaanapali UFS controller Document the UFS Controller on the Kaanapali Platform. Signed-off-by: Nitin Rawat Signed-off-by: Jingyi Wang Message-Id: <20250924-knp-ufs-v1-1-42e0955a1f7c@oss.qualcomm.com> Signed-off-by: Martin K. Petersen commit 120642726ecb1b7a266f5c21bec90821e1154509 Author: Dan Carpenter Date: Tue Sep 30 15:38:09 2025 +0300 scsi: libfc: Prevent integer overflow in fc_fcp_recv_data() The "offset" comes from the skb->data that we received. Here the code is verifying that "offset + len" is within bounds however it does not take integer overflows into account. Use size_add() to be safe. This would only be an issue on 32bit systems which are probably a very small percent of the users. Still, it's worth fixing just for correctness sake. Fixes: 42e9a92fe6a9 ("[SCSI] libfc: A modular Fibre Channel library") Signed-off-by: Dan Carpenter Message-Id: Signed-off-by: Martin K. Petersen commit 987da233b2982c686a8ea5cd4c76f0bd5e957ee3 Author: Alok Tiwari Date: Mon Sep 29 02:25:54 2025 -0700 scsi: qla4xxx: Fix typos in comments Fix several spelling mistakes in qla4xxx driver comments: "Unfortunely" -> "Unfortunately" "becase" -> "because" "funcions" -> "functions" "targer_id" -> "target_id" Signed-off-by: Alok Tiwari Signed-off-by: Martin K. Petersen commit b69ffeaa0ae43892683113b3f4ddf156398738b9 Author: Long Li Date: Wed Oct 1 22:05:30 2025 -0700 scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU When selecting an outgoing channel for I/O, storvsc tries to select a channel with a returning CPU that is not the same as issuing CPU. This worked well in the past, however it doesn't work well when the Hyper-V exposes a large number of channels (up to the number of all CPUs). Use a different CPU for returning channel is not efficient on Hyper-V. Change this behavior by preferring to the channel with the same CPU as the current I/O issuing CPU whenever possible. Tests have shown improvements in newer Hyper-V/Azure environment, and no regression with older Hyper-V/Azure environments. Tested-by: Raheel Abdul Faizy Signed-off-by: Long Li Message-Id: <1759381530-7414-1-git-send-email-longli@linux.microsoft.com> Signed-off-by: Martin K. Petersen commit 73bc073d4270b6b227d5545fc277c1f09a26a77a Merge: bae04c9658fc8e 1af59cd5cc2b65 Author: Dave Airlie Date: Tue Oct 7 11:50:02 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-10-03' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - Fix userptr to not allow device private pages with SVM (Thomas Hellström) Driver Changes: - Fix build with clang 16 (Michal Wajdeczko) - Fix handling of invalid configfs syntax usage and spell out the expected syntax in the documentation (Lucas De Marchi) - Do not try late bind firmware when running as VF since it shouldn't handle firmware loading (Michal Wajdeczko) - Fix idle assertion for local BOs (Thomas Hellström) - Fix uninitialized variable for late binding (Colin Ian King, Mallesh Koujalagi) - Do not require perfmon_capable to expose free memory at page granularity. Handle it like other drm drivers do (Matthew Auld) - Fix lock handling on suspend error path (Shuicheng Lin) - Fix I2C controller resume after S3 (Raag Jadav) Signed-off-by: Dave Airlie From: Lucas De Marchi Link: https://lore.kernel.org/r/q6yeyb7n2eqo5megxjqayooajirx5hhsntfo65m3y4myscz7oz@25qbabbbr4hj commit bae04c9658fc8ec1429a64636ff14b09c31ba1d8 Merge: b2ec5ca9d5c2c0 adefb2ccea1e96 Author: Dave Airlie Date: Tue Oct 7 11:35:38 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-10-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: v3d: - Fix fence locking Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20251002122303.GA21323@linux.fritz.box commit dbca0eabb821a6278925712a7bb263d0997e9c8f Author: Nicolas Frattaroli Date: Fri Oct 3 22:15:06 2025 +0200 mailbox: add MediaTek GPUEB IPI mailbox The MT8196 SoC uses an embedded MCU to control frequencies and power of the GPU. This controller is referred to as "GPUEB". It communicates to the application processor, among other ways, through a mailbox. The mailbox exposes one interrupt, which appears to only be fired when a response is received, rather than a transaction is completed. For us, this means we unfortunately need to poll for txdone. The mailbox also requires the EB clock to be on when touching any of the mailbox registers. Add a simple driver for it based on the common mailbox framework. Reviewed-by: Chia-I Wu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Jassi Brar commit d3e35a151a84ee607c817c08692dfd71568b3e0c Author: Nicolas Frattaroli Date: Fri Oct 3 22:15:05 2025 +0200 dt-bindings: mailbox: Add MT8196 GPUEB Mailbox The MediaTek MT8196 SoC includes an embedded MCU referred to as "GPUEB", acting as glue logic to control power and frequency of the Mali GPU. This MCU runs special-purpose firmware for this use, and the main application processor communicates with it through a mailbox. Add a binding that describes this mailbox. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Signed-off-by: Nicolas Frattaroli Signed-off-by: Jassi Brar commit bb160e791ab15b89188a7a19589b8e11f681bef3 Author: Harini T Date: Mon Sep 29 13:07:23 2025 +0530 mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash. Add explicit irq_type field to pdata for reliable identification of SGI interrupts (type-2) and only clean up SGI resources when appropriate. Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 0aead8197fc1a85b0a89646e418feb49a564b029 Author: Harini T Date: Mon Sep 29 13:07:22 2025 +0530 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond the allocated array bounds. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd Author: Harini T Date: Mon Sep 29 13:07:21 2025 +0530 mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes The ipi_mbox->dev.parent check is unreliable proxy for registration status as it fails to protect against probe failures that occur after the parent is assigned but before device_register() completes. device_is_registered() is the canonical and robust method to verify the registration status. Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes(). Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 Author: Harini T Date: Mon Sep 29 13:07:20 2025 +0530 mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call The controller is registered using the device-managed function 'devm_mbox_controller_register()'. As documented in mailbox.c, this ensures the devres framework automatically calls mbox_controller_unregister() when device_unregister() is invoked, making the explicit call unnecessary. Remove redundant mbox_controller_unregister() call as device_unregister() handles controller cleanup. Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Harini T Reviewed-by: Peng Fan Signed-off-by: Jassi Brar commit 60d7416d8eb46ef2e71bf3dc13cd0c5eefc2ef89 Author: Wolfram Sang Date: Wed Aug 13 18:14:53 2025 +0200 mailbox: remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Signed-off-by: Jassi Brar commit 426f4e9414df5d51e7bc6519edb82bccf07ce52f Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:39 2025 +0200 dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional The GCE Mailbox needs only one clock and the clock-names can be used only by the driver (which, for instance, does not use it), and this is true for all of the currently supported MediaTek SoCs. Stop requiring to specify clock-names on all non-MT8195 GCEs. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Acked-by: Rob Herring (Arm) Reviewed-by: Matthias Brugger Signed-off-by: Jassi Brar commit 526ce9eb455e03a6dcdbf9a6c57c777c06d1ddf2 Author: Sibi Sankar Date: Wed Sep 24 20:18:31 2025 +0530 dt-bindings: mailbox: qcom: Document Glymur CPUCP mailbox controller binding Document CPU Control Processor (CPUCP) mailbox controller for Qualcomm Glymur SoCs. It is software compatible with X1E80100 CPUCP mailbox controller hence fallback to it. Signed-off-by: Sibi Sankar Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 8ac2a8c4b3b5058be211f740f41e6da5380a3963 Author: Ang Tien Sung Date: Mon Aug 25 16:36:43 2025 +0800 MAINTAINERS: Change mailbox-altera maintainer Update the mailbox-alters maintainer from to as Tham mun yew is no longer with Altera. Signed-off-by: Ang Tien Sung Acked-by: Mun Yew Tham Signed-off-by: Jassi Brar commit d30352829667b92809ed4cb55844ea1841d146a6 Author: Liao Yuanhong Date: Mon Aug 11 16:25:36 2025 +0800 mailbox: arm_mhuv3: Remove no_free_ptr() to maintain the original form of the pointer Remove no_free_ptr() to ensure PTR_ERR() consistently retrieves the correct error code. Signed-off-by: Liao Yuanhong Acked-by: Cristian Marussi Signed-off-by: Jassi Brar commit 61da08ecb55264fa1e2c7b8c8a630bed716edbdb Author: Markus Elfring Date: Mon Oct 6 16:39:35 2025 -0500 smb: client: Use common code in cifs_lookup() Use three additional labels so that another bit of common code can be better reused at the end of this function implementation. Signed-off-by: Markus Elfring Signed-off-by: Steve French commit e7933f5b019c1daef0a138661d6e504f0259de98 Author: Markus Elfring Date: Sun Oct 5 19:01:48 2025 +0200 smb: client: Reduce the scopes for a few variables in two functions * cifs_lookup(): Move the definition for the local variable “cfid” into an else branch so that the corresponding setting will only be performed if a NULL inode was detected during lookup by this function. * cifs_d_revalidate(): Move the definition for the local variables “inode” and “rc” into an if branch so that the corresponding setting will only be performed after a d_really_is_positive() call. Move the definition for the local variable “cfid” into an else branch so that the corresponding setting will only be performed if further data processing will be needed for an open_cached_dir_by_dentry() call. Signed-off-by: Markus Elfring Acked-by: Henrique Carvalho Signed-off-by: Steve French commit c746c3b5169831d7fb032a1051d8b45592ae8d78 Merge: 81538c8e42806e 4335c4496b1bcf Author: Linus Torvalds Date: Mon Oct 6 13:53:19 2025 -0700 Merge tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two short fixes that would be good to have before rc1" * tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix PAGE_SIZE format specifier in open_ctree() btrfs: avoid potential out-of-bounds in btrfs_encode_fh() commit 81538c8e42806eed71ce125723877a7c2307370c Merge: 256e3417065b27 73cc6ec1a89a6c Author: Linus Torvalds Date: Mon Oct 6 13:22:21 2025 -0700 Merge tag 'nfsd-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Mike Snitzer has prototyped a mechanism for disabling I/O caching in NFSD. This is introduced in v6.18 as an experimental feature. This enables scaling NFSD in /both/ directions: - NFS service can be supported on systems with small memory footprints, such as low-cost cloud instances - Large NFS workloads will be less likely to force the eviction of server-local activity, helping it avoid thrashing Jeff Layton contributed a number of fixes to the new attribute delegation implementation (based on a pending Internet RFC) that we hope will make attribute delegation reliable enough to enable by default, as it is on the Linux NFS client. The remaining patches in this pull request are clean-ups and minor optimizations. Many thanks to the contributors, reviewers, testers, and bug reporters who participated during the v6.18 NFSD development cycle" * tag 'nfsd-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (42 commits) nfsd: discard nfserr_dropit SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it NFSD: Add io_cache_{read,write} controls to debugfs NFSD: Do the grace period check in ->proc_layoutget nfsd: delete unnecessary NULL check in __fh_verify() NFSD: Allow layoutcommit during grace period NFSD: Disallow layoutget during grace period sunrpc: fix "occurence"->"occurrence" nfsd: Don't force CRYPTO_LIB_SHA256 to be built-in nfsd: nfserr_jukebox in nlm_fopen should lead to a retry NFSD: Reduce DRC bucket size NFSD: Delay adding new entries to LRU SUNRPC: Move the svc_rpcb_cleanup() call sites NFS: Remove rpcbind cleanup for NFSv4.0 callback nfsd: unregister with rpcbind when deleting a transport NFSD: Drop redundant conversion to bool sunrpc: eliminate return pointer in svc_tcp_sendmsg() sunrpc: fix pr_notice in svc_tcp_sendto() to show correct length nfsd: decouple the xprtsec policy check from check_nfsd_access() NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() ... commit f3b601f900902ab80902c44f820a8985384ac021 Author: Vincent Minet Date: Mon Sep 22 07:37:02 2025 +0200 perf tools: Fix arm64 libjvmti build by generating unistd_64.h Since commit 22f72088ffe6 ("tools headers: Update the syscall table with the kernel sources") the arm64 syscall header is generated at build time. Later, commit bfb713ea53c7 ("perf tools: Fix arm64 build by generating unistd_64.h") added a dependency to libperf to guarantee that this header was created before building libperf or perf itself. However, libjvmti also requires this header but does not depend on libperf, leading to build failures such as: In file included from /usr/include/sys/syscall.h:24, from /usr/include/syscall.h:1, from jvmti/jvmti_agent.c:36: tools/arch/arm64/include/uapi/asm/unistd.h:2:10: fatal error: asm/unistd_64.h: No such file or directory 2 | #include Fix this by ensuring that libperf is built before libjvmti, so that unistd_64.h is always available. Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources") Cc: Namhyung Kim Cc: Vincent Minet Link: https://lore.kernel.org/r/20250922053702.2688374-1-v.minet@criteo.com Signed-off-by: Arnaldo Carvalho de Melo commit f07f91a36090b54076e89b46f159ea3a4b77fb2b Author: Jakub Kicinski Date: Fri Oct 3 14:01:27 2025 -0700 selftests: net: unify the Makefile formats We get a significant number of conflicts between net and net-next because of selftests Makefile changes. People tend to append new test cases at the end of the Makefile when there's no clear sort order. Sort all networking selftests Makefiles, use the following format: VAR_NAME := \ entry1 \ entry2 \ entry3 \ # end of VAR_NAME Some Makefiles are already pretty close to this. Acked-by: Antonio Quartulli Acked-by: Matthieu Baerts (NGI0) Acked-by: Allison Henderson Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251003210127.1021918-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2aa74c62589737054a6a8ba3c5b3d8cb10656737 Author: Jakub Kicinski Date: Fri Oct 3 13:57:36 2025 -0700 selftests: net: sort configs Sort config files for networking selftests. This should help us avoid merge conflicts between net and net-next. patchwork check will be added to prevent new issues. Acked-by: Phil Sutter Acked-by: Matthieu Baerts (NGI0) Acked-by: Florian Westphal Acked-by: Antonio Quartulli Link: https://patch.msgid.link/20251003205736.1019673-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b Author: Eric Dumazet Date: Fri Oct 3 18:41:19 2025 +0000 tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT on their listener, before accept(). This has an unfortunate effect on wscale selection in tcp_select_initial_window() during 3WHS. For instance, tcp_mmap was negotiating wscale 4, regardless of tcp_rmem[2] and sysctl_rmem_max. Do not change tp->window_clamp if it is zero or bigger than our computed value. Zero value is special, it allows tcp_select_initial_window() to enable autotuning. Note that SO_RCVLOWAT use on listener is probably not wise, because tp->scaling_ratio has a default value, possibly wrong. Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5205c3d002662093150fdcfd2a236ab897ffb5a5 Author: James Clark Date: Mon Oct 6 14:11:07 2025 +0100 perf tests: Don't retest sections in "Object code reading" We already only test each kcore map once, but on slow systems (particularly with network filesystems) even the non-kcore maps are slow. The test can test the same objdump output over and over which only wastes time. Generalize the skipping mechanism to track all DSOs and addresses so that each section is only tested once. On a fully loaded ARM Juno (simulating a parallel 'perf test' run) with a network filesystem, the original runtime is: real 1m51.126s user 0m19.445s sys 1m15.431s And the new runtime is: real 0m48.873s user 0m8.031s sys 0m32.353s Committer testing: # perf test "code read" 22: Object code reading : Ok # Reviewed-by: Ian Rogers Signed-off-by: James Clark Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 0a75ba3e842c73f60767333b349cf456dca74e1f Author: Leo Yan Date: Mon Oct 6 17:21:31 2025 +0100 perf docs: Document building with Clang Add example commands for building perf with Clang. Since recent Android NDK releases use Clang as the default compiler, a separate Android specific document is no longer needed; point to the general build documentation instead. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-9-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4772e66cb45e0dd2c3c9ac649532756c523afd1e Author: Leo Yan Date: Mon Oct 6 17:21:30 2025 +0100 perf build: Support build with clang Add support for building perf with clang. For cross compilation, the Makefile dynamically selects target flag for corresponding arch. This patch has been verified on x86_64 machine with Ubuntu distro, it can build successfully for native target, and for cross building Arm64 and s390. Example: native build on x86_64 / Ubuntu machine: $ HOSTCC=clang CC=clang CXX=clang++ make -C tools/perf Example: cross building s390 target on x86_64 / Ubuntu machine: # Install x390x cross toolchain and headers $ sudo apt-get install gcc-s390x-linux-gnu g++-s390x-linux-gnu \ libc6-dev-s390x-cross linux-libc-dev-s390x-cross # Build with clang $ HOSTCC=clang CC=clang CXX=clang++ \ ARCH=s390 CROSS_COMPILE=s390x-linux-gnu- \ make -C tools/perf NO_LIBELF=1 NO_LIBTRACEEVENT=1 NO_LIBPYTHON=1 Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-8-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 9ec46fc9380329de9dfd70de521e9da97cb4dfa8 Author: Leo Yan Date: Mon Oct 6 17:21:29 2025 +0100 perf test coresight: Dismiss clang warning for unroll loop thread clang-18.1.3 on Ubuntu 24.04.2 reports warning: unroll_loop_thread.c:35:25: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 35 | : /* in */ [in] "r" (in) | ^ unroll_loop_thread.c:39:1: warning: non-void function does not return a value [-Wreturn-type] 39 | } | ^ Use the modifier "w" for 32-bit register access and return NULL at the end of thread function. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-7-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 244a1ac76a671f100321ac2563b002b0354cbf42 Author: Leo Yan Date: Mon Oct 6 17:21:28 2025 +0100 perf test coresight: Dismiss clang warning for thread loop clang-18.1.3 on Ubuntu 24.04.2 reports warning: thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:37:8: note: use constraint modifier "w" 37 | "add %[i], %[i], #1\n" | ^~~~ | %w[i] thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:37:14: note: use constraint modifier "w" 37 | "add %[i], %[i], #1\n" | ^~~~ | %w[i] thread_loop.c:41:23: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:38:8: note: use constraint modifier "w" 38 | "cmp %[i], %[len]\n" | ^~~~ | %w[i] thread_loop.c:41:38: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] 41 | : /* in */ [i] "r" (i), [len] "r" (len) | ^ thread_loop.c:38:14: note: use constraint modifier "w" 38 | "cmp %[i], %[len]\n" | ^~~~~~ | %w[len] Use the modifier "w" for 32-bit register access. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-6-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 50b7e7082a3dde5bdba14a4e40a2e2279fd08a7b Author: Leo Yan Date: Mon Oct 6 17:21:27 2025 +0100 perf test coresight: Dismiss clang warning for memcpy thread clang-18.1.3 on Ubuntu 24.04.2 reports warning: memcpy_thread.c:30:1: warning: non-void function does not return a value in all control paths [-Wreturn-type] 30 | } | ^ Dismiss the warning with returning NULL from the thread function. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-5-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e7e86d7697c6ed1dbbde18d7185c35b6967945ed Author: Leo Yan Date: Mon Oct 6 17:21:26 2025 +0100 perf build: Disable thread safety analysis for perl header When build with perl5, it reports error: In file included from /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:7933: /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/inline.h:298:5: error: mutex 'PL_env_mutex.lock' is not held on every path through here [-Werror,-Wthread-safety-analysis] 298 | ENV_UNLOCK; | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:7091:31: note: expanded from macro 'ENV_UNLOCK' 7091 | # define ENV_UNLOCK PERL_REENTRANT_UNLOCK("env"... | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:6465:7: note: expanded from macro 'PERL_REENTRANT_UNLOCK' 6465 | } STMT_END | ^ /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/perl.h:865:28: note: expanded from macro 'STMT_END' 865 | # define STMT_END while (0) | ^ The error is caused by perl header but not perf code, disable thread safety analysis if including the header. Though GCC does not support the thread safety analysis option, this negative warning flag is silently ignored by it. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-4-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ed33e5e43c1e2b336fc172c8f7218520739ebd52 Author: Leo Yan Date: Mon Oct 6 17:21:25 2025 +0100 perf build: Correct CROSS_ARCH for clang Clang's -dumpmachine outputs "aarch64-unknown-linux-gnu", which does not match the MultiArch convention. This prevents the build system from detecting installed packages. Fix by stripping the trailing '-' from CROSS_COMPILE when setting CROSS_ARCH. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-3-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb Author: Leo Yan Date: Mon Oct 6 17:21:24 2025 +0100 perf python: split Clang options when invoking Popen When passing a list to subprocess.Popen, each element maps to one argv token. Current code bundles multiple Clang flags into a single element, something like: cmd = ['clang', '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch', 'test-hello.c'] So Clang only sees one long, invalid option instead of separate flags, as a result, the script cannot capture any log via PIPE. Fix this by using shlex.split() to separate the string so each option becomes its own argv element. The fixed list will be: cmd = ['clang', '--target=x86_64-linux-gnu', '-fintegrated-as', '-Wno-cast-function-type-mismatch', 'test-hello.c'] Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f Author: Leo Yan Date: Mon Oct 6 17:21:23 2025 +0100 tools build: Align warning options with perf The feature test programs are built without enabling '-Wall -Werror' options. As a result, a feature may appear to be available, but later building in perf can fail with stricter checks. Make the feature test program use the same warning options as perf. Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Nick Desaulniers Cc: Justin Stitt Cc: Bill Wendling Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nathan Chancellor Cc: James Clark Cc: linux-riscv@lists.infradead.org Cc: llvm@lists.linux.dev Cc: Paul Walmsley Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit e3b08a0664057bd89c72ee1ec312462ed3e37ca0 Author: Ian Rogers Date: Sun Oct 5 14:22:09 2025 -0700 perf disasm: Remove unused evsel from 'struct annotate_args' Set in symbol__annotate() but never used. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 257046a36750a6db6e0bab4612d7c8f9774b6b83 Author: Ian Rogers Date: Sun Oct 5 14:22:08 2025 -0700 perf srcline: Fallback between addr2line implementations Factor the addr2line function implementation into separate source files (addr2line.[ch]) and rename the addr2line function cmd__addr2line. In srcline replace the ifdef-ed addr2line implementations with one that first tries the llvm__addr2line implementation, then the deprecated libbfd__addr2line function and on failure uses cmd__addr2line. If HAVE_LIBLLVM_SUPPORT is enabled the llvm__addr2line will execute against the libLLVM.so it is linked against. If HAVE_LIBLLVM_DYNAMIC is enabled then libperf-llvm.so (that links against libLLVM.so) will be dlopened. If the dlopen succeeds then the behavior should match HAVE_LIBLLVM_SUPPORT. On failure cmd__addr2line is used. The dlopen is only tried once. If HAVE_LIBLLVM_DYNAMIC isn't enabled then llvm__addr2line immediately fails and cmd__addr2line is used. Clean up the dso__free_a2l logic, which is only needed in the non-LLVM version and moved to addr2line.c. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 256e3417065b2721f77bcd37331796b59483ef3b Merge: fb5bc347311b1d 6b36119b94d0b2 Author: Linus Torvalds Date: Mon Oct 6 12:37:34 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull x86 kvm updates from Paolo Bonzini: "Generic: - Rework almost all of KVM's exports to expose symbols only to KVM's x86 vendor modules (kvm-{amd,intel}.ko and PPC's kvm-{pr,hv}.ko x86: - Rework almost all of KVM x86's exports to expose symbols only to KVM's vendor modules, i.e. to kvm-{amd,intel}.ko - Add support for virtualizing Control-flow Enforcement Technology (CET) on Intel (Shadow Stacks and Indirect Branch Tracking) and AMD (Shadow Stacks). It is worth noting that while SHSTK and IBT can be enabled separately in CPUID, it is not really possible to virtualize them separately. Therefore, Intel processors will really allow both SHSTK and IBT under the hood if either is made visible in the guest's CPUID. The alternative would be to intercept XSAVES/XRSTORS, which is not feasible for performance reasons - Fix a variety of fuzzing WARNs all caused by checking L1 intercepts when completing userspace I/O. KVM has already committed to allowing L2 to to perform I/O at that point - Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 guests, as the MSR is supposed to exist for v2 PMUs - Allow Centaur CPU leaves (base 0xC000_0000) for Zhaoxin CPUs - Add support for the immediate forms of RDMSR and WRMSRNS, sans full emulator support (KVM should never need to emulate the MSRs outside of forced emulation and other contrived testing scenarios) - Clean up the MSR APIs in preparation for CET and FRED virtualization, as well as mediated vPMU support - Clean up a pile of PMU code in anticipation of adding support for mediated vPMUs - Reject in-kernel IOAPIC/PIT for TDX VMs, as KVM can't obtain EOI vmexits needed to faithfully emulate an I/O APIC for such guests - Many cleanups and minor fixes - Recover possible NX huge pages within the TDP MMU under read lock to reduce guest jitter when restoring NX huge pages - Return -EAGAIN during prefault if userspace concurrently deletes/moves the relevant memslot, to fix an issue where prefaulting could deadlock with the memslot update x86 (AMD): - Enable AVIC by default for Zen4+ if x2AVIC (and other prereqs) is supported - Require a minimum GHCB version of 2 when starting SEV-SNP guests via KVM_SEV_INIT2 so that invalid GHCB versions result in immediate errors instead of latent guest failures - Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents unauthorized CPU accesses from reading the ciphertext of SNP guest private memory, e.g. to attempt an offline attack. This feature splits the shared SEV-ES/SEV-SNP ASID space into separate ranges for SEV-ES and SEV-SNP guests, therefore a new module parameter is needed to control the number of ASIDs that can be used for VMs with CipherText Hiding vs. how many can be used to run SEV-ES guests - Add support for Secure TSC for SEV-SNP guests, which prevents the untrusted host from tampering with the guest's TSC frequency, while still allowing the the VMM to configure the guest's TSC frequency prior to launch - Validate the XCR0 provided by the guest (via the GHCB) to avoid bugs resulting from bogus XCR0 values - Save an SEV guest's policy if and only if LAUNCH_START fully succeeds to avoid leaving behind stale state (thankfully not consumed in KVM) - Explicitly reject non-positive effective lengths during SNP's LAUNCH_UPDATE instead of subtly relying on guest_memfd to deal with them - Reload the pre-VMRUN TSC_AUX on #VMEXIT for SEV-ES guests, not the host's desired TSC_AUX, to fix a bug where KVM was keeping a different vCPU's TSC_AUX in the host MSR until return to userspace KVM (Intel): - Preparation for FRED support - Don't retry in TDX's anti-zero-step mitigation if the target memslot is invalid, i.e. is being deleted or moved, to fix a deadlock scenario similar to the aforementioned prefaulting case - Misc bugfixes and minor cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (142 commits) KVM: x86: Export KVM-internal symbols for sub-modules only KVM: x86: Drop pointless exports of kvm_arch_xxx() hooks KVM: x86: Move kvm_intr_is_single_vcpu() to lapic.c KVM: Export KVM-internal symbols for sub-modules only KVM: s390/vfio-ap: Use kvm_is_gpa_in_memslot() instead of open coded equivalent KVM: VMX: Make CR4.CET a guest owned bit KVM: selftests: Verify MSRs are (not) in save/restore list when (un)supported KVM: selftests: Add coverage for KVM-defined registers in MSRs test KVM: selftests: Add KVM_{G,S}ET_ONE_REG coverage to MSRs test KVM: selftests: Extend MSRs test to validate vCPUs without supported features KVM: selftests: Add support for MSR_IA32_{S,U}_CET to MSRs test KVM: selftests: Add an MSR test to exercise guest/host and read/write KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors KVM: x86: Define Control Protection Exception (#CP) vector KVM: x86: Add human friendly formatting for #XM, and #VE KVM: SVM: Enable shadow stack virtualization for SVM KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid KVM: SVM: Pass through shadow stack MSRs as appropriate KVM: SVM: Update dump_vmcb with shadow stack save area additions KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02 ... commit fa770f1a9d40c99be4e7404c4a4bf77f50b0c892 Author: Ian Rogers Date: Sun Oct 5 14:22:07 2025 -0700 perf disasm: Make ins__scnprintf() and ins__is_nop() static Reduce the scope of ins__scnprintf() and ins__is_nop() that aren't used outside of disasm.c. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit bca753204e9eab3bd56907ec5f5ed151094d7742 Author: Ian Rogers Date: Sun Oct 5 14:22:06 2025 -0700 perf dso: Clean up read_symbol() error handling Ensure errno is set and return to caller for error handling. Unusually for perf the value isn't negated as expected by symbol__strerror_disassemble(). Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit aa04707f507e0f8161d1d8a4cef748a3d66b189a Author: Ian Rogers Date: Sun Oct 5 14:22:05 2025 -0700 perf dso: Support BPF programs in dso__read_symbol() Set the buffer to the code in the BPF linear info. This enables BPF JIT code disassembly by LLVM and capstone. Move the common but minimal disassmble_bpf_image call to disassemble_objdump so that it is only called after falling back to the objdump option. Similarly move the disassmble_bpf function to disassemble_objdump and rename to disassmble_bpf_libbfd to make it clearer that this support relies on libbfd. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 9518e10c2b399cb97eb527f2a67a8d97f11c1910 Author: Ian Rogers Date: Sun Oct 5 14:22:04 2025 -0700 perf dso: Move read_symbol() from llvm/capstone to dso Move the read_symbol function to dso.h, make the return type const and add a mutable out_buf out parameter. In future changes this will allow a code pointer to be returned without necessary allocating memory. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 0e52f3f9f15fdf914247f514f46d14b4fa4b2cbb Author: Ian Rogers Date: Sun Oct 5 14:22:03 2025 -0700 perf llvm: Reduce LLVM initialization Move the 3 LLVM initialization routines to be called in a single init_llvm function that has its own bool to avoid repeated initialization. Reduce the scope of triplet and avoid copying strings for x86. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan [ Move init_llvm() under HAVE_LIBLLVM_SUPPORT to fix the build ] Signed-off-by: Arnaldo Carvalho de Melo commit fb5bc347311b1d78dc608c91c2d68327b0a1d1d4 Merge: fc282d1731ec46 032676ff8217ca Author: Linus Torvalds Date: Mon Oct 6 12:18:56 2025 -0700 Merge tag 'loongarch-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Initialize acpi_gbl_use_global_lock to false - Allow specify SIMD width via kernel parameters - Add kexec_file (both EFI & ELF format) support - Add PER_VMA_LOCK for page fault handling support - Improve BPF trampoline support - Update the default config file - Some bug fixes and other small changes * tag 'loongarch-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (23 commits) LoongArch: Update Loongson-3 default config file LoongArch: BPF: Sign-extend struct ops return values properly LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() LoongArch: BPF: Make trampoline size stable LoongArch: BPF: Don't align trampoline size LoongArch: BPF: No support of struct argument in trampoline programs LoongArch: BPF: No text_poke() for kernel text LoongArch: BPF: Remove duplicated bpf_flush_icache() LoongArch: BPF: Remove duplicated flags check LoongArch: BPF: Fix uninitialized symbol 'retval_off' LoongArch: BPF: Optimize sign-extention mov instructions LoongArch: Handle new atomic instructions for probes LoongArch: Try VMA lock-based page fault handling first LoongArch: Automatically disable kaslr if boot from kexec_file LoongArch: Add crash dump support for kexec_file LoongArch: Add ELF binary support for kexec_file LoongArch: Add EFI binary support for kexec_file LoongArch: Add preparatory infrastructure for kexec_file LoongArch: Add struct loongarch_image_header for kernel LoongArch: Allow specify SIMD width via kernel parameters ... commit 95920c2ed02bde551ab654e9749c2ca7bc3100e0 Author: Toke Høiland-Jørgensen Date: Tue Sep 30 13:43:29 2025 +0200 page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine. Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages. The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives. Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages. v2: - Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap Link: https://lore.kernel.org/all/aMNJMFa5fDalFmtn@p100/ Fixes: ee62ce7a1d90 ("page_pool: Track DMA-mapped pages and unmap them when destroying the pool") Cc: stable@vger.kernel.org # 6.15+ Tested-by: Helge Deller Signed-off-by: Toke Høiland-Jørgensen Reviewed-by: Mina Almasry Tested-by: Helge Deller Link: https://patch.msgid.link/20250930114331.675412-1-toke@redhat.com Signed-off-by: Jakub Kicinski commit fc282d1731ec4686c1a84f8aca50c0c421e593b5 Merge: ba9dac987319d4 e66ae377fe219c Author: Linus Torvalds Date: Mon Oct 6 12:10:55 2025 -0700 Merge tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull uml updates from Johannes Berg: - minor preparations for SMP support - SPARSE_IRQ support for kunit - help output cleanups * tag 'uml-for-linux-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Remove unused ipi_pipe field from cpuinfo_um um: Remove unused cpu_data and current_cpu_data macros um: Stop tracking virtual CPUs via mm_cpumask() um: Centralize stub size calculations um: Remove outdated comment about STUB_DATA_PAGES um: Remove unused offset and child_err fields from stub_data um: Indent time-travel help messages um: Fix help message for ssl-non-raw um: vector: Fix indentation for help message um: Add missing trailing newline to help messages um: virtio-pci: implement .shutdown() um: Support SPARSE_IRQ commit 66128f4287b04aef4d4db9bf5035985ab51487d5 Author: Geert Uytterhoeven Date: Mon Oct 6 14:33:42 2025 +0200 kbuild: uapi: Strip comments before size type check On m68k, check_sizetypes in headers_check reports: ./usr/include/asm/bootinfo-amiga.h:17: found __[us]{8,16,32,64} type without #include This header file does not use any of the Linux-specific integer types, but merely refers to them from comments, so this is a false positive. As of commit c3a9d74ee413bdb3 ("kbuild: uapi: upgrade check_sizetypes() warning to error"), this check was promoted to an error, breaking m68k all{mod,yes}config builds. Fix this by stripping simple comments before looking for Linux-specific integer types. Signed-off-by: Geert Uytterhoeven Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/949f096337e28d50510e970ae3ba3ec9c1342ec0.1759753998.git.geert@linux-m68k.org [nathan: Adjust comment and remove unnecessary escaping from slashes in regex] Signed-off-by: Nathan Chancellor commit e444c2d4a2b5fe65759ba826d7444bb83fc4fc16 Author: Ian Rogers Date: Sun Oct 5 14:22:02 2025 -0700 perf check: Add libLLVM feature Advertise when perf is built with the HAVE_LIBLLVM_SUPPORT option. Committer testing: $ perf -vv | grep LLVM libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT $ And the form to use in scripts, notably the tools/perf/tests/shell/ 'perf test' ones: $ perf check feature libllvm libLLVM: [ on ] # HAVE_LIBLLVM_SUPPORT $ perf check -q feature libllvm && echo LLVM is present LLVM is present $ perf check -q feature liballvm && echo ALLVM is present $ Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a Author: Erick Karanja Date: Thu Oct 2 20:46:17 2025 +0300 net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe Add missing of_node_put call to release device node tbi obtained via for_each_child_of_node. Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes") Signed-off-by: Erick Karanja Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com Signed-off-by: Jakub Kicinski commit ba9dac987319d4f3969691dcf366ef19c9ed8281 Merge: 169c9d06a26567 5c34f2b6f89ad4 Author: Linus Torvalds Date: Mon Oct 6 11:17:18 2025 -0700 Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: "Primarily bug fixes. Dave introduced the usage of cleanup.h a bit late in the cycle to help with the new label work required within CXL [1] nvdimm: - Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - Clean up __nd_ioctl() and remove gotos - Remove duplicate linux/slab.h header - Introduce guard() for nvdimm_bus_lock - Use str_plural() to simplify the code ACPI: - NFIT: Fix incorrect ndr_desc being reportedin dev_err message" Link: https://lore.kernel.org/all/20250917134116.1623730-1-s.neeraj@samsung.com/ [1] * tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Remove duplicate linux/slab.h header nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() nvdimm: Clean up __nd_ioctl() and remove gotos nvdimm: Introduce guard() for nvdimm_bus_lock ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message nvdimm: Use str_plural() to simplify the code commit 2db687f3469dbc5c59bc53d55acafd75d530b497 Author: Haotian Zhang Date: Wed Oct 1 19:53:36 2025 +0800 ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same index to return -EBUSY, potentially leading to NULL pointer dereferences. Reorder the operations as suggested by Przemek Kitszel: 1. Check if adapter already exists (xa_load) 2. Reserve the XArray slot (xa_reserve) 3. Allocate the adapter (ice_adapter_new) 4. Store the adapter (xa_store) Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed") Suggested-by: Przemek Kitszel Suggested-by: Jacob Keller Signed-off-by: Haotian Zhang Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 7fc25c5a5ae6230d14b4c088fc94dbd58b2a9f3a Author: Sidharth Seela Date: Wed Oct 1 18:01:08 2025 +0530 selftest: net: ovpn: Fix uninit return values Fix functions that return undefined values. These issues were caught by running clang using LLVM=1 option. Clang warnings are as follows: ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 1587 | if (!sock) { | ^~~~~ ovpn-cli.c:1635:9: note: uninitialized use occurs here 1635 | return ret; | ^~~ ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false 1587 | if (!sock) { | ^~~~~~~~~~~~ 1588 | fprintf(stderr, "cannot allocate netlink socket\n"); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1589 | goto err_free; | ~~~~~~~~~~~~~~ 1590 | } | ~ ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning 1584 | int mcid, ret; | ^ | = 0 ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 2107 | case CMD_INVALID: | ^~~~~~~~~~~ ovpn-cli.c:2111:9: note: uninitialized use occurs here 2111 | return ret; | ^~~ ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning 1939 | int n, ret; | ^ | Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module") Signed-off-by: Sidharth Seela Link: https://patch.msgid.link/20251001123107.96244-2-sidharthseela@gmail.com Signed-off-by: Jakub Kicinski commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 Author: Duoming Zhou Date: Wed Oct 1 09:11:49 2025 +0800 net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workqueue() does wait for all pending work items in the work queue to complete before destroying the work queue, it cannot prevent the delayed work item from being rescheduled within the ocelot_check_stats_work() function. This limitation exists because the delayed work item is only enqueued into the work queue after its timer expires. Before the timer expiration, destroy_workqueue() has no visibility of this pending work item. Once the work queue appears empty, destroy_workqueue() proceeds with destruction. When the timer eventually expires, the delayed work item gets queued again, leading to the following warning: workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 ... RIP: 0010:__queue_work+0x875/0xaf0 ... RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0 FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0 Call Trace: ? kasan_report+0xc6/0xf0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? __pfx_delayed_work_timer_fn+0x10/0x10 call_timer_fn+0x25/0x1c0 __run_timer_base.part.0+0x3be/0x8c0 ? __pfx_delayed_work_timer_fn+0x10/0x10 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x1c0/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... The following diagram reveals the cause of the above warning: CPU 0 (remove) | CPU 1 (delayed work callback) mscc_ocelot_remove() | ocelot_deinit() | ocelot_check_stats_work() ocelot_stats_deinit() | cancel_delayed_work()| ... | queue_delayed_work() destroy_workqueue() | (wait a time) | __queue_work() //UAF The above scenario actually constitutes a UAF vulnerability. The ocelot_stats_deinit() is only invoked when initialization failure or resource destruction, so we must ensure that any delayed work items cannot be rescheduled. Replace cancel_delayed_work() with disable_delayed_work_sync() to guarantee proper cancellation of the delayed work item and ensure completion of any currently executing work before the workqueue is deallocated. A deadlock concern was considered: ocelot_stats_deinit() is called in a process context and is not holding any locks that the delayed work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated ocelot-switch device by writing a kernel module and prepared the necessary resources for the virtual ocelot-switch device's probe process. Then, removing the virtual device will trigger the mscc_ocelot_remove() function, which in turn destroys the workqueue. Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c Author: Kuniyuki Iwashima Date: Wed Oct 1 23:37:54 2025 +0000 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket. After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk. Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk. Let's remove reqsk_fastopen_remove() in tcp_conn_request(). Note that other callers make sure tp->fastopen_rsk is not NULL. [0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 370e98728bda92b1bdffb448d1acdcbe19dadb4c Author: Sammy Hsu Date: Thu Oct 2 10:48:41 2025 +0800 net: wwan: t7xx: add support for HP DRMR-H01 add support for HP DRMR-H01 (0x03f0, 0x09c8) Signed-off-by: Sammy Hsu Link: https://patch.msgid.link/20251002024841.5979-1-sammy.hsu@wnc.com.tw Signed-off-by: Jakub Kicinski commit 2f3119686ef50319490ccaec81a575973da98815 Author: Alexandr Sapozhnikov Date: Thu Oct 2 12:14:47 2025 +0300 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function. Signed-off-by: Alexandr Sapozhnikov Acked-by: Xin Long Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com Signed-off-by: Jakub Kicinski commit 112104e2b72c5c7ba1590e3a5614b2ff76474f14 Merge: f35f83208c7735 7d85cd8730ab77 Author: Stephen Boyd Date: Mon Oct 6 13:00:55 2025 -0500 Merge branch 'clk-determine-rate' into clk-next * clk-determine-rate: (120 commits) clk: microchip: core: remove duplicate roclk_determine_rate() clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: scmi: migrate round_rate() to determine_rate() clk: ti: fapll: convert from round_rate() to determine_rate() clk: ti: dra7-atl: convert from round_rate() to determine_rate() clk: ti: divider: convert from round_rate() to determine_rate() clk: ti: composite: convert from round_rate() to determine_rate() clk: ti: dpll: convert from round_rate() to determine_rate() clk: ti: dpll: change error return from ~0 to -EINVAL clk: ti: dpll: remove round_rate() in favor of determine_rate() clk: tegra: tegra210-emc: convert from round_rate() to determine_rate() clk: tegra: super: convert from round_rate() to determine_rate() clk: tegra: pll: convert from round_rate() to determine_rate() clk: tegra: periph: divider: convert from round_rate() to determine_rate() clk: tegra: divider: convert from round_rate() to determine_rate() clk: tegra: audio-sync: convert from round_rate() to determine_rate() clk: fixed-factor: drop round_rate() clk ops clk: divider: remove round_rate() in favor of determine_rate() clk: visconti: pll: convert from round_rate() to determine_rate() clk: versatile: vexpress-osc: convert from round_rate() to determine_rate() ... commit f35f83208c7735a3ed03629f934bb7ebbcf2ddf9 Merge: 8397c58ea73ebd decdff7db9d18a 383c4ff4987f65 Author: Stephen Boyd Date: Mon Oct 6 13:00:50 2025 -0500 Merge branches 'clk-aspeed' and 'clk-rockchip' into clk-next * clk-aspeed: reset: aspeed: register AST2700 reset auxiliary bus device dt-bindings: clock: ast2700: modify soc0/1 clock define * clk-rockchip: clk: rockchip: rk3368: use clock ids for SCLK_MIPIDSI_24M dt-bindings: clock: rk3368: Add SCLK_MIPIDSI_24M commit 169c9d06a2656772285d3dd2c387e338b2e2b915 Merge: 2f2c7254931f41 c64c2a50cdd487 Author: Linus Torvalds Date: Mon Oct 6 11:00:30 2025 -0700 Merge tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - renesas,wdt: Add support for RZ/T2H and RZ/N2H - Add SMARC-sAM67 support - Several small fixes and improvements * tag 'linux-watchdog-6.18-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog/hpwdt New maintianer dt-bindings: watchdog: add SMARC-sAM67 support watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog watchdog: visconti: don't print superfluous errors watchdog: rzv2h_wdt: don't print superfluous errors watchdog: rzg2l_wdt: don't print superfluous errors watchdog: s3c2410_wdt: exynosautov9: Enable supported features watchdog: s3c2410_wdt: exynosautov920: Enable QUIRK_HAS_32BIT_CNT watchdog: s3c2410_wdt: Increase max timeout value of watchdog watchdog: s3c2410_wdt: Fix max_timeout being calculated larger watchdog: s3c2410_wdt: Replace hardcoded values with macro definitions watchdog: rzv2h: Improve error strings and add newlines watchdog: rzv2h: Add support for RZ/T2H watchdog: rzv2h: Add support for configurable count clock source watchdog: rzv2h: Make "oscclk" and reset controller optional watchdog: rzv2h: Obtain clock-divider and timeout values from OF match data dt-bindings: watchdog: renesas,wdt: Add support for RZ/T2H and RZ/N2H watchdog: intel_oc_wdt: Do not try to write into const memory commit 8397c58ea73ebd1236820093b57ea4664f4d21b4 Merge: b91217d9124f7c a787ab591c38ef 7c2e86f7b5af93 2f66f069999dda 74743c53a19fb7 Author: Stephen Boyd Date: Mon Oct 6 13:00:22 2025 -0500 Merge branches 'clk-marvell', 'clk-xilinx', 'clk-mediatek' and 'clk-loongson' into clk-next - Add Mediatek MT8196 clk drivers * clk-marvell: clk: mmp: pxa1908: Instantiate power driver through auxiliary bus * clk-xilinx: clk: clocking-wizard: Fix output clock register offset for Versal platforms clk: xilinx: Optimize divisor search in clk_wzrd_get_divisors_ver() * clk-mediatek: (31 commits) clk: mediatek: Add MT8196 vencsys clock support clk: mediatek: Add MT8196 vdecsys clock support clk: mediatek: Add MT8196 ovl1 clock support clk: mediatek: Add MT8196 ovl0 clock support clk: mediatek: Add MT8196 disp-ao clock support clk: mediatek: Add MT8196 disp1 clock support clk: mediatek: Add MT8196 disp0 clock support clk: mediatek: Add MT8196 mfg clock support clk: mediatek: Add MT8196 mdpsys clock support clk: mediatek: Add MT8196 mcu clock support clk: mediatek: Add MT8196 I2C clock support clk: mediatek: Add MT8196 pextpsys clock support clk: mediatek: Add MT8196 ufssys clock support clk: mediatek: Add MT8196 peripheral clock support clk: mediatek: Add MT8196 vlpckgen clock support clk: mediatek: Add MT8196 topckgen2 clock support clk: mediatek: Add MT8196 topckgen clock support clk: mediatek: Add MT8196 apmixedsys clock support dt-bindings: clock: mediatek: Describe MT8196 clock controllers clk: mediatek: clk-mtk: Add MUX_DIV_GATE macro ... * clk-loongson: clk: loongson2: Add clock definitions for Loongson-2K0300 SoC clk: loongson2: Avoid hardcoding firmware name of the reference clock clk: loongson2: Allow zero divisors for dividers clk: loongson2: Support scale clocks with an alternative mode clk: loongson2: Allow specifying clock flags for gate clock dt-bindings: clock: loongson2: Add Loongson-2K0300 compatible commit b91217d9124f7cef7d0f699f7ff6ea96423f29f8 Merge: f0fd24820436d2 1803012a892921 4bf2d2744e6418 099760708aa377 Author: Stephen Boyd Date: Mon Oct 6 13:00:12 2025 -0500 Merge branches 'clk-microchip', 'clk-lookup' and 'clk-st' into clk-next - Speed up clk_core_lookup() by using a hashtable * clk-microchip: ARM: at91: remove default values for PMC_PLL_ACR clk: at91: add ACR in all PLL settings clk: at91: sam9x7: Add peripheral clock id for pmecc clk: at91: clk-master: Add check for divide by 3 clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register ARM: at91: pm: save and restore ACR during PLL disable/enable * clk-lookup: clk: Use hashtable for global clk lookups clk: Sort include statements * clk-st: dt-bindings: stm32: cosmetic fixes for STM32MP25 clock and reset bindings clk: stm32: introduce clocks for STM32MP21 platform dt-bindings: stm32: add STM32MP21 clocks and reset bindings commit f0fd24820436d2ee4d622080216ac563f7aa59cd Merge: c1e102f349bee5 18db1ff2dea0f9 575e9a62b8cace 6526402b9bac87 Author: Stephen Boyd Date: Mon Oct 6 12:57:03 2025 -0500 Merge branches 'clk-scmi', 'clk-qcom' and 'clk-broadcom' into clk-next * clk-scmi: clk: scmi: Add duty cycle ops only when duty cycle is supported * clk-qcom: (27 commits) clk: qcom: gcc-sc8280xp: drop obsolete PCIe GDSC comment clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk clk: qcom: dispcc-glymur: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock controller found on MSM8937 dt-bindings: clock: qcom: Add MSM8937 Global Clock Controller clk: qcom: Select the intended config in QCS_DISPCC_615 clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() clk: qcom: alpha-pll: convert from round_rate() to determine_rate() clk: qcom: milos: Constify 'struct qcom_cc_desc' clk: qcom: gcc: Add support for Global Clock Controller dt-bindings: clock: qcom: document the Glymur Global Clock Controller clk: qcom: clk-alpha-pll: Add support for Taycan EKO_T PLL clk: qcom: rpmh: Add support for Glymur rpmh clocks clk: qcom: Add TCSR clock driver for Glymur SoC dt-bindings: clock: qcom: Document the Glymur SoC TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add support for Glymur SoCs clk: qcom: dispcc-glymur: Add support for Display Clock Controller dt-bindings: clock: Add DISPCC and reset controller for GLYMUR SoC clk: qcom: gcc-sdm660: Add missing LPASS/CDSP vote clocks dt-bindings: clock: gcc-sdm660: Add LPASS/CDSP vote clocks/GDSCs ... * clk-broadcom: clk: bcm: rpi: Maximize V3D clock clk: bcm: rpi: Turn firmware clock on/off when preparing/unpreparing clk: bcm: rpi: Add missing logs if firmware fails commit c1e102f349bee5ae73e326339ea45daff4847b71 Merge: 3aae991cc2ce76 acf800c8fc567b 597fe80ba3fc55 048546931339b3 Author: Stephen Boyd Date: Mon Oct 6 12:56:54 2025 -0500 Merge branches 'clk-imx', 'clk-allwinner' and 'clk-ti' into clk-next * clk-imx: clk: imx95-blk-ctl: Save/restore registers when RPM routines are called clk: imx95-blk-ctl: Save platform data in imx95_blk_ctl structure * clk-allwinner: clk: sunxi-ng: add support for the A523/T527 MCU CCU clk: sunxi-ng: div: support power-of-two dividers clk: sunxi-ng: sun55i-a523-ccu: Add missing NPU module clock dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock clk: sunxi-ng: sun6i-rtc: Add A523 specifics * clk-ti: clk: keystone: sci-clk: use devm_kmemdup_array() clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled commit 3aae991cc2ce76deb1034d37021e3ab511c02b3a Merge: ec7336475d5257 823699ccbf0f37 ccd74beccdacda 7e2e4e32cd47a4 Author: Stephen Boyd Date: Mon Oct 6 12:56:46 2025 -0500 Merge branches 'clk-samsung', 'clk-tegra' and 'clk-amlogic' into clk-next * clk-samsung: clk: s2mps11: add support for S2MPG10 PMIC clock dt-bindings: clock: samsung,s2mps11: add s2mpg10 clk: samsung: exynos990: Add PERIC0 and PERIC1 clock support dt-bindings: clock: exynos990: Add PERIC0 and PERIC1 clock units clk: samsung: exynos990: Add missing USB clock registers to HSI0 clk: samsung: exynos990: Add LHS_ACEL gate clock for HSI0 and update CLK_NR_TOP dt-bindings: clock: exynos990: Add LHS_ACEL clock ID for HSI0 block clk: samsung: artpec-8: Add initial clock support for ARTPEC-8 SoC clk: samsung: Add clock PLL support for ARTPEC-8 SoC dt-bindings: clock: Add ARTPEC-8 clock controller clk: samsung: exynos990: Add DPU_BUS and CMUREF mux/div and update CLKS_NR_TOP dt-bindings: clock: exynos990: Extend clocks IDs clk: samsung: exynos990: Replace bogus divs with fixed-factor clocks clk: samsung: exynos990: Fix CMU_TOP mux/div bit widths clk: samsung: exynos990: Use PLL_CON0 for PLL parent muxes clk: samsung: pll: convert from round_rate() to determine_rate() clk: samsung: cpu: convert from round_rate() to determine_rate() clk: samsung: fsd: Add clk id for PCLK and PLL in CAM_CSI block dt-bindings: clock: Add CAM_CSI clock macro for FSD * clk-tegra: clk: tegra: dfll: Add CVB tables for Tegra114 clk: tegra: Add DFLL DVCO reset control for Tegra114 dt-bindings: arm: tegra: Add ASUS TF101G and SL101 dt-bindings: reset: Add Tegra114 CAR header dt-bindings: arm: tegra: Add Xiaomi Mi Pad (A0101) dt-bindings: clock: tegra30: Add IDs for CSI pad clocks dt-bindings: display: tegra: Move avdd-dsi-csi-supply from VI to CSI dt-bindings: i2c: nvidia,tegra20-i2c: Document Tegra264 I2C * clk-amlogic: clk: amlogic: fix recent code refactoring clk: amlogic: c3-peripherals: use helper for basic composite clocks clk: amlogic: align s4 and c3 pwm clock descriptions clk: amlogic: add composite clock helpers clk: amlogic: use the common pclk definition clk: amlogic: introduce a common pclk definition clk: amlogic: pclk explicitly use CLK_IGNORE_UNUSED clk: amlogic: drop CLK_SET_RATE_PARENT from peripheral clocks clk: amlogic: move PCLK definition to clkc-utils clk: amlogic: aoclk: use clkc-utils syscon probe clk: amlogic: use probe helper in mmio based controllers clk: amlogic: add probe helper for mmio based controllers clk: amlogic: drop meson-clkcee clk: amlogic: naming consistency alignment commit ec7336475d52575381149aa67f9526c2f6d45e0d Merge: ac28c7598611df 49ef6491106209 1ef1b8b9666d96 73e6f3ae8044f2 519cff1d85694c Author: Stephen Boyd Date: Mon Oct 6 12:56:23 2025 -0500 Merge branches 'clk-bindings', 'clk-cleanup', 'clk-renesas', 'clk-thead' and 'clk-spacemit' into clk-next * clk-bindings: dt-bindings: clock: mediatek: Add power-domains property dt-bindings: clock: silabs,si5341: Add missing properties dt-bindings: clock: adi,axi-clkgen: add clock-output-names property dt-bindings: clock: Remove unused fujitsu,mb86s70-crg11 binding dt-bindings: clock: Convert silabs,si570 to DT schema dt-bindings: clock: Convert silabs,si5341 to DT schema dt-bindings: clock: Convert silabs,si514/544 to DT schema * clk-cleanup: clk: tegra: do not overallocate memory for bpmp clocks clk: ep93xx: Use int type to store negative error codes dt-bindings: clock: st: flexgen: remove deprecated compatibles clk: st: flexgen: remove unused compatible clk: clk-axi-clkgen: remove unneeded semicolon clk: tegra: Remove redundant semicolons clk: npcm: select CONFIG_AUXILIARY_BUS clk: remove unneeded 'fast_io' parameter in regmap_config * clk-renesas: (27 commits) clk: renesas: r9a09g05[67]: Reduce differences clk: renesas: r9a09g047: Add USB3.0 clocks/resets clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() clk: renesas: r9a09g056: Add clock and reset entries for I3C clk: renesas: r9a09g057: Add clock and reset entries for I3C dt-bindings: clock: renesas,r9a09g047-cpg: Add USB3.0 core clocks clk: renesas: r9a09g077: Add Ethernet Subsystem core and module clocks clk: renesas: rzv2h: Simplify polling condition in __rzv2h_cpg_assert() clk: renesas: rzv2h: Re-assert reset on deassert timeout clk: renesas: rzg2l: Re-assert reset on deassert timeout clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert() dt-bindings: clock: renesas,r9a09g077/87: Add Ethernet clock IDs clk: renesas: r9a09g047: Add GPT clocks and resets clk: renesas: r9a09g077: Add module clocks for SCI1-SCI5 clk: renesas: rzv2h: remove round_rate() in favor of determine_rate() clk: renesas: rzg2l: convert from round_rate() to determine_rate() clk: renesas: r9a07g04[34]: Use tabs instead of spaces clk: renesas: r9a07g043: Add MSTOP for RZ/G2UL clk: renesas: r9a07g044: Add MSTOP for RZ/G2L clk: renesas: r9a08g045: Add MSTOP for GPIO ... * clk-thead: clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL clk: thead: support changing DPU pixel clock rate clk: thead: add support for enabling/disabling PLLs clk: thead: Correct parent for DPU pixel clocks clk: thead: th1520-ap: fix parent of padctrl0 clock clk: thead: th1520-ap: describe gate clocks with clk_gate * clk-spacemit: clk: spacemit: fix i2s clock clk: spacemit: introduce pre-div for ddn clock dt-bindings: clock: spacemit: introduce i2s pre-clock to fix i2s clock clk: spacemit: ccu_pll: convert from round_rate() to determine_rate() clk: spacemit: ccu_mix: convert from round_rate() to determine_rate() clk: spacemit: ccu_ddn: convert from round_rate() to determine_rate() clk: spacemit: fix sspax_clk dt-bindings: clock: spacemit: CLK_SSPA_I2S_BCLK for SSPA commit c34e08ba6c0037a72a7433741225b020c989e4ae Author: Rob Clark Date: Tue Sep 23 07:04:40 2025 -0700 drm/msm: Fix GEM free for imported dma-bufs Imported dma-bufs also have obj->resv != &obj->_resv. So we should check both this condition in addition to flags for handling the _NO_SHARE case. Fixes this splat that was reported with IRIS video playback: ------------[ cut here ]------------ WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm] CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : msm_gem_free_object+0x1f8/0x264 [msm] lr : msm_gem_free_object+0x138/0x264 [msm] sp : ffff800092a1bb30 x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08 x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6 x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200 x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020 x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032 x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8 Call trace: msm_gem_free_object+0x1f8/0x264 [msm] (P) drm_gem_object_free+0x1c/0x30 [drm] drm_gem_object_handle_put_unlocked+0x138/0x150 [drm] drm_gem_object_release_handle+0x5c/0xcc [drm] drm_gem_handle_delete+0x68/0xbc [drm] drm_gem_close_ioctl+0x34/0x40 [drm] drm_ioctl_kernel+0xc0/0x130 [drm] drm_ioctl+0x360/0x4e0 [drm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ Reported-by: Stephan Gerhold Fixes: de651b6e040b ("drm/msm: Fix refcnt underflow in error path") Signed-off-by: Rob Clark Tested-by: Stephan Gerhold Tested-by: Luca Weiss Tested-by: Bryan O'Donoghue # qrb5165-rb5 Patchwork: https://patchwork.freedesktop.org/patch/676273/ Message-ID: <20250923140441.746081-1-robin.clark@oss.qualcomm.com> commit 2f2c7254931f41b5736e3ba12aaa9ac1bbeeeb92 Merge: e4c0fdd5af4c59 51204faa4273a6 Author: Linus Torvalds Date: Mon Oct 6 10:41:03 2025 -0700 Merge tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Add PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() macros that take config space accessor functions. Implement pci_find_capability(), pci_find_ext_capability(), and dwc, dwc endpoint, and cadence capability search interfaces with them (Hans Zhang) - Leave parent unit address 0 in 'interrupt-map' so that when we build devicetree nodes to describe PCI functions that contain multiple peripherals, we can build this property even when interrupt controllers lack 'reg' properties (Lorenzo Pieralisi) - Add a Xeon 6 quirk to disable Extended Tags and limit Max Read Request Size to 128B to avoid a performance issue (Ilpo Järvinen) - Add sysfs 'serial_number' file to expose the Device Serial Number (Matthew Wood) - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das) Resource management: - Align m68k pcibios_enable_device() with other arches (Ilpo Järvinen) - Remove sparc pcibios_enable_device() implementations that don't do anything beyond what pci_enable_resources() does (Ilpo Järvinen) - Remove mips pcibios_enable_resources() and use pci_enable_resources() instead (Ilpo Järvinen) - Clean up bridge window sizing and assignment (Ilpo Järvinen), including: - Leave non-claimed bridge windows disabled - Enable bridges even if a window wasn't assigned because not all windows are required by downstream devices - Preserve bridge window type when releasing the resource, since the type is needed for reassignment - Consolidate selection of bridge windows into two new interfaces, pbus_select_window() and pbus_select_window_for_type(), so this is done consistently - Compute bridge window start and end earlier to avoid logging stale information MSI: - Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) Error handling: - Align AER with EEH by allowing drivers to request a Bus Reset on Non-Fatal Errors (in addition to the reset on Fatal Errors that we already do) (Lukas Wunner) - If error recovery fails, emit FAILED_RECOVERY uevents for the devices, not for the bridge leading to them. This makes them correspond to BEGIN_RECOVERY uevents (Lukas Wunner) - Align AER with EEH by calling err_handler.error_detected() callbacks to notify drivers if error recovery fails (Lukas Wunner) - Align AER with EEH by restoring device error_state to pci_channel_io_normal before the err_handler.slot_reset() callback. This is earlier than before the err_handler.resume() callback (Lukas Wunner) - Emit a BEGIN_RECOVERY uevent when driver's err_handler.error_detected() requests a reset, as well as when it says recovery is complete or can be done without a reset (Niklas Schnelle) - Align s390 with AER and EEH by emitting uevents during error recovery (Niklas Schnelle) - Align EEH with AER and s390 by emitting BEGIN_RECOVERY, SUCCESSFUL_RECOVERY, or FAILED_RECOVERY uevents depending on the result of err_handler.error_detected() (Niklas Schnelle) - Fix a NULL pointer dereference in aer_ratelimit() when ACPI GHES error information identifies a device without an AER Capability (Breno Leitao) - Update error decoding and TLP Log printing for new errors in current PCIe base spec (Lukas Wunner) - Update error recovery documentation to match the current code and use consistent nomenclature (Lukas Wunner) ASPM: - Enable all ClockPM and ASPM states for devicetree platforms, since there's typically no firmware that enables ASPM This is a risky change that may uncover hardware or configuration defects at boot-time rather than when users enable ASPM via sysfs later. Booting with "pcie_aspm=off" prevents this enabling (Manivannan Sadhasivam) - Remove the qcom code that enabled ASPM (Manivannan Sadhasivam) Power management: - If a device has already been disconnected, e.g., by a hotplug removal, don't bother trying to resume it to D0 when detaching the driver. This avoids annoying "Unable to change power state from D3cold to D0" messages (Mario Limonciello) - Ensure devices are powered up before config reads for 'max_link_width', 'current_link_speed', 'current_link_width', 'secondary_bus_number', and 'subordinate_bus_number' sysfs files. This prevents using invalid data (~0) in drivers or lspci and, depending on how the PCIe controller reports errors, may avoid error interrupts or crashes (Brian Norris) Virtualization: - Add rescan/remove locking when enabling/disabling SR-IOV, which avoids list corruption on s390, where disabling SR-IOV also generates hotplug events (Niklas Schnelle) Peer-to-peer DMA: - Free struct p2p_pgmap, not a member within it, in the pci_p2pdma_add_resource() error path (Sungho Kim) Endpoint framework: - Document sysfs interface for BAR assignment of vNTB endpoint functions (Jerome Brunet) - Fix array underflow in endpoint BAR test case (Dan Carpenter) - Skip endpoint IRQ test if the IRQ is out of range to avoid false errors (Christian Bruel) - Fix endpoint test case for controllers with fixed-size BARs smaller than requested by the test (Marek Vasut) - Restore inbound translation when disabling doorbell so the endpoint doorbell test case can be run more than once (Niklas Cassel) - Avoid a NULL pointer dereference when releasing DMA channels in endpoint DMA test case (Shin'ichiro Kawasaki) - Convert tegra194 interrupt number to MSI vector to fix endpoint Kselftest MSI_TEST test case (Niklas Cassel) - Reset tegra194 BARs when running in endpoint mode so the BAR tests don't overwrite the ATU settings in BAR4 (Niklas Cassel) - Handle errors in tegra194 BPMP transactions so we don't mistakenly skip future PERST# assertion (Vidya Sagar) AMD MDB PCIe controller driver: - Update DT binding example to separate PERST# to a Root Port stanza to make multiple Root Ports possible in the future (Sai Krishna Musham) - Add driver support for PERST# being described in a Root Port stanza, falling back to the host bridge if not found there (Sai Krishna Musham) Freescale i.MX6 PCIe controller driver: - Enable the 3.3V Vaux supply if available so devices can request wakeup with either Beacon or WAKE# (Richard Zhu) MediaTek PCIe Gen3 controller driver: - Add optional sys clock ready time setting to avoid sys_clk_rdy signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno) - Add DT binding and driver support for MT6991 and MT8196 (AngeloGioacchino Del Regno) NVIDIA Tegra PCIe controller driver: - When asserting PERST#, disable the controller instead of mistakenly disabling the PLL twice (Nagarjuna Kristam) - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) Qualcomm PCIe controller driver: - Select PCI Power Control Slot driver so slot voltage rails can be turned on/off if described in Root Port devicetree node (Qiang Yu) - Parse only PCI bridge child nodes in devicetree, skipping unrelated nodes such as OPP (Operating Performance Points), which caused probe failures (Krishna Chaitanya Chundru) - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang) - Consolidate Root Port 'phy' and 'reset' properties in struct qcom_pcie_port, regardless of whether we got them from the Root Port node or the host bridge node (Manivannan Sadhasivam) - Fetch and map the ELBI register space in the DWC core rather than in each driver individually (Krishna Chaitanya Chundru) - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG Shift Feature' and use this in the qcom driver (Krishna Chaitanya Chundru) - Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya Chundru) - Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm Glymur, which is compatible with X1E80100 but doesn't have the cnoc_sf_axi clock (Qiang Yu) Renesas R-Car PCIe controller driver: - Fix a typo that prevented correct PHY initialization (Marek Vasut) - Add a missing 1ms delay after PWR reset assertion as required by the V4H manual (Marek Vasut) - Assure reset has completed before DBI access to avoid SError (Marek Vasut) - Fix inverted PHY initialization check, which sometimes led to timeouts and failure to start the controller (Marek Vasut) - Pass the correct IRQ domain to generic_handle_domain_irq() to fix a regression when converting to msi_create_parent_irq_domain() (Claudiu Beznea) - Drop the spinlock protecting the PMSR register - it's no longer required since pci_lock already serializes accesses (Marek Vasut) - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) SOPHGO PCIe controller driver: - Check for existence of struct cdns_pcie.ops before using it to allow Cadence drivers that don't need to supply ops (Chen Wang) - Add DT binding and driver for the SOPHGO SG2042 PCIe controller (Chen Wang) STMicroelectronics STM32MP25 PCIe controller driver: - Update pinctrl documentation of initial states and use in runtime suspend/resume (Christian Bruel) - Add pinctrl_pm_select_init_state() for use by stm32 driver, which needs it during resume (Christian Bruel) - Add devicetree bindings and drivers for the STMicroelectronics STM32MP25 in host and endpoint modes (Christian Bruel) Synopsys DesignWare PCIe controller driver: - Add support for x16 in devicetree 'num-lanes' property (Konrad Dybcio) - Verify that if DT specifies a single IRQ for all eDMA channels, it is named 'dma' (Niklas Cassel) TI J721E PCIe driver: - Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth Vadapalli) - Power controller off before configuring the glue layer so the controller latches the correct values on power-on (Siddharth Vadapalli) TI Keystone PCIe controller driver: - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver exits with error (Siddharth Vadapalli) - Add Peripheral Virtualization Unit (PVU), which restricts DMA from PCIe devices to specific regions of host memory, to the ti,am65 binding (Jan Kiszka) Xilinx NWL PCIe controller driver: - Clear bootloader E_ECAM_CONTROL before merging in the new driver value to avoid writing invalid values (Jani Nurminen)" * tag 'pci-v6.18-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (141 commits) PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings PCI: stm32: Add PCIe host support for STM32MP25 PCI: xilinx-nwl: Fix ECAM programming PCI: j721e: Fix incorrect error message in probe() PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller PCI: dwc: Support 16-lane operation PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock PCI: rcar-gen4: Fix inverted break condition in PHY initialization PCI: rcar-gen4: Assure reset occurs before DBI access PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion PCI: Set up bridge resources earlier PCI: rcar-host: Drop PMSR spinlock ... commit e4c0fdd5af4c590ca07880b97e286c6532437658 Merge: 1d1ba4d390141d cc0bacac6de776 Author: Linus Torvalds Date: Mon Oct 6 10:37:06 2025 -0700 Merge tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "A couple of new device support and small driver updates for this round. New support: - Intel idxd Wildcat Lake family support - SpacemiT K1 PDMA controller support - Renesas RZ/G3E family support Updates: - Xilinx shutdown support and dma client properties update - Designware edma callback_result support" * tag 'dmaengine-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dt-bindings: dma: rz-dmac: Document RZ/G3E family of SoCs dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing dmaengine: mmp_pdma: Add operations structure for controller abstraction dmaengine: mmp_pdma: Add reset controller support dmaengine: mmp_pdma: Add clock support dt-bindings: dma: Add SpacemiT K1 PDMA controller dt-bindings: dmaengine: xilinx_dma: Remove DMA client properties dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation dmaengine: xilinx_dma: Support descriptor setup from dma_vecs dmaengine: sh: setup_xref error handling dmaengine: Replace zero-length array with flexible-array dmaengine: ppc4xx: Remove space before newline dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family platforms dmaengine: idxd: Replace memset(0) + strscpy() with strscpy_pad() dt-bindings: dma: nvidia,tegra20-apbdma: Add undocumented compatibles and "clock-names" dmaengine: zynqmp_dma: Add shutdown operation support commit 1d1ba4d390141d602dbce8f5f0ac19a384d10a64 Merge: 58b65f6dccb049 bdb978979ed133 Author: Linus Torvalds Date: Mon Oct 6 10:34:22 2025 -0700 Merge tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "The usual bunch of device support and update to drivers. New Support - Qualcomm SM8750 QMP PCIe PHY dual lane support, PMIV0104 eusb2 repeater support, QCS8300 eDP PHY support - Renesas RZ/T2H and RZ/N2H support and updates to driver for that - TI TCAN1051 phy support - Rockchip rk3588 dphy support, RK3528 combphy support Updates: - cadence updates for calibration and polling for ready and enabling of lower resolutions, runtime pm support, - Rockchip: enable U3 otg port - Renesas USXGMII mode support - Qualcomm UFS PHY and PLL regulator load support" * tag 'phy-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (64 commits) phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3588 variant phy: rockchip: phy-rockchip-inno-csidphy: allow for different reset lines phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 dt-bindings: phy: rockchip-inno-csi-dphy: add rk3588 variant dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required phy: cadence: cdns-dphy: Enable lower resolutions in dphy phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet phy: renesas: r8a779f0-ether-serdes: add USXGMII mode phy: sophgo: Add USB 2.0 PHY driver for Sophgo CV18XX/SG200X dt-bindings: phy: Add Sophgo CV1800 USB phy phy: cadence: cdns-dphy: Update calibration wait time for startup state machine phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling phy: renesas: rcar-gen3-usb2: Fix ID check logic with VBUS valid dt-bindings: phy: ti,tcan104x-can: Document TI TCAN1051 phy: lynx-28g: check return value when calling lynx_28g_pll_get phy: qcom: m31-eusb2: Fix the error log while enabling clock phy: rockchip: usbdp: Remove redundant ternary operators phy: renesas: rcar-gen3-usb2: Remove redundant ternary operators phy: hisilicon: Remove redundant ternary operators phy: qcom-qmp-ufs: Add PHY and PLL regulator load ... commit 58b65f6dccb0497802fad938e479df6ec8684c1f Merge: fd94619c43360e 88f5d2a477ec64 Author: Linus Torvalds Date: Mon Oct 6 10:32:22 2025 -0700 Merge tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "A very small update this time - add few registers to debugfs - core: drop dev_pm_domain_detach() call and use min() to improve code" * tag 'soundwire-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: Use min() to improve code soundwire: bus: Drop dev_pm_domain_detach() call soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers commit 451bb96328981808463405d436bd58de16dd967d Author: Cédric Le Goater Date: Thu Sep 18 14:19:28 2025 +0200 vfio: Dump migration features under debugfs A debugfs directory was recently added for VFIO devices. Add a new "features" file under the migration sub-directory to expose which features the device supports. Signed-off-by: Cédric Le Goater Link: https://lore.kernel.org/r/20250918121928.1921871-1-clg@redhat.com Signed-off-by: Alex Williamson commit d14de5b92578c769e12d84c9bdeee5627c042270 Author: Li Zhe Date: Thu Aug 14 14:47:14 2025 +0800 vfio/type1: optimize vfio_unpin_pages_remote() When vfio_unpin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual put_pfn() operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. It would be very rare for reserved PFNs and non reserved will to be mixed within the same range. So this patch utilizes the has_rsvd variable introduced in the previous patch to determine whether batch put_pfn() operations can be performed. Moreover, compared to put_pfn(), unpin_user_page_range_dirty_lock() is capable of handling large folio scenarios more efficiently. The performance test results for completing the 16G VFIO IOMMU DMA unmapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.141 s (113.7 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.307 s (52.2 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.135 s (118.6 GB/s) With this patchset: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO UNMAP DMA in 0.044 s (363.2 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO UNMAP DMA in 0.289 s (55.3 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO UNMAP DMA in 0.044 s (361.3 GB/s) For large folio, we achieve an over 67% performance improvement in the VFIO UNMAP DMA item. For small folios, the performance test results appear to show a slight improvement. Suggested-by: Jason Gunthorpe Signed-off-by: Li Zhe Reviewed-by: David Hildenbrand Acked-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-6-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 089722e8939e580c9ccc64678ba22f563fdf3bb5 Author: Li Zhe Date: Thu Aug 14 14:47:13 2025 +0800 vfio/type1: introduce a new member has_rsvd for struct vfio_dma Introduce a new member has_rsvd for struct vfio_dma. This member is used to indicate whether there are any reserved or invalid pfns in the region represented by this vfio_dma. If it is true, it indicates that there is at least one pfn in this region that is either reserved or invalid. Signed-off-by: Li Zhe Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-5-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit d10872050ffeda8c3bdc08f3376bb49b34b4e643 Author: Li Zhe Date: Thu Aug 14 14:47:12 2025 +0800 vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() The function vpfn_pages() can help us determine the number of vpfn nodes on the vpfn rb tree within a specified range. This allows us to avoid searching for each vpfn individually in the function vfio_unpin_pages_remote(). This patch batches the vfio_find_vpfn() calls in function vfio_unpin_pages_remote(). Signed-off-by: Li Zhe Link: https://lore.kernel.org/r/20250814064714.56485-4-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit f6c84a52cc41e2aaed0d956d0a1c1802513a239c Author: Li Zhe Date: Thu Aug 14 14:47:11 2025 +0800 vfio/type1: optimize vfio_pin_pages_remote() When vfio_pin_pages_remote() is called with a range of addresses that includes large folios, the function currently performs individual statistics counting operations for each page. This can lead to significant performance overheads, especially when dealing with large ranges of pages. Batch processing of statistical counting operations can effectively enhance performance. In addition, the pages obtained through longterm GUP are neither invalid nor reserved. Therefore, we can reduce the overhead associated with some calls to function is_invalid_reserved_pfn(). The performance test results for completing the 16G VFIO IOMMU DMA mapping are as follows. Base(v6.16): ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.049 s (328.5 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.268 s (59.6 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.051 s (310.9 GB/s) With this patch: ------- AVERAGE (MADV_HUGEPAGE) -------- VFIO MAP DMA in 0.025 s (629.8 GB/s) ------- AVERAGE (MAP_POPULATE) -------- VFIO MAP DMA in 0.253 s (63.1 GB/s) ------- AVERAGE (HUGETLBFS) -------- VFIO MAP DMA in 0.030 s (530.5 GB/s) For large folio, we achieve an over 40% performance improvement. For small folios, the performance test results indicate a slight improvement. Signed-off-by: Li Zhe Co-developed-by: Alex Williamson Acked-by: David Hildenbrand Tested-by: Eric Farman Link: https://lore.kernel.org/r/20250814064714.56485-3-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 929bf010e0599ddef6b640cd314f1de65dd1ca3e Author: Li Zhe Date: Thu Aug 14 14:47:10 2025 +0800 mm: introduce num_pages_contiguous() Let's add a simple helper for determining the number of contiguous pages that represent contiguous PFNs. In an ideal world, this helper would be simpler or not even required. Unfortunately, on some configs we still have to maintain (SPARSEMEM without VMEMMAP), the memmap is allocated per memory section, and we might run into weird corner cases of false positives when blindly testing for contiguous pages only. One example of such false positives would be a memory section-sized hole that does not have a memmap. The surrounding memory sections might get "struct pages" that are contiguous, but the PFNs are actually not. This helper will, for example, be useful for determining contiguous PFNs in a GUP result, to batch further operations across returned "struct page"s. VFIO will utilize this interface to accelerate the VFIO DMA map process. Implementation based on Linus' suggestions to avoid new usage of nth_page() where avoidable. Suggested-by: Linus Torvalds Suggested-by: Jason Gunthorpe Signed-off-by: Li Zhe Co-developed-by: David Hildenbrand Signed-off-by: David Hildenbrand Link: https://lore.kernel.org/r/20250814064714.56485-2-lizhe.67@bytedance.com Signed-off-by: Alex Williamson commit 9c78e747dd4fee6c36fcc926212e20032055cf9d Author: Rameshkumar Sundaram Date: Fri Oct 3 14:51:58 2025 +0530 wifi: ath11k: avoid bit operation on key flags Bitwise operations with WMI_KEY_PAIRWISE (defined as 0) are ineffective and misleading. This results in pairwise key validations added in commit 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") to always evaluate false and clear key commands for pairwise keys are not honored. Since firmware supports overwriting the new key without explicitly clearing the previous one, there is no visible impact currently. However, to restore consistency with the previous behavior and improve clarity, replace bitwise operations with direct assignments and comparisons for key flags. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aLlaetkalDvWcB7b@stanley.mountain Fixes: 97acb0259cc9 ("wifi: ath11k: fix group data packet drops during rekey") Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20251003092158.1080637-1-rameshkumar.sundaram@oss.qualcomm.com [update copyright per current guidance] Signed-off-by: Jeff Johnson commit 92282074e1d2e7b6da5c05fe38a7cc974187fe14 Author: Karthik M Date: Tue Sep 23 15:03:16 2025 -0700 wifi: ath12k: free skb during idr cleanup callback ath12k just like ath11k [1] did not handle skb cleanup during idr cleanup callback. Both ath12k_mac_vif_txmgmt_idr_remove() and ath12k_mac_tx_mgmt_pending_free() performed idr cleanup and DMA unmapping for skb but only ath12k_mac_tx_mgmt_pending_free() freed skb. As a result, during vdev deletion a memory leak occurs. Refactor all clean up steps into a new function. New function ath12k_mac_tx_mgmt_free() creates a centralized area where idr cleanup, DMA unmapping for skb and freeing skb is performed. Utilize skb pointer given by idr_remove(), instead of passed as a function argument because IDR will be protected by locking. This will prevent concurrent modification of the same IDR. Now ath12k_mac_tx_mgmt_pending_free() and ath12k_mac_vif_txmgmt_idr_remove() call ath12k_mac_tx_mgmt_free(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Link: https://lore.kernel.org/r/1637832614-13831-1-git-send-email-quic_srirrama@quicinc.com > # [1] Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Karthik M Signed-off-by: Muna Sinada Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250923220316.1595758-1-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0eb002c93c3b47f88244cecb1e356eaeab61a6bf Author: Mark Pearson Date: Mon Sep 29 15:21:35 2025 -0400 wifi: ath11k: Add missing platform IDs for quirk table Lenovo platforms can come with one of two different IDs. The pm_quirk table was missing the second ID for each platform. Add missing ID and some extra platform identification comments. Reported on https://bugzilla.kernel.org/show_bug.cgi?id=219196 Tested-on: P14s G4 AMD. Fixes: ce8669a27016 ("wifi: ath11k: determine PM policy based on machine model") Signed-off-by: Mark Pearson Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219196 Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250929192146.1789648-1-mpearson-lenovo@squebb.ca Signed-off-by: Jeff Johnson commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b Author: Loic Poulain Date: Fri Sep 26 21:56:56 2025 +0200 wifi: ath10k: Fix memory leak on unsupported WMI command ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the responsibility to release it in case of error. This patch fixes missing free in case of early error due to unhandled WMI command ID. Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1 Fixes: 553215592f14 ("ath10k: warn if give WMI command is not supported") Suggested-by: Jeff Johnson Signed-off-by: Loic Poulain Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250926195656.187970-1-loic.poulain@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 4d920ed684392ae064af62957d6f5a90312dfaf6 Author: Eric Biggers Date: Sun Oct 5 18:20:37 2025 -0700 libbpf: Fix undefined behavior in {get,put}_unaligned_be32() These violate aliasing rules and may be miscompiled unless -fno-strict-aliasing is used. Replace them with the standard memcpy() solution. Note that compilers know how to optimize this properly. Fixes: 4a1c9e544b8d ("libbpf: remove linux/unaligned.h dependency for libbpf_sha256()") Signed-off-by: Eric Biggers Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20251006012037.159295-1-ebiggers@kernel.org commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 Author: Ian Forbes Date: Fri Sep 26 14:54:26 2025 -0500 drm/vmwgfx: Fix copy-paste typo in validation 'entry' should be 'val' which is the loop iterator. Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.") Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a Author: Ian Forbes Date: Fri Sep 26 14:54:25 2025 -0500 drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 Author: Zack Rusin Date: Wed Sep 17 11:36:55 2025 -0400 drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. Signed-off-by: Zack Rusin Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") Reported-by: Kuzey Arda Bulut Cc: Broadcom internal kernel review list Cc: dri-devel@lists.freedesktop.org Reviewed-by: Ian Forbes Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com commit a7c4bb43bfdc2b9f06ee9d036028ed13a83df42a Author: Jakub Acs Date: Wed Oct 1 10:09:55 2025 +0000 fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was found by syzkaller. Race Condition Diagram: Thread 1 Thread 2 -------- -------- generic_shutdown_super() shrink_dcache_for_umount sb->s_root = NULL | | vfs_read() | inotify_fdinfo() | * inode get from mark * | show_mark_fhandle(m, inode) | exportfs_encode_fid(inode, ..) | ovl_encode_fh(inode, ..) | ovl_check_encode_origin(inode) | * deref i_sb->s_root * | | v fsnotify_sb_delete(sb) Which then leads to: [ 32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none) [ 32.143353] Call Trace: [ 32.143732] ovl_encode_fh+0xd5/0x170 [ 32.144031] exportfs_encode_inode_fh+0x12f/0x300 [ 32.144425] show_mark_fhandle+0xbe/0x1f0 [ 32.145805] inotify_fdinfo+0x226/0x2d0 [ 32.146442] inotify_show_fdinfo+0x1c5/0x350 [ 32.147168] seq_show+0x530/0x6f0 [ 32.147449] seq_read_iter+0x503/0x12a0 [ 32.148419] seq_read+0x31f/0x410 [ 32.150714] vfs_read+0x1f0/0x9e0 [ 32.152297] ksys_read+0x125/0x240 IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set to NULL in the unmount path. Fix it by protecting calling exportfs_encode_fid() from show_mark_fhandle() with s_umount lock. This form of fix was suggested by Amir in [1]. [1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/ Fixes: c45beebfde34 ("ovl: support encoding fid from inode with no alias") Signed-off-by: Jakub Acs Cc: Jan Kara Cc: Amir Goldstein Cc: Miklos Szeredi Cc: Christian Brauner Cc: linux-unionfs@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Jan Kara commit ee795e82e10197c070efd380dc9615c73dffad6c Author: Marek Szyprowski Date: Fri Oct 3 13:42:39 2025 +0200 spi: rockchip-sfc: Fix DMA-API usage Use DMA-API dma_map_single() call for getting the DMA address of the transfer buffer instead of hacking with virt_to_phys(). This fixes the following DMA-API debug warning: ------------[ cut here ]------------ DMA-API: rockchip-sfc fe300000.spi: device driver tries to sync DMA memory it has not allocated [device address=0x000000000cf70000] [size=288 bytes] WARNING: kernel/dma/debug.c:1106 at check_sync+0x1d8/0x690, CPU#2: systemd-udevd/151 Modules linked in: ... Hardware name: Hardkernel ODROID-M1 (DT) pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : check_sync+0x1d8/0x690 lr : check_sync+0x1d8/0x690 .. Call trace: check_sync+0x1d8/0x690 (P) debug_dma_sync_single_for_cpu+0x84/0x8c __dma_sync_single_for_cpu+0x88/0x234 rockchip_sfc_exec_mem_op+0x4a0/0x798 [spi_rockchip_sfc] spi_mem_exec_op+0x408/0x498 spi_nor_read_data+0x170/0x184 spi_nor_read_sfdp+0x74/0xe4 spi_nor_parse_sfdp+0x120/0x11f0 spi_nor_sfdp_init_params_deprecated+0x3c/0x8c spi_nor_scan+0x690/0xf88 spi_nor_probe+0xe4/0x304 spi_mem_probe+0x6c/0xa8 spi_probe+0x94/0xd4 really_probe+0xbc/0x298 ... Fixes: b69386fcbc60 ("spi: rockchip-sfc: Using normal memory for dma") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251003114239.431114-1-m.szyprowski@samsung.com Signed-off-by: Mark Brown commit 48b77733d0dbaf8cd0a122712072f92b2d95d894 Author: Jan Kara Date: Wed Oct 1 15:19:07 2025 +0200 expfs: Fix exportfs_can_encode_fh() for EXPORT_FH_FID After commit 5402c4d4d200 ("exportfs: require ->fh_to_parent() to encode connectable file handles") we will fail to create non-decodable file handles for filesystems without export operations. Fix it. Fixes: 5402c4d4d200 ("exportfs: require ->fh_to_parent() to encode connectable file handles") Reviewed-by: Christian Brauner Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara commit 83d59d81b20c09c256099d1c15d7da21969581bd Author: Ran Xiaokai Date: Tue Sep 30 08:34:02 2025 +0000 slab: Fix using this_cpu_ptr() in preemptible context defer_free() maybe called in preemptible context, this will trigger the below warning message: BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 caller is defer_free+0x1b/0x60 Call Trace: dump_stack_lvl+0xac/0xc0 check_preemption_disabled+0xbe/0xe0 defer_free+0x1b/0x60 kfree_nolock+0x1eb/0x2b0 alloc_slab_obj_exts+0x356/0x390 __alloc_tagging_slab_alloc_hook+0xa0/0x300 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 __kmalloc_noprof+0x3dc/0x6d0 __list_lru_init+0x6c/0x210 alloc_super+0x3b6/0x470 sget_fc+0x5f/0x3a0 get_tree_nodev+0x27/0x90 vfs_get_tree+0x26/0xc0 vfs_kern_mount.part.0+0xb6/0x140 kern_mount+0x24/0x40 init_pipe_fs+0x4f/0x70 do_one_initcall+0x62/0x2e0 kernel_init_freeable+0x25b/0x4b0 kernel_init+0x1a/0x1c0 ret_from_fork+0x290/0x2e0 ret_from_fork_asm+0x11/0x20 Disable preemption in defer_free() and also defer_deactivate_slab() to make it safe. [vbabka@suse.cz: disable preemption instead of using raw_cpu_ptr() per the discussion ] Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Link: https://lore.kernel.org/r/20250930083402.782927-1-ranxiaokai627@163.com Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit fd94619c43360eb44d28bd3ef326a4f85c600a07 Merge: 4b616669d1d8e9 a42938e80357a1 Author: Linus Torvalds Date: Sun Oct 5 20:45:49 2025 -0700 Merge tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs update from Damien Le Moal: - Some comment spelling fixes (Xichao) * tag 'zonefs-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: correct some spelling mistakes commit 4b616669d1d8e91d0964b0861b51a3bca5f678c1 Merge: 7a405dbb0f036f f145845d8348c9 Author: Linus Torvalds Date: Sun Oct 5 20:43:01 2025 -0700 Merge tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Damien Le Moal: - Improve the DT bindings documentation for the highbanck, imx and xgene-ahci controllers (Krzysztof, Fabio, Rob) * tag 'ata-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: dt-bindings: ata: apm,xgene-ahci: Add apm,xgene-ahci-v2 support dt-bindings: ata: imx: Document 'target-supply' dt-bindings: ata: highbank: Minor whitespace cleanup in example commit c0d36727bf39bb16ef0a67ed608e279535ebf0da Author: Herbert Xu Date: Thu Oct 2 17:45:39 2025 +0800 crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it. Fixes: 77ebdabe8de7 ("crypto: af_alg - add extra parameters for DRBG interface") Reported-by: Yiqi Sun Signed-off-by: Herbert Xu commit ca1354f7999d30cf565e810b56cba688927107c6 Author: Herbert Xu Date: Mon Oct 6 10:07:53 2025 +0800 Revert "crypto: testmgr - desupport SHA-1 for FIPS 140" This reverts commit 9d50a25eeb05c45fef46120f4527885a14c84fb2. Reported-by: Jiri Slaby Reported-by: Jon Kohler Link: https://lore.kernel.org/all/05b7ef65-37bb-4391-9ec9-c382d51bae4d@kernel.org/ Link: https://lore.kernel.org/all/26F8FCC9-B448-4A89-81DF-6BAADA03E174@nutanix.com/ Signed-off-by: Herbert Xu commit 87064da2db7be537a7da20a25c18ba912c4db9e1 Author: Bruno Thomsen Date: Tue Sep 2 20:22:35 2025 +0200 rtc: pcf2127: fix watchdog interrupt mask on pcf2131 When using interrupt pin (INT A) as watchdog output all other interrupt sources need to be disabled to avoid additional resets. Resulting INT_A_MASK1 value is 55 (0x37). Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20250902182235.6825-1-bruno.thomsen@gmail.com Signed-off-by: Alexandre Belloni commit e22f4d1321e0055065f274e20bf6d1dbf4b500f5 Author: Harini T Date: Wed Jul 30 19:51:10 2025 +0530 rtc: zynqmp: Restore alarm functionality after kexec transition During kexec reboots, RTC alarms that are fired during the kernel transition experience delayed execution. The new kernel would eventually honor these alarms, but the interrupt handlers would only execute after the driver probe is completed rather than at the intended alarm time. This is because pending alarm interrupt status from the previous kernel is not properly cleared during driver initialization, causing timing discrepancies in alarm delivery. To ensure precise alarm timing across kexec transitions, enhance the probe function to: 1. Clear any pending alarm interrupt status from previous boot. 2. Detect existing valid alarms and preserve their state. 3. Re-enable alarm interrupts for future alarms. Signed-off-by: Harini T Link: https://lore.kernel.org/r/20250730142110.2354507-1-harini.t@amd.com Signed-off-by: Alexandre Belloni commit f38bdd730914be1fcd63240af89a2dc802148c8a Author: Xianwei Zhao Date: Tue Jul 22 19:30:48 2025 +0800 rtc: amlogic-a4: Optimize global variables Convert a global variable into a local one of aml_rtc_probe(). Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250722-rtc-regmap-v2-1-58bc17187a11@amlogic.com Signed-off-by: Alexandre Belloni commit 75b002a38d4f740d51f0e09dcd778541f61a2797 Author: Tóth János Date: Mon Apr 7 13:48:49 2025 +0200 rtc: sd2405al: Add I2C address. It is common to include the I2C address of the device in the source file. Signed-off-by: Tóth János Signed-off-by: Alexandre Belloni commit a5a19e80b235ed2c456dbab59c85ca43e87e01bf Author: Alexandre Belloni Date: Sun Oct 5 22:30:48 2025 +0200 rtc: Kconfig: move symbols to proper section There is only one HID RTC, the following symbols are for on-SoC RTCs Link: https://lore.kernel.org/r/20251005203048.3759240-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit b650cf9108efea71e51f1287f2e5ccd2144979af Author: Alexandre Belloni Date: Sun Oct 5 22:19:24 2025 +0200 rtc: optee: make optee_rtc_pm_ops static Fix sparse warningg: drivers/rtc/rtc-optee.c:714:1: sparse: sparse: symbol 'optee_rtc_pm_ops' was not declared. Should it be static? Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509230549.L26lw7UZ-lkp@intel.com/ Link: https://lore.kernel.org/r/20251005201925.3757345-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 7a405dbb0f036f8d1713ab9e7df0cd3137987b07 Merge: cf0e371d2b0e25 c14bdcc9f27462 Author: Linus Torvalds Date: Sun Oct 5 12:11:07 2025 -0700 Merge tag 'mm-stable-2025-10-03-16-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: "Only two patch series in this pull request: - "mm/memory_hotplug: fixup crash during uevent handling" from Hannes Reinecke fixes a race that was causing udev to trigger a crash in the memory hotplug code - "mm_slot: following fixup for usage of mm_slot_entry()" from Wei Yang adds some touchups to the just-merged mm_slot changes" * tag 'mm-stable-2025-10-03-16-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/khugepaged: use KMEM_CACHE() mm/ksm: cleanup mm_slot_entry() invocation Documentation/mm: drop pxx_mkdevmap() descriptions from page table helpers mm: clean up is_guard_pte_marker() drivers/base: move memory_block_add_nid() into the caller mm/memory_hotplug: activate node before adding new memory blocks drivers/base/memory: add node id parameter to add_memory_block() commit cf0e371d2b0e25d115442a281a232922a6dc0d6a Merge: 678074f1a8e035 99da5bf3dd6a8c Author: Linus Torvalds Date: Sun Oct 5 12:08:14 2025 -0700 Merge tag 'efi-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Document what OVMF stands for (Open Virtual Machine Firmware) - Clear NX restrictions also from 'more reliable' type memory when using the DXE service API * tag 'efi-next-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/x86: Memory protection on EfiGcdMemoryTypeMoreReliable efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text commit eb7392a019642f0ef5b9acd5e56a3f051d64a5ef Author: Dan Carpenter Date: Thu Sep 18 12:49:48 2025 +0300 rtc: optee: Fix error code in optee_rtc_read_alarm() Return "optee_alarm" instead of "alarm". The "alarm" pointer is a valid pointer and not an error pointer. Fixes: 6266aea864fa ("rtc: optee: add alarm related rtc ops to optee rtc driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/9e3718fe1128964907619ad325c0c5f5c1354ace.1758182509.git.dan.carpenter@linaro.org Signed-off-by: Alexandre Belloni commit 8bbd727453b497722b3e31b5d634c35faa953fbd Author: Dan Carpenter Date: Thu Sep 18 12:49:31 2025 +0300 rtc: optee: fix error code in probe() Return an error code if kthread_create() fails. Currently the code returns success. Fixes: 6266aea864fa ("rtc: optee: add alarm related rtc ops to optee rtc driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/21f1a18008f1bbc8f70d0bd5c05b72fbf5fc9c7d.1758182509.git.dan.carpenter@linaro.org Signed-off-by: Alexandre Belloni commit a6b4f791cdc56655b2dee8ac793f5b28dc4e542d Author: Rob Herring (Arm) Date: Wed Sep 24 17:28:46 2025 -0500 dt-bindings: rtc: Convert apm,xgene-rtc to DT schema Convert the APM XGene RTC binding to DT schema format. It's a straight-forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250924222848.2949235-1-robh@kernel.org Signed-off-by: Alexandre Belloni commit 678074f1a8e03598977bdeea10a4ce51c4f4a0c4 Merge: 6a74422b9710e9 88b4cbcf6b041a Author: Linus Torvalds Date: Sun Oct 5 10:48:33 2025 -0700 Merge tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Just a couple of changes: crypto code cleanup and a IMA xattr bug fix" * tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr lib/digsig: Use SHA-1 library instead of crypto_shash integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS commit 6a74422b9710e987c7d6b85a1ade7330b1e61626 Merge: 742adaa16db994 c662a6fef10aff Author: Linus Torvalds Date: Sun Oct 5 10:09:55 2025 -0700 Merge tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - switch longson32 platform to DT and use MIPS_GENERIC framework - cleanups/fixes for lantiq DTs - other cleanups and fixes * tag 'mips_6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) mips: math-emu: replace deprecated strcpy() in me-debugfs MIPS: configs: Consolidate Loongson1 defconfigs MIPS: Unify Loongson1 PRID_REV MIPS: loongson32: Switch to generic core MIPS: loongson: Add built-in DTB support MIPS: dts: loongson: Add CQ-T300B board MIPS: dts: loongson: Add Smartloong-1C board MIPS: dts: loongson: Add LSGZ_1B_DEV board MIPS: dts: loongson: Add LS1B-DEMO board dt-bindings: mips: loongson: Add LS1B-DEMO and CQ-T300B mips: lantiq: danube: rename stp node on EASY50712 reference board mips: lantiq: xway: sysctrl: rename stp clock MIPS: RB532: Replace deprecated strcpy() with memcpy() and strscpy() MIPS: Loongson64: Replace deprecated strcpy() with strscpy_pad() MIPS: generic: Replace deprecated strcpy() in ocelot_detect() MIPS: octeon: Replace deprecated strcpy() in octeon_model_get_string_buffer() MIPS: octeon: Replace memset(0) + deprecated strcpy() with strscpy_pad() MIPS: arc: Replace deprecated strcpy() with memcpy() MIPS: txx9: Replace deprecated strcpy() with strscpy() MIPS: sni: Replace deprecated strcpy() in sni_console_setup() ... commit 742adaa16db994ba1748465b95548e2f28aa18ca Merge: 21fbefc5886cc3 8c30b0018f9d93 Author: Linus Torvalds Date: Sun Oct 5 10:02:54 2025 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: "I picked up one series from Chen Miao, our Google Summer of Code contributor, which adds OpenRISC support for static keys" * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Add jump label support openrisc: Regenerate defconfigs. openrisc: Add R_OR1K_32_PCREL relocation type module support openrisc: Add text patching API support commit 21fbefc5886cc38cf7b57b28c35bd619efbce914 Merge: d9f24f8e60798c 61e19cd2e5c523 Author: Linus Torvalds Date: Sun Oct 5 09:43:36 2025 -0700 Merge tag 'trace-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Use READ_ONCE() and WRITE_ONCE() instead of RCU for syscall tracepoints Individual system call trace events are pseudo events attached to the raw_syscall trace events that just trace the entry and exit of all system calls. When any of these individual system call trace events get enabled, an element in an array indexed by the system call number is assigned to the trace file that defines how to trace it. When the trace event triggers, it reads this array and if the array has an element, it uses that trace file to know what to write it (the trace file defines the output format of the corresponding system call). The issue is that it uses rcu_dereference_ptr() and marks the elements of the array as using RCU. This is incorrect. There is no RCU synchronization here. The event file that is pointed to has a completely different way to make sure its freed properly. The reading of the array during the system call trace event is only to know if there is a value or not. If not, it does nothing (it means this system call isn't being traced). If it does, it uses the information to store the system call data. The RCU usage here can simply be replaced by READ_ONCE() and WRITE_ONCE() macros. - Have the system call trace events use "0x" for hex values Some system call trace events display hex values but do not have "0x" in front of it. Seeing "count: 44" can be assumed that it is 44 decimal when in actuality it is 44 hex (68 decimal). Display "0x44" instead. - Use vmalloc_array() in tracing_map_sort_entries() The function tracing_map_sort_entries() used array_size() and vmalloc() when it could have simply used vmalloc_array(). - Use for_each_online_cpu() in trace_osnoise.c() Instead of open coding for_each_cpu(cpu, cpu_online_mask), use for_each_online_cpu(). - Move the buffer field in struct trace_seq to the end The buffer field in struct trace_seq is architecture dependent in size, and caused padding for the fields after it. By moving the buffer to the end of the structure, it compacts the trace_seq structure better. - Remove redundant zeroing of cmdline_idx field in saved_cmdlines_buffer() The structure that contains cmdline_idx is zeroed by memset(), no need to explicitly zero any of its fields after that. - Use system_percpu_wq instead of system_wq in user_event_mm_remove() As system_wq is being deprecated, use the new wq. - Add cond_resched() is ftrace_module_enable() Some modules have a lot of functions (thousands of them), and the enabling of those functions can take some time. On non preemtable kernels, it was triggering a watchdog timeout. Add a cond_resched() to prevent that. - Add a BUILD_BUG_ON() to make sure PID_MAX_DEFAULT is always a power of 2 There's code that depends on PID_MAX_DEFAULT being a power of 2 or it will break. If in the future that changes, make sure the build fails to ensure that the code is fixed that depends on this. - Grab mutex_lock() before ever exiting s_start() The s_start() function is a seq_file start routine. As s_stop() is always called even if s_start() fails, and s_stop() expects the event_mutex to be held as it will always release it. That mutex must always be taken in s_start() even if that function fails. * tag 'trace-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix lock imbalance in s_start() memory allocation failure path tracing: Ensure optimized hashing works ftrace: Fix softlockup in ftrace_module_enable tracing: replace use of system_wq with system_percpu_wq tracing: Remove redundant 0 value initialization tracing: Move buffer in trace_seq to end of struct tracing/osnoise: Use for_each_online_cpu() instead of for_each_cpu() tracing: Use vmalloc_array() to improve code tracing: Have syscall trace events show "0x" for values greater than 10 tracing: Replace syscall RCU pointer assignment with READ/WRITE_ONCE() commit d9f24f8e60798c066ead61f77e67ee6a5a204514 Merge: 2cd14dff1660f8 05b7e10687c69e Author: Linus Torvalds Date: Sun Oct 5 09:38:26 2025 -0700 Merge tag 'trace-tools-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt - This is mostly just consolidating code between osnoise/timerlat and top/hist for easier maintenance and less future divergence * tag 'trace-tools-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tools/rtla: Add remaining support for osnoise actions tools/rtla: Add test engine support for unexpected output tools/rtla: Fix -A option name in test comment tools/rtla: Consolidate code between osnoise/timerlat and hist/top tools/rtla: Create common_apply_config() tools/rtla: Move top/hist params into common struct tools/rtla: Consolidate common parameters into shared structure commit 2cd14dff1660f80e81ad914317872686ebcdccc0 Merge: 6093a688a07da0 9cf9aa7b0acfde Author: Linus Torvalds Date: Sun Oct 5 08:16:20 2025 -0700 Merge tag 'probes-fixes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fix from Masami Hiramatsu: - Fix race condition in kprobe initialization causing NULL pointer dereference. This happens on weak memory model, which does not correctly manage the flags access with appropriate memory barriers. Use RELEASE-ACQUIRE to fix it. * tag 'probes-fixes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference commit 032676ff8217cab3273da56ee774b64c46b56b5e Author: Huacai Chen Date: Sun Oct 5 11:52:43 2025 +0800 LoongArch: Update Loongson-3 default config file 1. Increase NR_CPUS to 2048. 2. Enable KEXEC_FILE options. 3. Enable some EXT4/XFS options. 4. Enable Loongson PWM/MMC/BMC/SE drivers. 5. Enable simple DRM driver. 6. Enable some Intel ethernet drivers. 7. Enable some gpio drivers. 8. Enable some network options. 9. Enable SM3/SM4 cryptographic algorithms. Signed-off-by: Huacai Chen commit 6093a688a07da07808f0122f9aa2a3eed250d853 Merge: 59697e061f6aec 22d693e45d4a45 Author: Linus Torvalds Date: Sat Oct 4 16:26:32 2025 -0700 Merge tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull Char/Misc/IIO/Binder updates from Greg KH: "Here is the big set of char/misc/iio and other driver subsystem changes for 6.18-rc1. Loads of different stuff in here, it was a busy development cycle in lots of different subsystems, with over 27k new lines added to the tree. Included in here are: - IIO updates including new drivers, reworking of existing apis, and other goodness in the sensor subsystems - MEI driver updates and additions - NVMEM driver updates - slimbus removal for an unused driver and some other minor updates - coresight driver updates and additions - MHI driver updates - comedi driver updates and fixes - extcon driver updates - interconnect driver additions - eeprom driver updates and fixes - minor UIO driver updates - tiny W1 driver updates But the majority of new code is in the rust bindings and additions, which includes: - misc driver rust binding updates for read/write support, we can now write "normal" misc drivers in rust fully, and the sample driver shows how this can be done. - Initial framework for USB driver rust bindings, which are disabled for now in the build, due to limited support, but coming in through this tree due to dependencies on other rust binding changes that were in here. I'll be enabling these back on in the build in the usb.git tree after -rc1 is out so that developers can continue to work on these in linux-next over the next development cycle. - Android Binder driver implemented in Rust. This is the big one, and was driving a huge majority of the rust binding work over the past years. Right now there are two binder drivers in the kernel, selected only at build time as to which one to use as binder wants to be included in the system at boot time. The binder C maintainers all agreed on this, as eventually, they want the C code to be removed from the tree, but it will take a few releases to get there while both are maintained to ensure that the rust implementation is fully stable and compliant with the existing userspace apis. All of these have been in linux-next for a while" * tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (320 commits) rust: usb: keep usb::Device private for now rust: usb: don't retain device context for the interface parent USB: disable rust bindings from the build for now samples: rust: add a USB driver sample rust: usb: add basic USB abstractions coresight: Add label sysfs node support dt-bindings: arm: Add label in the coresight components coresight: tnoc: add new AMBA ID to support Trace Noc V2 coresight: Fix incorrect handling for return value of devm_kzalloc coresight: tpda: fix the logic to setup the element size coresight: trbe: Return NULL pointer for allocation failures coresight: Refactor runtime PM coresight: Make clock sequence consistent coresight: Refactor driver data allocation coresight: Consolidate clock enabling coresight: Avoid enable programming clock duplicately coresight: Appropriately disable trace bus clocks coresight: Appropriately disable programming clocks coresight: etm4x: Support atclk coresight: catu: Support atclk ... commit 59697e061f6aec86d5738cd4752e16520f1d60dc Merge: c6006b8ca14dcc b76029bdd71054 Author: Linus Torvalds Date: Sat Oct 4 16:17:14 2025 -0700 Merge tag 'staging-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the 'big' set of staging driver changes for 6.18-rc1. Nothing really exciting in here they pretty much consist of: - minor coding style changes and cleanups - some api layer removals where not needed Overall a quiet development cycle. All have been in linux-next for a while with no reported issues" * tag 'staging-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (63 commits) staging: rtl8723bs: xmit: rephrase comment and drop extra space staging: sm750fb: rename camel case variable staging: rtl8723bs: hal: put return type and function name on one line staging: rtl8723bs: fix typo in comment staging: sm750fb: rename snake case variables staging: sm750fb: remove unnecessary volatile qualifiers staging: rtl8723bs: rtw_efuse.h: simplify copyright banner staging: rtl8723bs: remove unused tables staging: rtl8723bs: Hal_EfuseParseAntennaDiversity_8723B is empty staging: rtl8723bs: remove REG_EFUSE_ACCESS_8723 and EFUSE_ACCESS_ON_8723 staging: rtl8723bs: remove bWrite from Hal_EfusePowerSwitch staging: rtl8723bs: remove wrapper Efuse_PowerSwitch staging: octeon: Clean up dead code in ethernet-tx.c staging: rtl8723bs: fix fortify warnings by using struct_group staging: gpib: use int type to store negative error codes staging: rtl8723bs: remove include/recv_osdep.h staging: rtl8723bs: remove os_dep/recv_linux.c staging: rtl8723bs: rename rtw_os_recv_indicate_pkt staging: rtl8723bs: move rtw_os_recv_indicate_pkt to rtw_recv.c staging: rtl8723bs: rename rtw_os_alloc_msdu_pkt ... commit c6006b8ca14dcc604567be99fc4863e6e11ab6e3 Merge: 5d2f4730bb7550 e40b984b6c4ce3 Author: Linus Torvalds Date: Sat Oct 4 16:07:08 2025 -0700 Merge tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and thunderbolt drivers for 6.18-rc1. It was another normal development cycle, with lots of the usual drivers getting updates: - Thunderbolt driver cleanups and additions - dwc3 driver updates - dwc2 driver updates - typec driver updates - xhci driver updates and additions - offload USB engine updates for better power management - unused tracepoint removals - usb gadget fixes and updates as more users start to rely on these drivers instead of the "old" function gadget drivers - new USB device ids - other minor driver USB driver updates - new USB I/O driver framework and driver additions" The last item, the usb i/o driver, has an i2c and gpio driver added through this tree. Those drivers were acked by the respective subsystem maintainers. All of these have been in linux-next for a while" * tag 'usb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (132 commits) usb: vhci-hcd: Prevent suspending virtually attached devices USB: serial: option: add SIMCom 8230C compositions thunderbolt: Fix use-after-free in tb_dp_dprx_work usb: xhci: align PORTSC trace with one-based port numbering usb: xhci: correct indentation for PORTSC tracing function usb: xhci: improve TR Dequeue Pointer mask usb: xhci-pci: add support for hosts with zero USB3 ports usb: xhci: Update a comment about Stop Endpoint retries Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" usb: gadget: f_rndis: Refactor bind path to use __free() usb: gadget: f_ecm: Refactor bind path to use __free() usb: gadget: f_acm: Refactor bind path to use __free() usb: gadget: f_ncm: Refactor bind path to use __free() usb: gadget: Introduce free_usb_request helper usb: gadget: Store endpoint pointer in usb_request usb: host: xhci-rcar: Add Renesas RZ/G3E USB3 Host driver support usb: host: xhci-plat: Add .post_resume_quirk for struct xhci_plat_priv usb: host: xhci-rcar: Move R-Car reg definitions dt-bindings: usb: Document Renesas RZ/G3E USB3HOST usb: gadget: f_fs: Fix epfile null pointer access after ep enable. ... commit 5d2f4730bb7550d64c87785f1035d0e641dbc979 Merge: cc07b0a3afc8c1 f4abab350840d5 Author: Linus Torvalds Date: Sat Oct 4 15:57:44 2025 -0700 Merge tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here are some small updates for tty/serial drivers for 6.18-rc1. Not many changes overall, just the usual: - abi cleanups and reworking of the tty functions by Jiri by adding console lock guard logic - 8250_platform driver updates - qcom-geni driver updates - other minor serial driver updates - some more vt escape codes added All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (43 commits) tty: serial: fix help message for SERIAL_CPM serial: 8250: omap: Support wakeup pinctrl state on suspend dt-bindings: serial: 8250_omap: Add wakeup pinctrl state serial: max310x: improve interrupt handling vt: move vc_saved_screen to within tty allocated judgment Revert "m68k: make HPDCA and HPAPCI bools" tty: remove redundant condition checks tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() vt: remove redundant check on vc_mode in con_font_set() serial: qcom-geni: Add DFS clock mode support to GENI UART driver m68k: make HPDCA and HPAPCI bools tty: n_gsm: Don't block input queue by waiting MSC serial: qcom-geni: Fix off-by-one error in ida_alloc_range() serdev: Drop dev_pm_domain_detach() call serial: sc16is7xx: drop redundant conversion to bool vt: add support for smput/rmput escape codes serial: stm32: allow selecting console when the driver is module serial: 8250_core: fix coding style issue tty: serial: Modify the use of dev_err_probe() s390/char/con3270: use tty_port_tty guard() ... commit cc07b0a3afc8c15c1308497033453b44f7ccfc49 Merge: 20f868da2cc6c2 efebdf4b722143 Author: Linus Torvalds Date: Sat Oct 4 15:50:37 2025 -0700 Merge tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD core: - Bad blocks increment is skipped if the block is already known bad (improves user statistics relevance) - Expose the OOB layout via debugfs Raw NAND: - Add support for Loongson-2K1000 and Loongson-2K0500 NAND controllers, including extra features, such as chip select and 6-byte NAND ID reading support - Drop the s3c2410 driver SPI NAND: - Important SPI NAND continuous read improvements and fixes - Add support for FudanMicro FM25S01A - Add support for continuous reads in Gigadevice vendor driver ECC: - Add support for the Realtek ECC engine SPI NOR: - Some flashes can't perform reads or writes with start or end being an odd number in Octal DTR mode. File systems like UBIFS can request such reads or writes, causing the transaction to error out. Pad the read or write transactions with extra bytes to avoid this problem. And the usual amount of various miscellaneous fixes" * tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (46 commits) mtd: rawnand: sunxi: drop unused module alias mtd: rawnand: stm32_fmc2: drop unused module alias mtd: rawnand: rockchip: drop unused module alias mtd: rawnand: pl353: drop unused module alias mtd: rawnand: omap2: drop unused module alias mtd: rawnand: atmel: drop unused module alias mtd: onenand: omap2: drop unused module alias mtd: hyperbus: hbmc-am654: drop unused module alias mtd: jedec_probe: use struct_size() helper for cfiq allocation mtd: cfi: use struct_size() helper for cfiq allocation mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N mtd: rawnand: omap2: fix device leak on probe failure mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands mtd: nand: realtek-ecc: Add Realtek external ECC engine support dt-bindings: mtd: Add realtek,rtl9301-ecc mtd: spinand: repeat reading in regular mode if continuous reading fails mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails mtd: spinand: fix direct mapping creation sizes mtd: rawnand: fsmc: Default to autodetect buswidth mtd: nand: move nand_check_erased_ecc_chunk() to nand/core ... commit 20f868da2cc6c2d53e8a3c7a2a4d1edf5c730eae Merge: c35f902cb31dad 09390ed9af37ed Author: Linus Torvalds Date: Sat Oct 4 15:46:51 2025 -0700 Merge tag 'rpmsg-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Clean up the dev_pm_domain integration in rpmsg core. Correct module aliases for the rpmsg char driver. - Transition Qualcomm SMD and GLINK drivers to strscpy() and fix the regression in legacy code for acquiring outgoing interrupts using the non-mailbox based mechanism. * tag 'rpmsg-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse rpmsg: Use strscpy() instead of strscpy_pad() rpmsg: core: Drop dev_pm_domain_detach() call rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table commit c35f902cb31dad551dcc1c79540a58145cb19479 Merge: 54ba6d9b1393a0 d41e075b077142 Author: Linus Torvalds Date: Sat Oct 4 15:45:17 2025 -0700 Merge tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Enable coredump support for the i.MX HiFi core remoteproc, and clean up the i.MX remoteproc driver. - Introduce remoteprocs on the Qualcomm Milos platform. Gracefully shut own the ADSP remoteproc when bootloader has loaded the "Lite" firmware on X Elite. Improve the resource handover procedure to avoid possibly duplicate handling. - Transition the TI DA8xx, TI Keystone, and TI Wakeup M3 remoteproc drivers to handle resources using devres. * tag 'rproc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (29 commits) remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() remoteproc: qcom: pas: Drop redundant assignment to ret remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E remoteproc: qcom: q6v5: Avoid handling handover twice remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice remoteproc: qcom: pas: Add Milos remoteproc support dt-bindings: remoteproc: qcom,milos-pas: Document remoteprocs remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974 remoteproc: imx_rproc: Clean up after ops introduction remoteproc: imx_rproc: Simplify IMX_RPROC_SMC switch case remoteproc: imx_rproc: Simplify IMX_RPROC_SCU_API switch case remoteproc: imx_rproc: Simplify IMX_RPROC_MMIO switch case remoteproc: imx_rproc: Move imx_rproc_dcfg closer to imx_rproc_of_match remoteproc: imx_rproc: Introduce start/stop/detect_mode ops for imx_rproc_dcfg remoteproc: k3: Correctly release some resources allocated in k3_rproc_request_mbox() remoteproc: wkup_m3: Use devm_rproc_add() helper remoteproc: wkup_m3: Use devm_rproc_alloc() helper remoteproc: wkup_m3: Use devm action to call PM runtime put sync remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper remoteproc: keystone: Use devm_rproc_add() helper ... commit 54ba6d9b1393a0061600c0e49c8ebef65d60a8b2 Merge: b66451723c45b7 cd3770675874ae Author: Linus Torvalds Date: Sat Oct 4 15:38:04 2025 -0700 Merge tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - haptic touchpad support (Angela Czubak and Jonathan Denose) - support for audio jack handling on DualSense Playstation controllers (Cristian Ciocaltea) - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin Tissoires) - rework hidraw ioctls to make them safer (and tested) (Benjamin Tissoires) - various PIDFF and universal-PIDFF fixes/improvements (Tomasz Pakuła) - better configuration of Intel QuickI2C through ACPI (Xinpeng Sun) - other assorted cleanups and fixes * tag 'hid-for-linus-2025093001' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (58 commits) HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker() HID: playstation: Silence sparse warnings for locking context imbalances HID: playstation: Update SP preamp gain comment line HID: intel-thc-hid: intel-quicki2c: support ACPI config for advanced features HID: core: Change hid_driver to use a const char* for name HID: hidraw: tighten ioctl command parsing selftests/hid: hidraw: forge wrong ioctls and tests them selftests/hid: hidraw: add more coverage for hidraw ioctls selftests/hid: update vmtest.sh for virtme-ng HID: playstation: Support DualSense audio jack event reporting HID: playstation: Support DualSense audio jack hotplug detection HID: playstation: Redefine DualSense input report status field HID: playstation: Prefer kzalloc(sizeof(*buf)...) HID: playstation: Document spinlock_t usage HID: playstation: Fix all alignment and line length issues HID: playstation: Correct spelling in comment sections HID: playstation: Replace uint{32,16,8}_t with u{32,16,8} HID: playstation: Simplify locking with guard() and scoped_guard() HID: playstation: Add spaces around arithmetic operators HID: playstation: Make use of bitfield macros ... commit b66451723c45b791fd2824d1b8f62fe498989e23 Merge: b4e5bb55559482 b8754092dfed4f Author: Linus Torvalds Date: Sat Oct 4 15:28:18 2025 -0700 Merge tag 'platform-drivers-x86-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: - amd/pmf: - Add support for adjusting PMF PPT and PPT APU thresholds - Extend custom BIOS inputs for more policies - Update ta_pmf_action structure to the latest PMF TA - arm64: - thinkpad-t14s-ec: Add EC driver for ThinkPad T14s Gen6 Snapdragon - int3472: - Increase handshake GPIO delay - intel/pmc: - SSRAM support for Lunar Lake and Panther Lake - Support reading substate requirements data from S0ix blockers (for platforms starting from Panther Lake) - Wildcat Lake support - intel-uncore-freq: - Solve duplicate sysfs entry warnings - Present unique domain ID per package - portwell-ec: - Support suspend/resume - Add hwmon support for voltage and temperature - redmi-wmi: - Add WMI driver for Redmibook keyboard - think-lmi: - Certificate support for ThinkCenter - x86-android-tables + others: - Convert away from legacy GPIO APIs - x86-android-tables: - Add support for Acer A1-840 tablet - Fix modules list for Lenovo devices - Stop using EPROBE_DEFER - Miscellaneous cleanups / refactoring / improvements * tag 'platform-drivers-x86-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (63 commits) platform/x86: pcengines-apuv2: Use static device properties platform/x86: meraki-mx100: Use static device properties platform/x86: barco-p50-gpio: use software nodes for gpio-leds/keys platform/x86: x86-android-tablets: Stop using EPROBE_DEFER platform/x86: x86-android-tablets: Fix modules lists for Lenovo devices platform/x86: x86-android-tablets: Simplify lenovo_yoga_tab2_830_1050_exit() platform/x86: x86-android-tablets: Add support for Acer A1-840 tablet platform/x86: x86-android-tablets: Move Acer info to its own file platform/x86: x86-android-tablets: Update my email address platform/x86: x86-android-tablets: Simplify node-group [un]registration platform/x86: x86-android-tablets: use swnode_group instead of manual registering platform/x86: x86-android-tablets: replace bat_swnode with swnode_group platform/x86: x86-android-tablets: convert gpio_keys devices to GPIO references platform/x86: x86-android-tablets: remove support for GPIO lookup tables platform/x86: x86-android-tablets: convert Yoga Tab2 fast charger to GPIO references platform/x86: x86-android-tablets: convert HID-I2C devices to GPIO references platform/x86: x86-android-tablets: convert wm1502 devices to GPIO references platform/x86: x86-android-tablets: convert int3496 devices to GPIO references platform/x86: x86-android-tablets: convert EDT devices to GPIO references platform/x86: x86-android-tablets: convert Novatek devices to GPIO references ... commit b4e5bb555594826bb98aaf8bcd9f957f0428cb07 Merge: 908057d185a415 8be70a8fc667c3 Author: Linus Torvalds Date: Sat Oct 4 15:23:29 2025 -0700 Merge tag 'keys-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys updates from Jarkko Sakkinen: "A few minor updates/fixes for keys" * tag 'keys-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: security: keys: use menuconfig for KEYS symbol KEYS: encrypted: Use SHA-256 library instead of crypto_shash KEYS: trusted_tpm1: Move private functionality out of public header KEYS: trusted_tpm1: Use SHA-1 library instead of crypto_shash KEYS: trusted_tpm1: Compare HMAC values in constant time commit 908057d185a41560a55890afa69c9676fc63e55c Merge: d104e3d17f7bfc 166c83f7789ed0 Author: Linus Torvalds Date: Sat Oct 4 14:59:29 2025 -0700 Merge tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "Drivers: - Add ciphertext hiding support to ccp - Add hashjoin, gather and UDMA data move features to hisilicon - Add lz4 and lz77_only to hisilicon - Add xilinx hwrng driver - Add ti driver with ecb/cbc aes support - Add ring buffer idle and command queue telemetry for GEN6 in qat Others: - Use rcu_dereference_all to stop false alarms in rhashtable - Fix CPU number wraparound in padata" * tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (78 commits) dt-bindings: rng: hisi-rng: convert to DT schema crypto: doc - Add explicit title heading to API docs hwrng: ks-sa - fix division by zero in ks_sa_rng_init KEYS: X.509: Fix Basic Constraints CA flag parsing crypto: anubis - simplify return statement in anubis_mod_init crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs crypto: hisilicon/qm - clear all VF configurations in the hardware crypto: hisilicon - enable error reporting again crypto: hisilicon/qm - mask axi error before memory init crypto: hisilicon/qm - invalidate queues in use crypto: qat - Return pointer directly in adf_ctl_alloc_resources crypto: aspeed - Fix dma_unmap_sg() direction rhashtable: Use rcu_dereference_all and rcu_dereference_all_check crypto: comp - Use same definition of context alloc and free ops crypto: omap - convert from tasklet to BH workqueue crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() crypto: caam - double the entropy delay interval for retry padata: WQ_PERCPU added to alloc_workqueue users padata: replace use of system_unbound_wq with system_dfl_wq crypto: cryptd - WQ_PERCPU added to alloc_workqueue users ... commit d104e3d17f7bfc505281f57f8c1a5589fca6ffe4 Merge: 67da125e30ab17 46037455cbb748 Author: Linus Torvalds Date: Sat Oct 4 12:02:50 2025 -0700 Merge tag 'cxl-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "The changes include adding poison injection support, fixing CXL access coordinates when onlining CXL memory, and delaing the enumeration of downstream switch ports for CXL hierarchy to ensure that the CXL link is established at the time of enumeration to address a few issues observed on AMD and Intel platforms. Misc changes: - Use str_plural() instead of open code for emitting strings. - Use str_enabled_disabled() instead of ternary operator - Fix emit of type resource_size_t argument for validate_region_offset() - Typo fixup in CXL driver-api documentation - Rename CFMWS coherency restriction defines - Add convention doc describe dealing with x86 low memory hole and CXL Poison Inject support: - Move hpa_to_spa callback to new reoot decoder ops structure - Define a SPA to HPA callback for interleave calculation with XOR math - Add support for SPA to DPA address translation with XOR - Add locked variants of poison inject and clear functions - Add inject and clear poison support by region offset CXL access coordinates update fix: - A comment update for hotplug memory callback prority defines - Add node_update_perf_attrs() for updating perf attrs on a node - Update cxl_access_coordinates() to use the new node update function - Remove hmat_update_target_coordinates() and related code CXL delayed downstream port enumeration and initialization: - Add helper to detect top of CXL device topology and remove open coding - Add helper to delete single dport - Add a cached copy of target_map to cxl_decoder - Refactor decoder setup to reduce cxl_test burden - Defer dport allocation for switch ports - Add mock version of devm_cxl_add_dport_by_dev() for cxl_test - Adjust the mock version of devm_cxl_switch_port_decoders_setup() due to cxl core usage - Setup target_map for cxl_test decoder initialization - Change SSLBIS handler to handle single dport - Move port register setup to when first dport appears" * tag 'cxl-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (25 commits) cxl: Move port register setup to when first dport appear cxl: Change sslbis handler to only handle single dport cxl/test: Setup target_map for cxl_test decoder initialization cxl/test: Adjust the mock version of devm_cxl_switch_port_decoders_setup() cxl/test: Add mock version of devm_cxl_add_dport_by_dev() cxl: Defer dport allocation for switch ports cxl/test: Refactor decoder setup to reduce cxl_test burden cxl: Add a cached copy of target_map to cxl_decoder cxl: Add helper to delete dport cxl: Add helper to detect top of CXL device topology cxl: Documentation/driver-api/cxl: Describe the x86 Low Memory Hole solution cxl/acpi: Rename CFMW coherency restrictions Documentation/driver-api: Fix typo error in cxl acpi/hmat: Remove now unused hmat_update_target_coordinates() cxl, acpi/hmat: Update CXL access coordinates directly instead of through HMAT drivers/base/node: Add a helper function node_update_perf_attrs() mm/memory_hotplug: Update comment for hotplug memory callback priorities cxl: Fix emit of type resource_size_t argument for validate_region_offset() cxl/region: Add inject and clear poison by region offset cxl/core: Add locked variants of the poison inject and clear funcs ... commit 67da125e30ab17b5b8874eb32882e81cdec17ec8 Merge: 48e3694ae7fae3 1d289fc5691c7a Author: Linus Torvalds Date: Sat Oct 4 11:28:45 2025 -0700 Merge tag 'rcu.2025.09.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Paul McKenney: "Documentation updates: - Update whatisRCU.rst and checklist.rst for recent RCU API additions - Fix RCU documentation formatting and typos - Replace dead Ottawa Linux Symposium links in RTFP.txt Miscellaneous RCU updates: - Document that rcu_barrier() hurries RCU_LAZY callbacks - Remove redundant interrupt disabling from rcu_preempt_deferred_qs_handler() - Move list_for_each_rcu from list.h to rculist.h, and adjust the include directive in kernel/cgroup/dmem.c accordingly - Make initial set of changes to accommodate upcoming system_percpu_wq changes SRCU updates: - Create an srcu_read_lock_fast_notrace() for eventual use in tracing, including adding guards - Document the reliance on per-CPU operations as implicit RCU readers in __srcu_read_{,un}lock_fast() - Document the srcu_flip() function's memory-barrier D's relationship to SRCU-fast readers - Remove a redundant preempt_disable() and preempt_enable() pair from srcu_gp_start_if_needed() Torture-test updates: - Fix jitter.sh spin time so that it actually varies as advertised. It is still quite coarse-grained, but at least it does now vary - Update torture.sh help text to include the not-so-new --do-normal parameter, which permits (for example) testing KCSAN kernels without doing non-debug kernels - Fix a number of false-positive diagnostics that were being triggered by rcutorture starting before boot completed. Running multiple near-CPU-bound rcutorture processes when there is only the boot CPU is after all a bit excessive - Substitute kcalloc() for kzalloc() - Remove a redundant kfree() and NULL out kfree()ed objects" * tag 'rcu.2025.09.26a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (31 commits) rcu: WQ_UNBOUND added to sync_wq workqueue rcu: WQ_PERCPU added to alloc_workqueue users rcu: replace use of system_wq with system_percpu_wq refperf: Set reader_tasks to NULL after kfree() refperf: Remove redundant kfree() after torture_stop_kthread() srcu/tiny: Remove preempt_disable/enable() in srcu_gp_start_if_needed() srcu: Document srcu_flip() memory-barrier D relation to SRCU-fast srcu: Document __srcu_read_{,un}lock_fast() implicit RCU readers rculist: move list_for_each_rcu() to where it belongs refscale: Use kcalloc() instead of kzalloc() rcutorture: Use kcalloc() instead of kzalloc() docs: rcu: Replace multiple dead OLS links in RTFP.txt doc: Fix typo in RCU's torture.rst documentation Documentation: RCU: Retitle toctree index Documentation: RCU: Reduce toctree depth Documentation: RCU: Wrap kvm-remote.sh rerun snippet in literal code block rcu: docs: Requirements.rst: Abide by conventions of kernel documentation doc: Add RCU guards to checklist.rst doc: Update whatisRCU.rst for recent RCU API additions rcutorture: Delay forward-progress testing until boot completes ... commit 48e3694ae7fae347c1193c84f384f4ea41086075 Merge: b41048485ee395 7a75a5da79ef90 Author: Linus Torvalds Date: Sat Oct 4 11:13:11 2025 -0700 Merge tag 'printk-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Add KUnit test for the printk ring buffer - Fix the check of the maximal record size which is allowed to be stored into the printk ring buffer. It prevents corruptions of the ring buffer. Note that printk() is on the safe side. The messages are limited by 1kB buffer and are always small enough for the minimal log buffer size 4kB, see CONFIG_LOG_BUF_SHIFT definition. * tag 'printk-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: ringbuffer: Fix data block max size check printk: kunit: support offstack cpumask printk: kunit: Fix __counted_by() in struct prbtest_rbdata printk: ringbuffer: Explain why the KUnit test ignores failed writes printk: ringbuffer: Add KUnit test commit b41048485ee395edbbb69fc83491d314268f7bdb Merge: c4c8bcab18821e e68f150bc11d0a Author: Linus Torvalds Date: Sat Oct 4 11:03:10 2025 -0700 Merge tag 'memblock-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull mm-init update from Mike Rapoport: "Simplify deferred initialization of struct pages Refactor and simplify deferred initialization of the memory map. Beside the negative diffstat it gives 3ms (55ms vs 58ms) reduction in the initialization of deferred pages on single node system with 64GiB of RAM" * tag 'memblock-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: drop for_each_free_mem_pfn_range_in_zone_from() mm/mm_init: drop deferred_init_maxorder() mm/mm_init: deferred_init_memmap: use a job per zone mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone() commit c4c8bcab18821e0c2852c38dece918512c60c732 Merge: 86bcf7be1e26f2 fe0126702a40b2 Author: Linus Torvalds Date: Sat Oct 4 10:59:06 2025 -0700 Merge tag 'sparc-for-6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc Pull sparc updates from Andreas Larsson: - Add relocation handling for R_SPARC_UA64 for sparc64 that is generated by llvm and clarify printout on missing relocation handler - Fix missing hugetlb tte initialization for sun4u - Code cleanup for redundant use of __GPF_NOWARN for sparc64 - Fix prototypes of reads[bwl]() for sparc64 by adding missing const and volatile pointer qualifiers - Fix bugs in accurate exception reporting in multiple machine specific sparc64 variants of copy_{from,to}_user() for sparc64 - Fix memory leak in error handling for sparc32 - Drop -ansi from asflags and replace __ASSEMBLY__ with __ASSEMBLER__ in headers for all arch/sparc - Replace strcpy() with strscpy() for all arch/sparc * tag 'sparc-for-6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc: (22 commits) sparc: Replace deprecated strcpy() with strscpy() in handle_nextprop_quirks() sparc64: Replace deprecated strcpy() with strscpy() in build_path_component() sparc: Replace deprecated strcpy() with strscpy() in prom_32.c sparc: Replace deprecated strcpy() with strscpy() in domain services driver sparc64: Replace deprecated strcpy() with strscpy() in prom_nextprop() sparc: floppy: Replace deprecated strcpy() with strscpy() in sun_floppy_init() sparc: parport: Replace deprecated strcpy() with strscpy() in ecpp_probe() sparc: PCI: Replace deprecated strcpy() with strscpy() sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers sparc: Drop the "-ansi" from the asflags sparc: fix error handling in scan_one_device() sparc: fix accurate exception reporting in copy_{from,to}_user for M7 sparc: fix accurate exception reporting in copy_to_user for Niagara 4 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC sparc64: fix prototypes of reads[bwl]() sparc64: Remove redundant __GFP_NOWARN sparc64: fix hugetlb for sun4u ... commit 86bcf7be1e26f2d7277df90857d93ce0ebc11370 Merge: 7c738cb4ca678e 68247d45c045bb Author: Linus Torvalds Date: Sat Oct 4 10:36:22 2025 -0700 Merge tag 'riscv-for-linus-6.18-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Paul Walmsley: - Support for the RISC-V-standardized RPMI interface. RPMI is a platform management communication mechanism between OSes running on application processors, and a remote platform management processor. Similar to ARM SCMI, TI SCI, etc. This includes irqchip, mailbox, and clk changes. - Support for the RISC-V-standardized MPXY SBI extension. MPXY is a RISC-V-specific standard implementing a shared memory mailbox between S-mode operating systems (e.g., Linux) and M-mode firmware (e.g., OpenSBI). It is part of this PR since one of its use cases is to enable M-mode firmware to act as a single RPMI client for all RPMI activity on a core (including S-mode RPMI activity). Includes a mailbox driver. - Some ACPI-related updates to enable the use of RPMI and MPXY. - The addition of Linux-wide memcpy_{from,to}_le32() static inline functions, for RPMI use. - An ACPI Kconfig change to enable boot logos on any ACPI-using architecture (including RISC-V) - A RISC-V defconfig change to add GPIO keyboard and event device support, for front panel shutdown or reboot buttons * tag 'riscv-for-linus-6.18-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (26 commits) clk: COMMON_CLK_RPMI should depend on RISCV ACPI: support BGRT table on RISC-V MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers RISC-V: Enable GPIO keyboard and event device in RV64 defconfig irqchip/riscv-rpmi-sysmsi: Add ACPI support mailbox/riscv-sbi-mpxy: Add ACPI support irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode() ACPI: RISC-V: Add RPMI System MSI to GSI mapping ACPI: RISC-V: Add support to update gsi range ACPI: RISC-V: Create interrupt controller list in sorted order ACPI: scan: Update honor list for RPMI System MSI ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop irqchip: Add driver for the RPMI system MSI service group dt-bindings: Add RPMI system MSI interrupt controller bindings dt-bindings: Add RPMI system MSI message proxy bindings clk: Add clock driver for the RISC-V RPMI clock service group dt-bindings: clock: Add RPMI clock service controller bindings dt-bindings: clock: Add RPMI clock service message proxy bindings mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver ... commit 7c738cb4ca678e70c4583ab35587f30bfae823e5 Merge: be786eba12c87d 3da01ffe1aeaa0 Author: Linus Torvalds Date: Sat Oct 4 10:25:22 2025 -0700 Merge tag 'x86_entry_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry updates from Dave Hansen: "A pair of x86/entry updates. The FRED one adjusts the kernel to the latest spec. The spec change prevents attackers from abusing kernel entry points. The second one came about because of the LASS work[1]. It moves the vsyscall emulation code away from depending on X86_PF_INSTR which is not available on some CPUs. Those CPUs are pretty obscure these days, but this still seems like the right thing to do. It also makes this code consistent with some things that the LASS code is going to do. - Use RIP instead of X86_PF_INSTR for vsyscall emulation - Remove ENDBR64 from FRED entry points" Link: https://lore.kernel.org/lkml/20250620135325.3300848-1-kirill.shutemov@linux.intel.com/ [1] * tag 'x86_entry_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fred: Remove ENDBR64 from FRED entry points x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall commit be786eba12c87dc04ad8eac408dc17369c04ad47 Merge: 50ac57c3b156e8 86e6815b316ec0 Author: Linus Torvalds Date: Sat Oct 4 10:20:26 2025 -0700 Merge tag 'x86_mm_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm update from Dave Hansen: "A single change to remove an open-coded TLB flush operation by using an existing helper. This came out of Rik van Riel's work to get the INVLPGB instruction working. - Change cpa_flush() to call flush_kernel_range() directly" * tag 'x86_mm_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Change cpa_flush() to call flush_kernel_range() directly commit 50ac57c3b156e893e34310f0be340a130f36f6db Merge: 5b7ce9385441cf e414b1005891d7 Author: Linus Torvalds Date: Sat Oct 4 10:01:30 2025 -0700 Merge tag 'x86_tdx_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 TDX updates from Dave Hansen: "The biggest change here is making TDX and kexec play nicely together. Before this, the memory encryption hardware (which doesn't respect cache coherency) could write back old cachelines on top of data in the new kernel, so kexec and TDX were made mutually exclusive. This removes the limitation. There is also some work to tighten up a hardware bug workaround and some MAINTAINERS updates. - Make TDX and kexec work together - Skip TDX bug workaround when the bug is not present - Update maintainers entries" * tag 'x86_tdx_for_6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/virt/tdx: Use precalculated TDVPR page physical address KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs x86/virt/tdx: Update the kexec section in the TDX documentation x86/virt/tdx: Remove the !KEXEC_CORE dependency x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL x86/sme: Use percpu boolean to control WBINVD during kexec x86/kexec: Consolidate relocate_kernel() function parameters x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present x86/tdx: Tidy reset_pamt functions x86/tdx: Eliminate duplicate code in tdx_clear_page() MAINTAINERS: Add KVM mail list to the TDX entry MAINTAINERS: Add Rick Edgecombe as a TDX reviewer MAINTAINERS: Update the file list in the TDX entry. commit 5b7ce9385441cfce92e6b7324216cc38614f86ef Merge: f3826aa9962b45 fdbdd0ccb30af1 Author: Linus Torvalds Date: Sat Oct 4 09:59:05 2025 -0700 Merge tag 'kgdb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "A collection of small cleanups this cycle. Thorsten Blum has replaced a number strcpy() calls with safer alternatives (fixing a pointer aliasing bug in the process). Colin Ian King has simplified things by removing some unreachable code" * tag 'kgdb-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: remove redundant check for scancode 0xe0 kdb: Replace deprecated strcpy() with helper function in kdb_defcmd() kdb: Replace deprecated strcpy() with memcpy() in parse_grep() kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() kdb: Replace deprecated strcpy() with memcpy() in kdb_strdup() kernel: debug: gdbstub: Replace deprecated strcpy() with strscpy() commit d51e7cfca3fe5540466322c33d665674530148dd Author: Wolfram Sang Date: Thu Sep 25 23:05:18 2025 +0200 i2c: mt65xx: convert set_speed function to void cppcheck rightfully reports: drivers/i2c/busses/i2c-mt65xx.c:1464:6: warning: Condition 'ret' is always false [knownConditionTrueFalse] Make the function void and simplify the code. Signed-off-by: Wolfram Sang Reviewed-by: AngeloGioacchino Del Regno commit b71a6e2a1b710ea31c363a72c75f510ef35d8e69 Author: Byungchul Park Date: Thu Oct 2 17:12:35 2025 +0900 i2c: rename wait_for_completion callback to wait_for_completion_cb Functionally no change. Remove the ambiguity of 'wait_for_completion'. It helps development of the DEPT dependency tracker, but seems favorable in any case. Signed-off-by: Byungchul Park [wsa: reworded commit message] Signed-off-by: Wolfram Sang commit 09dc3972be3f6191ab021ac01932bf5279f961f0 Author: Thomas Richter Date: Thu Oct 2 09:36:20 2025 +0200 s390/pai_crypto: Consolidate PAI crypto allocation and cleanup paths Introduce paicrypt_free() to centralize memory release for per-CPU maps and remove duplicated free logic. Replace paicrypt_busy() with paicrypt_alloc_cpu() returning int error codes instead of ERR_PTR, and adjust callers accordingly. System-wide allocation now uses paicrypt_alloc() with consistent error handling. Memory allocation and free management is now identical to PMU pai_ext. Reference counting and root anchor management remain unchanged. Debug output in the destroy path is dropped. Signed-off-by: Thomas Richter Tested-by: Jan Polensky Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 Author: Vineeth Vijayan Date: Wed Oct 1 15:38:17 2025 +0200 s390/cio: Update purge function to unregister the unused subchannels Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")', cio no longer unregisters subchannels when the attached device is invalid or unavailable. As an unintended side-effect, the cio_ignore purge function no longer removes subchannels for devices on the cio_ignore list if no CCW device is attached. This situation occurs when a CCW device is non-operational or unavailable To ensure the same outcome of the purge function as when the current cio_ignore list had been active during boot, update the purge function to remove I/O subchannels without working CCW devices if the associated device number is found on the cio_ignore list. Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers") Suggested-by: Peter Oberparleiter Reviewed-by: Peter Oberparleiter Signed-off-by: Vineeth Vijayan Signed-off-by: Heiko Carstens commit b043a81ce3ee3aa1d4adc63eb77203a652cfc94e Author: Ramesh Errabolu Date: Sun Sep 28 23:38:27 2025 -0500 s390/pci: Expose firmware provided UID Checking state in sysfs The sysfs file /sys/bus/pci/devices//uid_is_unique provides the UID Checking state as a per device attribute, highlighting its effect of providing the guarantee that a device's UID is unique. As a device attribute, this parameter is however unavailable if no device is configured. Expose the UID Checking state as: - A platform-level parameter - Available regardless of device presence or state Signed-off-by: Ramesh Errabolu Reviewed-by: Niklas Schnelle Signed-off-by: Heiko Carstens commit 1884f54e48da54a16b6f03b6b1ea6b88f096c28e Merge: cbf33b8e0b360f 1e33137d47105a Author: Wolfram Sang Date: Sat Oct 4 18:29:16 2025 +0200 Merge tag 'i2c-host-6.18-pt2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.18, part 2 rtl9300 updates: - general cleanups - implemented block read/write support - added RTL9310 support commit de7342228b7343774d6a9981c2ddbfb5e201044b Author: Rong Tao Date: Sat Oct 4 22:23:29 2025 +0800 bpf: Finish constification of 1st parameter of bpf_d_path() The commit 1b8abbb12128 ("bpf...d_path(): constify path argument") constified the first parameter of the bpf_d_path(), but failed to update it in all places. Finish constification. Otherwise the selftest fail to build: .../selftests/bpf/bpf_experimental.h:222:12: error: conflicting types for 'bpf_path_d_path' 222 | extern int bpf_path_d_path(const struct path *path, char *buf, size_t buf__sz) __ksym; | ^ .../selftests/bpf/tools/include/vmlinux.h:153922:12: note: previous declaration is here 153922 | extern int bpf_path_d_path(struct path *path, char *buf, size_t buf__sz) __weak __ksym; Fixes: 1b8abbb12128 ("bpf...d_path(): constify path argument") Signed-off-by: Rong Tao Signed-off-by: Alexei Starovoitov commit f3826aa9962b4572d01083c84ac0f8345f121168 Merge: bf897d2626abe4 99cab80208809c Author: Linus Torvalds Date: Sat Oct 4 08:52:16 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "This excludes the bulk of the x86 changes, which I will send separately. They have two not complex but relatively unusual conflicts so I will wait for other dust to settle. guest_memfd: - Add support for host userspace mapping of guest_memfd-backed memory for VM types that do NOT use support KVM_MEMORY_ATTRIBUTE_PRIVATE (which isn't precisely the same thing as CoCo VMs, since x86's SEV-MEM and SEV-ES have no way to detect private vs. shared). This lays the groundwork for removal of guest memory from the kernel direct map, as well as for limited mmap() for guest_memfd-backed memory. For more information see: - commit a6ad54137af9 ("Merge branch 'guest-memfd-mmap' into HEAD") - guest_memfd in Firecracker: https://github.com/firecracker-microvm/firecracker/tree/feature/secret-hiding - direct map removal: https://lore.kernel.org/all/20250221160728.1584559-1-roypat@amazon.co.uk/ - mmap support: https://lore.kernel.org/all/20250328153133.3504118-1-tabba@google.com/ ARM: - Add support for FF-A 1.2 as the secure memory conduit for pKVM, allowing more registers to be used as part of the message payload. - Change the way pKVM allocates its VM handles, making sure that the privileged hypervisor is never tricked into using uninitialised data. - Speed up MMIO range registration by avoiding unnecessary RCU synchronisation, which results in VMs starting much quicker. - Add the dump of the instruction stream when panic-ing in the EL2 payload, just like the rest of the kernel has always done. This will hopefully help debugging non-VHE setups. - Add 52bit PA support to the stage-1 page-table walker, and make use of it to populate the fault level reported to the guest on failing to translate a stage-1 walk. - Add NV support to the GICv3-on-GICv5 emulation code, ensuring feature parity for guests, irrespective of the host platform. - Fix some really ugly architecture problems when dealing with debug in a nested VM. This has some bad performance impacts, but is at least correct. - Add enough infrastructure to be able to disable EL2 features and give effective values to the EL2 control registers. This then allows a bunch of features to be turned off, which helps cross-host migration. - Large rework of the selftest infrastructure to allow most tests to transparently run at EL2. This is the first step towards enabling NV testing. - Various fixes and improvements all over the map, including one BE fix, just in time for the removal of the feature. LoongArch: - Detect page table walk feature on new hardware - Add sign extension with kernel MMIO/IOCSR emulation - Improve in-kernel IPI emulation - Improve in-kernel PCH-PIC emulation - Move kvm_iocsr tracepoint out of generic code RISC-V: - Added SBI FWFT extension for Guest/VM with misaligned delegation and pointer masking PMLEN features - Added ONE_REG interface for SBI FWFT extension - Added Zicbop and bfloat16 extensions for Guest/VM - Enabled more common KVM selftests for RISC-V - Added SBI v3.0 PMU enhancements in KVM and perf driver s390: - Improve interrupt cpu for wakeup, in particular the heuristic to decide which vCPU to deliver a floating interrupt to. - Clear the PTE when discarding a swapped page because of CMMA; this bug was introduced in 6.16 when refactoring gmap code. x86 selftests: - Add #DE coverage in the fastops test (the only exception that's guest- triggerable in fastop-emulated instructions). - Fix PMU selftests errors encountered on Granite Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF). - Minor cleanups and improvements x86 (guest side): - For the legacy PCI hole (memory between TOLUD and 4GiB) to UC when overriding guest MTRR for TDX/SNP to fix an issue where ACPI auto-mapping could map devices as WB and prevent the device drivers from mapping their devices with UC/UC-. - Make kvm_async_pf_task_wake() a local static helper and remove its export. - Use native qspinlocks when running in a VM with dedicated vCPU=>pCPU bindings even when PV_UNHALT is unsupported. Generic: - Remove a redundant __GFP_NOWARN from kvm_setup_async_pf() as __GFP_NOWARN is now included in GFP_NOWAIT. * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (178 commits) KVM: s390: Fix to clear PTE when discarding a swapped page KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs KVM: arm64: selftests: Cope with arch silliness in EL2 selftest KVM: arm64: selftests: Add basic test for running in VHE EL2 KVM: arm64: selftests: Enable EL2 by default KVM: arm64: selftests: Initialize HCR_EL2 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 KVM: arm64: selftests: Select SMCCC conduit based on current EL KVM: arm64: selftests: Provide helper for getting default vCPU target KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts KVM: arm64: selftests: Create a VGICv3 for 'default' VMs KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation KVM: arm64: selftests: Add helper to check for VGICv3 support KVM: arm64: selftests: Initialize VGICv3 only once KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code KVM: selftests: Add ex_str() to print human friendly name of exception vectors selftests/kvm: remove stale TODO in xapic_state_test KVM: selftests: Handle Intel Atom errata that leads to PMU event overcount ... commit bf897d2626abe4559953342e2f7dda05d034c8c7 Merge: 55a42f78ffd386 ed9f3ab9f3d365 Author: Linus Torvalds Date: Sat Oct 4 08:48:16 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Just fixes and cleanups this time around. The mapping cleanups are preparing the ground for new features, though" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio-vdpa: Drop redundant conversion to bool vduse: Use fixed 4KB bounce pages for non-4KB page size vduse: switch to use virtio map API instead of DMA API vdpa: introduce map ops vdpa: support virtio_map virtio: introduce map ops in virtio core virtio_ring: rename dma_handle to map_handle virtio: introduce virtio_map container union virtio: rename dma helpers virtio_ring: switch to use dma_{map|unmap}_page() virtio_ring: constify virtqueue pointer for DMA helpers virtio_balloon: Remove redundant __GFP_NOWARN vhost: vringh: Fix copy_to_iter return value check vhost: vringh: Modify the return value check commit 55a42f78ffd386e01a5404419f8c5ded7db70a21 Merge: cbf33b8e0b360f 407aa63018d15c Author: Linus Torvalds Date: Sat Oct 4 08:24:54 2025 -0700 Merge tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Use fdinfo to expose the sysfs path of a device represented by a vfio device file (Alex Mastro) - Mark vfio-fsl-mc, vfio-amba, and the reset functions for vfio-platform for removal as these are either orphaned or believed to be unused (Alex Williamson) - Add reviewers for vfio-platform to save it from also being marked for removal (Mostafa Saleh, Pranjal Shrivastava) - VFIO selftests, including basic sanity testing and minimal userspace drivers for testing against real hardware. This is also expected to provide integration with KVM selftests for KVM-VFIO interfaces (David Matlack, Josh Hilke) - Fix drivers/cdx and vfio/cdx to build without CONFIG_GENERIC_MSI_IRQ (Nipun Gupta) - Fix reference leak in hisi_acc (Miaoqian Lin) - Use consistent return for unsupported device feature (Alex Mastro) - Unwind using the correct memory free callback in vfio/pds (Zilin Guan) - Use IRQ_DISABLE_LAZY flag to improve handling of pre-PCI2.3 INTx and resolve stalled interrupt on ppc64 (Timothy Pearson) - Enable GB300 in nvgrace-gpu vfio-pci variant driver (Tushar Dave) - Misc: - Drop unnecessary ternary conversion in vfio/pci (Xichao Zhao) - Grammatical fix in nvgrace-gpu (Morduan Zang) - Update Shameer's email address (Shameer Kolothum) - Fix document build warning (Alex Williamson) * tag 'vfio-v6.18-rc1' of https://github.com/awilliam/linux-vfio: (48 commits) vfio/nvgrace-gpu: Add GB300 SKU to the devid table vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices vfio/pds: replace bitmap_free with vfree vfio: return -ENOTTY for unsupported device feature hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init vfio/platform: Mark reset drivers for removal vfio/amba: Mark for removal MAINTAINERS: Add myself as VFIO-platform reviewer MAINTAINERS: Add myself as VFIO-platform reviewer docs: proc.rst: Fix VFIO Device title formatting vfio: selftests: Fix .gitignore for already tracked files vfio/cdx: update driver to build without CONFIG_GENERIC_MSI_IRQ cdx: don't select CONFIG_GENERIC_MSI_IRQ MAINTAINERS: Update Shameer Kolothum's email address vfio: selftests: Add a script to help with running VFIO selftests vfio: selftests: Make iommufd the default iommu_mode vfio: selftests: Add iommufd mode vfio: selftests: Add iommufd_compat_type1{,v2} modes vfio: selftests: Add vfio_type1v2_mode vfio: selftests: Replicate tests across all iommu_modes ... commit 8be70a8fc667c33e69257a72e8092f07c828241e Author: Randy Dunlap Date: Sat Sep 27 21:14:20 2025 +0300 security: keys: use menuconfig for KEYS symbol Give the KEYS kconfig symbol and its associated symbols a separate menu space under Security options by using "menuconfig" instead of "config". This also makes it easier to find the security and LSM options. Signed-off-by: Randy Dunlap Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 9b8d24a49fe83787208479d51f320cead25e856c Author: Eric Biggers Date: Mon Sep 15 21:14:43 2025 +0300 KEYS: encrypted: Use SHA-256 library instead of crypto_shash Instead of the "sha256" crypto_shash, just use sha256(). Similarly, instead of the "hmac(sha256)" crypto_shash, just use hmac_sha256_usingrawkey(). This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Reviewed-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 7a6399e327f4d5607d984c336c9c6e1cfcd9194a Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 14:37:57 2025 +0530 ALSA: emu10k1: Fix typo in docs interally => internally Signed-off-by: Bhanu Seshu Kumar Valluri Signed-off-by: Takashi Iwai commit 328b80b29a6a165c47fcc04d2bef3e09ed1d28f9 Author: Adam Holliday Date: Tue Sep 30 11:09:14 2025 -0400 ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo The ASUS ROG Zephyrus Duo 15 SE (GX551QS) with ALC 289 codec requires specific pin configuration for proper volume control. Without this quirk, volume adjustments produce a muffled sound effect as only certain channels attenuate, leaving bass frequency at full volume. Testing with hdajackretask confirms these pin tweaks fix the issue: - Pin 0x17: Internal Speaker (LFE) - Pin 0x1e: Internal Speaker Signed-off-by: Adam Holliday Signed-off-by: Takashi Iwai commit 1e33137d47105a807262aa17e028374463876f85 Author: Jonas Jelonek Date: Sat Sep 27 10:19:31 2025 +0000 i2c: rtl9300: add support for RTL9310 I2C controller Add support for the internal I2C controllers of RTL9310 series based SoCs to the driver for RTL9300. Add register definitions, chip-specific functions and compatible strings for known RTL9310-based SoCs RTL9311, RTL9312 and RTL9313. Make use of a new device tree property 'realtek,scl' which needs to be specified in case both or only the second master is used. This is required due how the register layout changed in contrast to RTL9300, which has SCL selection in a global register instead of a master-specific one. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-10-jelonek.jonas@gmail.com commit 99fd09e01db2c6fc4c6ffe851b337f64ff93e1b5 Author: Jonas Jelonek Date: Sat Sep 27 10:19:30 2025 +0000 dt-bindings: i2c: realtek,rtl9301-i2c: extend for RTL9310 support Adjust the regex for child-node address to account for the fact that RTL9310 supports 12 instead of only 8 SDA lines. Also, narrow this per variant. Add a vendor-specific property to explicitly specify the SCL line number of the defined I2C controller/master. This is required, in particular for RTL9310, to operate on the correct SCL for each controller. Require this property to be specified for RTL9310. Add compatibles for known SoC variants RTL9311, RTL9312 and RTL9313. Signed-off-by: Jonas Jelonek Reviewed-by: Rob Herring (Arm) Reviewed-by: Chris Packham Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-9-jelonek.jonas@gmail.com commit 46fe8265685cb6003a0989b53e11e8afa4826572 Author: Jonas Jelonek Date: Sat Sep 27 10:19:29 2025 +0000 i2c: rtl9300: use scoped guard instead of explicit lock/unlock Use the scoped guard infrastructure which unlocks a mutex automatically when the guard goes out of scope, instead of explicit lock and unlock. This simplifies the code and control flow in rtl9300_i2c_smbus_xfer and removes the need of using goto in error cases to unlock before returning. Signed-off-by: Jonas Jelonek Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-8-jelonek.jonas@gmail.com commit 059374aa0ab11a758a9e2219e90361911397b03d Author: Jonas Jelonek Date: Sat Sep 27 10:19:28 2025 +0000 i2c: rtl9300: separate xfer configuration and execution So far, the rtl9300_i2c_smbus_xfer code is quite a mess with function calls distributed over the whole function setting different values in different cases. Calls to rtl9300_i2c_config_xfer and rtl9300_i2c_reg_addr_set are used in every case-block with varying values whose meaning is not instantly obvious. In some cases, there are additional calls within these case-blocks doing more things. This is in general a bad design and especially really bad for readability and maintainability because it distributes changes or issues to multiple locations due to the same function being called with different hardcoded values in different places. To have a good structure, setting different parameters based on the desired operation should not be interleaved with applying these parameters to the hardware registers. Or in different words, the parameter site should be mixed with the call site. Thus, separate configuration and execution of an SMBus xfer within rtl9300_i2c_smbus_xfer to improve readability and maintainability. Add a new 'struct rtl9300_i2c_xfer' to carry the required parameters for an xfer which are configured based on the input parameters within a single switch-case block, without having any function calls within this block. The function calls to actually apply these values to the hardware registers then appear below in a single place and just operate on the passed instance of 'struct rtl9300_i2c_xfer'. These are 'rtl9300_i2c_prepare_xfer' which combines applying all parameters of the xfer to the corresponding register, and 'rtl9300_i2c_do_xfer' which actually executes the xfer and does post-processing if needed. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-7-jelonek.jonas@gmail.com commit d5b4fd6ed8ea3eb5dc072285a5e4c0ee32e829b2 Author: Jonas Jelonek Date: Sat Sep 27 10:19:27 2025 +0000 i2c: rtl9300: do not set read mode on every transfer Move the operation to set the read mode from config_xfer to probe. The I2C controller of RTL9300 and RTL9310 support a legacy message mode for READs with 'Read Address Data' instead of the standard format 'Write Address ; Read Data'. There is no way to pass that via smbus_xfer, thus there is no point in supported this in the driver and moreover no point in setting this on every transaction. Setting this once in the probe call is sufficient. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-6-jelonek.jonas@gmail.com commit d1cef7afc3c79260d4d1a86f7a814de2a1bf3fe4 Author: Jonas Jelonek Date: Sat Sep 27 10:19:26 2025 +0000 i2c: rtl9300: move setting SCL frequency to config_io Move the register operation to set the SCL frequency to the rtl9300_i2c_config_io function instead of the rtl9300_i2c_config_xfer function. This rather belongs there next to selecting the current SDA output line. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-5-jelonek.jonas@gmail.com commit c840492ad7487dcb58b0f5f249793e7350114076 Author: Jonas Jelonek Date: Sat Sep 27 10:19:25 2025 +0000 i2c: rtl9300: rename internal sda_pin to sda_num Rename the internally used 'sda_pin' to 'sda_num' to make it clear that this is NOT the actual pin number of the GPIO pin but rather the logical SDA channel number. Although the alternate function SDA_Y is sometimes given with the GPIO number, this is not always the case. Thus, avoid any confusion or misconfiguration by giving the variable the correct name. This follows the description change in the devicetree bindings. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-4-jelonek.jonas@gmail.com commit 0395a5e8fd07645df6743fd2a6883708196d9d75 Author: Jonas Jelonek Date: Sat Sep 27 10:19:24 2025 +0000 dt-bindings: i2c: realtek,rtl9301-i2c: fix wording and typos Fix wording of binding description to use plural because there is not only a single RTL9300 SoC. RTL9300 describes a whole family of Realtek SoCs. Add missing word 'of' in description of reg property. Change 'SDA pin' to 'SDA line number' because the property must contain the SDA (channel) number ranging from 0-7 instead of a real pin number. Signed-off-by: Jonas Jelonek Reviewed-by: Rob Herring (Arm) Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-3-jelonek.jonas@gmail.com commit 85f1c01ce2f98a4925d2610d9d3f4c2749eb9331 Author: Jonas Jelonek Date: Sat Sep 27 10:19:23 2025 +0000 i2c: rtl9300: use regmap fields and API for registers Adapt the RTL9300 I2C controller driver to use more of the regmap API, especially make use of reg_field and regmap_field instead of macros to represent registers. Most register operations are performed through regmap_field_* API then. Handle SCL selection using separate chip-specific functions since this is already known to differ between the Realtek SoC families in such a way that this cannot be properly handled using just a different reg_field. This makes it easier to add support for newer generations or to handle differences between specific revisions within a series. Just by defining a separate driver data structure with the corresponding register field definitions and linking it to a new compatible. Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250927101931.71575-2-jelonek.jonas@gmail.com commit d3c2191d493a9a017ea816f3b38dfbcadb6cccb5 Author: Harshal Gohel Date: Sat Sep 27 11:52:17 2025 +0200 i2c: rtl9300: Implement I2C block read and write It was noticed that the original implementation of SMBus Block Write in the driver was actually an I2C Block Write. Both differ only in the Count byte before the actual data: S Addr Wr [A] Comm [A] Count [A] Data [A] Data [A] ... [A] Data [A] P The I2C Block Write is just skipping this Count byte and starts directly with the data: S Addr Wr [A] Comm [A] Data [A] Data [A] ... [A] Data [A] P The I2C controller of RTL93xx doesn't handle this Count byte special and it is simply another one of (16 possible) data bytes. Adding support for the I2C Block Write therefore only requires skipping the count byte (0) in data->block. It is similar for reads. The SMBUS Block read is having a Count byte before the data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Count] A [Data] A [Data] A ... A [Data] NA P And the I2C Block Read is directly starting with the actual data: S Addr Wr [A] Comm [A] Sr Addr Rd [A] [Data] A [Data] A ... A [Data] NA P The I2C controller is also not handling this byte in a special way. It simply provides every byte after the Rd marker + Ack as part of the 16 byte receive buffer (registers). The content of this buffer just has to be copied to the right position in the receive data->block. Signed-off-by: Harshal Gohel Co-developed-by: Sven Eckelmann Signed-off-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham Reviewed-by: Jonas Jelonek Tested-by: Jonas Jelonek Signed-off-by: Andi Shyti Link: https://lore.kernel.org/all/20250927-i2c-rtl9300-multi-byte-v7-2-c0fd0e78b818@narfation.org commit cbf33b8e0b360f667b17106c15d9e2aac77a76a1 Merge: d955299b5c468f 63d2247e2e37d9 Author: Linus Torvalds Date: Fri Oct 3 19:38:19 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix selftests/bpf (typo, conflicts) and unbreak BPF CI (Jiri Olsa) - Remove linux/unaligned.h dependency for libbpf_sha256 (Andrii Nakryiko) and add a test (Eric Biggers) - Reject negative offsets for ALU operations in the verifier (Yazhou Tang) and add a test (Eduard Zingerman) - Skip scalar adjustment for BPF_NEG operation if destination register is a pointer (Brahmajit Das) and add a test (KaFai Wan) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: libbpf: Fix missing #pragma in libbpf_utils.c selftests/bpf: Add tests for rejection of ALU ops with negative offsets selftests/bpf: Add test for libbpf_sha256() bpf: Reject negative offsets for ALU ops libbpf: remove linux/unaligned.h dependency for libbpf_sha256() libbpf: move libbpf_sha256() implementation into libbpf_utils.c libbpf: move libbpf_errstr() into libbpf_utils.c libbpf: remove unused libbpf_strerror_r and STRERR_BUFSIZE libbpf: make libbpf_errno.c into more generic libbpf_utils.c selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer selftests/bpf: Fix realloc size in bpf_get_addrs selftests/bpf: Fix typo in subtest_basic_usdt after merge conflict selftests/bpf: Fix open-coded gettid syscall in uprobe syscall tests commit d955299b5c468f805d75e0b92e7c1d2392bae921 Merge: 674b0ddb7586a1 91f98de42310c7 Author: Linus Torvalds Date: Fri Oct 3 19:36:39 2025 -0700 Merge tag 'soc-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC build fix from Arnd Bergmann: "One commit for the dt bindings was missing from the dt branch, this one is already pending in the clk tree that contains the corresponding device driver" * tag 'soc-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: dt-bindings: clock: Add ARTPEC-8 clock controller commit 674b0ddb7586a192612442c3aed9cf523faeed7a Merge: 7dbec0bbc3b468 fb641516a66878 Author: Linus Torvalds Date: Fri Oct 3 19:17:48 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Usual driver updates (ufs, mpi3mr, lpfc, pm80xx, mpt3sas) plus assorted cleanups and fixes. The only core update is to sd.c and is mostly cosmetic" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (105 commits) scsi: MAINTAINERS: Update FC element owners scsi: mpt3sas: Update driver version to 54.100.00.00 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGE scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() scsi: ufs: ufs-qcom: Add support for limiting HS gear and rate scsi: ufs: pltfrm: Add DT support to limit HS gear and gear rate scsi: ufs: ufs-qcom: Remove redundant re-assignment to hs_rate scsi: ufs: dt-bindings: Document gear and rate limit properties scsi: ufs: core: Fix data race in CPU latency PM QoS request handling scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() scsi: storvsc: Remove redundant ternary operators scsi: ufs: core: Change MCQ interrupt enable flow scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user() scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() scsi: lpfc: Copyright updates for 14.4.0.11 patches scsi: lpfc: Update lpfc version to 14.4.0.11 scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int scsi: lpfc: Clean up extraneous phba dentries ... commit 7dbec0bbc3b468310be172f1ce6ddc9411c84952 Merge: 2ccb4d203fe4be 55dcfdf8af9c38 Author: Linus Torvalds Date: Fri Oct 3 18:48:02 2025 -0700 Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - a new dm-pcache target for read/write caching on persistent memory - fix typos in docs - misc small refactoring - mark dm-error with DM_TARGET_PASSES_INTEGRITY - dm-request-based: fix NULL pointer dereference and quiesce_depth out of sync - dm-linear: optimize REQ_PREFLUSH - dm-vdo: return error on corrupted metadata - dm-integrity: support asynchronous hash interface * tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (27 commits) dm raid: use proper md_ro_state enumerators dm-integrity: prefer synchronous hash interface dm-integrity: enable asynchronous hash interface dm-integrity: rename internal_hash dm-integrity: add the "offset" argument dm-integrity: allocate the recalculate buffer with kmalloc dm-integrity: introduce integrity_kmap and integrity_kunmap dm-integrity: replace bvec_kmap_local with kmap_local_page dm-integrity: use internal variable for digestsize dm vdo: return error on corrupted metadata in start_restoring_volume functions dm vdo: Update code to use mem_is_zero dm: optimize REQ_PREFLUSH with data when using the linear target dm-pcache: use int type to store negative error codes dm: fix "writen"->"written" dm-pcache: cleanup: fix coding style report by checkpatch.pl dm-pcache: remove ctrl_lock for pcache_cache_segment dm: fix NULL pointer dereference in __dm_suspend() dm: fix queue start/stop imbalance under suspend/load/resume races dm-pcache: add persistent cache target in device-mapper dm error: mark as DM_TARGET_PASSES_INTEGRITY ... commit 2ccb4d203fe4bec72fb333ccc2feb71a462c188d Merge: e56ebe27a00dee e6d736bd08902b Author: Linus Torvalds Date: Fri Oct 3 18:35:22 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "A new Pensando ionic driver, a new Gen 3 HW support for Intel irdma, and lots of small bnxt_re improvements. - Small bug fixes and improves to hfi1, efa, mlx5, erdma, rdmarvt, siw - Allow userspace access to IB service records through the rdmacm - Optimize dma mapping for erdma - Fix shutdown of the GSI QP in mana - Support relaxed ordering MR and fix a corruption bug with mlx5 DMA Data Direct - Many improvement to bnxt_re: - Debugging features and counters - Improve performance of some commands - Change flow_label reporting in completions - Mirror vnic - RDMA flow support - New RDMA driver for Pensando Ethernet devices: ionic - Gen 3 hardware support for the Intel irdma driver - Fix rdma routing resolution with VRFs" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (85 commits) RDMA/ionic: Fix memory leak of admin q_wr RDMA/siw: Always report immediate post SQ errors RDMA/bnxt_re: improve clarity in ALLOC_PAGE handler RDMA/irdma: Remove unused struct irdma_cq fields RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() RDMA/bnxt_re: Remove non-statistics counters from hw_counters RDMA/bnxt_re: Add debugfs info entry for device and resource information RDMA/bnxt_re: Fix incorrect errno used in function comments RDMA: Use %pe format specifier for error pointers RDMA/ionic: Use ether_addr_copy instead of memcpy RDMA/ionic: Fix build failure on SPARC due to xchg() operand size RDMA/rxe: Fix race in do_task() when draining IB/sa: Fix sa_local_svc_timeout_ms read race IB/ipoib: Ignore L3 master device RDMA/core: Use route entry flag to decide on loopback traffic RDMA/core: Resolve MAC of next-hop device without ARP support RDMA/core: Squash a single user static function RDMA/irdma: Update Kconfig RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices RDMA/irdma: Add Atomic Operations support ... commit e56ebe27a00dee1e083621b67ec23310d8e0319a Merge: 8a44189f204695 2a918911ed3d08 Author: Linus Torvalds Date: Fri Oct 3 18:18:48 2025 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Two minor fixes: - Make the selftest work again on x86 platforms with iommus enabled - Fix a compiler warning in the userspace kselftest" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Register iommufd mock devices with fwspec iommu/selftest: prevent use of uninitialized variable commit 8a44189f204695637be0373c8ea8e3ea4c1a1926 Merge: bed0653fe2aacb 479bec4cb39a1b Author: Linus Torvalds Date: Fri Oct 3 18:15:39 2025 -0700 Merge tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl Pull fwctl updates from Jason Gunthorpe: - Fix mismatched kvalloc() kfree() on error paths - Remove NOP dev_err_probe(), shouldn't print on error paths anyhow - For mlx5 permit: MLX5_CMD_OP_MODIFY_CONG_STATUS MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT MLX5_CMD_OP_QUERY_DELEGATED_VHCA - Use memdup_user in pds * tag 'for-linus-fwctl' of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl: pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc fwctl/mlx5: Add Adjacent function query commands and their scope fwctl/mlx5: Allow MODIFY_CONG_STATUS command pds_fwctl: Remove the use of dev_err_probe() fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() commit bed0653fe2aacb0ca8196075cffc9e7062e74927 Merge: a498d59c469bf1 5f4b8c03f41782 Author: Linus Torvalds Date: Fri Oct 3 18:00:11 2025 -0700 Merge tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: - Inte VT-d: - IOMMU driver updated to the latest VT-d specification - Don't enable PRS if PDS isn't supported - Replace snprintf with scnprintf - Fix legacy mode page table dump through debugfs - Miscellaneous cleanups - AMD-Vi: - Support kdump boot when SNP is enabled - Apple-DART: - 4-level page-table support - RISC-V IOMMU: - ACPI support - Small number of miscellaneous cleanups and fixes * tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (22 commits) iommu/vt-d: Disallow dirty tracking if incoherent page walk iommu/vt-d: debugfs: Avoid dumping context command register iommu/vt-d: Removal of Advanced Fault Logging iommu/vt-d: PRS isn't usable if PDS isn't supported iommu/vt-d: Remove LPIG from page group response descriptor iommu/vt-d: Drop unused cap_super_offset() iommu/vt-d: debugfs: Fix legacy mode page table dump logic iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() iommu/io-pgtable-dart: Fix off by one error in table index check iommu/riscv: Add ACPI support ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id() ACPI: RISC-V: Add support for RIMT iommu/omap: Use int type to store negative error codes iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs iommu/amd: Skip enabling command/event buffers for kdump crypto: ccp: Skip SEV and SNP INIT for kdump boot iommu/amd: Reuse device table for kdump iommu/amd: Add support to remap/unmap IOMMU buffers for kdump iommu/apple-dart: Add 4-level page table support iommu/io-pgtable-dart: Add 4-level page table support ... commit 3637d34b35b287ab830e66048841ace404382b67 Author: Albin Babu Varghese Date: Fri Oct 3 03:32:09 2025 -0400 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese Signed-off-by: Helge Deller commit a498d59c469bf1cab2710ffeb34050f475de28ce Merge: ee2fe81cdcd17f ef3d979b3e270b Author: Linus Torvalds Date: Fri Oct 3 17:41:12 2025 -0700 Merge tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - Refactoring of DMA mapping API to physical addresses as the primary interface instead of page+offset parameters This gets much closer to Matthew Wilcox's long term wish for struct-pageless IO to cacheable DRAM and is supporting memdesc project which seeks to substantially transform how struct page works. An advantage of this approach is the possibility of introducing DMA_ATTR_MMIO, which covers existing 'dma_map_resource' flow in the common paths, what in turn lets to use recently introduced dma_iova_link() API to map PCI P2P MMIO without creating struct page Developped by Leon Romanovsky and Jason Gunthorpe - Minor clean-up by Petr Tesarik and Qianfeng Rong * tag 'dma-mapping-6.18-2025-09-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: kmsan: fix missed kmsan_handle_dma() signature conversion mm/hmm: properly take MMIO path mm/hmm: migrate to physical address-based DMA mapping API dma-mapping: export new dma_*map_phys() interface xen: swiotlb: Open code map_resource callback dma-mapping: implement DMA_ATTR_MMIO for dma_(un)map_page_attrs() kmsan: convert kmsan_handle_dma to use physical addresses dma-mapping: convert dma_direct_*map_page to be phys_addr_t based iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys() iommu/dma: rename iommu_dma_*map_page to iommu_dma_*map_phys dma-mapping: rename trace_dma_*map_page to trace_dma_*map_phys dma-debug: refactor to use physical addresses for page mapping iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link(). dma-mapping: introduce new DMA attribute to indicate MMIO memory swiotlb: Remove redundant __GFP_NOWARN dma-direct: clean up the logic in __dma_direct_alloc_pages() commit ee2fe81cdcd17f875aeca074afe64d7e8f57750f Merge: 50647a1176b7ab 99510c324e531a Author: Linus Torvalds Date: Fri Oct 3 17:16:13 2025 -0700 Merge tag 'docs-6.18' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It has been a relatively busy cycle in docsland, with changes all over: - Bring the kernel memory-model docs into the Sphinx build in the "literal include" mode. - Lots of build-infrastructure work, further cleaning up long-term kernel-doc technical debt. The sphinx-pre-install tool has been converted to Python and updated for current systems. - A new tool to detect when documents have been moved and generate HTML redirects; this can be used on kernel.org (or any other site hosting the rendered docs) to avoid breaking links. - Automated processing of the YAML files describing the netlink protocol. - A significant update of the maintainer's PGP guide. ... and a seemingly endless series of typo fixes, build-problem fixes, etc" * tag 'docs-6.18' of git://git.lwn.net/linux: (193 commits) Documentation/features: Update feature lists for 6.17-rc7 docs: remove cdomain.py Documentation/process: submitting-patches: fix typo in "were do" docs: dev-tools/lkmm: Fix typo of missing file extension Documentation: trace: histogram: Convert ftrace docs cross-reference Documentation: trace: histogram-design: Wrap introductory note in note:: directive Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram Documentation: trace: histogram-design: Trim trailing vertices in diagram explanation text Documentation: trace: histogram: Fix histogram trigger subsection number order docs: driver-api: fix spelling of "buses". Documentation: fbcon: Use admonition directives Documentation: fbcon: Reindent 8th step of attach/detach/unload Documentation: fbcon: Add boot options and attach/detach/unload section headings docs: filesystems: sysfs: add remaining top level sysfs directory descriptions docs: filesystems: sysfs: clarify symlink destinations in dev and bus/devices descriptions docs: filesystems: sysfs: remove top level sysfs net directory docs: maintainer: Fix ambiguous subheading formatting docs: kdoc: a few more dump_typedef() tweaks docs: kdoc: remove redundant comment stripping in dump_typedef() docs: kdoc: remove some dead code in dump_typedef() ... commit c14bdcc9f274620492aba7d920cc2641440cf1ba Author: Wei Yang Date: Wed Oct 1 09:19:00 2025 +0000 mm/khugepaged: use KMEM_CACHE() We got some late review commits during review of commit b4c9ffb54b32 ("mm/khugepaged: remove definition of struct khugepaged_mm_slot"). No need to keep the old cache name "khugepaged_mm_slot", let's simply use KMEM_CACHE(). Link: https://lkml.kernel.org/r/20251001091900.20041-3-richard.weiyang@gmail.com Fixes: b4c9ffb54b32 ("mm/khugepaged: remove definition of struct khugepaged_mm_slot") Signed-off-by: Wei Yang Acked-by: Lance Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Raghavendra K T Cc: Kiryl Shutsemau Cc: xu xin Cc: SeongJae Park Cc: Nico Pache Cc: Baolin Wang Cc: Barry Song Cc: Chengming Zhou Cc: Dan Carpenter Cc: Kiryl Shutsemau Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Signed-off-by: Andrew Morton commit df6879a7483e2372fcd70762660c546446f99006 Author: Wei Yang Date: Wed Oct 1 09:18:59 2025 +0000 mm/ksm: cleanup mm_slot_entry() invocation Patch series "mm_slot: following fixup for usage of mm_slot_entry()", v2. We got some late review commits during review of "mm_slot: fix the usage of mm_slot_entry()" in [1]. This patch (of 2): We got some late review commits during review of commit 08498be43ee6 ("mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL"). Let's reduce the indentation level and make the code easier to follow by using gotos to a new label. Link: https://lkml.kernel.org/r/20251001091900.20041-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251001091900.20041-2-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250927004539.19308-1-richard.weiyang@gmail.com [1] Fixes: 08498be43ee6 ("mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL") Signed-off-by: Wei Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Kiryl Shutsemau Acked-by: Zi Yan Cc: Lance Yang Cc: xu xin Cc: Dan Carpenter Cc: Chengming Zhou Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Raghavendra K T Cc: Ryan Roberts Cc: Kiryl Shutsemau Cc: SeongJae Park Signed-off-by: Andrew Morton commit a089461a5994204558096eff4e4e518614755463 Author: Anshuman Khandual Date: Mon Sep 29 13:00:45 2025 +0100 Documentation/mm: drop pxx_mkdevmap() descriptions from page table helpers Remove pxx_mkdevmap() descriptions, as these helper functions have already been dropped (including DEBUG_VM_PGTABLE test) via the commit d438d2734170 ("mm: remove devmap related functions and page table bits"). Link: https://lkml.kernel.org/r/20250929120045.1109707-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Dev Jain Cc: Lorenzo Stoakes Cc: Alistair Popple Signed-off-by: Andrew Morton commit 89be2815f465a8b167fbef09a8b664bad28713bb Author: Lance Yang Date: Wed Sep 24 12:58:30 2025 +0800 mm: clean up is_guard_pte_marker() Let's simplify the implementation. The current code is redundant as it effectively expands to: is_swap_pte(pte) && is_pte_marker_entry(...) && // from is_pte_marker() is_pte_marker_entry(...) // from is_guard_swp_entry() While a modern compiler could likely optimize this away, let's have clean code and not rely on it. Link: https://lkml.kernel.org/r/20250924045830.3817-1-lance.yang@linux.dev Signed-off-by: Lance Yang Reviewed-by: Wei Yang Reviewed-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Hugh Dickins Cc: Kairui Song Cc: "Kirill A. Shutemov" Cc: Liam Howlett Cc: Mariano Pache Cc: Mika Penttilä Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 0a947c14e48cbf9de222836170282e0167a9e096 Author: Hannes Reinecke Date: Tue Jul 29 08:46:36 2025 +0200 drivers/base: move memory_block_add_nid() into the caller Now the node id only needs to be set for early memory, so move memory_block_add_nid() into the caller and rename it into memory_block_add_nid_early(). This allows us to further simplify the code by dropping the 'context' argument to do_register_memory_block_under_node(). Link: https://lkml.kernel.org/r/20250729064637.51662-4-hare@kernel.org Suggested-by: David Hildenbrand Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit b8179af120943e2fc099ea87caa234039a709a66 Author: Hannes Reinecke Date: Tue Jul 29 08:46:35 2025 +0200 mm/memory_hotplug: activate node before adding new memory blocks The sysfs attributes for memory blocks require the node ID to be set and initialized, so move the node activation before adding new memory blocks. This also has the nice side effect that the BUG_ON() can be converted into a WARN_ON() as we now can handle registration errors. Link: https://lkml.kernel.org/r/20250729064637.51662-3-hare@kernel.org Fixes: b9ff036082cd ("mm/memory_hotplug.c: make add_memory_resource use __try_online_node") Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit c6a809363a66b8ff0f6a000b5f09408a1b33eeb5 Author: Hannes Reinecke Date: Tue Jul 29 08:46:34 2025 +0200 drivers/base/memory: add node id parameter to add_memory_block() Patch series "mm/memory_hotplug: fixup crash during uevent handling", v4. we have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): We have some udev rules trying to read the sysfs attribute 'valid_zones' during an memory 'add' event, causing a crash in zone_for_pfn_range(). Debugging found that mem->nid was set to NUMA_NO_NODE, which crashed in NODE_DATA(nid). Further analysis revealed that we're running into a race with udev event processing: add_memory_resource() has this function calls: 1) __try_online_node() 2) arch_add_memory() 3) create_memory_block_devices() -> calls device_register() -> memory 'add' event 4) node_set_online()/__register_one_node() -> calls device_register() -> node 'add' event 5) register_memory_blocks_under_node() -> sets mem->nid Which, to the uninitated, is ... weird ... Why do we try to online the node in 1), but only register the node in 4) _after_ we have created the memory blocks in 3) ? And why do we set the 'nid' value in 5), when the uevent (which might need to see the correct 'nid' value) is sent out in 3) ? There must be a reason, I'm sure ... So here's a small patchset to fixup uevent ordering. The first patch adds a 'nid' parameter to add_memory_blocks() (to avoid mem->nid being initialized with NUMA_NO_NODE), and the second patch reshuffles the code in add_memory_resource() to fully initialize the node prior to calling create_memory_block_devices() so that the node is valid at that time and uevent processing will see correct values in sysfs. This patch (of 3): Add a 'nid' parameter to add_memory_block() to initialize the memory block with the correct node id. Link: https://lkml.kernel.org/r/20250729064637.51662-1-hare@kernel.org Link: https://lkml.kernel.org/r/20250729064637.51662-2-hare@kernel.org Signed-off-by: Hannes Reinecke Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Donet Tom Signed-off-by: Andrew Morton commit 50647a1176b7abd1b4ae55b491eb2fbbeef89db9 Merge: 070a542f08acb7 2f7d98f10b8f64 Author: Linus Torvalds Date: Fri Oct 3 16:32:36 2025 -0700 Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull file->f_path constification from Al Viro: "Only one thing was modifying ->f_path of an opened file - acct(2). Massaging that away and constifying a bunch of struct path * arguments in functions that might be given &file->f_path ends up with the situation where we can turn ->f_path into an anon union of const struct path f_path and struct path __f_path, the latter modified only in a few places in fs/{file_table,open,namei}.c, all for struct file instances that are yet to be opened" * tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (23 commits) Have cc(1) catch attempts to modify ->f_path kernel/acct.c: saner struct file treatment configfs:get_target() - release path as soon as we grab configfs_item reference apparmor/af_unix: constify struct path * arguments ovl_is_real_file: constify realpath argument ovl_sync_file(): constify path argument ovl_lower_dir(): constify path argument ovl_get_verity_digest(): constify path argument ovl_validate_verity(): constify {meta,data}path arguments ovl_ensure_verity_loaded(): constify datapath argument ksmbd_vfs_set_init_posix_acl(): constify path argument ksmbd_vfs_inherit_posix_acl(): constify path argument ksmbd_vfs_kern_path_unlock(): constify path argument ksmbd_vfs_path_lookup_locked(): root_share_path can be const struct path * check_export(): constify path argument export_operations->open(): constify path argument rqst_exp_get_by_name(): constify path argument nfs: constify path argument of __vfs_getattr() bpf...d_path(): constify path argument done_path_create(): constify path argument ... commit a22d167ed82505f770340c3a7c257c04ba24dac9 Author: Ian Rogers Date: Thu Sep 4 21:26:43 2025 -0700 perf parse-events: Fix parsing of >30kb event strings Metrics may generate many particularly uncore event references. The resulting event string may then be >32kb. The parse events lex is using "%option reject" which stores backtracking state in a buffer sized at roughtly 30kb. If the event string is larger than this then a buffer overflow and typically a crash happens. The need for "%option reject" was for BPF events which were removed in commit 3d6dfae88917 ("perf parse-events: Remove BPF event support"). As "%option reject" is both a memory and performance cost let's remove it and fix the parsing case for event strings being over ~30kb. Whilst cleaning up "%option reject" make the header files accurately reflect functions used in the code and tidy up not requiring yywrap. Measuring on the "PMU JSON event tests" a modest reduction of 0.41% user time and 0.27% max resident size was observed. More importantly this change fixes parsing large metrics and event strings. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 7e8f305a081e22ce81aab7f7b9ce01437cbd38b3 Author: Gopi Krishna Menon Date: Fri Oct 3 23:05:59 2025 +0530 docs/zh_CN: Fix malformed table Running "make htmldocs" generates the following build error in zh_CN/cpu-freq/cpu-drivers.rst: Documentation/translations/zh_CN/cpu-freq/cpu-drivers.rst:109: ERROR: Malformed table. Fix the table formatting to resolve the error. Signed-off-by: Gopi Krishna Menon Signed-off-by: Rafael J. Wysocki commit 989ed3cad2fdb7921bf0f9f0f730e1bb065946c2 Author: Gopi Krishna Menon Date: Fri Oct 3 23:06:00 2025 +0530 docs/zh_TW: Fix malformed table Running "make htmldocs" generate the following build error in zh_TW/cpu-freq/cpu-drivers.rst: Documentation/translations/zh_TW/cpu-freq/cpu-drivers.rst:109: ERROR: Malformed table. Fix the table formatting to resolve the error. Signed-off-by: Gopi Krishna Menon Signed-off-by: Rafael J. Wysocki commit 070a542f08acb7e8cf197287f5c44658c715d2d1 Merge: 63e62baaa72e1a 1f0d4ab0f5326a Author: Linus Torvalds Date: Fri Oct 3 14:20:40 2025 -0700 Merge tag 'nfs-for-6.18-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Add a Kconfig option to redirect dfprintk() to the trace buffer - Enable use of the RWF_DONTCACHE flag on the NFS client - Add striped layout handling to pNFS flexfiles - Add proper localio handling for READ and WRITE O_DIRECT Bugfixes: - Handle NFS4ERR_GRACE errors during delegation recall - Fix NFSv4.1 backchannel max_resp_sz verification check - Fix mount hang after CREATE_SESSION failure - Fix d_parent->d_inode locking in nfs4_setup_readdir() Other Cleanups and Improvements: - Improvements to write handling tracepoints - Fix a few trivial spelling mistakes - Cleanups to the rpcbind cleanup call sites - Convert the SUNRPC xdr_buf to use a scratch folio instead of scratch page - Remove unused NFS_WBACK_BUSY() macro - Remove __GFP_NOWARN flags - Unexport rpc_malloc() and rpc_free()" * tag 'nfs-for-6.18-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (46 commits) NFS: add basic STATX_DIOALIGN and STATX_DIO_READ_ALIGN support nfs/localio: add tracepoints for misaligned DIO READ and WRITE support nfs/localio: add proper O_DIRECT support for READ and WRITE nfs/localio: refactor iocb initialization nfs/localio: refactor iocb and iov_iter_bvec initialization nfs/localio: avoid issuing misaligned IO using O_DIRECT nfs/localio: make trace_nfs_local_open_fh more useful NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support sunrpc: unexport rpc_malloc() and rpc_free() NFSv4/flexfiles: Add support for striped layouts NFSv4/flexfiles: Update layout stats & error paths for striped layouts NFSv4/flexfiles: Write path updates for striped layouts NFSv4/flexfiles: Commit path updates for striped layouts NFSv4/flexfiles: Read path updates for striped layouts NFSv4/flexfiles: Update low level helper functions to be DS stripe aware. NFSv4/flexfiles: Add data structure support for striped layouts NFSv4/flexfiles: Use ds_commit_idx when marking a write commit NFSv4/flexfiles: Remove cred local variable dependency nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing NFS: Enable use of the RWF_DONTCACHE flag on the NFS client ... commit 63e62baaa72e1aceb422f64a50408bc9b02a6022 Merge: b3fee71e667339 37e263e68c5e27 Author: Linus Torvalds Date: Fri Oct 3 14:13:23 2025 -0700 Merge tag '6.18-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Fix oops in crypt message - Remove duplicate arc4 code - Fix potential io_uring reconnect - Two important directory leases fixes and three perf improvements - Three minor cleanups - Four debug improvements (e.g. for showing more information on leases, and one for adding more helpful information on reconnect) * tag '6.18-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: client: force multichannel=off when max_channels=1 smb client: fix bug with newly created file in cached dir smb: client: short-circuit negative lookups when parent dir is fully cached smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry smb: client: remove pointless cfid->has_lease check smb: client: transport: minor indentation style fix smb: client: transport: avoid reconnects triggered by pending task work smb: client: remove unused fid_lock smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid smb: client: account smb directory cache usage and per-tcon totals smb: client: add drop_dir_cache module parameter to invalidate cached dirents smb: client: show lease state as R/H/W (or NONE) in open_files smb: client: fix crypto buffers in non-linear memory smb: Use arc4 library instead of duplicate arc4 code smb: client: add tcon information to smb2_reconnect() debug messages commit b3fee71e6673393d04476fbe0f4f03f97765e32d Merge: 86d563ac5fb0c6 e28c5bc45640bc Author: Linus Torvalds Date: Fri Oct 3 14:09:59 2025 -0700 Merge tag 'v6.18rc1-part1-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix potential UAFs and corruptions in rpc open and close - Fix copy_file_range when ranges overlap - Improve session, share, connection lookup performance - Fix potential hash collisions in share and session lists - Debugging improvement - making per-connection threads easier to identify - Improve socket creation - Fix return code mapping for posix query fs info - Add support for limiting the maximum number of connections per IP address, extending the existing connection limiting mechanism to enforce per-IP connection limits alongside the global connection limit * tag 'v6.18rc1-part1-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: increase session and share hash table bits ksmbd: replace connection list with hash table ksmbd: add an error print when maximum IP connections limit is reached ksmbd: add max ip connections parameter ksmbd: fix error code overwriting in smb2_get_info_filesystem() ksmbd: copy overlapped range within the same file ksmbd: use sock_create_kern interface to create kernel socket ksmbd: make ksmbd thread names distinct by client IP ksmbd: Fix race condition in RPC handle list access commit 86d563ac5fb0c6f404e82692581bb67a6f35e5de Merge: f0712c203862b0 4e715744bf7b4e Author: Linus Torvalds Date: Fri Oct 3 14:05:12 2025 -0700 Merge tag 'f2fs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "This focuses on two primary updates for Android devices. First, it sets hash-based file name lookup as the default method to improve performance, while retaining an option to fall back to a linear lookup. Second, it resolves a persistent issue with the 'checkpoint=enable' feature. The update further boosts performance by prefetching node blocks, merging FUA writes more efficiently, and optimizing block allocation policies. The release is rounded out by a comprehensive set of bug fixes that address memory safety, data integrity, and potential system hangs, along with minor documentation and code clean-ups. Enhancements: - add mount option and sysfs entry to tune the lookup mode - dump more information and add a timeout when enabling/disabling checkpoints - readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode - merge FUA command with the existing writes - allocate HOT_DATA for IPU writes - Use allocate_section_policy to control write priority in multi-devices setups - add reserved nodes for privileged users - Add bggc_io_aware to adjust the priority of BG_GC when issuing IO - show the list of donation files Bug fixes: - add missing dput() when printing the donation list - fix UAF issue in f2fs_merge_page_bio() - add sanity check on ei.len in __update_extent_tree_range() - fix infinite loop in __insert_extent_tree() - fix zero-sized extent for precache extents - fix to mitigate overhead of f2fs_zero_post_eof_page() - fix to avoid migrating empty section - fix to truncate first page in error path of f2fs_truncate() - fix to update map->m_next_extent correctly in f2fs_map_blocks() - fix wrong layout information on 16KB page - fix to do sanity check on node footer for non inode dnode - fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() - fix to detect potential corrupted nid in free_nid_list - fix to clear unusable_cap for checkpoint=enable - fix to zero data after EOF for compressed file correctly - fix to avoid overflow while left shift operation - fix condition in __allow_reserved_blocks()" * tag 'f2fs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (43 commits) f2fs: add missing dput() when printing the donation list f2fs: fix UAF issue in f2fs_merge_page_bio() f2fs: readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode f2fs: add sanity check on ei.len in __update_extent_tree_range() f2fs: fix infinite loop in __insert_extent_tree() f2fs: fix zero-sized extent for precache extents f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() f2fs: fix to avoid migrating empty section f2fs: fix to truncate first page in error path of f2fs_truncate() f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() f2fs: fix wrong layout information on 16KB page f2fs: clean up error handing of f2fs_submit_page_read() f2fs: avoid unnecessary folio_clear_uptodate() for cleanup f2fs: merge FUA command with the existing writes f2fs: allocate HOT_DATA for IPU writes f2fs: Use allocate_section_policy to control write priority in multi-devices setups Documentation: f2fs: Reword title Documentation: f2fs: Indent compression_mode option list Documentation: f2fs: Wrap snippets in literal code blocks Documentation: f2fs: Span write hint table section rows ... commit f0712c203862b00139b34fcbb1710b479af2b101 Merge: f2327dc8513d09 d01579d590f72d Author: Linus Torvalds Date: Fri Oct 3 14:02:53 2025 -0700 Merge tag 'exfat-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Add support for FS_IOC_{GET,SET}FSLABEL ioctl - Two small clean-up patches - Optimizes allocation bitmap loading time on large partitions with small cluster sizes - Allow changes for discard, zero_size_dir, and errors options via remount - Validate that the clusters used for the allocation bitmap are correctly marked as in-use during mount, preventing potential data corruption from reallocating the bitmap's own space - Uses ratelimit to avoid too many error prints on I/O error path * tag 'exfat-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: Add support for FS_IOC_{GET,SET}FSLABEL exfat: combine iocharset and utf8 option setup exfat: support modifying mount options via remount exfat: optimize allocation bitmap loading time exfat: Remove unnecessary parentheses exfat: drop redundant conversion to bool exfat: validate cluster allocation bits of the allocation bitmap exfat: limit log print for IO error commit f2327dc8513d0928a64b75656a6efe12b5c7c00a Merge: a9b38767c607e0 11f6bce77e27e8 Author: Linus Torvalds Date: Fri Oct 3 13:59:56 2025 -0700 Merge tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Two cleanups and a bug fix: - Remove unused type in macro fill_default_sys_attrs (Zhen Ni) - Replace kzalloc + copy_from_user with memdup_user_nul (Thorsten Blum) - Fix xattr related buffer overflow... A message was forwarded to me from Disclosure indicating a problem with a loop condition in our xattr code. When I fixed the problem it exposed a related memory leak problem, and I fixed that too" * tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul orangefs: fix xattr related buffer overflow... orangefs: Remove unused type in macro fill_default_sys_attrs commit a9b38767c607e0de219b66a2b1ba0cb37beaba08 Merge: 5cb08b62fb1eca 7d460636b64023 Author: Linus Torvalds Date: Fri Oct 3 13:57:33 2025 -0700 Merge tag 'ntfs3_for_6.18' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "Added: - support for FS_IOC_{GET,SET}FSLABEL ioctl - reject index allocation if $BITMAP is empty but blocks exist Fixed: - integer overflow in run_unpack() - resource leak bug in wnd_extend() Changed: - pretend $Extend records as regular files - stop using write_cache_pages" * tag 'ntfs3_for_6.18' of https://github.com/Paragon-Software-Group/linux-ntfs3: ntfs3: stop using write_cache_pages fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist fs/ntfs3: Fix a resource leak bug in wnd_extend() fs: ntfs3: Fix integer overflow in run_unpack() ntfs3: pretend $Extend records as regular files ntfs3: add FS_IOC_SETFSLABEL ioctl ntfs3: add FS_IOC_GETFSLABEL ioctl ntfs3: transition magic number to shared constant commit 5cb08b62fb1ecacf886fc0142316b17230e1b3a9 Merge: 65989db7f88456 cafc6679824a02 Author: Linus Torvalds Date: Fri Oct 3 13:54:23 2025 -0700 Merge tag 'jfs-6.18' of github.com:kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "A few fixes and cleanups for JFS" * tag 'jfs-6.18' of github.com:kleikamp/linux-shaggy: jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant JFS: Remove redundant 0 value initialization JFS: Remove unnecessary parentheses jfs: fix uninitialized waitqueue in transaction manager jfs: Verify inode mode when loading from disk commit 65989db7f88456273d0913d8d21f6097fa6aad19 Merge: a4eb9356480fa4 acf943e9768ec9 Author: Linus Torvalds Date: Fri Oct 3 13:47:10 2025 -0700 Merge tag 'ext4_for_linus-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "New ext4 features: - Add support so tune2fs can modify/update the superblock using an ioctl, without needing write access to the block device - Add support for 32-bit reserved uid's and gid's Bug fixes: - Fix potential warnings and other failures caused by corrupted / fuzzed file systems - Fail unaligned direct I/O write with EINVAL instead of silently falling back to buffered I/O - Correectly handle fsmap queries for metadata mappings - Avoid journal stalls caused by writeback throttling - Add some missing GFP_NOFAIL flags to avoid potential deadlocks under extremem memory pressure Cleanups: - Remove obsolete EXT3 Kconfigs" * tag 'ext4_for_linus-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix checks for orphan inodes ext4: validate ea_ino and size in check_xattrs ext4: guard against EA inode refcount underflow in xattr update ext4: implemet new ioctls to set and get superblock parameters ext4: add support for 32-bit default reserved uid and gid values ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() ext4: fix an off-by-one issue during moving extents ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() ext4: verify orphan file size is not too big ext4: fail unaligned direct IO write with EINVAL ext4: correctly handle queries for metadata mappings ext4: increase IO priority of fastcommit ext4: remove obsolete EXT3 config options jbd2: increase IO priority of checkpoint ext4: fix potential null deref in ext4_mb_init() ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() ext4: replace min/max nesting with clamp() fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock commit a4eb9356480fa47618e597a43284c52ac6023f28 Merge: 67f5f11cdf5081 3bd5e45c2ce30e Author: Linus Torvalds Date: Fri Oct 3 13:44:05 2025 -0700 Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf and quota updates from Jan Kara: "A fix for UDF and quota" * tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs: udf: fix OOB read in lengthAllocDescs handling fs: quota: create dedicated workqueue for quota_release_work commit 67f5f11cdf5081af9b592d8ab24d054a0d681b2f Merge: 2c1ef408c2bbad b8cf8fda522d5a Author: Linus Torvalds Date: Fri Oct 3 13:23:10 2025 -0700 Merge tag 'fsnotify_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: - a couple of small cleanups and fixes - implement fanotify watchdog that reports processes that fail to respond to fanotify permission events in a given time * tag 'fsnotify_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: add watchdog for permission events fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing fsnotify: fix "rewriten"->"rewritten" commit 2c1ef408c2bbadd814cc0b1d38d02da42f759584 Merge: 6238729bfce13f 462272dd734b56 Author: Linus Torvalds Date: Fri Oct 3 13:13:17 2025 -0700 Merge tag 'configfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs update from Andreas Hindborg: "Just a very small refactoring to use PTR_ERR_OR_ZERO()" * tag 'configfs-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: configfs: use PTR_ERR_OR_ZERO() to simplify code commit 56be0fe5f62c8d165b8c9c3d3bc1dab6e8443146 Author: Thomas Falcon Date: Thu Oct 2 18:43:06 2025 -0500 perf record: Add auto counter reload parse and regression tests Include event parsing and regression tests for auto counter reload and ratio-to-prev event term. Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6b9c0261b3fb298b1fd49621f0479518efdcf3dc Author: Thomas Falcon Date: Thu Oct 2 18:43:05 2025 -0500 perf record: Add ratio-to-prev term Provide ratio-to-prev term which allows the user to set the event sample period of two events corresponding to a desired ratio. If using on an Intel x86 platform with Auto Counter Reload support, also set corresponding event's config2 attribute with a bitmask which counters to reset and which counters to sample if the desired ratio is met or exceeded. On other platforms, only the sample period is affected by the ratio-to-prev term. Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andi Kleen Cc: Dapeng Mi Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 584754cbee6edf8495117e176427113b51a9bd7f Author: Ian Rogers Date: Thu Oct 2 18:23:49 2025 -0700 tools build: Remove libbpf-strings feature test The feature test is unnecessary as the LIBBPF_CURRENT_VERSION_GEQ(1,7) macro can be used instead. The only use was in perf and this is now removed. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Blake Jones Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 2bd597170f46610792c541814ac36d14618de459 Author: Ian Rogers Date: Thu Oct 2 18:23:48 2025 -0700 perf bpf-event: Use libbpf version rather than feature check The feature check guarded the -DHAVE_LIBBPF_STRINGS_SUPPORT is unnecessary as it is sufficient and easier to use the LIBBPF_CURRENT_VERSION_GEQ macro. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Blake Jones Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a90777bb03fc7b9bc5d668ed136d86c3971f48bf Author: Ian Rogers Date: Thu Oct 2 19:39:28 2025 -0700 perf build: Move libopcode disasm tests to BUILD_NONDISTRO The disasm feature tests feature-disassembler-four-args and feature-disassembler-init-styled link against libopcodes part of binutils which is license incompatible (GPLv3) with perf. Moving these tests out of the common config will help improve build time. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit c5b76ab525d3f6ad711ff07fd77de04ec1f0c9b0 Author: Ian Rogers Date: Thu Oct 2 19:27:33 2025 -0700 tools build: Remove feature-libslang-include-subdir Added in commit cbefd24f0aee3a5d ("tools build: Add test to check if slang.h is in /usr/include/slang/") this feature was to fix build support on now unsupported versions of RHEL 5 and 6. As 6 years has passed let's remove the workaround. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a5099d8143db7f44e82b1098b75c398e6abc7c54 Author: Zecheng Li Date: Wed Sep 17 19:58:00 2025 +0000 perf annotate: Rename TSR_KIND_POINTER to TSR_KIND_PERCPU_POINTER TSR_KIND_POINTER only represents percpu pointers currently. Rename it to TSR_KIND_PERCPU_POINTER so we can use the TSR_KIND_POINTER to represent pointer to a type. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Signed-off-by: Arnaldo Carvalho de Melo commit 2cc7aa995ce9ecd897c1df7ac04c624d542415ae Author: Ian Rogers Date: Thu Oct 2 15:07:27 2025 -0700 perf stat: Refactor retry/skip/fatal error handling For the sake of Intel topdown events commit 9eac5612da1c9102 ("perf stat: Don't skip failing group events") changed 'perf stat' error handling making it so that more errors were fatal and didn't report "" events. The change outside of topdown events was unintentional. The notion of "fatal" error handling was introduced in commit e0e6a6ca3ac211cc ("perf stat: Factor out open error handling") and refined in commits like commit cb5ef60067c11cc8 ("perf stat: Error out unsupported group leader immediately") to be an approach for avoiding later assertion failures in the code base. This change fixes those issues and removes the notion of a fatal error on an event. If all events fail to open then a fatal error occurs with the previous fatal error message. This seems to best match the notion of supported events and allowing some errors not to stop 'perf stat', while allowing the truly fatal no event case to terminate the tool early. The evsel->errored flag is only used in the stat code but always just meaning !evsel->supported although there is a comment about it being sticky. Force all evsels to be supported in evsel__init and then clear this when evsel__open fails. When an event is tried the supported is set to true again. This simplifies the notion of whether an evsel is broken. In the get_group_fd code, fail to get a group fd when the evsel isn't supported. If the leader isn't supported then it is also expected that there is no group_fd as the leader will have been skipped. Therefore change the BUG_ON test to be on supported rather than skippable. This corrects the assertion errors that were the reason for the previous fatal error handling. Fixes: 9eac5612da1c9102 ("perf stat: Don't skip failing group events") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Howard Chu Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Link: https://lore.kernel.org/r/20251002220727.1889799-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 6026ab657a0e9e8b05f8d9fbf99a65151ce7a40b Author: Ian Rogers Date: Thu Oct 2 15:07:26 2025 -0700 perf stat: Move create_perf_stat_counter() to builtin-stat.c The function create_perf_stat_counter is only used in builtin-stat.c and contains logic about retrying events specific to builtin-stat.c. Move the code to builtin-stat.c to tidy this up. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 79cc9b4b2cc1e9a100f3bdab22c954f8541a8cc7 Author: Ian Rogers Date: Fri Oct 3 10:56:13 2025 -0700 tools build: Remove get_current_dir_name feature check As perf no longer tests for this feature, and it was the only user, remove the feature test. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra [ Remove the call to main_test_get_current_dir_name() from main() in test-all.c, otherwise it will always fail ] Signed-off-by: Arnaldo Carvalho de Melo commit 6238729bfce13f94b701766996a5d116d2df8bff Merge: cf06d791f840be cb403594701cd3 Author: Linus Torvalds Date: Fri Oct 3 12:48:18 2025 -0700 Merge tag 'fuse-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Extend copy_file_range interface to be fully 64bit capable (Miklos) - Add selftest for fusectl (Chen Linxuan) - Move fuse docs into a separate directory (Bagas Sanjaya) - Allow fuse to enter freezable state in some cases (Sergey Senozhatsky) - Clean up writeback accounting after removing tmp page copies (Joanne) - Optimize virtiofs request handling (Li RongQing) - Add synchronous FUSE_INIT support (Miklos) - Allow server to request prune of unused inodes (Miklos) - Fix deadlock with AIO/sync release (Darrick) - Add some prep patches for block/iomap support (Darrick) - Misc fixes and cleanups * tag 'fuse-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (26 commits) fuse: move CREATE_TRACE_POINTS to a separate file fuse: move the backing file idr and code into a new source file fuse: enable FUSE_SYNCFS for all fuseblk servers fuse: capture the unique id of fuse commands being sent fuse: fix livelock in synchronous file put from fuseblk workers mm: fix lockdep issues in writeback handling fuse: add prune notification fuse: remove redundant calls to fuse_copy_finish() in fuse_notify() fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() fuse: remove FUSE_NOTIFY_CODE_MAX from fuse: remove fuse_readpages_end() null mapping check fuse: fix references to fuse.rst -> fuse/fuse.rst fuse: allow synchronous FUSE_INIT fuse: zero initialize inode private data fuse: remove unused 'inode' parameter in fuse_passthrough_open virtio_fs: fix the hash table using in virtio_fs_enqueue_req() mm: remove BDI_CAP_WRITEBACK_ACCT fuse: use default writeback accounting virtio_fs: Remove redundant spinlock in virtio_fs_request_complete() fuse: remove unneeded offset assignment when filling write pages ... commit dea00c204e7e99aca9a4cb8603174c4cd0051728 Author: Emil Dahl Juhl Date: Wed Oct 1 13:40:57 2025 +0200 tools: lib: thermal: expose thermal_exit symbols Remove duplicate entry for thermal_init and add the missing entries for thermal_exit and their respectives in cmd, events, and sampling context. Signed-off-by: Emil Dahl Juhl Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 1375152bb02ab2a8435e87ea27034482dbc95f57 Author: Emil Dahl Juhl Date: Wed Oct 1 13:40:56 2025 +0200 tools: lib: thermal: don't preserve owner in install Instead of preserving mode, timestamp, and owner, for the object files during installation, just preserve the mode and timestamp. When installing as root, the installed files should be owned by root. When installing as user, --preserve=ownership doesn't work anyway. This makes --preserve=ownership rather pointless. Signed-off-by: Emil Dahl Juhl Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit b31f7f725cd932e2c2b41f3e4b66273653953687 Author: Sascha Hauer Date: Wed Oct 1 13:40:55 2025 +0200 tools: lib: thermal: use pkg-config to locate libnl3 To make libthermal more cross compile friendly use pkg-config to locate libnl3. Only if that fails fall back to hardcoded /usr/include/libnl3. Signed-off-by: Sascha Hauer Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 1af59cd5cc2b65d7fc95165f056695ce3f171133 Author: Raag Jadav Date: Thu Sep 18 16:02:00 2025 +0530 drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM path In S3 and above sleep states, the device can loose power regardless of d3cold.allowed flag. Bring up I2C controller explicitly in system PM path to ensure its normal operation after losing power. v2: Cover S3 and above states (Rodrigo) Fixes: 0ea07b69517a ("drm/xe/pm: Wire up suspend/resume for I2C controller") Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250918103200.2952576-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit e4863f1159befcd70df24fcb5458afaf2feab043) Signed-off-by: Lucas De Marchi commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d Author: Shuicheng Lin Date: Thu Sep 25 02:31:46 2025 +0000 drm/xe/hw_engine_group: Fix double write lock release in error path In xe_hw_engine_group_get_mode(), a write lock is acquired before calling switch_mode(), which in turn invokes xe_hw_engine_group_suspend_faulting_lr_jobs(). On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(), the write lock is released there, and then again in xe_hw_engine_group_get_mode(), leading to a double release. Fix this by keeping both acquire and release operation in xe_hw_engine_group_get_mode(). Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes") Cc: Francois Dugast Signed-off-by: Shuicheng Lin Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c) Signed-off-by: Lucas De Marchi commit 2d1684a077d62fddfac074052c162ec6573a34e1 Author: Matthew Auld Date: Fri Sep 19 13:20:53 2025 +0100 drm/xe/uapi: loosen used tracking restriction Currently this is hidden behind perfmon_capable() since this is technically an info leak, given that this is a system wide metric. However the granularity reported here is always PAGE_SIZE aligned, which matches what the core kernel is already willing to expose to userspace if querying how many free RAM pages there are on the system, and that doesn't need any special privileges. In addition other drm drivers seem happy to expose this. The motivation here if with oneAPI where they want to use the system wide 'used' reporting here, so not the per-client fdinfo stats. This has also come up with some perf overlay applications wanting this information. Fixes: 1105ac15d2a1 ("drm/xe/uapi: restrict system wide accounting") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Joshua Santosh Cc: José Roberto de Souza Cc: Matthew Brost Cc: Rodrigo Vivi Cc: # v6.8+ Acked-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250919122052.420979-2-matthew.auld@intel.com (cherry picked from commit 4d0b035fd6dae8ee48e9c928b10f14877e595356) Signed-off-by: Lucas De Marchi commit cf06d791f840be97f726ecaaea872a876ff62436 Merge: 9b0d551bcc05fa ad1423922781e6 Author: Linus Torvalds Date: Fri Oct 3 12:14:24 2025 -0700 Merge tag 'ovl-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs updates from Amir Goldstein: - Work by André Almeida to support case-insensitive overlayfs Underlying case-insensitive filesystems casefolding is per directory, but for overlayfs it is all-or-nothing. It supports layers where all directories are casefolded (with same encoding) or layers where no directories are casefolded. - A fix for a "bug" in Neil's ovl directory lock changes, which only manifested itself with casefold enabled layers which may return an unhashed negative dentry from lookup. * tag 'ovl-update-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: make sure that ovl_create_real() returns a hashed dentry ovl: Support mounting case-insensitive enabled layers ovl: Check for casefold consistency when creating new dentries ovl: Add S_CASEFOLD as part of the inode flag to be copied ovl: Set case-insensitive dentry operations for ovl sb ovl: Ensure that all layers have the same encoding ovl: Create ovl_casefold() to support casefolded strncmp() ovl: Prepare for mounting case-insensitive enabled layers fs: Create sb_same_encoding() helper fs: Create sb_encoding() helper commit 92158fae2ed986f44347fc5b9a269830862c1529 Author: Dan Carpenter Date: Fri Oct 3 12:29:31 2025 +0300 PM: runtime: Fix error checking for kunit_device_register() The kunit_device_register() function never returns NULL, it returns error pointers. Update the assertions to use KUNIT_ASSERT_NOT_ERR_OR_NULL() instead of checking for NULL. Fixes: 7f7acd193ba8 ("PM: runtime: Add basic kunit tests for API contracts") Signed-off-by: Dan Carpenter Reviewed-by: Brian Norris Signed-off-by: Rafael J. Wysocki commit 384b52ce32110db974d3b61d463af48347eb73fb Author: Rafael J. Wysocki Date: Wed Oct 1 19:34:29 2025 +0200 PM: runtime: Introduce one more usage counter guard Follow previous commit 9a0abc39450a ("PM: runtime: Add auto-cleanup macros for "resume and get" operations") and define a runtime PM usage counter guard in which pm_runtime_get_noresume() and pm_runtime_put_noidle() will be used for incrementing and decrementing it, respectively. Signed-off-by: Rafael J. Wysocki Reviewed-by: Jonathan Cameron commit 9b0d551bcc05fa4786689544a2845024db1d41b6 Merge: 33fc69a05c50f0 f037fd7fbca4d1 Author: Linus Torvalds Date: Fri Oct 3 11:37:50 2025 -0700 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc non-vfs updates from Al Viro: "Assorted dead code removal around asm/pgtable.h" * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: alpha: unobfuscate _PAGE_P() definition kill FIRST_USER_PGD_NR alpha: get rid of the remnants of BAD_PAGE and friends SET_PAGE_DIR() users had been gone since 2.3.12pre1 PAGE_PTR() had been last used outside of arch/* in 1.1.94 csky: remove BS check for FAULT_FLAG_ALLOW_RETRY commit 062d02a96d810d55afdc594ceeb52223d8b36b5c Author: Ian Rogers Date: Fri Oct 3 10:56:12 2025 -0700 perf namespaces: Avoid get_current_dir_name dependency get_current_dir_name is a GNU extension not supported on, for example, Android. There is only one use of it so let's just switch to getcwd to avoid build and other complexity. Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 33fc69a05c50f00f1218408a56348bcab95b831d Merge: 829745b75a1af2 180a9cc3fd6a02 Author: Linus Torvalds Date: Fri Oct 3 11:14:02 2025 -0700 Merge tag 'pull-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull d_name audit update from Al Viro: "Simplifying ->d_name audits, easy part. Turn dentry->d_name into an anon union of const struct qsrt (d_name itself) and a writable alias (__d_name). With constification of some struct qstr * arguments of functions that get &dentry->d_name passed to them, that ends up with all modifications provably done only in fs/dcache.c (and a fairly small part of it). Any new places doing modifications will be easy to find - grep for __d_name will suffice" * tag 'pull-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: make it easier to catch those who try to modify ->d_name generic_ci_validate_strict_name(): constify name argument afs_dir_search: constify qstr argument afs_edit_dir_{add,remove}(): constify qstr argument exfat_find(): constify qstr argument security_dentry_init_security(): constify qstr argument commit 829745b75a1af25bfb0c7dc36640548c98c57169 Merge: 867e4513fe4ba7 2944ebee9a96c9 Author: Linus Torvalds Date: Fri Oct 3 10:59:31 2025 -0700 Merge tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull finish_no_open updates from Al Viro: "finish_no_open calling conventions change to simplify callers" * tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: slightly simplify nfs_atomic_open() simplify gfs2_atomic_open() simplify fuse_atomic_open() simplify nfs_atomic_open_v23() simplify vboxsf_dir_atomic_open() simplify cifs_atomic_open() 9p: simplify v9fs_vfs_atomic_open_dotl() 9p: simplify v9fs_vfs_atomic_open() allow finish_no_open(file, ERR_PTR(-E...)) commit 867e4513fe4ba7e7a7ff6a59a1fbbc7d54f443c7 Merge: 51e9889ab120c2 92003056e5d45f Author: Linus Torvalds Date: Fri Oct 3 10:55:35 2025 -0700 Merge tag 'pull-nfsctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull nfsctl updates from Al Viro: "nfsctl cleanups and a fix" * tag 'pull-nfsctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: nfsd_get_inode(): lift setting ->i_{,f}op to callers. nfsdfs_create_files(): switch to simple_start_creating() _nfsd_symlink(): switch to simple_start_creating() nfsd_mkdir(): switch to simple_start_creating() nfsctl: symlink has no business bumping link count of parent directory commit 51e9889ab120c21de8a3ae447672e69aa4266103 Merge: e64aeecbbb0962 57e62089f8e9d0 Author: Linus Torvalds Date: Fri Oct 3 10:51:44 2025 -0700 Merge tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull fs_context updates from Al Viro: "Change vfs_parse_fs_string() calling conventions Get rid of the length argument (almost all callers pass strlen() of the string argument there), add vfs_parse_fs_qstr() for the cases that do want separate length" * tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: do_nfs4_mount(): switch to vfs_parse_fs_string() change the calling conventions for vfs_parse_fs_string() commit 1b54b0756f051c11f5a5d0fbc1581e0b9a18e2bc Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 16:27:15 2025 +0530 net: doc: Fix typos in docs Fix typos in doc comments. Signed-off-by: Bhanu Seshu Kumar Valluri Link: https://patch.msgid.link/20251001105715.50462-1-bhanuseshukumar@gmail.com Signed-off-by: Jakub Kicinski commit 7a0f94361ffd6e1d31c79023e8674b492bef05e3 Author: Jakub Kicinski Date: Tue Sep 30 19:24:26 2025 -0700 net: psp: don't assume reply skbs will have a socket Rx path may be passing around unreferenced sockets, which means that skb_set_owner_edemux() may not set skb->sk and PSP will crash: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:psp_reply_set_decrypted (./include/net/psp/functions.h:132 net/psp/psp_sock.c:287) tcp_v6_send_response.constprop.0 (net/ipv6/tcp_ipv6.c:979) tcp_v6_send_reset (net/ipv6/tcp_ipv6.c:1140 (discriminator 1)) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1683) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1912) Fixes: 659a2899a57d ("tcp: add datapath logic for PSP with inline key exchange") Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251001022426.2592750-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c Author: Dan Carpenter Date: Tue Sep 30 15:25:01 2025 +0300 net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() Print "entry->mac" before freeing "entry". The "entry" pointer is freed with kfree_rcu() so it's unlikely that we would trigger this in real life, but it's safer to re-order it. Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering") Signed-off-by: Dan Carpenter Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain Signed-off-by: Jakub Kicinski commit e64aeecbbb0962601bd2ac502a2f9c0d9be97502 Merge: e406d57be7bd2a a79765248649de Author: Linus Torvalds Date: Fri Oct 3 10:19:44 2025 -0700 Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount updates from Al Viro: "Several piles this cycle, this mount-related one being the largest and trickiest: - saner handling of guards in fs/namespace.c, getting rid of needlessly strong locking in some of the users - lock_mount() calling conventions change - have it set the environment for attaching to given location, storing the results in caller-supplied object, without altering the passed struct path. Make unlock_mount() called as __cleanup for those objects. It's not exactly guard(), but similar to it - MNT_WRITE_HOLD done right. mnt_hold_writers() does *not* mess with ->mnt_flags anymore, so insertion of a new mount into ->s_mounts of underlying superblock does not, in itself, expose ->mnt_flags of that mount to concurrent modifications - getting rid of pathological cases when umount() spends quadratic time removing the victims from propagation graph - part of that had been dealt with last cycle, this should finish it - a bunch of stuff constified - assorted cleanups * tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (64 commits) constify {__,}mnt_is_readonly() WRITE_HOLD machinery: no need for to bump mount_lock seqcount struct mount: relocate MNT_WRITE_HOLD bit preparations to taking MNT_WRITE_HOLD out of ->mnt_flags setup_mnt(): primitive for connecting a mount to filesystem simplify the callers of mnt_unhold_writers() copy_mnt_ns(): use guards copy_mnt_ns(): use the regular mechanism for freeing empty mnt_ns on failure open_detached_copy(): separate creation of namespace into helper open_detached_copy(): don't bother with mount_lock_hash() path_has_submounts(): use guard(mount_locked_reader) fs/namespace.c: sanitize descriptions for {__,}lookup_mnt() ecryptfs: get rid of pointless mount references in ecryptfs dentries umount_tree(): take all victims out of propagation graph at once do_mount(): use __free(path_put) do_move_mount_old(): use __free(path_put) constify can_move_mount_beneath() arguments path_umount(): constify struct path argument may_copy_tree(), __do_loopback(): constify struct path argument path_mount(): constify struct path argument ... commit 49bdb63ff64469a6de8ea901aef123c75be9bbe7 Author: Bhanu Seshu Kumar Valluri Date: Tue Sep 30 14:19:02 2025 +0530 net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout ===================================================== BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707 Local variable sig.i.i created at: lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline] lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline] lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241 lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766 The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM read timeout errors (-ETIMEDOUT). In the fallthrough path, it first attempted to restore the pin configuration for LED outputs and then returned only the status of that restore operation, discarding the original timeout error. As a result, callers could mistakenly treat the data buffer as valid even though the EEPROM read had actually timed out with no data or partial data. To fix this, handle errors in restoring the LED pin configuration separately. If the restore succeeds, return any prior EEPROM timeout error correctly to the caller. Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9 Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations") Signed-off-by: Bhanu Seshu Kumar Valluri Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250930084902.19062-1-bhanuseshukumar@gmail.com Signed-off-by: Jakub Kicinski commit 51204faa4273a64b7066b5c1b5383e9b20d58caa Merge: 43c59341487d53 cf6ee09b091330 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:25 2025 -0500 Merge branch 'pci/misc' - Fix whitespace issues (Li Jun) - Fix pci_acpi_preserve_config() memory leak (Nirmoy Das) - Add sysfs 'serial_number' file to expose the Device Serial Number (Matthew Wood) * pci/misc: PCI/sysfs: Expose PCI device serial number PCI/ACPI: Fix pci_acpi_preserve_config() memory leak commit 43c59341487d53c782695d1b85b3bd1d69182931 Merge: 7fe17980cb4e55 98a4f5b7359205 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:25 2025 -0500 Merge branch 'pci/controller/xilinx-nwl' - Clear bootloader E_ECAM_CONTROL before merging in the new driver value (Jani Nurminen) * pci/controller/xilinx-nwl: PCI: xilinx-nwl: Fix ECAM programming commit 7fe17980cb4e55beb634e58085ac3a880786ca93 Merge: c4c50d8da88c38 b26fc701a25195 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:24 2025 -0500 Merge branch 'pci/controller/xgene' * pci/controller/xgene: PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup() commit c4c50d8da88c383cc446e60fda8c2c317ebb93e5 Merge: 30eccd3b7d2f0c e1bd928479fb1f Author: Bjorn Helgaas Date: Fri Oct 3 12:13:23 2025 -0500 Merge branch 'pci/controller/tegra' - Correct the devm_kcalloc() argument order (Alok Tiwari) - When asserting PERST#, disable the controller instead of mistakenly disabling the PLL twice (Nagarjuna Kristam) - Convert struct tegra_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) - Rename 'root_bus' to 'root_port_bus' for clarity (Manivannan Sadhasivam) * pci/controller/tegra: PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation commit 30eccd3b7d2f0cdd86929fc9a0f7d75493fb520e Merge: 0157e111db7d7a c86a24dfa902fc Author: Bjorn Helgaas Date: Fri Oct 3 12:13:23 2025 -0500 Merge branch 'pci/controller/stm32' - Update pinctrl documentation of initial states and use in runtime suspend/resume (Christian Bruel) - Add pinctrl_pm_select_init_state() for use by stm32 driver, which needs it during resume (Christian Bruel) - Add devicetree bindings and drivers for the STMicroelectronics STM32MP25 in host and endpoint modes (Christian Bruel) * pci/controller/stm32: MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings PCI: stm32: Add PCIe host support for STM32MP25 dt-bindings: PCI: Add STM32MP25 PCIe Root Complex bindings pinctrl: Add pinctrl_pm_select_init_state helper function Documentation: pinctrl: Describe PM helper functions for standard states. commit 0157e111db7d7a2527a9387bca18b8e3855780dc Merge: 2ee6181ffdb8ca 1c72774df02842 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:22 2025 -0500 Merge branch 'pci/controller/sophgo' - Check for existence of struct cdns_pcie.ops before using it to allow Cadence drivers that don't need to supply ops (Chen Wang) - Add DT binding and driver for the Sophgo SG2042 PCIe controller (Chen Wang) * pci/controller/sophgo: PCI: sg2042: Add Sophgo SG2042 PCIe driver PCI: cadence: Check for the existence of cdns_pcie::ops before using it dt-bindings: pci: Add Sophgo SG2042 PCIe host commit 2ee6181ffdb8cad074a26465433fe8f9e9bef923 Merge: 86a3f3db9a0f4f 5ed35b4d490d87 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:22 2025 -0500 Merge branch 'pci/controller/rcar-host' - Pass the correct IRQ domain to generic_handle_domain_irq() to fix a regression when converting to msi_create_parent_irq_domain() (Claudiu Beznea) - Drop the spinlock protecting the PMSR register; it's no longer required since pci_lock already serializes accesses (Marek Vasut) - Convert struct rcar_msi mask_lock to raw spinlock to avoid a lock nesting error (Marek Vasut) * pci/controller/rcar-host: PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock PCI: rcar-host: Drop PMSR spinlock PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() commit 86a3f3db9a0f4f5b9a6f77a63d063b57c146306b Merge: 531abff0fa53bc 2bdf1d428f48e1 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:21 2025 -0500 Merge branch 'pci/controller/rcar-gen4' - Fix a typo that prevented correct PHY initialization (Marek Vasut) - Add a missing 1ms delay after PWR reset assertion as required by the V4H manual (Marek Vasut) - Assure reset has completed before DBI access to avoid SError (Marek Vasut) - Fix inverted PHY initialization check, which sometimes led to timeouts and failure to start the controller (Marek Vasut) * pci/controller/rcar-gen4: PCI: rcar-gen4: Fix inverted break condition in PHY initialization PCI: rcar-gen4: Assure reset occurs before DBI access PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion PCI: rcar-gen4: Fix PHY initialization commit 531abff0fa53bc3a2f7f69b2693386eb6bda96e5 Merge: 93f32da3d409a2 0da48c5b2fa731 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:20 2025 -0500 Merge branch 'pci/controller/qcom' - Select PCI Power Control Slot driver so slot voltage rails can be turned on/off if described in Root Port device tree node (Qiang Yu) - Parse only PCI bridge child nodes in device tree, skipping unrelated nodes such as OPP (Operating Performance Points), which caused probe failures (Krishna Chaitanya Chundru) - Add 8.0 GT/s and 32.0 GT/s equalization settings (Ziyue Zhang) - Fix typo in CURSOR macro names (Ziyue Zhang) - Consolidate Root Port 'phy' and 'reset' properties in struct qcom_pcie_port, regardless of whether we got them from the Root Port node or the host bridge node (Manivannan Sadhasivam) - Fetch and map the ELBI register space in the DWC core rather than in each driver individually (Krishna Chaitanya Chundru) - Enable ECAM mechanism in DWC core by setting up iATU with 'CFG Shift Feature' and use this in the qcom driver (Krishna Chaitanya Chundru) * pci/controller/qcom: PCI: dwc: Support ECAM mechanism by enabling iATU 'CFG Shift Feature' PCI: qcom: Prepare for the DWC ECAM enablement PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature' PCI: dwc: Add support for ELBI resource mapping PCI: qcom: Move host bridge 'phy' and 'reset' pointers to struct qcom_pcie_port PCI: qcom: Fix macro typo for CURSOR PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s PCI: qcom: Restrict port parsing only to PCIe bridge child nodes PCI: qcom: Select PCI Power Control Slot driver commit 93f32da3d409a29187e0bbc940a9ed619c754cce Merge: dde4b05e26c507 882569dca6646e Author: Bjorn Helgaas Date: Fri Oct 3 12:13:20 2025 -0500 Merge branch 'pci/controller/plda' - Return -ENOMEM directly instead of using dev_err_probe() (Xichao Zhao) * pci/controller/plda: PCI: plda: Remove dev_err_probe() when the errno is -ENOMEM commit dde4b05e26c5077d751ba1ca71aaf2d0bfa8a180 Merge: 836eec3a7c6fe2 81fedb39a9f0da Author: Bjorn Helgaas Date: Fri Oct 3 12:13:19 2025 -0500 Merge branch 'pci/controller/mediatek-gen3' - Add optional sys clock ready time setting to avoid sys_clk_rdy signal glitching in MT6991 and MT8196 (AngeloGioacchino Del Regno) - Add DT binding and driver support for MT6991 and MT8196 (AngeloGioacchino Del Regno) * pci/controller/mediatek-gen3: PCI: mediatek-gen3: Add support for MediaTek MT8196 SoC dt-bindings: PCI: mediatek-gen3: Add support for MT6991/MT8196 PCI: mediatek-gen3: Implement sys clock ready time setting commit 836eec3a7c6fe2484bc8701546fe17e11c1b3fff Merge: da72dcc28eb757 e51d05f523e43c Author: Bjorn Helgaas Date: Fri Oct 3 12:13:19 2025 -0500 Merge branch 'pci/controller/keystone' - Use kcalloc() instead of kzalloc() to avoid potential integer overflow (Qianfeng Rong) - Use devm_request_irq() so 'ks-pcie-error-irq' is freed when driver exits with error (Siddharth Vadapalli) * pci/controller/keystone: PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit PCI: keystone: Use kcalloc() instead of kzalloc() commit da72dcc28eb75758366da0167074911f71a8ead6 Merge: efe4466add2f23 cfcd6cab2f33c2 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:18 2025 -0500 Merge branch 'pci/controller/j721e' - Add MODULE_DEVICE_TABLE() so driver can be autoloaded (Siddharth Vadapalli) - Power controller off before configuring the glue layer so the controller latches the correct values on power-on (Siddharth Vadapalli) - Correct the error message when j721e_pcie_ctrl_init() fails (Alok Tiwari) * pci/controller/j721e: PCI: j721e: Fix incorrect error message in probe() PCI: j721e: Fix programming sequence of "strap" settings PCI: j721e: Fix module autoloading commit efe4466add2f237fe17d053e2de71768e1141463 Merge: 5611712af3e645 c221cbf8dc547e Author: Bjorn Helgaas Date: Fri Oct 3 12:13:18 2025 -0500 Merge branch 'pci/controller/imx6' - Enable the 3.3V Vaux supply if available so devices can request wakeup with either Beacon or WAKE# (Richard Zhu) * pci/controller/imx6: PCI: imx6: Enable the Vaux supply if available commit 5611712af3e6450f826a5e9b7df022b995fb65c1 Merge: 0a09e23176beb4 ce47f81925ed73 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:17 2025 -0500 Merge branch 'pci/controller/hv' - Remove unused hv_msi_free() parameter (Nam Cao) * pci/controller/hv: PCI: hv: Remove unused parameter of hv_msi_free() commit 0a09e23176beb46879007257b678b6a59905109f Merge: f2b2fcf6d64e45 eea30c76012245 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:16 2025 -0500 Merge branch 'pci/controller/dwc-edma' - Verify that if DT specifies a single IRQ for all eDMA channels, it is named 'dma' (Niklas Cassel) - Remove qcom edma.nr_irqs initialization, which is redundant since dw_pcie_edma_irq_verify() initializes it based on whether the DT contains 'dma' (single IRQ) or 'dmaX' (multiple IRQs) (Niklas Cassel) * pci/controller/dwc-edma: PCI: qcom-ep: Remove redundant edma.nr_irqs initialization PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() commit f2b2fcf6d64e45f68e1730ac0a63fe896f06241e Merge: df1d435baafa18 cef730075cfe2b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:16 2025 -0500 Merge branch 'pci/controller/dwc' - Add support for x16 in devicetree 'num-lanes' property (Konrad Dybcio) * pci/controller/dwc: PCI: dwc: Support 16-lane operation commit df1d435baafa18b1b8a923dfaf663241cde54364 Merge: f26502c7b895ed 1d0156c8b230ca Author: Bjorn Helgaas Date: Fri Oct 3 12:13:15 2025 -0500 Merge branch 'pci/controller/amd-mdb' - Update DT binding example to separate PERST# to a Root Port stanza to make multiple Root Ports possible in the future (Sai Krishna Musham) - Add driver support for Root Port PERST# (Sai Krishna Musham) * pci/controller/amd-mdb: PCI: amd-mdb: Add support for PCIe RP PERST# signal handling dt-bindings: PCI: amd-mdb: Add example usage of reset-gpios for PCIe RP PERST# commit f26502c7b895ed33867824ac35e401d6641a9985 Merge: 94401068457e04 f8c9ad46b00453 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:15 2025 -0500 Merge branch 'pci/endpoint' - Check for errors returned from pci_epc_get(), which returns IS_ERR(), not NULL on error (Dan Carpenter) - Fix pci_endpoint_test_ioctl() array underflow (Dan Carpenter) - Document sysfs interface for BAR assignment of vNTB endpoint functions (Jerome Brunet) - Drop superfluous pci_epc_features initialization for unsupported features; we only have to mention features that *are* supported (Niklas Cassel) - Skip IRQ tests if the IRQ is out of range (Christian Bruel) - Fix pci-epf-test for controllers with fixed-size BARs smaller than requested by the test (Marek Vasut) - Restore inbound translation when disabling doorbell so the doorbell test case can be run more than once (Niklas Cassel) - Check for NULL before releasing DMA channels to avoid a NULL pointer dereference (Shin'ichiro Kawasaki) - Convert tegra194 interrupt number to MSI vector to fix endpoint Kselftest MSI_TEST test case (Niklas Cassel) - Set tegra_pcie_epc_features.msi_capable so the pci_endpoint_test can use the optimal IRQ type (Niklas Cassel) - Reset tegra194 BARs when running in endpoint mode so the BAR tests don't overwrite the ATU settings in BAR4 (Niklas Cassel) - Handle errors in tegra194 BPMP transactions so we don't mistakenly skip future PERST# assertion (Vidya Sagar) * pci/endpoint: PCI: tegra194: Handle errors in BPMP response PCI: tegra194: Reset BARs when running in PCIe endpoint mode PCI: tegra194: Set pci_epc_features::msi_capable to true PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release PCI: endpoint: pci-epf-test: Fix doorbell test support PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs selftests: pci_endpoint: Skip IRQ test if IRQ is out of range. misc: pci_endpoint_test: Cleanup extra 0 initialization misc: pci_endpoint_test: Skip IRQ tests if irq is out of range PCI: endpoint: Drop superfluous pci_epc_features initialization Documentation: PCI: endpoint: Document BAR assignment misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg() commit 94401068457e041fd2738c1ee23dc86ea4accdcc Merge: fef353037982e3 96a17ed17b3691 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:14 2025 -0500 Merge branch 'pci/dt-binding' - Correct indentation in qcom,pcie-sa8255p.yaml and amd,versal2-mdb-host.yaml so they indent with four spaces consistently (Krzysztof Kozlowski) - Add SM8750 compatible to qcom,pcie-sm8550.yaml (Krishna Chaitanya Chundru) - Add Peripheral Virtualization Unit (PVU), which restricts DMA from PCIe devices to specific regions of host memory, to the ti,am65 binding (Jan Kiszka) - Update qcom,pcie-x1e80100.yaml to allow fifth PCIe host on Qualcomm Glymur, which is compatible with X1E80100 but doesn't have the cnoc_sf_axi clock (Qiang Yu) * pci/dt-binding: dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller dt-bindings: PCI: ti,am65: Extend for use with PVU dt-bindings: PCI: qcom,pcie-sm8550: Add SM8750 compatible dt-bindings: PCI: Correct example indentation commit fef353037982e3fd9aa38e2b8a7426768443777c Merge: 91553998f26abd 907912c1daa7d8 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:14 2025 -0500 Merge branch 'pci/capability-search' - Simplify __pci_find_next_cap_ttl() by replacing magic numbers with #defines, extracting fields with FIELD_GET(), etc (Hans Zhang) - Convert __pci_find_next_cap_ttl() to a PCI_FIND_NEXT_CAP() macro that takes a config space accessor function so we can also use it in cases where the usual config accessors aren't available (Hans Zhang) - Similarly convert pci_find_next_ext_capability() to a PCI_FIND_NEXT_EXT_CAP() macro (Hans Zhang) - Implement dwc, dwc endpoint, and cadence capability search interfaces on top of PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP(), replacing the previous duplicated code (Hans Zhang) - Search for capabilities in the cadence core instead of hard-coding their offsets, which are subject to change (Hans Zhang) * pci/capability-search: PCI: cadence: Use cdns_pcie_find_*capability() to avoid hardcoding offsets PCI: cadence: Implement capability search using PCI core APIs PCI: dwc: ep: Implement capability search using PCI core APIs PCI: dwc: Implement capability search using PCI core APIs PCI: Refactor extended capability search into PCI_FIND_NEXT_EXT_CAP() PCI: Refactor capability search into PCI_FIND_NEXT_CAP() PCI: Clean up __pci_find_next_cap_ttl() readability commit 91553998f26abd1a06a7d7e971e6e2aa711111b5 Merge: 3d56c863189dcf f2543da14dc2b9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:13 2025 -0500 Merge branch 'pci/switchtec' - Replace manual locks with guard to simplify code (Erick Karanja) * pci/switchtec: PCI: switchtec: Replace manual locks with guard commit 3d56c863189dcf72118326bb4043f24907cc4f5c Merge: fead6a0b15bf3b 60e7b5aa85712f Author: Bjorn Helgaas Date: Fri Oct 3 12:13:12 2025 -0500 Merge branch 'pci/virtualization' - Add rescan/remove locking when enabling/disabling SR-IOV, which solves list corruption on s390, where disabling SR-IOV also generates hotplug events (Niklas Schnelle) - Add lockdep assertion in pci_stop_and_remove_bus_device() to catch device removal without appropriate locking (Niklas Schnelle) * pci/virtualization: PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV commit fead6a0b15bf3b33dba877efec6b4e7b4cc4abc3 Merge: b365c0a76946b3 a43ac325c7cbbf Author: Bjorn Helgaas Date: Fri Oct 3 12:13:12 2025 -0500 Merge branch 'pci/resource' - Ensure relaxed tail alignment does not increase min_align when computing bridge window size, to fix a regression (Ilpo Järvinen) - Fix bridge window size computation to fix a regression for devices with undefined PCI class, e.g., Samsung [144d:a5a5] (Ilpo Järvinen) - Fix error handling during resource resize to fix a regression in amdgpu (Ilpo Järvinen) - Align m68k pcibios_enable_device() with other arches (Ilpo Järvinen) - Remove several sparc pcibios_enable_device() implementations that don't do anything beyond what pci_enable_resources() does (Ilpo Järvinen) - Remove mips pcibios_enable_resources() and use pci_enable_resources() instead (Ilpo Järvinen) - Refactor and simplify find_bus_resource_of_type() (Ilpo Järvinen) - Claim bridge windows before setting them up (Ilpo Järvinen) - Disable non-claimed bridge windows so the kernel's view matches the hardware configuration (Ilpo Järvinen) - Use pci_release_resource() instead of release_resource() to reduce code duplication and increase consistency (Ilpo Järvinen) - Enable bridges even if bridge window assignment fails (Ilpo Järvinen) - Preserve bridge window resource type flags when assignment fails because we may need it later (Ilpo Järvinen) - Add bridge window selection functions to make the selection consistent across the several places that do this (Ilpo Järvinen) - Warn if bridge window cannot be released when resizing BAR (Ilpo Järvinen) - Set up bridge resources before enumerating children so we can check whether child resources are inside bridge windows (Ilpo Järvinen) * pci/resource: PCI: Set up bridge resources earlier PCI: Don't print stale information about resource PCI: Alter misleading recursion to pci_bus_release_bridge_resources() PCI: Pass bridge window to pci_bus_release_bridge_resources() PCI: Add pci_setup_one_bridge_window() PCI: Refactor remove_dev_resources() to use pbus_select_window() PCI: Refactor distributing available memory to use loops PCI: Use pbus_select_window_for_type() during mem window sizing PCI: Use pbus_select_window() in space available checker PCI: Rename resource variable from r to res PCI: Use pbus_select_window_for_type() during IO window sizing PCI: Use pbus_select_window() during BAR resize PCI: Warn if bridge window cannot be released when resizing BAR PCI: Fix finding bridge window in pci_reassign_bridge_resources() PCI: Add bridge window selection functions PCI: Add defines for bridge window indexing PCI: Preserve bridge window resource type flags PCI: Enable bridge even if bridge window fails to assign PCI: Use pci_release_resource() instead of release_resource() PCI: Disable non-claimed bridge window PCI: Always claim bridge window before its setup PCI: Refactor find_bus_resource_of_type() logic checks PCI: Move find_bus_resource_of_type() earlier MIPS: PCI: Use pci_enable_resources() sparc/PCI: Remove pcibios_enable_device() as they do nothing extra m68k/PCI: Use pci_enable_resources() in pcibios_enable_device() PCI: Fix failure detection during resource resize PCI: Fix pdev_resources_assignable() disparity PCI: Ensure relaxed tail alignment does not increase min_align commit b365c0a76946b3f18e835c1ee85a280753f9a9b0 Merge: 4c5cd8d64172de dc32e9346b26ba Author: Bjorn Helgaas Date: Fri Oct 3 12:13:11 2025 -0500 Merge branch 'pci/pwrctrl' - Fix a double cleanup of regulators if devm_add_action_or_reset() fails (Geert Uytterhoeven) * pci/pwrctrl: PCI/pwrctrl: Fix device leak at device stop PCI/pwrctrl: Fix device and OF node leak at bus scan PCI/pwrctrl: Fix device leak at registration PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure commit 4c5cd8d64172de3730056366dc61392a3f2f003a Merge: 0bb65e32495e62 48991e4935078b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:11 2025 -0500 Merge branch 'pci/pm' - If a device has already been disconnected, e.g., by a hotplug removal, don't bother trying to resume it to D0 when detaching the driver (Mario Limonciello) - Ensure devices are powered up before config reads for 'max_link_width', 'current_link_speed', 'current_link_width', 'secondary_bus_number', and 'subordinate_bus_number' sysfs files (Brian Norris) * pci/pm: PCI/sysfs: Ensure devices are powered for config reads PCI/PM: Skip resuming to D0 if device is disconnected commit 0bb65e32495e6235a069b60e787140da99e9c122 Merge: 3cde1c3ec9207e 54dbd2a8e974b9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:10 2025 -0500 Merge branch 'pci/p2pdma' - Free struct p2p_pgmap, not a member within it, in the pci_p2pdma_add_resource() error path (Sungho Kim) - Make pci_has_p2pmem() static (Leon Romanovsky) * pci/p2pdma: PCI/P2PDMA: Reduce scope of pci_has_p2pmem() PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call commit 3cde1c3ec9207eafccd56c3645ad7f0641407c78 Merge: 5c16adf2b95104 fad8e97854504b Author: Bjorn Helgaas Date: Fri Oct 3 12:13:10 2025 -0500 Merge branch 'pci/of' - Leave parent unit address 0 in 'interrupt-map' so we can build this property even when interrupt controllers lack 'reg' properties (Lorenzo Pieralisi) * pci/of: PCI: of: Update parent unit address generation in of_pci_prop_intr_map() commit 5c16adf2b95104c1b2bfd3fff33d697a57f5ba0f Merge: 35dbfcb7dc0d3a ebc7086b39e5e4 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:09 2025 -0500 Merge branch 'pci/msi' - Add quirk to disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) * pci/msi: PCI: Disable MSI on RDC PCI to PCIe bridges commit 35dbfcb7dc0d3acad5e44749cbd49f418eaae2fa Merge: 31e04a46cefcd7 1d33d9e46c08e9 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:08 2025 -0500 Merge branch 'pci/hotplug' - Clean up whitespace in messages (Colin Ian King) * pci/hotplug: PCI: hotplug: Clean up spaces in messages commit 31e04a46cefcd79976a57eaebbc174dbf7b2100f Merge: 7cc5e1e62bd20a a22250fe933dbd Author: Bjorn Helgaas Date: Fri Oct 3 12:13:08 2025 -0500 Merge branch 'pci/enumeration' - Use PCI_HEADER_TYPE_* defines, not hard-coded values (Ilpo Järvinen) - Clean up early_dump_pci_device() to avoid hard-coded values (Ilpo Järvinen) - Clean up pci_scan_child_bus_extend() loop to avoid hard-coded values (Ilpo Järvinen) - Add a Xeon 6 quirk to disable Extended Tags and limit Max Read Request Size to 128B to avoid a performance issue (Ilpo Järvinen) * pci/enumeration: PCI: Add Extended Tag + MRRS quirk for Xeon 6 PCI: Clean up pci_scan_child_bus_extend() loop PCI: Clean up early_dump_pci_device() PCI: Use header type defines in pci_setup_device() commit 7cc5e1e62bd20a6c24597a0d13bcf24f784e8b74 Merge: a0d0cad13f7173 a729c166461988 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:07 2025 -0500 Merge branch 'pci/aspm' - Enable all ClockPM and ASPM states for devicetree platforms, since there's typically no firmware that enables ASPM (Manivannan Sadhasivam) - Remove the qcom code that enabled ASPM (Manivannan Sadhasivam) * pci/aspm: PCI: qcom: Remove custom ASPM enablement code PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms commit a0d0cad13f7173a5a584fe3596c394cd987771f6 Merge: 8f5ae30d69d754 deb2f228388ff3 Author: Bjorn Helgaas Date: Fri Oct 3 12:13:07 2025 -0500 Merge branch 'pci/aer' - Allow drivers to request a Bus Reset on Non-Fatal Errors (Lukas Wunner) - Send uevents for subordinate devices (not the bridge) on failure to recover from errors on the subordinate devices (Lukas Wunner) - Notify drivers by calling their err_handler.error_detected() callback on failure to recover (Lukas Wunner) - Update device error_state earlier after reset to align AER and EEH error recovery (Lukas Wunner) - Remove obsolete comments about .link_reset(), which was removed long ago (Lukas Wunner) - Emit a uevent for the beginning of error recovery if driver requests a reset (Niklas Schnelle) - Emit error recover uevents on s390 as is done by EEH and AER (Niklas Schnelle) - Include error_detected() result in AER uevent to align with corresponding uevents from EEH and s390 (Niklas Schnelle) - Decode new errors added in PCIe r6.0 (Lukas Wunner) - Print TLP Log for errors introduced since PCIe spec r1.1 (Lukas Wunner) - Check for allocation failure in pci_aer_init() (Vernon Yang) - Update error recovery documentation to match the current code and use consistent nomenclature (Lukas Wunner) - Avoid NULL pointer dereference in aer_ratelimit() when GHES error info points to a device with no AER Capability (Breno Leitao) * pci/aer: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() Documentation: PCI: Fix typos Documentation: PCI: Tidy error recovery doc's PCIe nomenclature Documentation: PCI: Amend error recovery doc with DPC/AER specifics Documentation: PCI: Sync error recovery doc with code Documentation: PCI: Sync AER doc with code PCI/AER: Fix NULL pointer access by aer_info PCI/AER: Print TLP Log for errors introduced since PCIe r1.1 PCI/AER: Support errors introduced by PCIe r6.0 powerpc/eeh: Use result of error_detected() in uevent s390/pci: Use pci_uevent_ers() in PCI recovery PCI/AER: Fix missing uevent on recovery when a reset is requested PCI/ERR: Remove remnants of .link_reset() callback PCI/ERR: Update device error_state already after reset PCI/ERR: Notify drivers on failure to recover PCI/ERR: Fix uevent on failure to recover PCI/AER: Allow drivers to opt in to Bus Reset on Non-Fatal Errors commit 61e19cd2e5c5235326a13a68df1a2f8ec4eeed7b Author: Sasha Levin Date: Mon Sep 29 07:32:38 2025 -0400 tracing: Fix lock imbalance in s_start() memory allocation failure path When s_start() fails to allocate memory for set_event_iter, it returns NULL before acquiring event_mutex. However, the corresponding s_stop() function always tries to unlock the mutex, causing a lock imbalance warning: WARNING: bad unlock balance detected! 6.17.0-rc7-00175-g2b2e0c04f78c #7 Not tainted ------------------------------------- syz.0.85611/376514 is trying to release lock (event_mutex) at: [] traverse.part.0.constprop.0+0x2c4/0x650 fs/seq_file.c:131 but there are no more locks to release! The issue was introduced by commit b355247df104 ("tracing: Cache ':mod:' events for modules not loaded yet") which added the kzalloc() allocation before the mutex lock, creating a path where s_start() could return without locking the mutex while s_stop() would still try to unlock it. Fix this by unconditionally acquiring the mutex immediately after allocation, regardless of whether the allocation succeeded. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250929113238.3722055-1-sashal@kernel.org Fixes: b355247df104 ("tracing: Cache ":mod:" events for modules not loaded yet") Signed-off-by: Sasha Levin Signed-off-by: Steven Rostedt (Google) commit 4af66c2bcab06e6e515b23139122e745d7619680 Author: Dan Carpenter Date: Fri Oct 3 12:29:18 2025 +0300 mfd: ls2kbmc: check for devm_mfd_add_devices() failure Call pci_disable_device() if devm_mfd_add_devices() fails. Fixes: 0d64f6d1ffe9 ("mfd: ls2kbmc: Introduce Loongson-2K BMC core driver") Signed-off-by: Dan Carpenter Message-ID: Signed-off-by: Corey Minyard commit 0892507f4a0b76eb897afc2bacca85e172512379 Author: Dan Carpenter Date: Fri Oct 3 12:29:09 2025 +0300 mfd: ls2kbmc: Fix an IS_ERR() vs NULL check in probe() The devm_kzalloc() function returns NULL on error so check for that instead of error pointers. Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support") Signed-off-by: Dan Carpenter Message-ID: Signed-off-by: Corey Minyard commit efebdf4b722143dc5073cee21276baf1673d451e Merge: 0473d5b964b755 1001cc1171248e Author: Miquel Raynal Date: Fri Oct 3 17:23:18 2025 +0200 Merge tag 'nand/for-6.18' into mtd/next * Raw NAND: - Add support for Loongson-2K1000 and Loongson-2K0500 NAND controllers, including extra features, such as chip select and 6-byte NAND ID reading support. - Drop the s3c2410 driver. * SPI NAND: - Important SPI NAND continuous read improvements and fixes. - Add support for FudanMicro FM25S01A. - Add support for continuous reads in Gigadevice vendor driver. * ECC: - Add support for the Realtek ECC engine. This PR comes with the usual amount of various miscellaneous fixes. Signed-off-by: Miquel Raynal commit 0473d5b964b755a55178f36cbcd832eb362cac03 Merge: 362f84c89e1365 17926cd770ec83 Author: Miquel Raynal Date: Fri Oct 3 17:23:08 2025 +0200 Merge tag 'spi-nor/for-6.18' into mtd/next SPI NOR changes for 6.18 Notable changes: - Some flashes can't perform reads or writes with start or end being an odd number in Octal DTR mode. File systems like UBIFS can request such reads or writes, causing the transaction to error out. Pad the read or write transactions with extra bytes to avoid this problem. Signed-off-by: Miquel Raynal commit 93a4b36ef3cf4ce5e6a7e7a7686181de76e246a1 Author: Nirbhay Sharma Date: Fri Oct 3 17:15:55 2025 +0530 cgroup: Fix seqcount lockdep assertion in cgroup freezer The commit afa3701c0e45 ("cgroup: cgroup.stat.local time accounting") introduced a seqcount to track freeze timing but initialized it as a plain seqcount_t using seqcount_init(). However, the write-side critical section in cgroup_do_freeze() holds the css_set_lock spinlock while calling write_seqcount_begin(). On PREEMPT_RT kernels, spinlocks do not disable preemption, causing the lockdep assertion for a plain seqcount_t, which checks for preemption being disabled, to fail. This triggers the following warning: WARNING: CPU: 0 PID: 9692 at include/linux/seqlock.h:221 Fix this by changing the type to seqcount_spinlock_t and initializing it with seqcount_spinlock_init() to associate css_set_lock with the seqcount. This allows lockdep to correctly validate that the spinlock is held during write operations, resolving the assertion failure on all kernel configurations. Reported-by: syzbot+27a2519eb4dad86d0156@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=27a2519eb4dad86d0156 Fixes: afa3701c0e45 ("cgroup: cgroup.stat.local time accounting") Signed-off-by: Nirbhay Sharma Link: https://lore.kernel.org/r/20251002165510.KtY3IT--@linutronix.de/ Acked-by: Michal Koutný Signed-off-by: Tejun Heo commit f620d66af3165838bfa845dcf9f5f9b4089bf508 Author: Catalin Marinas Date: Wed Sep 24 13:31:22 2025 +0100 arm64: mte: Do not flag the zero page as PG_mte_tagged Commit 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page") attempted to fix ptrace() reading of tags from the zero page by marking it as PG_mte_tagged during cpu_enable_mte(). The same commit also changed the ptrace() tag access permission check to the VM_MTE vma flag while turning the page flag test into a WARN_ON_ONCE(). Attempting to set the PG_mte_tagged flag early with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled may either hang (after commit d77e59a8fccd "arm64: mte: Lock a page for MTE tag initialisation") or have the flags cleared later during page_alloc_init_late(). In addition, pages_identical() -> memcmp_pages() will reject any comparison with the zero page as it is marked as tagged. Partially revert the above commit to avoid setting PG_mte_tagged on the zero page. Update the __access_remote_tags() warning on untagged pages to ignore the zero page since it is known to have the tags initialised. Note that all user mapping of the zero page are marked as pte_special(). The arm64 set_pte_at() will not call mte_sync_tags() on such pages, so PG_mte_tagged will remain cleared. Signed-off-by: Catalin Marinas Fixes: 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page") Reported-by: Gergely Kovacs Cc: stable@vger.kernel.org # 5.10.x Cc: Will Deacon Cc: David Hildenbrand Cc: Lance Yang Acked-by: Lance Yang Reviewed-by: David Hildenbrand Tested-by: Lance Yang Signed-off-by: Will Deacon commit 0ca286477b5e2dc9a00ccd3ab1eaceb9fda4be06 Author: Jens Axboe Date: Fri Oct 3 07:22:02 2025 -0600 io_uring: update liburing git URL Change the liburing git URL to point to the git.kernel.org servers, rather than my private git.kernel.dk server. Due to continued AI scraping of cgit etc, it's becoming quite the chore to maintain a private git server. Signed-off-by: Jens Axboe commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd Author: Coiby Xu Date: Mon Sep 15 13:55:23 2025 +0800 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include #include #include #include #include #include int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; } Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit 191cac349c8eeeb6d64453b8db194d3ad42ca9dc Author: Eric Biggers Date: Thu Aug 14 19:17:33 2025 -0700 lib/digsig: Use SHA-1 library instead of crypto_shash Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers Reviewed-by: Paul Menzel Signed-off-by: Mimi Zohar commit 1376956c5e9e7871978153a483904dc3238e96fb Author: Eric Biggers Date: Thu Aug 14 19:17:32 2025 -0700 integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS, since INTEGRITY_ASYMMETRIC_KEYS selects several options that depend on CRYPTO. This unblocks the removal of the CRYPTO selection from SIGNATURE. SIGNATURE (lib/digsig.c) itself will no longer need CRYPTO, but INTEGRITY_ASYMMETRIC_KEYS was depending on it indirectly via the chain SIGNATURE => INTEGRITY_SIGNATURE => INTEGRITY_ASYMMETRIC_KEYS. Signed-off-by: Eric Biggers Reviewed-by: Paul Menzel Signed-off-by: Mimi Zohar commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 Author: Peter Ujfalusi Date: Thu Oct 2 10:47:19 2025 +0300 ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel It is allowed to mix Link and Host DMA channels in a way that their index is different. In this case we would read the LLP from a channel which is not used or used for other operation. Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire configuration: playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA used Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and Link channel 0 (stream_tag 1). In this case reading the LLP from channel 2 is incorrect as that is not the Link channel used for the HDMI playback. To correct this, we should look up the BE and get the channel used on the Link side. Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)") Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a4b8152c09a832b089864e5e209a479bb0fb5cc9 Author: Kai Vehmanen Date: Thu Oct 2 10:47:18 2025 +0300 ASoC: SOF: ipc4-pcm: do not report invalid delay values Add a sanity check for the calculated delay value before reporting it to the application. If the value is clearly invalid, emit a rate limited warning to kernel log and return a zero delay. This can occur e.g if the host or link DMA hits a buffer over/underrun condition. Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 18dbff48a1ea58100f9fa6886cfef286a96a5fb0 Author: Peter Ujfalusi Date: Thu Oct 2 10:47:17 2025 +0300 ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper Add dev_dbg_ratelimited() wrapper for snd_sof_pcm specific debug prints that needs rate limited. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002074719.2084-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit e95e2d3f34642d1bfd97c703c23c9c282a64d686 Author: Ran Xiaokai Date: Tue Sep 30 06:38:31 2025 +0000 slab: Add allow_spin check to eliminate kmemleak warnings In slab_post_alloc_hook(), kmemleak check is skipped when gfpflags_allow_spinning() returns false since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Therefore, unconditionally calling kmemleak_not_leak() in alloc_slab_obj_exts() would trigger the following warning: kmemleak: Trying to color unknown object at 0xffff8881057f5000 as Grey Call Trace: alloc_slab_obj_exts+0x1b5/0x370 __alloc_tagging_slab_alloc_hook+0x9f/0x2d0 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 Add the allow_spin check in alloc_slab_obj_exts() to eliminate the above warning. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Reviewed-by: Harry Yoo Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20250930063831.782815-1-ranxiaokai627@163.com Signed-off-by: Vlastimil Babka commit 16abbabc004bedeeaa702e11913da9d4fa70e63a Author: Petr Tesarik Date: Wed Oct 1 08:10:28 2025 +0200 dma-mapping: fix direction in dma_alloc direction traces Set __entry->dir to the actual "dir" parameter of all trace events in dma_alloc_class. This struct member was left uninitialized by mistake. Signed-off-by: Petr Tesarik Fixes: 3afff779a725 ("dma-mapping: trace dma_alloc/free direction") Cc: stable@vger.kernel.org Reviewed-by: Sean Anderson Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251001061028.412258-1-ptesarik@suse.com commit ab220548dbefa8f99636741924b6fdf33f3230a2 Author: Shigeru Yoshida Date: Thu Oct 2 14:10:24 2025 +0900 kmsan: fix kmsan_handle_dma() to avoid false positives KMSAN reports an uninitialized value issue in dma_map_phys()[1]. This is a false positive caused by the way the virtual address is handled in kmsan_handle_dma(). Fix it by translating the physical address to a virtual address using phys_to_virt(). [1] BUG: KMSAN: uninit-value in dma_map_phys+0xdc5/0x1060 dma_map_phys+0xdc5/0x1060 dma_map_page_attrs+0xcf/0x130 e1000_xmit_frame+0x3c51/0x78f0 dev_hard_start_xmit+0x22f/0xa30 sch_direct_xmit+0x3b2/0xcf0 __dev_queue_xmit+0x3588/0x5e60 neigh_resolve_output+0x9c5/0xaf0 ip6_finish_output2+0x24e0/0x2d30 ip6_finish_output+0x903/0x10d0 ip6_output+0x331/0x600 mld_sendpack+0xb4a/0x1770 mld_ifc_work+0x1328/0x19b0 process_scheduled_works+0xb91/0x1d80 worker_thread+0xedf/0x1590 kthread+0xd5c/0xf00 ret_from_fork+0x1f5/0x4c0 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __kmalloc_cache_noprof+0x8f5/0x16b0 syslog_print+0x9a/0xef0 do_syslog+0x849/0xfe0 __x64_sys_syslog+0x97/0x100 x64_sys_call+0x3cf8/0x3e30 do_syscall_64+0xd9/0xfa0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 0-89 of 90 are uninitialized Memory access of size 90 starts at ffff8880367ed000 CPU: 1 UID: 0 PID: 1552 Comm: kworker/1:2 Not tainted 6.17.0-next-20250929 #26 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-5.fc42 04/01/2014 Workqueue: mld mld_ifc_work Fixes: 6eb1e769b2c1 ("kmsan: convert kmsan_handle_dma to use physical addresses") Signed-off-by: Shigeru Yoshida Reviewed-by: Jason Gunthorpe Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251002051024.3096061-1-syoshida@redhat.com commit 6982a462cb64c5f0a38cd8738398961ddfb883cf Author: Mallesh Koujalagi Date: Thu Oct 2 06:26:48 2025 +0530 drm/xe/xe_late_bind_fw: Initialize uval variable in xe_late_bind_fw_num_fans() Initialize the uval variable to 0 in xe_late_bind_fw_num_fans() to fix a potential use of uninitialized variable warning and ensure predictable behavior. The variable is passed by reference to xe_pcode_read() which should populate it on success, but initializing it to 0 provides a safe default value and follows kernel coding best practices. v2: - uval = 0 which serves as both a safe default and the fallback value when the pcode read operation fails. v3: - Handle MMIO failure (Rodrigo) - The function should probably return the error and make the uval as pointer-argument, like the pcode_read. - Change the caller of this function to propagate the error upwards if mmio failed. Fixes: 45832bf9c10f3 ("drm/xe/xe_late_bind_fw: Initialize late binding firmware") Signed-off-by: Mallesh Koujalagi Link: https://lore.kernel.org/r/20251002005648.3185636-1-mallesh.koujalagi@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 07abc16c14693df703763c45e9fc0abfefc927d5) Signed-off-by: Lucas De Marchi commit 10aa5c80603088d10c2cd5e7e27d561a8fb59c7e Author: Thomas Hellström Date: Tue Sep 30 14:27:52 2025 +0200 drm/gpusvm, drm/xe: Fix userptr to not allow device private pages When userptr is used on SVM-enabled VMs, a non-NULL hmm_range::dev_private_owner value might mean that hmm_range_fault() attempts to return device private pages. Either that will fail, or the userptr code will not know how to handle those. Use NULL for hmm_range::dev_private_owner to migrate such pages to system. In order to do that, move the struct drm_gpusvm::device_private_page_owner field to struct drm_gpusvm_ctx::device_private_page_owner so that it doesn't remain immutable over the drm_gpusvm lifetime. v2: - Don't conditionally compile xe_svm_devm_owner(). - Kerneldoc xe_svm_devm_owner(). Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250930122752.96034-1-thomas.hellstrom@linux.intel.com (cherry picked from commit ad298d9ec957414dbf3d51f3c8bca4b6d2416c0c) Signed-off-by: Lucas De Marchi commit 5b440a8bbafcc673bcff33438c68ea03993948b2 Author: Colin Ian King Date: Wed Sep 24 11:22:08 2025 +0100 drm/xe/xe_late_bind_fw: Fix missing initialization of variable offset The variable offset is not being initialized, and it is only set inside a for-loop if entry->name is the same as manifest_entry. In the case where it is not initialized a non-zero check on offset is potentialy checking a bogus uninitalized value. Fix this by initializing offset to zero. Fixes: efa29317a553 ("drm/xe/xe_late_bind_fw: Extract and print version info") Signed-off-by: Colin Ian King Reviewed-by: Badal Nilawar Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250924102208.9216-1-colin.i.king@gmail.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 20f3b28e2e07747fd27301f0f5deb3cb569ee15c) Signed-off-by: Lucas De Marchi commit 17f6f6f25a98f10e8ebe022b7412a030462e7d2e Author: Thomas Hellström Date: Mon Sep 29 13:26:49 2025 +0200 drm/xe/bo: Fix an idle assertion for local bos Before calling ttm_bo_populate() in the CPU fault path of a bo, we assert that the bo is not being migrated. However, for local bos we share the reservation object with other local bos that might be in the process of being migrated. Also some VM operations may attach USAGE_KERNEL fences to the common reservation object and trigger false positives from the assert. So remove the assert and instead wait for bo idle. This may unnecessarily wait for idle in some cases but since we're doing this wait later in the fault path anyway we might as well do it here as well. This fixes warnings like: Sep 25 14:56:23 desky kernel: ------------[ cut here ]------------ Sep 25 14:56:23 desky kernel: xe 0000:03:00.0: [drm] Assertion `dma_resv_test_signaled(tbo->base.resv, DMA_RESV_USAGE_KERNEL) || (tbo->ttm && ttm_tt_is_populated(tbo->ttm))` failed! platform: BATTLEMAGE subplatform: 1 graphics: Xe2_HPG 20.01 step A0 media: Xe2_HPM 13.01 step A1 Sep 25 14:56:23 desky kernel: WARNING: CPU: 6 PID: 24767 at drivers/gpu/drm/xe/xe_bo.c:1748 xe_bo_fault_migrate+0x1bb/0x300 [xe] Sep 25 14:56:23 desky kernel: Modules linked in: cpuid dm_crypt xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 bridge stp llc xfrm_user xfr> Sep 25 14:56:23 desky kernel: snd_soc_sdca snd_seq_midi prime_numbers coretemp snd_seq_midi_event drm_ttm_helper snd_hda_codec drm_buddy drm_exec snd_rawmidi snd_soc_core snd_hda_cor> Sep 25 14:56:23 desky kernel: CPU: 6 UID: 1000 PID: 24767 Comm: steamwebhelper Tainted: G U W 6.17.0-rc7+ #32 PREEMPT(voluntary) Sep 25 14:56:23 desky kernel: Tainted: [U]=USER, [W]=WARN Sep 25 14:56:23 desky kernel: Hardware name: Micro-Star International Co., Ltd. MS-7D36/PRO Z690-P DDR4 (MS-7D36), BIOS A.A1 10/18/2022 Sep 25 14:56:23 desky kernel: RIP: 0010:xe_bo_fault_migrate+0x1bb/0x300 [xe] Sep 25 14:56:23 desky kernel: Code: fa 64 29 f9 48 c7 c7 40 e0 d3 c1 51 48 c7 c1 c0 e3 d3 c1 52 4c 8b 45 c0 41 50 44 8b 4d c8 4d 89 e0 48 8b 55 a8 e8 25 27 95 ef <0f> 0b 48 83 c4 40 4> Sep 25 14:56:23 desky kernel: RSP: 0000:ffffae1ca88c7b10 EFLAGS: 00010286 Sep 25 14:56:23 desky kernel: RAX: 0000000000000000 RBX: ffff8d7cfd7e6800 RCX: 0000000000000027 Sep 25 14:56:23 desky kernel: RDX: ffff8d845019cec8 RSI: 0000000000000001 RDI: ffff8d845019cec0 Sep 25 14:56:23 desky kernel: RBP: ffffae1ca88c7bc8 R08: 0000000000000000 R09: 0000000000000000 Sep 25 14:56:23 desky kernel: R10: 0000000000000000 R11: 0000000000000004 R12: ffffffffc1db1faa Sep 25 14:56:23 desky kernel: R13: ffffffffc1db2ab4 R14: 0000000000000001 R15: ffffae1ca88c7bd8 Sep 25 14:56:23 desky kernel: FS: 00007fb1baf31940(0000) GS:ffff8d849c870000(0000) knlGS:0000000000000000 Sep 25 14:56:23 desky kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Sep 25 14:56:23 desky kernel: CR2: 00007fb1b2860020 CR3: 00000001705a9004 CR4: 0000000000772ef0 Sep 25 14:56:23 desky kernel: PKRU: 55555558 Sep 25 14:56:23 desky kernel: Call Trace: Sep 25 14:56:23 desky kernel: Sep 25 14:56:23 desky kernel: xe_bo_cpu_fault_fastpath+0x11e/0x220 [xe] Sep 25 14:56:23 desky kernel: xe_bo_cpu_fault+0x84/0x410 [xe] Sep 25 14:56:23 desky kernel: ? __x64_sys_mmap+0x33/0x50 Sep 25 14:56:23 desky kernel: ? x64_sys_call+0x1b2e/0x20d0 Sep 25 14:56:23 desky kernel: ? do_syscall_64+0x9d/0x1f0 Sep 25 14:56:23 desky kernel: ? __check_object_size+0x4a/0x2e0 Sep 25 14:56:23 desky kernel: __do_fault+0x36/0x190 Sep 25 14:56:23 desky kernel: do_fault+0xcf/0x570 Sep 25 14:56:23 desky kernel: __handle_mm_fault+0x92b/0xfe0 Sep 25 14:56:23 desky kernel: ? ktime_get_mono_fast_ns+0x39/0xd0 Sep 25 14:56:23 desky kernel: handle_mm_fault+0x164/0x2c0 Sep 25 14:56:23 desky kernel: do_user_addr_fault+0x2cb/0x840 Sep 25 14:56:23 desky kernel: exc_page_fault+0x75/0x180 Sep 25 14:56:23 desky kernel: asm_exc_page_fault+0x27/0x30 Sep 25 14:56:23 desky kernel: RIP: 0033:0x7fb1bc388bb7 Sep 25 14:56:23 desky kernel: Code: 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 84 00 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7> Sep 25 14:56:23 desky kernel: RSP: 002b:00007ffd7814fad8 EFLAGS: 00010207 Sep 25 14:56:23 desky kernel: RAX: 00007fb1b2860000 RBX: 0000000000000690 RCX: 00007fb1b2860000 Sep 25 14:56:23 desky kernel: RDX: 00007fb1b2860610 RSI: 0000556eda79f4c0 RDI: 00007fb1b2860020 Sep 25 14:56:23 desky kernel: RBP: 00007ffd7814fb60 R08: 0000000000000000 R09: 000000012be0e000 Sep 25 14:56:23 desky kernel: R10: 00007fb1b2860000 R11: 0000000000000246 R12: 0000556edd39a240 Sep 25 14:56:23 desky kernel: R13: 00007fb1b2dcb010 R14: 0000556eda79f420 R15: 0000000000000000 Sep 25 14:56:23 desky kernel: Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5250 Fixes: c2ae94cf8cd8 ("drm/xe: Convert the CPU fault handler for exhaustive eviction") Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250929112649.6131-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 8f1756a7ea33b352a54e6f53d76c552b3a424187) Signed-off-by: Lucas De Marchi commit 3734c8184d71c946c4128ce44ca1767c084f2358 Author: Michal Wajdeczko Date: Sun Sep 28 19:48:11 2025 +0200 drm/xe/vf: Don't claim support for firmware late-bind if VF In general, the VFs can't load firmwares so attempt to initialize the firmware late-bind component leads to errors like: [] xe 0000:03:00.1: [drm] *ERROR* Late bind component not bound Fixes: 918bd789d62e ("drm/xe/xe_late_bind_fw: Introduce xe_late_bind_fw") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6190 Signed-off-by: Michal Wajdeczko Cc: Badal Nilawar Reviewed-by: Piotr Piórkowski Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250928174811.198933-3-michal.wajdeczko@intel.com (cherry picked from commit e35e288090f362be88d77b60d9846cea15df173e) Signed-off-by: Lucas De Marchi commit de61d5944c87d21e5692823f30fb61c95df300bf Author: Michal Wajdeczko Date: Sun Sep 28 19:48:10 2025 +0200 drm/xe/vf: Rename sriov_update_device_info This is a VF only function and its name should reflect that to avoid any confusion. Move the VF check to the caller side. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250928174811.198933-2-michal.wajdeczko@intel.com (cherry picked from commit b88bb1eefa88f0cefc00fe5e78b1186cd8f9db78) Signed-off-by: Lucas De Marchi commit 59b7ed0ba2e0fc18dda19a2c48eea2c3cef652f3 Author: Lucas De Marchi Date: Wed Sep 24 08:27:11 2025 -0700 drm/xe/configfs: Improve doc for ctx_restore* attributes Spell out the syntax instead of only using examples. Particularly important the part since that's different than engines_allowed and may confuse users. The same batch buffer is used for all engines of a certain class. Cc: Raag Jadav Reviewed-by: Raag Jadav Reviewed-by: Jonathan Cavitt Fixes: e2a9854d806e ("drm/xe/configfs: Allow to select by class only") Link: https://lore.kernel.org/r/20250924152709.659483-4-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 47ca7acff4011fa322853a3612f464b959e88210) Signed-off-by: Lucas De Marchi commit 7646423c7ff14156f5c163e995ba896ea9a0d559 Author: Lucas De Marchi Date: Wed Sep 24 08:27:10 2025 -0700 drm/xe/configfs: Fix engine class parsing If mask is NULL, only the engine class should be accepted, so the pattern string should be completely parsed. This should fix passing e.g. rcs0 to ctx_restore_post_bb when it's only expecting the engine class. Reported-by: Jonathan Cavitt Closes: https://lore.kernel.org/r/20250922155544.67712-1-jonathan.cavitt@intel.com Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aNJKnrCQmL9xS9Gv@stanley.mountain Fixes: e2a9854d806e ("drm/xe/configfs: Allow to select by class only") Reviewed-by: Jonathan Cavitt Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250924152709.659483-3-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit dd797967160b79cc0ca2d2eb05fc55436b66dce0) Signed-off-by: Lucas De Marchi commit 7bd03e3914f15720f8385d58bef0f1849df659e1 Author: Michal Wajdeczko Date: Mon Sep 22 12:12:07 2025 +0200 drm/xe/tests: Fix build break on clang 16.0.6 The following error was reported when building with clang 16.0.6: In file included from drivers/gpu/drm/xe/xe_pci.c:1104: >> drivers/gpu/drm/xe/tests/xe_pci.c:214:2: error: initializer \ element is not a compile-time constant graphics_ip_xelp, ^~~~~~~~~~~~~~~~ drivers/gpu/drm/xe/tests/xe_pci.c:221:2: error: initializer \ element is not a compile-time constant media_ip_xem, ^~~~~~~~~~~~ 2 errors generated. Fix that by explicit re-definition of pre-GMDID IPs, as there are not so many of them. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509192041.tQwdE4DS-lkp@intel.com/ Fixes: 5bb5258e357e ("drm/xe/tests: Add pre-GMDID IP descriptors to param generators") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Nathan Chancellor Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250922101207.192028-1-michal.wajdeczko@intel.com (cherry picked from commit 2de80e2da74b402a9d838b8e729cd01cf94cdcbc) Signed-off-by: Lucas De Marchi commit 4e715744bf7b4e5521cc3b77f310060f862cb719 Author: Jaegeuk Kim Date: Thu Oct 2 01:55:32 2025 +0000 f2fs: add missing dput() when printing the donation list We missed to call dput() on the grabbed dentry. Fixes: f1a49c1b112b ("f2fs: show the list of donation files") Reviewed-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e406d57be7bd2a4e73ea512c1ae36a40a44e499e Merge: 8804d970fab457 9f1c14c1de1bdd Author: Linus Torvalds Date: Thu Oct 2 18:44:54 2025 -0700 Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "ida: Remove the ida_simple_xxx() API" from Christophe Jaillet completes the removal of this legacy IDR API - "panic: introduce panic status function family" from Jinchao Wang provides a number of cleanups to the panic code and its various helpers, which were rather ad-hoc and scattered all over the place - "tools/delaytop: implement real-time keyboard interaction support" from Fan Yu adds a few nice user-facing usability changes to the delaytop monitoring tool - "efi: Fix EFI boot with kexec handover (KHO)" from Evangelos Petrongonas fixes a panic which was happening with the combination of EFI and KHO - "Squashfs: performance improvement and a sanity check" from Phillip Lougher teaches squashfs's lseek() about SEEK_DATA/SEEK_HOLE. A mere 150x speedup was measured for a well-chosen microbenchmark - plus another 50-odd singleton patches all over the place * tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (75 commits) Squashfs: reject negative file sizes in squashfs_read_inode() kallsyms: use kmalloc_array() instead of kmalloc() MAINTAINERS: update Sibi Sankar's email address Squashfs: add SEEK_DATA/SEEK_HOLE support Squashfs: add additional inode sanity checking lib/genalloc: fix device leak in of_gen_pool_get() panic: remove CONFIG_PANIC_ON_OOPS_VALUE ocfs2: fix double free in user_cluster_connect() checkpatch: suppress strscpy warnings for userspace tools cramfs: fix incorrect physical page address calculation kernel: prevent prctl(PR_SET_PDEATHSIG) from racing with parent process exit Squashfs: fix uninit-value in squashfs_get_parent kho: only fill kimage if KHO is finalized ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name() kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths sched/task.h: fix the wrong comment on task_lock() nesting with tasklist_lock coccinelle: platform_no_drv_owner: handle also built-in drivers coccinelle: of_table: handle SPI device ID tables lib/decompress: use designated initializers for struct compress_format efi: support booting with kexec handover (KHO) ... commit 8804d970fab45726b3c7cd7f240b31122aa94219 Merge: 24d9e8b3c9c8a6 1367da7eb875d0 Author: Linus Torvalds Date: Thu Oct 2 18:18:33 2025 -0700 Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "mm, swap: improve cluster scan strategy" from Kairui Song improves performance and reduces the failure rate of swap cluster allocation - "support large align and nid in Rust allocators" from Vitaly Wool permits Rust allocators to set NUMA node and large alignment when perforning slub and vmalloc reallocs - "mm/damon/vaddr: support stat-purpose DAMOS" from Yueyang Pan extend DAMOS_STAT's handling of the DAMON operations sets for virtual address spaces for ops-level DAMOS filters - "execute PROCMAP_QUERY ioctl under per-vma lock" from Suren Baghdasaryan reduces mmap_lock contention during reads of /proc/pid/maps - "mm/mincore: minor clean up for swap cache checking" from Kairui Song performs some cleanup in the swap code - "mm: vm_normal_page*() improvements" from David Hildenbrand provides code cleanup in the pagemap code - "add persistent huge zero folio support" from Pankaj Raghav provides a block layer speedup by optionalls making the huge_zero_pagepersistent, instead of releasing it when its refcount falls to zero - "kho: fixes and cleanups" from Mike Rapoport adds a few touchups to the recently added Kexec Handover feature - "mm: make mm->flags a bitmap and 64-bit on all arches" from Lorenzo Stoakes turns mm_struct.flags into a bitmap. To end the constant struggle with space shortage on 32-bit conflicting with 64-bit's needs - "mm/swapfile.c and swap.h cleanup" from Chris Li cleans up some swap code - "selftests/mm: Fix false positives and skip unsupported tests" from Donet Tom fixes a few things in our selftests code - "prctl: extend PR_SET_THP_DISABLE to only provide THPs when advised" from David Hildenbrand "allows individual processes to opt-out of THP=always into THP=madvise, without affecting other workloads on the system". It's a long story - the [1/N] changelog spells out the considerations - "Add and use memdesc_flags_t" from Matthew Wilcox gets us started on the memdesc project. Please see https://kernelnewbies.org/MatthewWilcox/Memdescs and https://blogs.oracle.com/linux/post/introducing-memdesc - "Tiny optimization for large read operations" from Chi Zhiling improves the efficiency of the pagecache read path - "Better split_huge_page_test result check" from Zi Yan improves our folio splitting selftest code - "test that rmap behaves as expected" from Wei Yang adds some rmap selftests - "remove write_cache_pages()" from Christoph Hellwig removes that function and converts its two remaining callers - "selftests/mm: uffd-stress fixes" from Dev Jain fixes some UFFD selftests issues - "introduce kernel file mapped folios" from Boris Burkov introduces the concept of "kernel file pages". Using these permits btrfs to account its metadata pages to the root cgroup, rather than to the cgroups of random inappropriate tasks - "mm/pageblock: improve readability of some pageblock handling" from Wei Yang provides some readability improvements to the page allocator code - "mm/damon: support ARM32 with LPAE" from SeongJae Park teaches DAMON to understand arm32 highmem - "tools: testing: Use existing atomic.h for vma/maple tests" from Brendan Jackman performs some code cleanups and deduplication under tools/testing/ - "maple_tree: Fix testing for 32bit compiles" from Liam Howlett fixes a couple of 32-bit issues in tools/testing/radix-tree.c - "kasan: unify kasan_enabled() and remove arch-specific implementations" from Sabyrzhan Tasbolatov moves KASAN arch-specific initialization code into a common arch-neutral implementation - "mm: remove zpool" from Johannes Weiner removes zspool - an indirection layer which now only redirects to a single thing (zsmalloc) - "mm: task_stack: Stack handling cleanups" from Pasha Tatashin makes a couple of cleanups in the fork code - "mm: remove nth_page()" from David Hildenbrand makes rather a lot of adjustments at various nth_page() callsites, eventually permitting the removal of that undesirable helper function - "introduce kasan.write_only option in hw-tags" from Yeoreum Yun creates a KASAN read-only mode for ARM, using that architecture's memory tagging feature. It is felt that a read-only mode KASAN is suitable for use in production systems rather than debug-only - "mm: hugetlb: cleanup hugetlb folio allocation" from Kefeng Wang does some tidying in the hugetlb folio allocation code - "mm: establish const-correctness for pointer parameters" from Max Kellermann makes quite a number of the MM API functions more accurate about the constness of their arguments. This was getting in the way of subsystems (in this case CEPH) when they attempt to improving their own const/non-const accuracy - "Cleanup free_pages() misuse" from Vishal Moola fixes a number of code sites which were confused over when to use free_pages() vs __free_pages() - "Add Rust abstraction for Maple Trees" from Alice Ryhl makes the mapletree code accessible to Rust. Required by nouveau and by its forthcoming successor: the new Rust Nova driver - "selftests/mm: split_huge_page_test: split_pte_mapped_thp improvements" from David Hildenbrand adds a fix and some cleanups to the thp selftesting code - "mm, swap: introduce swap table as swap cache (phase I)" from Chris Li and Kairui Song is the first step along the path to implementing "swap tables" - a new approach to swap allocation and state tracking which is expected to yield speed and space improvements. This patchset itself yields a 5-20% performance benefit in some situations - "Some ptdesc cleanups" from Matthew Wilcox utilizes the new memdesc layer to clean up the ptdesc code a little - "Fix va_high_addr_switch.sh test failure" from Chunyu Hu fixes some issues in our 5-level pagetable selftesting code - "Minor fixes for memory allocation profiling" from Suren Baghdasaryan addresses a couple of minor issues in relatively new memory allocation profiling feature - "Small cleanups" from Matthew Wilcox has a few cleanups in preparation for more memdesc work - "mm/damon: add addr_unit for DAMON_LRU_SORT and DAMON_RECLAIM" from Quanmin Yan makes some changes to DAMON in furtherance of supporting arm highmem - "selftests/mm: Add -Wunreachable-code and fix warnings" from Muhammad Anjum adds that compiler check to selftests code and fixes the fallout, by removing dead code - "Improvements to Victim Process Thawing and OOM Reaper Traversal Order" from zhongjinji makes a number of improvements in the OOM killer: mainly thawing a more appropriate group of victim threads so they can release resources - "mm/damon: misc fixups and improvements for 6.18" from SeongJae Park is a bunch of small and unrelated fixups for DAMON - "mm/damon: define and use DAMON initialization check function" from SeongJae Park implement reliability and maintainability improvements to a recently-added bug fix - "mm/damon/stat: expose auto-tuned intervals and non-idle ages" from SeongJae Park provides additional transparency to userspace clients of the DAMON_STAT information - "Expand scope of khugepaged anonymous collapse" from Dev Jain removes some constraints on khubepaged's collapsing of anon VMAs. It also increases the success rate of MADV_COLLAPSE against an anon vma - "mm: do not assume file == vma->vm_file in compat_vma_mmap_prepare()" from Lorenzo Stoakes moves us further towards removal of file_operations.mmap(). This patchset concentrates upon clearing up the treatment of stacked filesystems - "mm: Improve mlock tracking for large folios" from Kiryl Shutsemau provides some fixes and improvements to mlock's tracking of large folios. /proc/meminfo's "Mlocked" field became more accurate - "mm/ksm: Fix incorrect accounting of KSM counters during fork" from Donet Tom fixes several user-visible KSM stats inaccuracies across forks and adds selftest code to verify these counters - "mm_slot: fix the usage of mm_slot_entry" from Wei Yang addresses some potential but presently benign issues in KSM's mm_slot handling * tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (372 commits) mm: swap: check for stable address space before operating on the VMA mm: convert folio_page() back to a macro mm/khugepaged: use start_addr/addr for improved readability hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list alloc_tag: fix boot failure due to NULL pointer dereference mm: silence data-race in update_hiwater_rss mm/memory-failure: don't select MEMORY_ISOLATION mm/khugepaged: remove definition of struct khugepaged_mm_slot mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL hugetlb: increase number of reserving hugepages via cmdline selftests/mm: add fork inheritance test for ksm_merging_pages counter mm/ksm: fix incorrect KSM counter handling in mm_struct during fork drivers/base/node: fix double free in register_one_node() mm: remove PMD alignment constraint in execmem_vmalloc() mm/memory_hotplug: fix typo 'esecially' -> 'especially' mm/rmap: improve mlock tracking for large folios mm/filemap: map entire large folio faultaround mm/fault: try to map the entire file folio in finish_fault() mm/rmap: mlock large folios in try_to_unmap_one() mm/rmap: fix a mlock race condition in folio_referenced_one() ... commit 24d9e8b3c9c8a6f72c8b4c196a703e144928d919 Merge: 07fdad3a93756b ca74b8cadaad4b Author: Linus Torvalds Date: Thu Oct 2 15:58:05 2025 -0700 Merge tag 'slab-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - A new layer for caching objects for allocation and free via percpu arrays called sheaves. The aim is to combine the good parts of SLAB (lower-overhead and simpler percpu caching, compared to SLUB) without the past issues with arrays for freeing remote NUMA node objects and their flushing. It also allows more efficient kfree_rcu(), and cheaper object preallocations for cases where the exact number of objects is unknown, but an upper bound is. Currently VMAs and maple nodes are using this new caching, with a plan to enable it for all caches and remove the complex SLUB fastpath based on cpu (partial) slabs and this_cpu_cmpxchg_double(). (Vlastimil Babka, with Liam Howlett and Pedro Falcato for the maple tree changes) - Re-entrant kmalloc_nolock(), which allows opportunistic allocations from NMI and tracing/kprobe contexts. Building on prior page allocator and memcg changes, it will result in removing BPF-specific caches on top of slab (Alexei Starovoitov) - Various fixes and cleanups. (Kuan-Wei Chiu, Matthew Wilcox, Suren Baghdasaryan, Ye Liu) * tag 'slab-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (40 commits) slab: Introduce kmalloc_nolock() and kfree_nolock(). slab: Reuse first bit for OBJEXTS_ALLOC_FAIL slab: Make slub local_(try)lock more precise for LOCKDEP mm: Introduce alloc_frozen_pages_nolock() mm: Allow GFP_ACCOUNT to be used in alloc_pages_nolock(). locking/local_lock: Introduce local_lock_is_locked(). maple_tree: Convert forking to use the sheaf interface maple_tree: Add single node allocation support to maple state maple_tree: Prefilled sheaf conversion and testing tools/testing: Add support for prefilled slab sheafs maple_tree: Replace mt_free_one() with kfree() maple_tree: Use kfree_rcu in ma_free_rcu testing/radix-tree/maple: Hack around kfree_rcu not existing tools/testing: include maple-shim.c in maple.c maple_tree: use percpu sheaves for maple_node_cache mm, vma: use percpu sheaves for vm_area_struct cache tools/testing: Add support for changes to slab for sheaves slab: allow NUMA restricted allocations to use percpu sheaves tools/testing/vma: Implement vm_refcnt reset slab: skip percpu sheaves for remote object freeing ... commit 07fdad3a93756b872da7b53647715c48d0f4a2d0 Merge: f79e772258df31 f1455695d2d998 Author: Linus Torvalds Date: Thu Oct 2 15:17:01 2025 -0700 Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Paolo Abeni: "Core & protocols: - Improve drop account scalability on NUMA hosts for RAW and UDP sockets and the backlog, almost doubling the Pps capacity under DoS - Optimize the UDP RX performance under stress, reducing contention, revisiting the binary layout of the involved data structs and implementing NUMA-aware locking. This improves UDP RX performance by an additional 50%, even more under extreme conditions - Add support for PSP encryption of TCP connections; this mechanism has some similarities with IPsec and TLS, but offers superior HW offloads capabilities - Ongoing work to support Accurate ECN for TCP. AccECN allows more than one congestion notification signal per RTT and is a building block for Low Latency, Low Loss, and Scalable Throughput (L4S) - Reorganize the TCP socket binary layout for data locality, reducing the number of touched cachelines in the fastpath - Refactor skb deferral free to better scale on large multi-NUMA hosts, this improves TCP and UDP RX performances significantly on such HW - Increase the default socket memory buffer limits from 256K to 4M to better fit modern link speeds - Improve handling of setups with a large number of nexthop, making dump operating scaling linearly and avoiding unneeded synchronize_rcu() on delete - Improve bridge handling of VLAN FDB, storing a single entry per bridge instead of one entry per port; this makes the dump order of magnitude faster on large switches - Restore IP ID correctly for encapsulated packets at GSO segmentation time, allowing GRO to merge packets in more scenarios - Improve netfilter matching performance on large sets - Improve MPTCP receive path performance by leveraging recently introduced core infrastructure (skb deferral free) and adopting recent TCP autotuning changes - Allow bridges to redirect to a backup port when the bridge port is administratively down - Introduce MPTCP 'laminar' endpoint that con be used only once per connection and simplify common MPTCP setups - Add RCU safety to dst->dev, closing a lot of possible races - A significant crypto library API for SCTP, MPTCP and IPv6 SR, reducing code duplication - Supports pulling data from an skb frag into the linear area of an XDP buffer Things we sprinkled into general kernel code: - Generate netlink documentation from YAML using an integrated YAML parser Driver API: - Support using IPv6 Flow Label in Rx hash computation and RSS queue selection - Introduce API for fetching the DMA device for a given queue, allowing TCP zerocopy RX on more H/W setups - Make XDP helpers compatible with unreadable memory, allowing more easily building DevMem-enabled drivers with a unified XDP/skbs datapath - Add a new dedicated ethtool callback enabling drivers to provide the number of RX rings directly, improving efficiency and clarity in RX ring queries and RSS configuration - Introduce a burst period for the health reporter, allowing better handling of multiple errors due to the same root cause - Support for DPLL phase offset exponential moving average, controlling the average smoothing factor Device drivers: - Add a new Huawei driver for 3rd gen NIC (hinic3) - Add a new SpacemiT driver for K1 ethernet MAC - Add a generic abstraction for shared memory communication devices (dibps) - Ethernet high-speed NICs: - nVidia/Mellanox: - Use multiple per-queue doorbell, to avoid MMIO contention issues - support adjacent functions, allowing them to delegate their SR-IOV VFs to sibling PFs - support RSS for IPSec offload - support exposing raw cycle counters in PTP and mlx5 - support for disabling host PFs. - Intel (100G, ice, idpf): - ice: support for SRIOV VFs over an Active-Active link aggregate - ice: support for firmware logging via debugfs - ice: support for Earliest TxTime First (ETF) hardware offload - idpf: support basic XDP functionalities and XSk - Broadcom (bnxt): - support Hyper-V VF ID - dynamic SRIOV resource allocations for RoCE - Meta (fbnic): - support queue API, zero-copy Rx and Tx - support basic XDP functionalities - devlink health support for FW crashes and OTP mem corruptions - expand hardware stats coverage to FEC, PHY, and Pause - Wangxun: - support ethtool coalesce options - support for multiple RSS contexts - Ethernet virtual: - Macsec: - replace custom netlink attribute checks with policy-level checks - Bonding: - support aggregator selection based on port priority - Microsoft vNIC: - use page pool fragments for RX buffers instead of full pages to improve memory efficiency - Ethernet NICs consumer, and embedded: - Qualcomm: support Ethernet function for IPQ9574 SoC - Airoha: implement wlan offloading via NPU - Freescale - enetc: add NETC timer PTP driver and add PTP support - fec: enable the Jumbo frame support for i.MX8QM - Renesas (R-Car S4): - support HW offloading for layer 2 switching - support for RZ/{T2H, N2H} SoCs - Cadence (macb): support TAPRIO traffic scheduling - TI: - support for Gigabit ICSS ethernet SoC (icssm-prueth) - Synopsys (stmmac): a lot of cleanups - Ethernet PHYs: - Support 10g-qxgmi phy-mode for AQR412C, Felix DSA and Lynx PCS driver - Support bcm63268 GPHY power control - Support for Micrel lan8842 PHY and PTP - Support for Aquantia AQR412 and AQR115 - CAN: - a large CAN-XL preparation work - reorganize raw_sock and uniqframe struct to minimize memory usage - rcar_canfd: update the CAN-FD handling - WiFi: - extended Neighbor Awareness Networking (NAN) support - S1G channel representation cleanup - improve S1G support - WiFi drivers: - Intel (iwlwifi): - major refactor and cleanup - Broadcom (brcm80211): - support for AP isolation - RealTek (rtw88/89) rtw88/89: - preparation work for RTL8922DE support - MediaTek (mt76): - HW restart improvements - MLO support - Qualcomm/Atheros (ath10k): - GTK rekey fixes - Bluetooth drivers: - btusb: support for several new IDs for MT7925 - btintel: support for BlazarIW core - btintel_pcie: support for _suspend() / _resume() - btintel_pcie: support for Scorpious, Panther Lake-H484 IDs" * tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1536 commits) net: stmmac: Add support for Allwinner A523 GMAC200 dt-bindings: net: sun8i-emac: Add A523 GMAC200 compatible Revert "Documentation: net: add flow control guide and document ethtool API" octeontx2-pf: fix bitmap leak octeontx2-vf: fix bitmap leak net/mlx5e: Use extack in set rxfh callback net/mlx5e: Introduce mlx5e_rss_params for RSS configuration net/mlx5e: Introduce mlx5e_rss_init_params net/mlx5e: Remove unused mdev param from RSS indir init net/mlx5: Improve QoS error messages with actual depth values net/mlx5e: Prevent entering switchdev mode with inconsistent netns net/mlx5: HWS, Generalize complex matchers net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs selftests/net: add tcp_port_share to .gitignore Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" net: add NUMA awareness to skb_attempt_defer_free() net: use llist for sd->defer_list net: make softnet_data.defer_count an atomic selftests: drv-net: psp: add tests for destroying devices selftests: drv-net: psp: add test for auto-adjusting TCP MSS ... commit 63d2247e2e37d9c589a0a26aa4e684f736a45e29 Author: Tony Ambardar Date: Thu Oct 2 13:31:50 2025 -0700 libbpf: Fix missing #pragma in libbpf_utils.c The recent sha256 patch uses a GCC pragma to suppress compile errors for a packed struct, but omits a needed pragma (see related link) and thus still raises errors: (e.g. on GCC 12.3 armhf) libbpf_utils.c:153:29: error: packed attribute causes inefficient alignment for ‘__val’ [-Werror=attributes] 153 | struct __packed_u32 { __u32 __val; } __attribute__((packed)); | ^~~~~ Resolve by adding the GCC diagnostic pragma to ignore "-Wattributes". Link: https://lore.kernel.org/bpf/CAP-5=fXURWoZu2j6Y8xQy23i7=DfgThq3WC1RkGFBx-4moQKYQ@mail.gmail.com/ Fixes: 4a1c9e544b8d ("libbpf: remove linux/unaligned.h dependency for libbpf_sha256()") Signed-off-by: Tony Ambardar Acked-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 510d76646a6a7beaa49fc0da7282e285a3dfce97 Author: Tang Yizhou Date: Tue Sep 23 19:21:36 2025 +0800 block: Update a comment of disk statistics >From commit 074a7aca7afa ("block: move stats from disk to part0"), we know that: * {disk|all}_stat_*() are gone. * disk_stat_lock/unlock() are renamed to part_stat_lock/unlock(). Therefore, outdated comments should be updated accordingly. Fixes: 074a7aca7afa ("block: move stats from disk to part0") Signed-off-by: Tang Yizhou Signed-off-by: Jens Axboe commit 98b7bf54338b797e3a11e8178ce0e806060d8fa3 Author: Li Chen Date: Tue Sep 30 08:35:59 2025 +0800 loop: fix backing file reference leak on validation error loop_change_fd() and loop_configure() call loop_check_backing_file() to validate the new backing file. If validation fails, the reference acquired by fget() was not dropped, leaking a file reference. Fix this by calling fput(file) before returning the error. Cc: stable@vger.kernel.org Cc: Markus Elfring CC: Yang Erkun Cc: Ming Lei Cc: Yu Kuai Fixes: f5c84eff634b ("loop: Add sanity check for read/write_iter") Signed-off-by: Li Chen Reviewed-by: Ming Lei Reviewed-by: Yang Erkun Signed-off-by: Jens Axboe commit b595edcb24727e7f93e7962c3f6f971cc16dd29e Author: Roman Kisel Date: Wed Oct 1 16:08:46 2025 -0700 hyperv: Remove the spurious null directive line The file contains a line that consists of the lone # symbol followed by a newline. While that is a valid syntax as defined by the C99+ grammar (6.10.7 "Null directive"), it serves no apparent purpose in this case. Remove the null preprocessor directive. No functional changes. Fixes: e68bda71a238 ("hyperv: Add new Hyper-V headers in include/hyperv") Signed-off-by: Roman Kisel Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu commit 020b4e86834f7a35e9986cacd10eb0202d8faa08 Author: Prasanna Kumar T S M Date: Wed Sep 17 07:03:24 2025 -0700 MAINTAINERS: Mark hyperv_fb driver Obsolete The hyperv_fb driver is deprecated in favor of Hyper-V DRM driver. Split the hyperv_fb entry from the hyperv drivers list, mark it obsolete. Signed-off-by: Prasanna Kumar T S M Reviewed-by: Saurabh Sengar Reviewed-by: Michael Kelley Acked-by: Thomas Zimmermann Signed-off-by: Wei Liu commit 34b4620349fe4776babf9c735e1c68e620784763 Author: Prasanna Kumar T S M Date: Thu Oct 2 21:10:36 2025 +0000 fbdev/hyperv_fb: deprecate this in favor of Hyper-V DRM driver The Hyper-V DRM driver is available since kernel version 5.14 and it provides full KMS support and fbdev emulation via the DRM fbdev helpers. Deprecate this driver in favor of Hyper-V DRM driver. Signed-off-by: Prasanna Kumar T S M Acked-by: Thomas Zimmermann Reviewed-by: Michael Kelley Reviewed-by: Saurabh Sengar Signed-off-by: Wei Liu commit 2ce61c63e7459058709f12f43a8a98c500382382 Author: Eduard Zingerman Date: Thu Oct 2 12:11:40 2025 -0700 selftests/bpf: Add tests for rejection of ALU ops with negative offsets Define a simple program using MOD, DIV, ADD instructions, make sure that the program is rejected if invalid offset field is used for instruction. These are test cases for commit 55c0ced59fe1 ("bpf: Reject negative offsets for ALU ops") Link: https://lore.kernel.org/all/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com/ Signed-off-by: Eduard Zingerman Signed-off-by: Alexei Starovoitov commit f79e772258df311c2cb21594ca0996318e720d28 Merge: 58809f614e0e3f afb100a5ea7a13 Author: Linus Torvalds Date: Thu Oct 2 13:13:26 2025 -0700 Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Added a new V4L2 clock helper - New camera sensor drivers - iris: Enable H.264/H.265 encoder support and fixes in iris driver common code - camss: add support for new SoC flavors - venus: add new SoC support - tc358743: support more infoframe types - Various fixes, driver improvements and cleanups * tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (439 commits) media: venus: pm_helpers: add fallback for the opp-table media: qcom: camss: vfe: Fix BPL alignment for QCM2290 media: tuner: xc5000: Fix use-after-free in xc5000_release media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove media: vsp1: Export missing vsp1_isp_free_buffer symbol media: renesas: vsp1: Convert to SYSTEM_SLEEP/RUNTIME_PM_OPS() media: renesas: ceu: Convert to RUNTIME_PM_OPS() media: renesas: fdp1: Convert to RUNTIME_PM_OPS() media: renesas: rcar-vin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: renesas: rcar_drif: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls media: uvcvideo: Shorten the transfer size non compliance message media: uvcvideo: Do not re-reference dev->udev media: uvcvideo: Use intf instead of udev for printks media: uvcvideo: Move video_device under video_queue media: uvcvideo: Drop stream->mutex media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header ... commit c8fee6a7c5cbde4908804aafc469391c22e72be9 Author: Thomas Zimmermann Date: Wed Sep 24 10:33:40 2025 +0200 fbdev: Make drivers depend on LCD_CLASS_DEVICE LCD_CLASS_DEVICE is the user-controlled option that enables the LCD display subsystem. Do not select it from fbdev drivers. Selecting it from drivers can lead to cyclic dependencies within the config. Some guidelines for using select can be found in the kernel docs at [1]. Signed-off-by: Thomas Zimmermann Link: https://elixir.bootlin.com/linux/v6.16/source/Documentation/kbuild/kconfig-language.rst#L147 # [1] Signed-off-by: Helge Deller commit c3073f1da0517b63cf3e561d79c346e15bd8c5a8 Author: Sukrut Heroorkar Date: Tue Sep 23 19:14:04 2025 +0200 fbdev: radeonfb: Remove stale product link in Kconfig The product page referenced in the FB_RADEON is no longer valid. Remove it to avoid pointing to an invalid link. Signed-off-by: Sukrut Heroorkar Acked-by: Alex Deucher Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 9d079868ae4b519ab925296337050fd1f2a20720 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:15 2025 +0700 Documentation: fb: Retitle driver docs Many framebuffer driver docs are copied from vesafb docs as their template, including "What is " title. Such title implies the introductory section, however, and not the whole docs. Retitle them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 9070fbcb9af5dd351628d030973a143f9e1b0ed4 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:14 2025 +0700 Documentation: fb: ep93xx: Demote section headings Section headings are formatted the same as title heading, thus increasing number of entries in framebuffer toctree. Demote them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 7a6e249f90fd8d3fcaa8c497bc72c8e61b988bf0 Author: Bagas Sanjaya Date: Mon Sep 22 17:36:16 2025 +0700 Documentation: fb: Split toctree Framebuffer docs toctree consists of driver-independent docs (e.g. API docs) and driver-specific docs. The latter has much more entries. Group the docs into separate toctrees. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Helge Deller commit 58809f614e0e3f4e12b489bddf680bfeb31c0a20 Merge: 05a54fa773284d b2ec5ca9d5c2c0 Author: Linus Torvalds Date: Thu Oct 2 12:47:25 2025 -0700 Merge tag 'drm-next-2025-10-01' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "cross-subsystem: - i2c-hid: Make elan touch controllers power on after panel is enabled - dt bindings for STM32MP25 SoC - pci vgaarb: use screen_info helpers - rust pin-init updates - add MEI driver for late binding firmware update/load uapi: - add ioctl for reassigning GEM handles - provide boot_display attribute on boot-up devices core: - document DRM_MODE_PAGE_FLIP_EVENT - add vendor specific recovery method to drm device wedged uevent gem: - Simplify gpuvm locking ttm: - add interface to populate buffers sched: - Fix race condition in trace code atomic: - Reallow no-op async page flips display: - dp: Fix command length video: - Improve pixel-format handling for struct screen_info rust: - drop Opaque<> from ioctl args - Alloc: - BorrowedPage type and AsPageIter traits - Implement Vmalloc::to_page() and VmallocPageIter - DMA/Scatterlist: - Add dma::DataDirection and type alias for dma_addr_t - Abstraction for struct scatterlist and sg_table - DRM: - simplify use of generics - add DriverFile type alias - drop Object::SIZE - Rust: - pin-init tree merge - Various methods for AsBytes and FromBytes traits gpuvm: - Support madvice in Xe driver gpusvm: - fix hmm_pfn_to_map_order usage in gpusvm bridge: - Improve and fix ref counting on bridge management - cdns-dsi: Various improvements to mode setting - Support Solomon SSD2825 plus DT bindings - Support Waveshare DSI2DPI plus DT bindings - Support Content Protection property - display-connector: Improve DP display detection - Add support for Radxa Ra620 plus DT bindings - adv7511: Provide SPD and HDMI infoframes - it6505: Replace crypto_shash with sha() - synopsys: Add support for DW DPTX Controller plus DT bindings - adv7511: Write full Audio infoframe - ite6263: Support vendor-specific infoframes - simple: Add support for Realtek RTD2171 DP-to-HDMI plus DT bindings panel: - panel-edp: Support mt8189 Chromebooks; Support BOE NV140WUM-N64; Support SHP LQ134Z1; Fixes - panel-simple: Support Olimex LCD-OLinuXino-5CTS plus DT bindings - Support Samsung AMS561RA01 - Support Hydis HV101HD1 plus DT bindings - ilitek-ili9881c: Refactor mode setting; Add support for Bestar BSD1218-A101KL68 LCD plus DT bindings - lvds: Add support for Ampire AMP19201200B5TZQW-T03 to DT bindings - edp: Add support for additonal mt8189 Chromebook panels - lvds: Add DT bindings for EDT ETML0700Z8DHA amdgpu: - add CRIU support for gem objects - RAS updates - VCN SRAM load fixes - EDID read fixes - eDP ALPM support - Documentation updates - Rework PTE flag generation - DCE6 fixes - VCN devcoredump cleanup - MMHUB client id fixes - VCN 5.0.1 RAS support - SMU 13.0.x updates - Expanded PCIe DPC support - Expanded VCN reset support - VPE per queue reset support - give kernel jobs unique id for tracing - pre-populate exported buffers - cyan skillfish updates - make vbios build number available in sysfs - userq updates - HDCP updates - support MMIO remap page as ttm pool - JPEG parser updates - DCE6 DC updates - use devm for i2c buses - GPUVM locking updates - Drop non-DC DCE11 code - improve fallback handling for pixel encoding amdkfd: - SVM/page migration fixes - debugfs fixes - add CRIO support for gem objects - SVM updates radeon: - use dev_warn_once in CS parsers xe: - add madvise interface - add DRM_IOCTL_XE_VM_QUERY_MEMORY_RANGE_ATTRS to query VMA count and memory attributes - drop L# bank mask reporting from media GT3 on Xe3+. - add SLPC power_profile sysfs interface - add configs attribs to add post/mid context-switch commands - handle firmware reported hardware errors notifying userspace with device wedged uevent - use same dir structure across sysfs/debugfs - cleanup and future proof vram region init - add G-states and PCI link states to debugfs - Add SRIOV support for CCS surfaces on Xe2+ - Enable SRIOV PF mode by default on supported platforms - move flush to common code - extended core workarounds for Xe2/3 - use DRM scheduler for delayed GT TLB invalidations - configs improvements and allow VF device enablement - prep work to expose mmio regions to userspace - VF migration support added - prepare GPU SVM for THP migration - start fixing XE_PAGE_SIZE vs PAGE_SIZE - add PSMI support for hw validation - resize VF bars to max possible size according to number of VFs - Ensure GT is in C0 during resume - pre-populate exported buffers - replace xe_hmm with gpusvm - add more SVM GT stats to debugfs - improve fake pci and WA kunnit handle for new platform testing - Test GuC to GuC comms to add debugging - use attribute groups to simplify sysfs registration - add Late Binding firmware code to interact with MEI i915: - apply multiple JSL/EHL/Gen7/Gen6 workarounds properly - protect against overflow in active_engine() - Use try_cmpxchg64() in __active_lookup() - include GuC registers in error state - get rid of dev->struct_mutex - iopoll: generalize read_poll_timout - lots more display refactoring - Reject HBR3 in any eDP Panel - Prune modes for YUV420 - Display Wa fix, additions, and updates - DP: Fix 2.7 Gbps link training on g4x - DP: Adjust the idle pattern handling - DP: Shuffle the link training code a bit - Don't set/read the DSI C clock divider on GLK - Enable_psr kernel parameter changes - Type-C enabled/disconnected dp-alt sink - Wildcat Lake enabling - DP HDR updates - DRAM detection - wait PSR idle on dsb commit - Remove FBC modulo 4 restriction for ADL-P+ - panic: refactor framebuffer allocation habanalabs: - debug/visibility improvements - vmalloc-backed coherent mmap support - HLDIO infrastructure nova-core: - various register!() macro improvements - minor vbios/firmware fixes/refactoring - advance firmware boot stages; process Booter and patch signatures - process GSP and GSP bootloader - Add r570.144 firmware bindings and update to it - Move GSP boot code to own module - Use new pin-init features to store driver's private data in a single allocation - Update ARef import from sync::aref nova-drm: - Update ARef import from sync::aref tyr: - initial driver skeleton for a rust driver for ARM Mali GPUs - capable of powering up, query metadata and provide it to userspace. msm: - GPU and Core: - in DT bindings describe clocks per GPU type - GMU bandwidth voting for x1-85 - a623/a663 speedbins - cleanup some remaining no-iommu leftovers after VM_BIND conversion - fix GEM obj 32b size truncation - add missing VM_BIND param validation - IFPC for x1-85 and a750 - register xml and gen_header.py sync from mesa - Display: - add missing bindings for display on SC8180X - added DisplayPort MST bindings - conversion from round_rate() to determine_rate() amdxdna: - add IOCTL_AMDXDNA_GET_ARRAY - support user space allocated buffers - streamline PM interfaces - Refactoring wrt. hardware contexts - improve error reporting nouveau: - use GSP firmware by default - improve error reporting - Pre-populate exported buffers ast: - Clean up detection of DRAM config exynos: - add DSIM bridge driver support for Exynos7870 - Document Exynos7870 DSIM compatible in dt-binding panthor: - Print task/pid on errors - Add support for Mali G710, G510, G310, Gx15, Gx20, Gx25 - Improve cache flushing - Fail VM bind if BO has offset renesas: - convert to RUNTIME_PM_OPS rcar-du: - Make number of lanes configurable - Use RUNTIME_PM_OPS - Add support for DSI commands rocket: - Add driver for Rockchip NPU plus DT bindings - Use kfree() and sizeof() correctly - Test DMA status rockchip: - dsi2: Add support for RK3576 plus DT bindings - Add support for RK3588 DPTX output tidss: - Use crtc_ fields for programming display mode - Remove other drivers from aperture pixpaper: - Add support for Mayqueen Pixpaper plus DT bindings v3d: - Support querying nubmer of GPU resets for KHR_robustness stm: - Clean up logging - ltdc: Add support support for STM32MP257F-EV1 plus DT bindings sitronix: - st7571-i2c: Add support for inverted displays and 2-bit grayscale tidss: - Convert to kernel's FIELD_ macros vesadrm: - Support 8-bit palette mode imagination: - Improve power management - Add support for TH1520 GPU - Support Risc-V architectures v3d: - Improve job management and locking vkms: - Support variants of ARGB8888, ARGB16161616, RGB565, RGB888 and P01x - Spport YUV with 16-bit components" * tag 'drm-next-2025-10-01' of https://gitlab.freedesktop.org/drm/kernel: (1455 commits) drm/amd: Add name to modes from amdgpu_connector_add_common_modes() drm/amd: Drop some common modes from amdgpu_connector_add_common_modes() drm/amdgpu: update MODULE_PARM_DESC for freesync_video drm/amd: Use dynamic array size declaration for amdgpu_connector_add_common_modes() drm/amd/display: Share dce100_validate_global with DCE6-8 drm/amd/display: Share dce100_validate_bandwidth with DCE6-8 drm/amdgpu: Fix fence signaling race condition in userqueue amd/amdkfd: enhance kfd process check in switch partition amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw drm/amd/display: Reject modes with too high pixel clock on DCE6-10 drm/amd: Drop unnecessary check in amdgpu_connector_add_common_modes() drm/amd/display: Only enable common modes for eDP and LVDS drm/amdgpu: remove the redeclaration of variable i drm/amdgpu/userq: assign an error code for invalid userq va drm/amdgpu: revert "rework reserved VMID handling" v2 drm/amdgpu: remove leftover from enforcing isolation by VMID drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails accel/habanalabs: add Infineon version check accel/habanalabs/gaudi2: read preboot status after recovering from dirty state accel/habanalabs: add HL_GET_P_STATE passthrough type ... commit 2836ed1748ccc567fddd51d4544a35f1e0f43136 Author: Ian Rogers Date: Mon Sep 29 12:07:55 2025 -0700 perf capstone: Remove open_capstone_handle open_capstone_handle is similar to capstone_init and used only by symbol__disassemble_capstone. symbol__disassemble_capstone_powerpc already uses capstone_init, transition symbol__disassemble_capstone and eliminate open_capstone_handle. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 95931d9a594dd0b5f2191a6a6340549b8f3b031b Author: Ian Rogers Date: Mon Sep 29 12:07:54 2025 -0700 perf libbfd: Move libbfd functionality to its own file Move symbolization and srcline libbfd dependencies to a separate libbfd.c. This mirrors moving llvm and capstone code. While this code is deprecated as it is part of BUILD_NONDISTRO license incompatible code, moving the code to its own file minimizes disruption in the main files. disasm_bpf.c is moved to libbfd.c also except for symbol__disassemble_bpf_image which is currently more of a placeholder function rather than something that provides disassembly support. demangle-cxx.cpp code isn't migrated as it is very limited. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit d9007afca0cf6c549c5049d5a75bce470453b024 Author: Ian Rogers Date: Mon Sep 29 12:07:53 2025 -0700 perf llvm: Move llvm functionality into its own file LLVM disassembly support was in disasm.c and addr2line support in srcline.c. Move support out of these files into llvm.[ch] and remove LLVM includes from those files. As disassembly routines can fail, make failure the only option without HAVE_LIBLLVM_SUPPORT. For simplicity's sake, duplicate the read_symbol utility function. The intent with moving LLVM support into a single file is that dynamic support, using dlopen for libllvm, can be added in later patches. This can potentially always succeed or fail, so relying on ifdefs isn't sufficient. Using dlopen is a useful option to minimize the perf tools dependencies and potentially size. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit 05a54fa773284d1a7923cdfdd8f0c8dabb98bd26 Merge: e1b1d03ceec343 f65dc3b1ab145c Author: Linus Torvalds Date: Thu Oct 2 11:37:19 2025 -0700 Merge tag 'sound-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It's been relatively calm in this cycle from the feature POV, but there were lots of cleanup works in the wide-range of code for converting with the auto-cleanup macros like guard(). The mostly user-visible changes are the support of a couple of new compress-offload API extensions, and the support of new ASoC codec / platform drivers as well as USB-audio quirks. Here we go with some highlights: Core: - Compress-offload API extension for 64bit timestamp support - Compress-offload API extension for OPUS codec support - Workaround for PCM locking issue with PREEMPT_RT and softirq - KCSAN warning fix for ALSA sequencer core ASoC: - Continued cleanup works for ASoC core APIs - Lots of cleanups and conversions of DT bindings - Substantial maintainance work on the Intel AVS drivers - Support for Qualcomm Glymur and PM4125, Realtek RT1321, Shanghai FourSemi FS2104/5S, Texas Instruments PCM1754 and TAS2783A - Remove support for TI WL1273 for old Nokia systems USB-audio: - Support for Tascam US-144mkII, Presonus S1824c support - More flexible quirk option handling - Fix for USB MIDI timer bug triggered by fuzzer Others: - A large series of cleanups with guard() & co macros over (non-ASoC) sound drivers (PCI, ISA, HD-audio, USB-audio, drivers, etc) - TAS5825 HD-audio side-codec support" * tag 'sound-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (454 commits) ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio ALSA: usb-audio: add the initial mix for Presonus Studio 1824c ALSA: doc: improved docs about quirk_flags in snd-usb-audio ALSA: usb-audio: make param quirk_flags change-able in runtime ALSA: usb-audio: improve module param quirk_flags ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free ALSA: usb-audio: add mono main switch to Presonus S1824c ALSA: compress: document 'chan_map' member in snd_dec_opus ASoC: cs35l56: Add support for CS35L56 B2 silicon ASoC: cs35l56: Set fw_regs table after getting REVID ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 ASoc: tas2783A: Fix an error code in probe() ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 ASoC: stm32: sai: manage context in set_sysclk callback ASoC: renesas: msiof: ignore 1st FSERR ASoC: renesas: msiof: Add note for The possibility of R/L opposite Capture ASoC: renesas: msiof: setup both (Playback/Capture) in the same time ASoC: renesas: msiof: tidyup DMAC stop timing ... commit bbb99668b5b1c2411de2683e89f018be60a75dff Author: Ian Rogers Date: Mon Sep 29 12:07:52 2025 -0700 perf capstone: Move capstone functionality into its own file Capstone disassembly support was split between disasm.c and print_insn.c. Move support out of these files into capstone.[ch] and remove include capstone/capstone.h from those files. As disassembly routines can fail, make failure the only option without HAVE_LIBCAPSTONE_SUPPORT. For simplicity's sake, duplicate the read_symbol utility function. The intent with moving capstone support into a single file is that dynamic support, using dlopen for libcapstone, can be added in later patches. This can potentially always succeed or fail, so relying on ifdefs isn't sufficient. Using dlopen is a useful option to minimize the perf tools dependencies and potentially size. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit c0b8a55a1180274247f6081260cd854c2a309379 Author: Ian Rogers Date: Mon Sep 29 12:07:51 2025 -0700 perf map: Constify objdump offset/address conversion APIs Make the map argument const as the conversion act won't modify the map and this allows other callers to use a const struct map. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Athira Rajeev Cc: Bill Wendling Cc: Charlie Jenkins Cc: Collin Funk Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Eric Biggers Cc: Haibo Xu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Justin Stitt Cc: Li Huafei Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Song Liu Cc: Stephen Brennan Signed-off-by: Arnaldo Carvalho de Melo commit cbeb3d4784d489d7e494313fb2ec4f6a7ae4609d Author: Dapeng Mi Date: Fri Sep 19 10:16:59 2025 +0800 perf tools kvm: Use "cycles" to sample guest for "kvm top" on Intel As same reason with previous patch, use "cyles" instead of "cycles:P" event by default to sample guest for "perf kvm top" command on Intel platforms. Fixes: cf8e55fe50df0c02 ("KVM: x86/pmu: Expose CPUIDs feature bits PDCM, DS, DTES64") Reported-by: Kevin Tian Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Like Xu Cc: Paolo Bonzini Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit c1afca106e16fbbf9508b3770e6ab1c2f7993ea1 Author: Dapeng Mi Date: Fri Sep 19 10:16:58 2025 +0800 perf tools kvm: Use "cycles" to sample guest for "kvm record" on Intel After KVM supports PEBS for guest on Intel platforms (https://lore.kernel.org/all/20220411101946.20262-1-likexu@tencent.com/), host loses the capability to sample guest with PEBS since all PEBS related MSRs are switched to guest value after vm-entry, like IA32_DS_AREA MSR is switched to guest GVA at vm-entry. This would lead to "perf kvm record" fails to sample guest on Intel platforms since "cycles:P" event is used to sample guest by default as below case shows. sudo perf kvm record -a ^C[ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.787 MB perf.data.guest ] So to ensure guest record can be sampled successfully, use "cycles" instead of "cycles:P" to sample guest record by default on Intel platforms. With this patch, the guest record can be sampled successfully. sudo perf kvm record -a ^C[ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.783 MB perf.data.guest (23 samples) ] Fixes: cf8e55fe50df0c02 ("KVM: x86/pmu: Expose CPUIDs feature bits PDCM, DS, DTES64") Reported-by: Kevin Tian Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Like Xu Cc: Paolo Bonzini Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 0f53264d714ae7db2a827b3483418f0288fa953f Author: Dapeng Mi Date: Fri Sep 19 10:16:57 2025 +0800 perf tools: Add helper x86__is_intel_cpu() Add helper x86__is_intel_cpu() to indicate if it's a x86 intel platform. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 45ff39f6e70aa55d0054fbc3508eba9ac03d7e29 Author: Dapeng Mi Date: Fri Sep 19 10:16:56 2025 +0800 perf tools kvm: Fix the potential out of range memory access issue kvm_add_default_arch_event() helper may add 2 extra options but it directly modifies the original argv[] array. This may cause out of range memory access. Fix this issue. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 6f58cf10457f5868ef4cd98b4de6428787b3fb2c Author: Dapeng Mi Date: Fri Sep 19 10:16:55 2025 +0800 perf tools kwork: Add missed memory allocation check and free Same with previous builtin-kvm code, perf_kwork__record() doesn't check the memory allocation and explicitly free the allocated memory. Just fix it. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 9262fa242b73d32bd849cbcefb9b7311d2c04637 Author: Dapeng Mi Date: Fri Sep 19 10:16:54 2025 +0800 perf tools kvm: Add missed memory allocation check and free Current code allocates rec_argv[] array, but doesn't check if the allocation is successful and explicitly free the rec_argv[] array. Add them back. Signed-off-by: Dapeng Mi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit f0015d8149de3b54af04147527163422eb34ec00 Author: Ian Rogers Date: Fri Sep 5 15:47:08 2025 -0700 tools include: Add headers to make tools builds more hermetic tools/lib/bpf/netlink.c depends on rtnetlink.h and genetlink.h (via nlattr.h) which then depends on if_addr.h. tools/bpf/bpftool/link.c depends on netfilter_arp.h which then depends on netfilter.h. Update check-headers.sh to keep these in sync. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit 57a64919f21ef4bd620da7d2ed8c683d55413b16 Author: Ian Rogers Date: Fri Sep 5 15:47:07 2025 -0700 tools include: Replace tools linux/gfp_types.h with kernel version Previously the header gfp_types.h in tools points to the gfp_types.h in include/linux. This is a problem for tools like perf, since the tools header is supposed to be independent of the kernel headers. Therefore this patch copies the kernel header to the tools header and adds a header check. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit f38ce0209ab4553906b44bd1159e35c740a84161 Author: Ian Rogers Date: Fri Sep 5 15:47:06 2025 -0700 tools bitmap: Add missing asm-generic/bitsperlong.h include small_const_nbits is defined in asm-generic/bitsperlong.h which bitmap.h uses but doesn't include causing build failures in some build systems. Add the missing #include. Note the bitmap.h in tools has diverged from that of the kernel, so no changes are made there. Signed-off-by: Ian Rogers Acked-by: Yury Norov Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yuyang Huang Signed-off-by: Arnaldo Carvalho de Melo commit 83fde0ee8f1608fc0925452a82a35aa3b4b37c4b Author: Ian Rogers Date: Fri Sep 5 15:47:05 2025 -0700 perf bench futex: Add missing stdbool.h futex.h uses bool but lacks stdbool.h which causes build failures in some build systems. Add the missing #include. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: André Almeida Cc: Daniel Borkmann Cc: Darren Hart Cc: David S. Miller Cc: Davidlohr Bueso Cc: Ido Schimmel Cc: Ingo Molnar Cc: Jakub Kicinski Cc: Jamal Hadi Salim Cc: Jason Xing Cc: Jiri Olsa Cc: Jonas Gottlieb Cc: Kan Liang Cc: Mark Rutland Cc: Maurice Lambert Cc: Namhyung Kim Cc: Paolo Abeni Cc: Peter Zijlstra Cc: Petr Machata Cc: Rasmus Villemoes Cc: Thomas Gleixner Cc: Yury Norov Cc: Yuyang Huang Link: https://lore.kernel.org/r/20250905224708.2469021-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit a272195f1c69c928e206e907e139cc0e30e6dd45 Author: Ian Rogers Date: Sun Sep 14 11:21:40 2025 -0700 perf test: Stat std output don't fail metric only When running on a hypervisor the expected IPC metric may be missing as the events may fail to be read. Don't expect metric output for this test to avoid it failing. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Veronika Molnarova Signed-off-by: Arnaldo Carvalho de Melo commit 8dc364fa484df22d301a16148d1b356931d0cbb0 Author: Ian Rogers Date: Sun Sep 14 11:24:37 2025 -0700 libperf mmap: In user mmap rdpmc avoid undefined behavior A shift left of a signed 64-bit s64 may overflow and result in undefined behavior caught by ubsan. Switch to a u64 instead. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit de1111f91a7a681303265938c2ad32f5ec3f21b7 Author: Ian Rogers Date: Sun Sep 14 11:31:31 2025 -0700 perf symbol-minimal: Be more defensive when reading build IDs The note_data at ptr is read as a nhdr but this may yield out-of-bounds reads if there isn't nhdrs worth of data. Be more defensive before doing the reads. This is motivated by address sanitizer capturing out of bounds reads running "perf top". Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 4fc844347ec1c755c460be2c7aa684cc3580fea3 Author: Sam James Date: Wed Aug 6 01:03:01 2025 +0100 perf bpf: Use __builtin_preserve_field_info for GCC compatibility When exploring building bpf_skel with GCC's BPF support, there was a build failure because of bpf_core_field_exists vs the mem_hops bitfield: ``` In file included from util/bpf_skel/sample_filter.bpf.c:6: util/bpf_skel/sample_filter.bpf.c: In function 'perf_get_sample': tools/perf/libbpf/include/bpf/bpf_core_read.h:169:42: error: cannot take address of bit-field 'mem_hops' 169 | #define ___bpf_field_ref1(field) (&(field)) | ^ tools/perf/libbpf/include/bpf/bpf_helpers.h:222:29: note: in expansion of macro '___bpf_field_ref1' 222 | #define ___bpf_concat(a, b) a ## b | ^ tools/perf/libbpf/include/bpf/bpf_helpers.h:225:29: note: in expansion of macro '___bpf_concat' 225 | #define ___bpf_apply(fn, n) ___bpf_concat(fn, n) | ^~~~~~~~~~~~~ tools/perf/libbpf/include/bpf/bpf_core_read.h:173:9: note: in expansion of macro '___bpf_apply' 173 | ___bpf_apply(___bpf_field_ref, ___bpf_narg(args))(args) | ^~~~~~~~~~~~ tools/perf/libbpf/include/bpf/bpf_core_read.h:188:39: note: in expansion of macro '___bpf_field_ref' 188 | __builtin_preserve_field_info(___bpf_field_ref(field), BPF_FIELD_EXISTS) | ^~~~~~~~~~~~~~~~ util/bpf_skel/sample_filter.bpf.c:167:29: note: in expansion of macro 'bpf_core_field_exists' 167 | if (bpf_core_field_exists(data->mem_hops)) | ^~~~~~~~~~~~~~~~~~~~~ cc1: error: argument is not a field access ``` ___bpf_field_ref1 was adapted for GCC in 12bbcf8e840f40b82b02981e96e0a5fbb0703ea9 but the trick added for compatibility in 3a8b8fc3174891c4c12f5766d82184a82d4b2e3e isn't compatible with that as an address is used as an argument. Workaround this by calling __builtin_preserve_field_info directly as the bpf_core_field_exists macro does, but without the ___bpf_field_ref use. Co-developed-by: Andrew Pinski Signed-off-by: Andrew Pinski Signed-off-by: Sam James Acked-by: Yonghong Song Tested-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Peter Zijlstra Link: https://gcc.gnu.org/PR121420 Signed-off-by: Arnaldo Carvalho de Melo commit e1b1d03ceec343362524318c076b110066ffe305 Merge: 5832d26433f2bd 130e6de6210711 Author: Linus Torvalds Date: Thu Oct 2 10:16:56 2025 -0700 Merge tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: - NVMe pull request via Keith: - FC target fixes (Daniel) - Authentication fixes and updates (Martin, Chris) - Admin controller handling (Kamaljit) - Target lockdep assertions (Max) - Keep-alive updates for discovery (Alastair) - Suspend quirk (Georg) - MD pull request via Yu: - Add support for a lockless bitmap. A key feature for the new bitmap are that the IO fastpath is lockless. If a user issues lots of write IO to the same bitmap bit in a short time, only the first write has additional overhead to update bitmap bit, no additional overhead for the following writes. By supporting only resync or recover written data, means in the case creating new array or replacing with a new disk, there is no need to do a full disk resync/recovery. - Switch ->getgeo() and ->bios_param() to using struct gendisk rather than struct block_device. - Rust block changes via Andreas. This series adds configuration via configfs and remote completion to the rnull driver. The series also includes a set of changes to the rust block device driver API: a few cleanup patches, and a few features supporting the rnull changes. The series removes the raw buffer formatting logic from `kernel::block` and improves the logic available in `kernel::string` to support the same use as the removed logic. - floppy arch cleanups - Reduce the number of dereferencing needed for ublk commands - Restrict supported sockets for nbd. Mostly done to eliminate a class of issues perpetually reported by syzbot, by using nonsensical socket setups. - A few s390 dasd block fixes - Fix a few issues around atomic writes - Improve DMA interation for integrity requests - Improve how iovecs are treated with regards to O_DIRECT aligment constraints. We used to require each segment to adhere to the constraints, now only the request as a whole needs to. - Clean up and improve p2p support, enabling use of p2p for metadata payloads - Improve locking of request lookup, using SRCU where appropriate - Use page references properly for brd, avoiding very long RCU sections - Fix ordering of recursively submitted IOs - Clean up and improve updating nr_requests for a live device - Various fixes and cleanups * tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (164 commits) s390/dasd: enforce dma_alignment to ensure proper buffer validation s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request ublk: remove redundant zone op check in ublk_setup_iod() nvme: Use non zero KATO for persistent discovery connections nvmet: add safety check for subsys lock nvme-core: use nvme_is_io_ctrl() for I/O controller check nvme-core: do ioccsz/iorcsz validation only for I/O controllers nvme-core: add method to check for an I/O controller blk-cgroup: fix possible deadlock while configuring policy blk-mq: fix null-ptr-deref in blk_mq_free_tags() from error path blk-mq: Fix more tag iteration function documentation selftests: ublk: fix behavior when fio is not installed ublk: don't access ublk_queue in ublk_unmap_io() ublk: pass ublk_io to __ublk_complete_rq() ublk: don't access ublk_queue in ublk_need_complete_req() ublk: don't access ublk_queue in ublk_check_commit_and_fetch() ublk: don't pass ublk_queue to ublk_fetch() ublk: don't access ublk_queue in ublk_config_io_buf() ublk: don't access ublk_queue in ublk_check_fetch_buf() ublk: pass q_id and tag to __ublk_check_and_get_req() ... commit aefada95fbab74035aca62e3ab80f93fe91d2d58 Merge: bace10b59624e6 45ad27d9a6f7c6 Author: Mark Brown Date: Thu Oct 2 18:07:06 2025 +0100 ASoC: SOF: ipc4/Intel: Fix the host buffer Merge series from Peter Ujfalusi : The size of the DSP host buffer was incorrectly defined as 2ms while it is 4ms and the ChainDMA PCMs are using 5ms as host facing buffer. The constraint will be set against the period time rather than the buffer time to make sure that application will not face with xruns when the DMA bursts to refill the host buffer. The minimal period size will be also used by Pipewire in case of SOF cards to set the headroom to a length which will avoid the cases when the hw_ptr jumps over the appl_ptr because of a burst. Iow, it will make Pipewire to keep a safe distance from the hw_ptr. https://github.com/thesofproject/linux/issues/5284 https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/740 https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2548 commit 5832d26433f2bd0d28f8b12526e3c2fdb203507f Merge: 77633c77eee37d ef9f603fd3d4b7 Author: Linus Torvalds Date: Thu Oct 2 09:56:23 2025 -0700 Merge tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Store ring provided buffers locally for the users, rather than stuff them into struct io_kiocb. These types of buffers must always be fully consumed or recycled in the current context, and leaving them in struct io_kiocb is hence not a good ideas as that struct has a vastly different life time. Basically just an architecture cleanup that can help prevent issues with ring provided buffers in the future. - Support for mixed CQE sizes in the same ring. Before this change, a CQ ring either used the default 16b CQEs, or it was setup with 32b CQE using IORING_SETUP_CQE32. For use cases where a few 32b CQEs were needed, this caused everything else to use big CQEs. This is wasteful both in terms of memory usage, but also memory bandwidth for the posted CQEs. With IORING_SETUP_CQE_MIXED, applications may use request types that post both normal 16b and big 32b CQEs on the same ring. - Add helpers for async data management, to make it harder for opcode handlers to mess it up. - Add support for multishot for uring_cmd, which ublk can use. This helps improve efficiency, by providing a persistent request type that can trigger multiple CQEs. - Add initial support for ring feature querying. We had basic support for probe operations, but the API isn't great. Rather than expand that, add support for QUERY which is easily expandable and can cover a lot more cases than the existing probe support. This will help applications get a better idea of what operations are supported on a given host. - zcrx improvements from Pavel: - Improve refill entry alignment for better caching - Various cleanups, especially around deduplicating normal memory vs dmabuf setup. - Generalisation of the niov size (Patch 12). It's still hard coded to PAGE_SIZE on init, but will let the user to specify the rx buffer length on setup. - Syscall / synchronous bufer return. It'll be used as a slow fallback path for returning buffers when the refill queue is full. Useful for tolerating slight queue size misconfiguration or with inconsistent load. - Accounting more memory to cgroups. - Additional independent cleanups that will also be useful for mutli-area support. - Various fixes and cleanups * tag 'for-6.18/io_uring-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (68 commits) io_uring/cmd: drop unused res2 param from io_uring_cmd_done() io_uring: fix nvme's 32b cqes on mixed cq io_uring/query: cap number of queries io_uring/query: prevent infinite loops io_uring/zcrx: account niov arrays to cgroup io_uring/zcrx: allow synchronous buffer return io_uring/zcrx: introduce io_parse_rqe() io_uring/zcrx: don't adjust free cache space io_uring/zcrx: use guards for the refill lock io_uring/zcrx: reduce netmem scope in refill io_uring/zcrx: protect netdev with pp_lock io_uring/zcrx: rename dma lock io_uring/zcrx: make niov size variable io_uring/zcrx: set sgt for umem area io_uring/zcrx: remove dmabuf_offset io_uring/zcrx: deduplicate area mapping io_uring/zcrx: pass ifq to io_zcrx_alloc_fallback() io_uring/zcrx: check all niovs filled with dma addresses io_uring/zcrx: move area reg checks into io_import_area io_uring/zcrx: don't pass slot to io_zcrx_create_area ... commit a39516805992d22d35fd044ab555303ad453456d Author: Arnaldo Carvalho de Melo Date: Thu Oct 2 09:52:11 2025 -0300 tools build: Don't assume libtracefs-devel is always available perf doesn't use libtracefs and so it doesn't make sense to assume it is always available when building test-all.bin, defeating the feature check speedup it provides. The other tools/build/ users such as rtla, rv, etc call $(feature_check libtracefs) to check its availability instead of using the test-all.bin mechanism, stopping the build and asking for libtracefs-devel to be installed. Remove it from FEATURE_TESTS_BASIC to not have it as available, as noted by Ian Rogers during review. Reviewed-by: Ian Rogers Acked-by: Tomas Glozar Cc: Adrian Hunter Cc: Gabriele Monaco Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Namhyung Kim Cc: Steven Rostedt Signed-off-by: Arnaldo Carvalho de Melo commit 77633c77eee37ddc160493a4cf6070c166f47dc0 Merge: d7a018eb761f44 2cdae413cd3ee6 Author: Linus Torvalds Date: Thu Oct 2 08:57:03 2025 -0700 Merge tag 'bitmap-for-6.18' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - FIELD_PREP_WM16() consolidation (Nicolas) - bitmaps for Rust (Burak) - __fls() fix for arc (Kees) * tag 'bitmap-for-6.18' of https://github.com/norov/linux: (25 commits) rust: add dynamic ID pool abstraction for bitmap rust: add find_bit_benchmark_rust module. rust: add bitmap API. rust: add bindings for bitops.h rust: add bindings for bitmap.h phy: rockchip-pcie: switch to FIELD_PREP_WM16 macro clk: sp7021: switch to FIELD_PREP_WM16 macro PCI: dw-rockchip: Switch to FIELD_PREP_WM16 macro PCI: rockchip: Switch to FIELD_PREP_WM16* macros net: stmmac: dwmac-rk: switch to FIELD_PREP_WM16 macro ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro drm/rockchip: dw_hdmi: switch to FIELD_PREP_WM16* macros phy: rockchip-usb: switch to FIELD_PREP_WM16 macro drm/rockchip: inno-hdmi: switch to FIELD_PREP_WM16 macro drm/rockchip: dw_hdmi_qp: switch to FIELD_PREP_WM16 macro phy: rockchip-samsung-dcphy: switch to FIELD_PREP_WM16 macro drm/rockchip: vop2: switch to FIELD_PREP_WM16 macro drm/rockchip: dsi: switch to FIELD_PREP_WM16* macros phy: rockchip-emmc: switch to FIELD_PREP_WM16 macro drm/rockchip: lvds: switch to FIELD_PREP_WM16 macro ... commit d7a018eb761f44f1f48667540185d025354f33b6 Merge: 7f7072574127c9 800348aa34b2bc Author: Linus Torvalds Date: Thu Oct 2 08:31:44 2025 -0700 Merge tag 'kcsan-20250929-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver: - Replace deprecated strcpy() with strscpy() * tag 'kcsan-20250929-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux: kcsan: test: Replace deprecated strcpy() with strscpy() commit 8b51b11b3d81c1ed48a52f87da9256d737b723a0 Author: Hengqi Chen Date: Thu Oct 2 22:39:53 2025 +0800 LoongArch: BPF: Sign-extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel panic: Oops[#1]: CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58, era == 90000000851b5ac0, ra == 90000000851b5aa4 CPU: 0 UID: 0 PID: 449 Comm: test_progs Tainted: G OE 6.16.0+ #3 PREEMPT(full) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 pc 90000000851b5ac0 ra 90000000851b5aa4 tp 90000001076b8000 sp 90000001076bb600 a0 0000000000741ce8 a1 0000000000000001 a2 90000001076bb5c0 a3 0000000000000008 a4 90000001004c4620 a5 9000000100741ce8 a6 0000000000000000 a7 0100000000000000 t0 0000000000000010 t1 0000000000000000 t2 9000000104d24d30 t3 0000000000000001 t4 4f2317da8a7e08c4 t5 fffffefffc002f00 t6 90000001004c4620 t7 ffffffffc61c5b3d t8 0000000000000000 u0 0000000000000001 s9 0000000000000050 s0 90000001075bc800 s1 0000000000000040 s2 900000010597c400 s3 0000000000000008 s4 90000001075bc880 s5 90000001075bc8f0 s6 0000000000000000 s7 0000000000741ce8 s8 0000000000000000 ra: 90000000851b5aa4 __qdisc_run+0xac/0x8d8 ERA: 90000000851b5ac0 __qdisc_run+0xc8/0x8d8 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) BADV: 0000000000741d58 PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)] Process test_progs (pid: 449, threadinfo=000000009af02b3a, task=00000000e9ba4956) Stack : 0000000000000000 90000001075bc8ac 90000000869524a8 9000000100741ce8 90000001075bc800 9000000100415300 90000001075bc8ac 0000000000000000 900000010597c400 900000008694a000 0000000000000000 9000000105b59000 90000001075bc800 9000000100741ce8 0000000000000050 900000008513000c 9000000086936000 0000000100094d4c fffffff400676208 0000000000000000 9000000105b59000 900000008694a000 9000000086bf0dc0 9000000105b59000 9000000086bf0d68 9000000085147010 90000001075be788 0000000000000000 9000000086bf0f98 0000000000000001 0000000000000010 9000000006015840 0000000000000000 9000000086be6c40 0000000000000000 0000000000000000 0000000000000000 4f2317da8a7e08c4 0000000000000101 4f2317da8a7e08c4 ... Call Trace: [<90000000851b5ac0>] __qdisc_run+0xc8/0x8d8 [<9000000085130008>] __dev_queue_xmit+0x578/0x10f0 [<90000000853701c0>] ip6_finish_output2+0x2f0/0x950 [<9000000085374bc8>] ip6_finish_output+0x2b8/0x448 [<9000000085370b24>] ip6_xmit+0x304/0x858 [<90000000853c4438>] inet6_csk_xmit+0x100/0x170 [<90000000852b32f0>] __tcp_transmit_skb+0x490/0xdd0 [<90000000852b47fc>] tcp_connect+0xbcc/0x1168 [<90000000853b9088>] tcp_v6_connect+0x580/0x8a0 [<90000000852e7738>] __inet_stream_connect+0x170/0x480 [<90000000852e7a98>] inet_stream_connect+0x50/0x88 [<90000000850f2814>] __sys_connect+0xe4/0x110 [<90000000850f2858>] sys_connect+0x18/0x28 [<9000000085520c94>] do_syscall+0x94/0x1a0 [<9000000083df1fb8>] handle_syscall+0xb8/0x158 Code: 4001ad80 2400873f 2400832d <240073cc> 001137ff 001133ff 6407b41f 001503cc 0280041d ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires LoongArch ABI. So let's sign extend struct ops return values according to the LoongArch ABI ([1]) and return value spec in function model. [1]: https://loongson.github.io/LoongArch-Documentation/LoongArch-ELF-ABI-EN.html Cc: stable@vger.kernel.org Fixes: 6abf17d690d8 ("LoongArch: BPF: Add struct ops support for trampoline") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit de2c0b7788648850b68b75f7cc8698b2749dd31e Author: Hengqi Chen Date: Thu Oct 2 22:39:53 2025 +0800 LoongArch: BPF: Make error handling robust in arch_prepare_bpf_trampoline() Bail out instead of trying to perform a bpf_arch_text_copy() if __arch_prepare_bpf_trampoline() failed. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit ea645cfd3d5f74a2bd40a60003f113b3c467975d Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Make trampoline size stable When attach fentry/fexit BPF programs, __arch_prepare_bpf_trampoline() is called twice with different `struct bpf_tramp_image *im`: bpf_trampoline_update() -> arch_bpf_trampoline_size() -> __arch_prepare_bpf_trampoline() -> arch_prepare_bpf_trampoline() -> __arch_prepare_bpf_trampoline() Use move_imm() will emit unstable instruction sequences, so let's use move_addr() instead to prevent subtle bugs. (I observed this while debugging other issues with printk.) Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit a04731cbee6e981afa4263289a0c0059c8b2e7b9 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Don't align trampoline size Currently, arch_alloc_bpf_trampoline() use bpf_prog_pack_alloc() which will pack multiple trampolines into a huge page. So, no need to assume the trampoline size is page aligned. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit e82406c7cbdd368c5459b8a45e118811d2ba0794 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: No support of struct argument in trampoline programs The current implementation does not support struct argument. This causes a oops when running bpf selftest: $ ./test_progs -a tracing_struct Oops[#1]: CPU -1 Unable to handle kernel paging request at virtual address 0000000000000018, era == 9000000085bef268, ra == 90000000844f3938 rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: 1-...0: (19 ticks this GP) idle=1094/1/0x4000000000000000 softirq=1380/1382 fqs=801 rcu: (detected by 0, t=5252 jiffies, g=1197, q=52 ncpus=4) Sending NMI from CPU 0 to CPUs 1: rcu: rcu_preempt kthread starved for 2495 jiffies! g1197 f0x0 RCU_GP_DOING_FQS(6) ->state=0x0 ->cpu=2 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:0 pid:15 tgid:15 ppid:2 task_flags:0x208040 flags:0x00000800 Stack : 9000000100423e80 0000000000000402 0000000000000010 90000001003b0680 9000000085d88000 0000000000000000 0000000000000040 9000000087159350 9000000085c2b9b0 0000000000000001 900000008704a000 0000000000000005 00000000ffff355b 00000000ffff355b 0000000000000000 0000000000000004 9000000085d90510 0000000000000000 0000000000000002 7b5d998f8281e86e 00000000ffff355c 7b5d998f8281e86e 000000000000003f 9000000087159350 900000008715bf98 0000000000000005 9000000087036000 900000008704a000 9000000100407c98 90000001003aff80 900000008715c4c0 9000000085c2b9b0 00000000ffff355b 9000000085c33d3c 00000000000000b4 0000000000000000 9000000007002150 00000000ffff355b 9000000084615480 0000000007000002 ... Call Trace: [<9000000085c2a868>] __schedule+0x410/0x1520 [<9000000085c2b9ac>] schedule+0x34/0x190 [<9000000085c33d38>] schedule_timeout+0x98/0x140 [<90000000845e9120>] rcu_gp_fqs_loop+0x5f8/0x868 [<90000000845ed538>] rcu_gp_kthread+0x260/0x2e0 [<900000008454e8a4>] kthread+0x144/0x238 [<9000000085c26b60>] ret_from_kernel_thread+0x28/0xc8 [<90000000844f20e4>] ret_from_kernel_thread_asm+0xc/0x88 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 2: NMI backtrace for cpu 2 skipped: idling at idle_exit+0x0/0x4 Reject it for now. Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 3d770bd11b943066db11dba7be0b6f0d81cb5d50 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: No text_poke() for kernel text The current implementation of bpf_arch_text_poke() requires 5 nops at patch site which is not applicable for kernel/module functions. Because LoongArch reserves ONLY 2 nops at the function entry. With CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y, this can be done by ftrace instead. See the following commit for details: * commit b91e014f078e ("bpf: Make BPF trampoline use register_ftrace_direct() API") * commit 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support") Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit b0f50dc09bf008b2e581d5e6ad570d325725881c Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Remove duplicated bpf_flush_icache() The bpf_flush_icache() is called by bpf_arch_text_copy() already. So remove it. This has been done in arm64 and riscv. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 909d3e3f51b1bc00f33a484ce0d41b42fed01965 Author: Hengqi Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Remove duplicated flags check The check for (BPF_TRAMP_F_ORIG_STACK | BPF_TRAMP_F_SHARE_IPMODIFY) is duplicated in __arch_prepare_bpf_trampoline(). Remove it. While at it, make sure stack_size and nargs are initialized once. Cc: stable@vger.kernel.org Tested-by: Vincent Li Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 7b6c2d172d023d344527d3cb4516d0d6b29f4919 Author: Huacai Chen Date: Thu Oct 2 22:39:52 2025 +0800 LoongArch: BPF: Fix uninitialized symbol 'retval_off' In __arch_prepare_bpf_trampoline(), retval_off is meaningful only when save_ret is not 0, so the current logic is correct. But it may cause a build warning: arch/loongarch/net/bpf_jit.c:1547 __arch_prepare_bpf_trampoline() error: uninitialized symbol 'retval_off'. So initialize retval_off unconditionally to fix it. Cc: stable@vger.kernel.org Fixes: f9b6b41f0cf3 ("LoongArch: BPF: Add basic bpf trampoline support") Closes: https://lore.kernel.org/r/202508191020.PBBh07cK-lkp@intel.com/ Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Huacai Chen commit 24ff0347bbfda1cee9b4aca29c8eeb1a2b7bd61e Author: Tiezhu Yang Date: Thu Oct 2 22:39:35 2025 +0800 LoongArch: BPF: Optimize sign-extention mov instructions For 8-bit and 16-bit sign-extention mov instructions, it can use the native instructions ext.w.b and ext.w.h directly, no need to use the temporary t1 register, just remove the redundant operations. Here are the test results: # modprobe test_bpf test_range=81,84 # dmesg -t | tail -5 test_bpf: #81 ALU_MOVSX | BPF_B jited:1 5 PASS test_bpf: #82 ALU_MOVSX | BPF_H jited:1 5 PASS test_bpf: #83 ALU64_MOVSX | BPF_B jited:1 5 PASS test_bpf: #84 ALU64_MOVSX | BPF_H jited:1 5 PASS test_bpf: Summary: 4 PASSED, 0 FAILED, [4/4 JIT'ed] Acked-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit db740f5689e61f2e75b73e5c8e7c985a3b4bc045 Author: Tiezhu Yang Date: Thu Oct 2 22:39:35 2025 +0800 LoongArch: Handle new atomic instructions for probes The atomic instructions sc.q, llacq.{w/d}, screl.{w/d} were newly added in the LoongArch Reference Manual v1.10, it is necessary to handle them in insns_not_supported() to avoid putting a breakpoint in the middle of a ll/sc atomic sequence, otherwise it will loop forever for kprobes and uprobes. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 892979b0a97c5f3a5decfd6a33e7f902414bfc41 Author: Wentao Guan Date: Thu Oct 2 22:39:19 2025 +0800 LoongArch: Try VMA lock-based page fault handling first Attempt VMA lock-based page fault handling first, and fall back to the existing mmap_lock-based handling if that fails. The "ebizzy -mTRp" test on Loongson-3A6000 shows that PER_VMA_LOCK can improve the benchmark by about 17.9% (97837.7 to 115430.8). This is the LoongArch variant of "x86/mm: try VMA lock-based page fault handling first". Signed-off-by: Wentao Guan Signed-off-by: Huacai Chen commit c8168b4faf1d62cbb320a3e518ad31cdd567cb05 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Automatically disable kaslr if boot from kexec_file Automatically disable kaslr when the kernel loads from kexec_file. kexec_file loads the secondary kernel image to a non-linked address, inherently providing KASLR-like randomization. However, on LoongArch where System RAM may be non-contiguous, enabling KASLR for the second kernel may relocate it to an invalid memory region and cause a boot failure. Thus, we disable KASLR when "kexec_file" is detected in the command line. To ensure compatibility with older kernels loaded via kexec_file, this patch should be backported to stable branches. Cc: stable@vger.kernel.org Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 1bcca8620a915d2f98ad7641f82d799c17f04b93 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Add crash dump support for kexec_file Enabling crash dump (kdump) includes: - Prepare contents of ELF header of a core dump file, /proc/vmcore, using crash_prepare_elf64_headers(). - Add "mem=size@start" parameter to the command line and pass it to the capture kernel. Limit the runtime memory area of the captured kernel to avoid disrupting the production kernel's runtime state. - Add "elfcorehdr=size@start" parameter to the cmdline. The basic usage for kdump (add the cmdline parameter crashkernel=512M to grub.cfg for production kernel): 1) Load capture kernel image (vmlinux.efi or vmlinux can both be used): # kexec -s -p vmlinuz.efi --initrd=initrd.img --reuse-cmdline 2) Do something to crash, like: # echo c > /proc/sysrq-trigger Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit fc9c112f804abcd984a20a66a909332a147a23e8 Author: Youling Tang Date: Thu Oct 2 22:39:08 2025 +0800 LoongArch: Add ELF binary support for kexec_file This patch creates kexec_elf_ops to load ELF binary file for kexec_file_load() syscall. However, for `kbuf->memsz` and `kbuf->buf_min`, special handling is required, and the generic `kexec_elf_load()` cannot be used directly. $ readelf -l vmlinux ... Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000010000 0x9000000000200000 0x9000000000200000 0x0000000002747a00 0x000000000287a0d8 RWE 0x10000 NOTE 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 R 0x8 phdr->p_paddr should have been a physical address, but it is a virtual address on the current LoongArch. This will cause kexec_file to fail when loading the kernel and need to be converted to a physical address. From the above MemSiz, it can be seen that 0x287a0d8 isn't page aligned. Although kexec_add_buffer() will perform PAGE_SIZE alignment on kbuf-> memsz, there is still a stampeding in the loaded kernel space and initrd space. The initrd resolution failed when starting the second kernel. It can be known from the link script vmlinux.lds.S that, BSS_SECTION(0, SZ_64K, 8) . = ALIGN(PECOFF_SEGMENT_ALIGN); It needs to be aligned according to SZ_64K, so that after alignment, its size is consistent with _kernel_asize. The basic usage (vmlinux): 1) Load second kernel image: # kexec -s -l vmlinux --initrd=initrd.img --reuse-cmdline 2) Startup second kernel: # kexec -e Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 55d990f0084c2b8ab9321dc59fc11dce855b4d61 Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add EFI binary support for kexec_file This patch creates kexec_efi_ops to load EFI binary file for kexec_file_load() syscall. The efi_kexec_load() as two parts: - the first part loads the kernel image (vmlinuz.efi or vmlinux.efi) - the second part loads other segments (e.g: initrd, cmdline, etc) Currently, pez (vmlinuz.efi) and pei (vmlinux.efi) format images are supported. The basic usage (vmlinuz.efi or vmlinux.efi): 1) Load second kernel image: # kexec -s -l vmlinuz.efi --initrd=initrd.img --reuse-cmdline 2) Startup second kernel: # kexec -e Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit d162feec6b6e7ed97986118450812fdd7e9ba202 Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add preparatory infrastructure for kexec_file Add some preparatory infrastructure: - Add command line processing. - Add support for loading other segments. - Other minor modifications. This initrd will be passed to the second kernel via the command line 'initrd=start,size'. The 'kexec_file' command line parameter indicates that the kernel is loaded via kexec_file. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 30ade4fef7ad95ab266a74a2f69544b02af7299d Author: Youling Tang Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Add struct loongarch_image_header for kernel Define a dedicated image header structure for LoongArch architecture to standardize kernel loading in bootloaders (primarily for kexec_file). This header includes critical metadata, such as PE/DOS signature, kernel entry points, kernel image size and load address offset, etc. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 5dcddd268a8d434e0ca562b7bbca3642226ba213 Author: Huacai Chen Date: Thu Oct 2 22:39:07 2025 +0800 LoongArch: Allow specify SIMD width via kernel parameters For power saving or debugging purpose, we usually want to limit the SIMD (LSX/LASX) usage on a rich feature platform. So allow specify SIMD width via kernel parameters "simd=". Allowed values of "simd=" are any integers, and recommended values are: 0: Disable all SIMD features; 128: Enable at most 128bit SIMD features; 256: Enable at most 256bit SIMD features; -1(default): Enable as many as possible SIMD features automatically. Signed-off-by: Huacai Chen commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 Author: Huacai Chen Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Init acpi_gbl_use_global_lock to false Init acpi_gbl_use_global_lock to false, in order to void error messages during boot phase: ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182) ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59) Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines") Signed-off-by: Huacai Chen commit 19baac378a5f4c34e61007023cfcb605cc64c76d Author: Huacai Chen Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Fix build error for LTO with LLVM-18 Commit b15212824a01 ("LoongArch: Make LTO case independent in Makefile") moves "KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump" out of CONFIG_CC_HAS_ANNOTATE_TABLEJUMP, which breaks the build for LLVM-18, as '--loongarch-annotate-tablejump' is unimplemented there: ld.lld: error: -mllvm: ld.lld: Unknown command line argument '--loongarch-annotate-tablejump'. Call ld-option to detect '--loongarch-annotate-tablejump' before use, so as to fix the build error. Fixes: b15212824a01 ("LoongArch: Make LTO case independent in Makefile") Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor # build Suggested-by: WANG Rui Signed-off-by: Huacai Chen commit abb2a5572264b425e6dd9c213b735a82ab0ca68a Author: Tiezhu Yang Date: Thu Oct 2 22:38:57 2025 +0800 LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference Currently, when compiling with GCC, there is no "break 7" instruction for zero division due to using the option -mno-check-zero-division, but the compiler still generates "break 0" instruction for zero division. Here is a simple example: $ cat test.c int div(int a) { return a / 0; } $ gcc -O2 -S test.c -o test.s GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes "ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the objtool warnings for LoongArch, but this is not the intention. When decoding "break 0" as INSN_TRAP in the previous commit, the aim is to handle "break 0" as a trap. The generated "break 0" for zero division by GCC is not proper, it should generate a break instruction with proper bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference to avoid generating the unexpected "break 0" instruction for now. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/ Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code") Suggested-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit deb2f228388ff3a9d0623e3b59a053e9235c341d Author: Breno Leitao Date: Mon Sep 29 02:15:47 2025 -0700 PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn't advertise an AER Capability and therefore dev->aer_info, which contains AER stats and ratelimiting data, is NULL. pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but aer_ratelimit() did not, leading to NULL pointer dereferences like this one from the URL below: {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0 {1}[Hardware Error]: event severity: corrected {1}[Hardware Error]: device_id: 0000:00:00.0 {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2020 {1}[Hardware Error]: aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000 BUG: kernel NULL pointer dereference, address: 0000000000000264 RIP: 0010:___ratelimit+0xc/0x1b0 pci_print_aer+0x141/0x360 aer_recover_work_func+0xb5/0x130 [8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to be a Root Port but does not advertise an AER Capability. Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference. Note that this also prevents ratelimiting these events from GHES. Fixes: a57f2bfb4a5863 ("PCI/AER: Ratelimit correctable and non-fatal error logging") Link: https://lore.kernel.org/r/buduna6darbvwfg3aogl5kimyxkggu3n4romnmq6sozut6axeu@clnx7sfsy457/ Signed-off-by: Breno Leitao [bhelgaas: add crash details to commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250929-aer_crash_2-v1-1-68ec4f81c356@debian.org commit 2b5f6638204cc0e0f6ecd55b963ebb895ec61f3b Merge: e5f0a698b34ed7 c87072064bd482 Author: Huacai Chen Date: Thu Oct 2 22:29:26 2025 +0800 Merge tag 'acpi-6.18-rc1' into loongarch-next LoongArch architecture changes for 6.18 need acpica changes to handle global lock initialization, so merge 'acpi-6.18-rc1' to create a base. commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a Author: Peter Ujfalusi Date: Thu Oct 2 16:57:52 2025 +0300 ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time Instead of constraining the ALSA buffer time to be double of the firmware host buffer size, it is better to set it for the period time. This will implicitly constrain the buffer time to a safe value (num_periods is at least 2) and prohibits applications to set smaller period size than what will be covered by the initial DMA burst. Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a Author: Peter Ujfalusi Date: Thu Oct 2 16:57:51 2025 +0300 ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size For ChainDMA the firmware allocates 5ms host buffer instead of the standard 4ms which should be taken into account when setting the constraint on the buffer size. Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 Author: Peter Ujfalusi Date: Thu Oct 2 16:57:50 2025 +0300 ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size The firmware has changed the minimum host buffer size from 2 periods to 4 periods (1 period is 1ms) which was missed by the kernel side. Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware. Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7 Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b19a0f610088a1416d118b4f89b1e2fda9eeb7ca Author: Ian Rogers Date: Mon Sep 29 10:06:00 2025 -0700 perf build: Remove libtracefs configuration libtracefs isn't used by perf but not having it installed causes build warnings. Given the library isn't used, there is no need for the configuration or warnings so remove. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250929170600.59000-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 4092fc5f35cecb01d59b2cdf7740b203eac6948a Author: Conor Dooley Date: Wed Oct 1 19:31:12 2025 +0100 spi: dt-bindings: cadence: add soc-specific compatible strings for zynqmp and versal-net When the binding for the Cadence spi controller was written, a dedicated compatible was added for the zynq device. Later when zynqmp and versal-net, which also use this spi controller IP, were added they did not receive soc-specific compatibles. Add them now, with a fallback to the existing compatible for the r1p6 version of the IP so that there will be no functional change. Retain the r1p6 in the string, to match what was done for zynq. Disallow the cdns,spi-r1p6 compatible in isolation to "encourage" people to actually add soc-specific compatible strings in the future. Signed-off-by: Conor Dooley Acked-by: Michal Simek Link: https://patch.msgid.link/20251001-basics-grafting-a1a214ef65ac@spud Signed-off-by: Mark Brown commit bace10b59624e6bd8d68bc9304357f292f1b3dcf Author: Kai Vehmanen Date: Thu Oct 2 10:47:16 2025 +0300 ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA Assumption that chain DMA module starts the link DMA when 1ms of data is available from host is not correct. Instead the firmware chain DMA module fills the link DMA with initial buffer of zeroes and the host and link DMAs are started at the same time. This results in a small error in delay calculation. This can become a more severe problem if host DMA has delays that exceed 1ms. This results in negative delay to be calculated and bogus values reported to applications. This can confuse some applications like alsa_conformance_test. Fix the issue by correctly calculating the firmware chain DMA preamble size and initializing the start offset to this value. Cc: stable@vger.kernel.org Fixes: a1d203d390e0 ("ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams") Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit bcd1383516bb5a6f72b2d1e7f7ad42c4a14837d1 Author: Kai Vehmanen Date: Thu Oct 2 10:47:15 2025 +0300 ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples When the sampling rates going in (host) and out (dai) from the DSP are different, the IPC4 delay reporting does not work correctly. Add support for this case by scaling the all raw position values to a common timebase before calculating real-time delay for the PCM. Cc: stable@vger.kernel.org Fixes: 0ea06680dfcb ("ASoC: SOF: ipc4-pcm: Correct the delay calculation") Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002074719.2084-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 59abe7bc7e7c70e9066b3e46874d1b7e6a13de14 Author: Ranjani Sridharan Date: Thu Oct 2 10:31:25 2025 +0300 ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down In the case of static pipelines, freeing the widgets in the pipelines that were not suspended after freeing the scheduler widgets results in errors because the secondary cores are powered off when the scheduler widgets are freed. Fix this by tearing down the leftover pipelines before powering off the secondary cores. Cc: stable@vger.kernel.org Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic") Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Kai Vehmanen Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251002073125.32471-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ef2b6e0317d82731b4d083e53839d966059c5ddd Author: T Pratham Date: Tue Sep 30 15:40:26 2025 +0530 crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES-ECB and AES-CBC algorithms so as to properly indicate driver capabilities. Suggested-by: Herbert Xu Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)") Signed-off-by: T Pratham Signed-off-by: Herbert Xu commit e649c3662b4fd9d4e01607c91a0facc7d9005570 Author: Geert Uytterhoeven Date: Tue Sep 30 15:47:11 2025 +0200 thermal: renesas: Fix RZ/G3E fall-out - Restore sort order in MAINTAINERS and Kconfig, - Remove empty trailing line from Makefile. Fixes: 19d3a401a617c68e ("thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC") Signed-off-by: Geert Uytterhoeven Signed-off-by: Rafael J. Wysocki commit 7a75a5da79ef9006e7f051341b768245c814efa0 Merge: 4d164e08cd8457 bf42df09b6aa4e Author: Petr Mladek Date: Thu Oct 2 10:33:08 2025 +0200 Merge branch 'rework/ringbuffer-kunit-test' into for-linus commit 9aa791c8d7bfc46d8e155cfd812674e8ffedf6b9 Author: Richard Weinberger Date: Wed Aug 20 09:12:46 2025 +0100 ARM: 9457/1: ftrace: Implement HAVE_FUNCTION_GRAPH_FREGS Enable support for ftrace's funcgraph-retval feature by capturing r0-r3 and fp. Since ARM does not provide its own __arch_ftrace_regs structure, we instead populate pt_regs with the registers required by ftrace. Cc: Donglin Peng Signed-off-by: Richard Weinberger Signed-off-by: Russell King (Oracle) commit fb0e5f266ebc86eb97e061ce5e3a74370c16de53 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:26 2025 +0100 ARM: 9456/1: mm: fault: use string choices helper We can use string choices helper, let's use it. It makes one line code. Signed-off-by: Kuninori Morimoto Signed-off-by: Russell King (Oracle) commit 2a295922a20b82f8713ae753705cdf6900d912f5 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:51 2025 +0100 ARM: 9454/1: kernel: bios32: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Signed-off-by: Russell King (Oracle) commit c085ddfd22da76ef64bfd3005c3fe0626324b285 Author: Kuninori Morimoto Date: Thu Aug 7 00:20:18 2025 +0100 ARM: 9451/1: mm: l2x0: use string choices helper We can use string choices helper, let's use it. It updates format - ..."%sabled", ...? "en" : "dis", + ..."%s", ... str_enabled_disabled(...) ^^^^^ Signed-off-by: Kuninori Morimoto Signed-off-by: Russell King (Oracle) commit 81c1a15eb4a273eabedfcc28eb6afa4b50cb8a46 Author: Herbert Xu Date: Tue Sep 30 16:08:34 2025 +0800 crypto: zstd - Fix compression bug caused by truncation Use size_t for the return value of zstd_compress_cctx as otherwise negative errors will be truncated to a positive value. Reported-by: Han Xu Fixes: f5ad93ffb541 ("crypto: zstd - convert to acomp") Signed-off-by: Herbert Xu Reviewed-by: David Sterba Tested-by: Han Xu Signed-off-by: Herbert Xu commit 3b63efa21bc6acc1a0fadd1dd0f0e1988a4c0177 Author: Geert Uytterhoeven Date: Tue Sep 30 16:44:27 2025 +0200 tee: QCOMTEE should depend on ARCH_QCOM The Qualcomm Trusted Execution Environment (QTEE) is only available on Qualcomm SoCs. Hence add a dependency on ARCH_QCOM, to prevent asking the user about this driver when configuring a kernel without Qualcomm platform support. Fixes: d6e290837e50f73f ("tee: add Qualcomm TEE driver") Signed-off-by: Geert Uytterhoeven Reviewed-by: Konrad Dybcio Signed-off-by: Jens Wiklander commit 7f7072574127c9e971cad83a0274e86f6275c0d5 Merge: c0f53f0d2e761e 2ea77fca84f078 Author: Linus Torvalds Date: Wed Oct 1 20:58:51 2025 -0700 Merge tag 'kbuild-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild updates from Nathan Chancellor: - Extend modules.builtin.modinfo to include module aliases from MODULE_DEVICE_TABLE for builtin modules so that userspace tools (such as kmod) can verify that a particular module alias will be handled by a builtin module - Bump the minimum version of LLVM for building the kernel to 15.0.0 - Upgrade several userspace API checks in headers_check.pl to errors - Unify and consolidate CONFIG_WERROR / W=e handling - Turn assembler and linker warnings into errors with CONFIG_WERROR / W=e - Respect CONFIG_WERROR / W=e when building userspace programs (userprogs) - Enable -Werror unconditionally when building host programs (hostprogs) - Support copy_file_range() and data segment alignment in gen_init_cpio to improve performance on filesystems that support reflinks such as btrfs and XFS - Miscellaneous small changes to scripts and configuration files * tag 'kbuild-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (47 commits) modpost: Initialize builtin_modname to stop SIGSEGVs Documentation: kbuild: note CONFIG_DEBUG_EFI in reproducible builds kbuild: vmlinux.unstripped should always depend on .vmlinux.export.o modpost: Create modalias for builtin modules modpost: Add modname to mod_device_table alias scsi: Always define blogic_pci_tbl structure kbuild: extract modules.builtin.modinfo from vmlinux.unstripped kbuild: keep .modinfo section in vmlinux.unstripped kbuild: always create intermediate vmlinux.unstripped s390: vmlinux.lds.S: Reorder sections KMSAN: Remove tautological checks objtool: Drop noinstr hack for KCSAN_WEAK_MEMORY lib/Kconfig.debug: Drop CLANG_VERSION check from DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT riscv: Remove ld.lld version checks from many TOOLCHAIN_HAS configs riscv: Unconditionally use linker relaxation riscv: Remove version check for LTO_CLANG selects powerpc: Drop unnecessary initializations in __copy_inst_from_kernel_nofault() mips: Unconditionally select ARCH_HAS_CURRENT_STACK_POINTER arm64: Remove tautological LLVM Kconfig conditions ARM: Clean up definition of ARM_HAS_GROUP_RELOCS ... commit 37e263e68c5e27d5f1fbc1377f64f9373dc5bf15 Author: Rajasi Mandal Date: Mon Sep 22 08:24:16 2025 +0000 cifs: client: force multichannel=off when max_channels=1 Previously, specifying both multichannel and max_channels=1 as mount options would leave multichannel enabled, even though it is not meaningful when only one channel is allowed. This led to confusion and inconsistent behavior, as the client would advertise multichannel capability but never establish secondary channels. Fix this by forcing multichannel to false whenever max_channels=1, ensuring the mount configuration is consistent and matches user intent. This prevents the client from advertising or attempting multichannel support when it is not possible. Signed-off-by: Rajasi Mandal Signed-off-by: Steve French commit aa12118dbcfe659697567c9daa0eac2c71e3fd37 Author: Bharath SM Date: Fri Sep 26 10:13:50 2025 -0500 smb client: fix bug with newly created file in cached dir Test generic/637 spotted a problem with create of a new file in a cached directory (by the same client) could cause cases where the new file does not show up properly in ls on that client until the lease times out. Fixes: 037e1bae588e ("smb: client: use ParentLeaseKey in cifs_do_create") Cc: stable@vger.kernel.org Signed-off-by: Bharath SM Signed-off-by: Steve French commit 316025335a2d41dc71c47abf6eb9a41987e94c0a Author: Henrique Carvalho Date: Mon Sep 8 22:04:23 2025 -0300 smb: client: short-circuit negative lookups when parent dir is fully cached When the parent directory has a valid and complete cached enumeration we can assume that negative dentries are not present in the directory, thus we can return without issuing a request. This reduces traffic for common ENOENT when the directory entries are cached. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 55580ad027a6764b7b1ee75f537d67811a06307f Author: Henrique Carvalho Date: Thu Sep 18 18:39:51 2025 -0300 smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry When dentry is NULL, the current code acquires the spinlock and traverses the entire list, but the condition (dentry && cfid->dentry == dentry) ensures no match will ever be found. Return -ENOENT early in this case, avoiding unnecessary lock acquisition and list traversal. Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 2f6a4af028dbb392d55b261cafcb922dd7b7ffea Author: Henrique Carvalho Date: Thu Sep 18 22:44:34 2025 -0300 smb: client: remove pointless cfid->has_lease check open_cached_dir() will only return a valid cfid, which has both has_lease = true and time != 0. Remove the pointless check of cfid->has_lease right after open_cached_dir() returns no error. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit c0f53f0d2e761e780608cf72737f93bc75539da4 Merge: 30bbcb44707a97 19692013415486 Author: Linus Torvalds Date: Wed Oct 1 20:41:10 2025 -0700 Merge tag 'linux_kselftest-next-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - Fix watchdog test to exit when device doesn't support keep-alive - Fix missing header build complaints during out of tree build - A few minor fixes to git ignore - MAINTAINERS file change to update dma_map_benchmark * tag 'linux_kselftest-next-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: MAINTAINERS: add myself and Barry to dma_map_benchmark maintainers selftests/kexec: Ignore selftest binary selftests: always install UAPI headers to the correct directory selftests/kselftest_harness: Add harness-selftest.expected to TEST_FILES selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported commit 6c7fd184234336a3b998fdf8f8db51e970dd6071 Author: Fiona Ebner Date: Mon Sep 15 17:19:40 2025 +0200 smb: client: transport: minor indentation style fix Signed-off-by: Fiona Ebner Signed-off-by: Steve French commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a Author: Fiona Ebner Date: Mon Sep 15 17:19:39 2025 +0200 smb: client: transport: avoid reconnects triggered by pending task work When io_uring is used in the same task as CIFS, there might be unnecessary reconnects, causing issues in user-space applications like QEMU with a log like: > CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server Certain io_uring completions might be added to task_work with notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for the task. In __smb_send_rqst(), signals are masked before calling smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL. If sk_stream_wait_memory() is reached via sock_sendmsg() while TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to true there, and -EINTR will be propagated all the way from sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec(). Afterwards, __smb_send_rqst() will see that not everything was written and reconnect. Signed-off-by: Fiona Ebner Signed-off-by: Steve French commit 17ef15fa80cf3b60b6f82ea1d88fa499d5495994 Author: Henrique Carvalho Date: Mon Jun 2 17:45:17 2025 -0300 smb: client: remove unused fid_lock The fid_lock in struct cached_fid does not currently provide any real synchronization. Previously, it had the intention to prevent a double release of the dentry, but every change to cfid->dentry is already protected either by cfid_list_lock (while the entry is in the list) or happens after the cfid has been removed (so no other thread should find it). Since there is no scenario in which fid_lock prevents any race, it is vestigial and can be removed along with its associated spin_lock()/spin_unlock() calls. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit 5676398315b73f21d6a4e2d36606ce94e8afc79e Author: Henrique Carvalho Date: Thu Sep 18 22:41:58 2025 -0300 smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() open_cached_dir_by_dentry() was missing an update of cfid->last_access_time to jiffies, similar to what open_cached_dir() has. Add it to the function. Signed-off-by: Henrique Carvalho Reviewed-by: Enzo Matsumiya Signed-off-by: Steve French commit a365f2c049b3846640234bc25e4f8c46abea6c98 Author: Steve French Date: Wed Oct 1 21:49:59 2025 -0500 smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid open_cached_dir_by_dentry() was exposing an invalid cached directory to callers. The validity check outside the function was exclusively based on cfid->time. Add validity check before returning success and introduce is_valid_cached_dir() helper for consistent checks across the code. Signed-off-by: Henrique Carvalho Reviwed-by: Enzo Matsumiya Signed-off-by: Steve French commit 63eb8bd6c81d84a23fdc18fffd604e3ea38bb96c Author: Bharath SM Date: Mon Sep 29 15:57:46 2025 -0500 smb: client: account smb directory cache usage and per-tcon totals Add lightweight accounting for directory lease cache usage to aid debugging and limiting cache size in future. Track per-directory entry/byte counts and maintain per-tcon aggregates. Also expose the totals in /proc/fs/cifs/open_dirs. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 30bbcb44707a97fcb62246bebc8b413b5ab293f8 Merge: d2b2fea3503e5e 285cae57a51664 Author: Linus Torvalds Date: Wed Oct 1 19:15:11 2025 -0700 Merge tag 'linux_kselftest-kunit-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: - New parameterized test features KUnit parameterized tests supported two primary methods for getting parameters: - Defining custom logic within a generate_params() function. - Using the KUNIT_ARRAY_PARAM() and KUNIT_ARRAY_PARAM_DESC() macros with a pre-defined static array and passing the created *_gen_params() to KUNIT_CASE_PARAM(). These methods present limitations when dealing with dynamically generated parameter arrays, or in scenarios where populating parameters sequentially via generate_params() is inefficient or overly complex. These limitations are fixed with a parameterized test method - Fix issues in kunit build artifacts cleanup - Fix parsing skipped test problem in kselftest framework - Enable PCI on UML without triggering WARN() - a few other fixes and adds support for new configs such as MIPS * tag 'linux_kselftest-kunit-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Extend kconfig help text for KUNIT_UML_PCI rust: kunit: allow `cfg` on `test`s kunit: qemu_configs: Add MIPS configurations kunit: Enable PCI on UML without triggering WARN() Documentation: kunit: Document new parameterized test features kunit: Add example parameterized test with direct dynamic parameter array setup kunit: Add example parameterized test with shared resource management using the Resource API kunit: Enable direct registration of parameter arrays to a KUnit test kunit: Pass parameterized test context to generate_params() kunit: Introduce param_init/exit for parameterized test context management kunit: Add parent kunit for parameterized test context kunit: tool: Accept --raw_output=full as an alias of 'all' kunit: tool: Parse skipped tests from kselftest.h kunit: Always descend into kunit directory during build commit dde6667fa3c8f52ec4b8afd487749e47d032d833 Author: Bharath SM Date: Tue Sep 2 01:16:00 2025 +0530 smb: client: add drop_dir_cache module parameter to invalidate cached dirents Add write-only /sys/module/cifs/parameters/drop_dir_cache. Writing a non-zero value iterates all tcons and calls invalidate_all_cached_dirs() to drop cached directory entries. This is useful to force a dirent cache drop across mounts for debugging and testing purpose. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 68247d45c045bb7dda923cf2c8d0937ce0e16394 Author: Geert Uytterhoeven Date: Tue Sep 30 16:50:23 2025 +0200 clk: COMMON_CLK_RPMI should depend on RISCV The RISC-V platform management interface (RPMI) is only available on RISC-V platforms. Hence add a dependency on RISCV, to prevent asking the user about this driver when configuring a kernel for a different architecture. Fixes: 5ba9f520f41a33c9 ("clk: Add clock driver for the RISC-V RPMI clock service group") Signed-off-by: Geert Uytterhoeven Signed-off-by: Paul Walmsley commit d2b2fea3503e5e12b2e28784152937e48bcca6ff Merge: 42cbaeec987b9f edcc8a38b5ac1a Author: Linus Torvalds Date: Wed Oct 1 17:47:16 2025 -0700 Merge tag 'asm-generic-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "Two small patches for the asm-generic header files: Varad Gautam improves the MMIO tracing to be faster when the tracepoints are built into the kernel but disabled, while Qi Xi updates the DO_ONCE logic so that clearing the WARN_ONCE() flags does not change the other DO_ONCE users" * tag 'asm-generic-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: once: fix race by moving DO_ONCE to separate section asm-generic/io.h: Skip trace helpers if rwmmio events are disabled commit 42cbaeec987b9fb91045060f2e7ce3152458ead9 Merge: 38057e32365769 65d2419f931c08 Author: Linus Torvalds Date: Wed Oct 1 17:41:15 2025 -0700 Merge tag 'soc-arm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The at91 power management code and the TI AM33 platform each get a few updates for robustness, the other changes are just minor cleanups" * tag 'soc-arm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: versatile: clock: convert from round_rate() to determine_rate() ARM: rockchip: remove REGULATOR conditional to PM ARM: at91: pm: Remove 2.5V regulator ARM: OMAP2+: clock: convert from round_rate() to determine_rate() ARM: OMAP1: clock: convert from round_rate() to determine_rate() ARM: mach-hpe: Rework support and directory structure arm: omap2: use string choices helper ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init ARM: OMAP2+: use IS_ERR_OR_NULL() helper ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) ARM: at91: pm: save and restore ACR during PLL disable/enable ARM: at91: pm: fix MCKx restore routine ARM: at91: pm: fix .uhp_udp_mask specification for current SoCs ARM: shmobile: rcar-gen2: Use SZ_256K definition commit 38057e323657695ec8f814aff0cdd1c7e00d3e9b Merge: f8912147dba3e9 c4ebd661282df5 Author: Linus Torvalds Date: Wed Oct 1 17:32:51 2025 -0700 Merge tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "Lots of platform specific updates for Qualcomm SoCs, including a new TEE subsystem driver for the Qualcomm QTEE firmware interface. Added support for the Apple A11 SoC in drivers that are shared with the M1/M2 series, among more updates for those. Smaller platform specific driver updates for Renesas, ASpeed, Broadcom, Nvidia, Mediatek, Amlogic, TI, Allwinner, and Freescale SoCs. Driver updates in the cache controller, memory controller and reset controller subsystems. SCMI firmware updates to add more features and improve robustness. This includes support for having multiple SCMI providers in a single system. TEE subsystem support for protected DMA-bufs, allowing hardware to access memory areas that managed by the kernel but remain inaccessible from the CPU in EL1/EL0" * tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (139 commits) soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu() soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver soc: fsl: qe: Change GPIO driver to a proper platform driver tee: fix register_shm_helper() pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" dt-bindings: spmi: Add Apple A11 and T2 compatible serial: qcom-geni: Load UART qup Firmware from linux side spi: geni-qcom: Load spi qup Firmware from linux side i2c: qcom-geni: Load i2c qup Firmware from linux side soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem soc: qcom: geni-se: Cleanup register defines and update copyright dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus Documentation: tee: Add Qualcomm TEE driver tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl tee: qcom: add primordial object tee: add Qualcomm TEE driver tee: increase TEE_MAX_ARG_SIZE to 4096 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF tee: add close_context to TEE driver operation ... commit f8912147dba3e9688b290aab0987bc9b0c6bb9a3 Merge: 0f048c878ee32a 1f76c941c29bff Author: Linus Torvalds Date: Wed Oct 1 17:25:57 2025 -0700 Merge tag 'soc-defconfig-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "Only a small set up updates, enabling a few drivers for Artpec, THead, Renesas and Broadcom chips, and cleaning out some Qualcomm options that were removed previously" * tag 'soc-defconfig-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: configs: u8500: Set NFC_SHDLC as built-in riscv: defconfig: Enable MMP_PDMA support for SpacemiT K1 SoC riscv: defconfig: run savedefconfig to reorder it ARM: defconfig: Remove obsolete CONFIG_USB_EHCI_MSM arm64: defconfig: Enable Marvell WiFi-Ex USB driver arm64: defconfig: Enable BCM2712 on-chip pin controller driver arm64: defconfig: Enable Axis ARTPEC SoC ARM: s3c6400_defconfig: Drop MTD_NAND_S3C2410 ARM: defconfig: pxa: Remove duplicate CONFIG_USB_GPIO_VBUS entry ARM: defconfig: cleanup orphaned CONFIGs arm64: defconfig: enable i.MX91 pinctrl arm64: defconfig: Enable X1P42100 GPUCC driver arm64: defconfig: Enable QCS615 clock controllers arm64: defconfig: Enable the RZ/V2H(P) RSPI driver arm64: defconfig: Enable Renesas RZ/T2H serial SCI commit 0f048c878ee32a4259dbf28e0ad8fd0b71ee0085 Merge: a8253f807760e9 8c0650e0cef283 Author: Linus Torvalds Date: Wed Oct 1 17:19:38 2025 -0700 Merge tag 'soc-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC dt updates from Arnd Bergmann: "There are five sets of new SoCs that get added in existing families, all of them being either upgrades or cut-down versions of the older chips: - Apple M2 Pro, M2 Max and M2 Ultra, used in the 2022/2023 generation of high-end workstations and laptops from Apple. Linux has been working on these for a while but stil requires patches. - Axis Artpec8 is an Armv8 chip based on Samsung Exynos design, unlike the earlier Armv7 Artpec6 from the same company that was part of a separate family of chips. - NXP i.MX91 is a cut-down version of i.MX93, using only a single Cortex-A55 core. - Qualcomm Lemans Auto is a variant of the Lemans SoC that was originally merged under the sa8775p name, the differences being mostly the firmware configuration of the platform. - Four new Renesas SoCs RZ/T2H (r9a09g077m44), RZ/N2H (r9a09g087m44), RZ/T2H (r9a09g077), and RZ/N2H (r9a09g087) are all industrial bedded SoCs based on Cortex-A55 cores In total, there are 65 new machines, including: - Industrial embedded system and single-board computers based on NXP, Allwinner, TI, Rockchips, Marvell, Xilinx Spacemit, Starfive chips. - Reference boards for the newly added Renesas, Qualcomm, NXP and Axis ARMv8 chips as well as Microchip's MPFS RISC-V SoC - Laptops and Workstations using Apple M2 and Qualcomm Snapdragon X1 chips. - Several Samsung phones using Qualcomm Snapdragon chips - Set-top boxes based on Allwinner H313 - Five BMC boards using 32-bit ASpeed SoCs - Three network routers using IXP4xx (ARMv5!) and Broadcom bcm4708 (ARMv7) SoCs Two machines get phased out because they were available only in small quantities but never made it into products: one STi407 based reference board, and a Snapdragon 845 based Chromebook. Aside from the newly added machines, a lot of work went into improving hardware support on the existing machines and cleaning up contents for validation" * tag 'soc-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (931 commits) arm64: dts: apm-shadowcat: Drop "apm,xgene2-pcie" compatible arm64: dts: apm-shadowcat: Move slimpro nodes out of "simple-bus" node ARM: dts: microchip: sam9x7: Add qspi controller arm64: dts: qcom: Add MST pixel streams for displayport arm64: dts: qcom: sm6350: correct DP compatibility strings arm64: dts: qcom: monaco-evk: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300-ride: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300: Add gpu and gmu nodes arm64: dts: allwinner: h313: Add Amediatech X96Q dt-bindings: arm: sunxi: Add Amediatech X96Q arm64: dts: apple: t8015: Add SPMI node arm64: dts: apple: t8012: Add SPMI node arm64: dts: apple: Add J180d (Mac Pro, M2 Ultra, 2023) device tree arm64: dts: rockchip: Add devicetree for the ROC-RK3588-RT dt-bindings: arm: rockchip: Add Firefly ROC-RK3588-RT arm64: dts: rockchip: update pinctrl names for Radxa E52C arm64: dts: rockchip: remove vcc_3v3_pmu regulator for Radxa E52C arm64: dts: apple: Add J474s, J475c and J475d device trees arm64: dts: apple: Add J414 and J416 Macbook Pro device trees arm64: dts: apple: Add initial t6020/t6021/t6022 DTs ... commit a8253f807760e9c80eada9e5354e1240ccf325f9 Merge: 9792d660a4e91d fee2f45def0379 Author: Linus Torvalds Date: Wed Oct 1 17:10:27 2025 -0700 Merge tag 'soc-newsoc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull new SoC support from Arnd Bergmann: "Pinkesh Vaghela adds support for the ESWIN EIC7700 SoC consisting of SiFive Quad-Core P550 CPU cluster and the first development board that uses it, the SiFive HiFive Premier P550 [1]. This adds initial device tree and also adds ESWIN architecture support. Boot-tested using intiramfs with Linux v6.17-rc3 on HiFive Premier P550 board using U-Boot 2024.01 and OpenSBI 1.4" Link: https://lore.kernel.org/linux-riscv/20250825132427.1618089-1-pinkesh.vaghela@einfochips.com/ [1] * tag 'soc-newsoc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: dts: eswin: add HiFive Premier P550 board device tree riscv: dts: add initial support for EIC7700 SoC dt-bindings: interrupt-controller: Add ESWIN EIC7700 PLIC dt-bindings: riscv: Add SiFive HiFive Premier P550 board riscv: Add Kconfig option for ESWIN platforms dt-bindings: riscv: Add SiFive P550 CPU compatible commit 9792d660a4e91d31a6b1af105ae3f1c29107e94b Merge: f13ee7cc2dca5e 129b91fc329604 Author: Linus Torvalds Date: Wed Oct 1 16:58:24 2025 -0700 Merge tag 'devicetree-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT core: - Update dtc to upstream version v1.7.2-35-g52f07dcca47c - Add stub for of_get_next_child_with_prefix() - Convert of_msi_map_id() callers to of_msi_xlate() DT bindings: - Convert multiple text board bindings to DT schema format - Add bindings for synaptics,synaptics_i2c touchscreen controller, innolux,n133hse-ea1 and nlt,nl12880bc20-spwg-24 displays, and NXP vf610 reboot controller - Add new Arm Cortex-A320/A520AE/A720AE and C1-Nano/Pro/Premium/Ultra CPUs. Add missing Applied Micro CPU compatibles. Add pu-supply and fsl,soc-operating-points properties for CPU nodes. - Add QCom Glymur PDC and tegra264-agic interrupt controllers - Add samsung,exynos8890-mali GPU to Arm Mali Midgard - Drop Samsung S3C2410 display related bindings - Allow separate DP lane and AUX connections in dp-connector - Add some missing, undocumented vendor prefixes - Add missing '#address-cells' properties in interrupt controller bindings which dtc now warns about - Drop duplicate socfpga-sdram-edac.txt, moxa,moxart-watchdog.txt, fsl/mpic.txt, ti,opa362.txt, and cavium-thunder2.txt legacy text bindings which are already covered by existing schemas. - Various binding fixes for Mediatek platforms in mailbox, regulator, pinctrl, timer, and display - Drop work-around for yamllint quoting of values containing ',' - Various spelling, typo, grammar, and duplicated words fixes in DT bindings and docs - Add binding guidelines for defining properties at top level of schemas, lack of node name ABI, and usage of simple-mfd" * tag 'devicetree-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (81 commits) dt-bindings: arm: altera: Drop socfpga-sdram-edac.txt dt-bindings: gpu: Convert nvidia,gk20a to DT schema dt-bindings: rng: sparc_sun_oracle_rng: convert to DT schema dt-bindings: vendor-prefixes: update regex for properties without a prefix dt-bindings: display: bridge: convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml scripts: dt_to_config: fix grammar and a typo in --help text dt-bindings: fix spelling, typos, grammar, duplicated words docs: dt: fix grammar and spelling of: base: Add of_get_next_child_with_prefix() stub dt-bindings: trivial-devices: Add compatible string synaptics,synaptics_i2c dt-bindings: soc: mediatek: pwrap: Add power-domains property dt-bindings: pinctrl: mt65xx: Allow gpio-line-names dt-bindings: media: Convert MediaTek mt8173-vpu bindings to DT schema dt-bindings: arm: mediatek: Support mt8183-audiosys variant dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional dt-bindings: regulator: mediatek,mt6331: Add missing compatible dt-bindings: regulator: mediatek,mt6331: Fix various regulator names dt-bindings: regulator: mediatek,mt6332-regulator: Add missing compatible dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing base reg dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing pwm_ch7_2 ... commit f13ee7cc2dca5ebbd7f01e14d6c8db1caabd863b Merge: 679a16399af080 2085f0f4697234 Author: Linus Torvalds Date: Wed Oct 1 16:33:14 2025 -0700 Merge tag 'thermal-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These are mostly thermal driver updates, including new thermal drivers for Renesas RZ/G3S and Renesas RZ/G3E SoCs, a new power slider platform feature support in the Intel int340x thermal driver, a new Tegra114- specific SOCTHERM driver and more. There is also a Step-wise thermal governor update allowing it to start reducing cooling somewhat earlier if the temperature of the given thermal zone is falling down and a thermal testing code cleanup. Specifics: - Add new thermal driver for the Renesas RZ/G3S SoC (Claudiu Beznea) - Add new thermal driver for the Renesas RZ/G3E SoC (John Madieu) - Add support for new platform power slider feature to the Intel int340x driver (Srinivas Pandruvada). - Add new Tegra114-specific SOCTHERM driver and document Tegra114 SOCTHERM Thermal Management System in DT bindings (Svyatoslav Ryhel) - Add temperature sensor channel to thermal-generic-adc (Svyatoslav Ryhel) - Add support for per-SoC default trim values to the Renesas rcar_gen3 thermal driver, use it for adding R-Car V4H default trim values, fix a comment typo in that driver and document Gen4 support in its Kconfig entry (Marek Vasut) - Fix mapping SoCs to generic Gen4 entry in the Renesas rcar_gen3 thermal driver (Wolfram Sang) - Document the TSU unit in the r9a08g045-tsu and r9a09g047-tsu DT bindings (Claudiu Beznea, John Madieu) - Make LMH select QCOM_SCM and add missing IRQ includes to the qcom/lmh thermal driver (Dmitry Baryshkov) - Fix incorrect error message in the qcom/lmh thermal driver (Sumeet Pawnikar) - Add QCS615 compatible to tsens thermal DT bindings (Gaurav Kohli) - Document the Glymur temperature sensor in qcom-tsens thermal DT bindings (Manaf Meethalavalappu Pallikunhi) - Make k3_j72xx_bandgap thermal driver register the thermal sensor with hwmon (Michael Walle) - Tighten GRF requirements in the rockchip thermal DT bindings, silence a GRF warning in the rockchip thermal driver and unify struct rockchip_tsadc_chip format in it (Sebastian Reichel) - Update the Step-wise thermal governor to allow it to reduce the cooling level earlier if thermal zone temperature is dropping and clean it up (Rafael Wysocki) - Clean up the thermal testing code (Rafael Wysocki) - Assorted cleanups of thermal drivers (Jiapeng Chong, Salah Triki, Osama Abdelkader)" * tag 'thermal-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (37 commits) thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit thermal/drivers/thermal-generic-adc: Add temperature sensor channel dt-bindings: thermal: rockchip: Tighten grf requirements thermal/drivers/rockchip: Shut up GRF warning thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver dt-bindings: thermal: add Tegra114 soctherm header thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry thermal/drivers/rcar_gen3: Fix comment typo drivers/thermal/qcom/lmh: Fix incorrect error message thermal/drivers/qcom/lmh: Add missing IRQ includes ... commit 679a16399af08088a83e1d30e01c31832f055ae7 Merge: 991053178e08fb c87072064bd482 Author: Linus Torvalds Date: Wed Oct 1 16:24:50 2025 -0700 Merge tag 'acpi-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These include an ACPICA update (upstream revision 20250807 with a few fixes on top), fixes and cleanups of the ACPI processor driver, fixes and cleanups of the ACPI properties management code, one more ACPI IRQ resource management quirk, one more ACPI backlight quirk, an ACPI device enumeration quirk related to _DEP, a power resource quirk related to WWAN modem for HP EliteBook 855 G7, ACPI SPCR table parser extensions, an ACPI APEI EINJ driver update allowing it to handle more address types, and several assorted cleanups of ACPI drivers and PNP code. Specifics: - Add SoundWire File Table (SWFT) signature to ACPICA (Maciej Strozek) - Rearrange local variable definition involving #ifdef in ACPICA to avoid using uninitialized variables (Zhe Qiao) - Allow ACPICA to skip Global Lock initialization (Huacai Chen) - Apply ACPI_NONSTRING in more places in ACPICA and fix two regressions related to incorrect ACPI_NONSTRING usage (Ahmed Salem) - Fix printing CDAT table header when dissasebling CDAT AML (Ahmed Salem) - Use acpi_ds_clear_operands() in acpi_ds_call_control_method() in ACPICA (Hans de Goede) - Update dsmethod.c in ACPICA to address unused variable warning (Saket Dumbre) - Print error messages in ACPICA for too few or too many control method arguments (Saket Dumbre) - Update ACPICA version to 20250807 (Saket Dumbre) - Fix largest possible resource descriptor index in ACPICA (Dmitry Antipov) - Add Back-Invalidate restriction to CXL Window for CEDT in ACPICA (Davidlohr Bueso) - Add the package type to acceptable Arg3 types for _DSM in ACPICA because ACPI_TYPE_ANY does not cover it (Saket Dumbre) - Fix return values in ap_is_valid_checksum() in the acpidump utility in ACPICA (Kaushlendra Kumar) - Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] so it is not regarded as real dependency (Hans de Goede) - Use ACPI_FREE() for freeing an ACPI object in description_show() in the ACPI sysfs-related code (Kaushlendra Kumar) - Fix memory leak in the ACPI processor idle driver registration error code path and optimize ACPI idle driver registration (Huisong Li, Rafael Wysocki) - Add module import namespace to the ACPI processor idle driver (Rafael Wysocki) - Eliminate static variable flat_state_cnt from the ACPI processor idle driver (Rafael Wysocki) - Release cpufreq policy references using __free() in the ACPI processor thremal driver (Zihuan Zhang) - Remove unused empty stubs of some functions and rearrange function declarations in a header file in the ACPI processor driver (Huisong Li) - Redefine two functions as void in the ACPI processor driver (Rafael Wysocki) - Stop exposing global variable acpi_idle_driver in the ACPI processor driver (Huisong Li) - Fix ACPI buffer properties extraction for data-only subnodes represented as _DSD-equivalent packages (Rafael Wysocki) - Fix handling of ACPI data-only subnodes represented as _DSD-equivalent packages in the case when they are embedded in larger _DSD-equivalent packages and clean up acpi_nondev_subnode_extract() (Rafael Wysocki) - Skip ACPI IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen) - Add power resource init function and use it for introducing an HP EliteBook 855 G7 WWAN modem power resource quirk (Maciej Szmigiero) - Add support for DBG2 RISC-V SBI port subtype and Precise Baud Rate field to the ACPI SPCR table parser (Chen Pei) - Eliminate a dummy local variable from the ACPI thermal driver (Rafael Wysocki) - Fold two simple functions into their only caller in the ACPI fan driver (Rafael Wysocki) - Force native backlight on Lenovo 82K8 in the ACPI backlight (video) driver (Mario Limonciello) - Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang) - Skip PRM handlers with NULL handler_address or NULL VA in the ACPI PRM driver (Shang song) - Remove redundant assignments in erst_dbg_{ioctl|write}() in the ACPI APEI driver (Thorsten Blum) - Allow the ACPI APEI EINJ to handle more types of addresses than just MMIO (Jiaqi Yan) - Use str_low_high() helper in two places in the ACPI code (Chelsy Ratnawat) - Use str_plural() to simplify the PNP code (Xichao Zhao) - Fix signedness issues in read/write helpers in the ACPI AML debugger interface (Amir Mohammad)" * tag 'acpi-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (50 commits) ACPI: debug: fix signedness issues in read/write helpers ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: SPCR: Support Precise Baud Rate field ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Remove unused empty stubs of some functions ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() ACPI: property: Do not pass NULL handles to acpi_attach_data() ACPI: property: Add code comments explaining what is going on ACPI: property: Disregard references in data-only subnode lists ACPI: property: Fix buffer properties extraction for subnodes ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype ACPI: APEI: EINJ: Allow more types of addresses except MMIO ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() ACPICA: acpidump: fix return values in ap_is_valid_checksum() ACPICA: ACPI_TYPE_ANY does not include the package type ACPICA: CEDT: Add Back-Invalidate restriction to CXL Window ACPICA: Fix largest possible resource descriptor index ACPICA: Update version to 20250807 ... commit 991053178e08fb4d1f80398367db05c2cc4f20b4 Merge: 080ffb4bec4d49 40d2cf9c3c1a5a Author: Linus Torvalds Date: Wed Oct 1 16:08:37 2025 -0700 Merge tag 'pm-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "The majority of these are cpufreq changes, which has been a recurring pattern for a few recent cycles. Those changes include new hardware support (AN7583 SoC support in the airoha cpufreq driver, ipq5424 support in the qcom-nvmem cpufreq driver, MT8196 support in the mediatek cpufreq driver, AM62D2 support in the ti cpufreq driver), DT bindings and Rust code updates, cleanups of the core and governors, and multiple driver fixes and cleanups. Beyond that, there are hibernation fixes (some remaining 6.16 cycle fallout and an issue related to hybrid suspend in the amdgpu driver), cleanups of the PM core code, runtime PM documentation update, cpuidle and power capping cleanups, and tooling updates. Specifics: - Rearrange variable declarations involving __free() in the cpufreq core and intel_pstate driver to follow common coding style (Rafael Wysocki) - Fix object lifecycle issue in update_qos_request(), rearrange freq QoS updates using __free(), and adjust frequency percentage computations in the intel_pstate driver (Rafael Wysocki) - Update intel_pstate to allow it to enable HWP without EPP if the new DEC (Dynamic Efficiency Control) HW feature is enabled (Rafael Wysocki) - Use on_each_cpu_mask() in drv_write() in the ACPI cpufreq driver to simplify the code (Rafael Wysocki) - Use likely() optimization in intel_pstate_sample() (Yaxiong Tian) - Remove dead EPB-related code from intel_pstate (Srinivas Pandruvada) - Use scope-based cleanup for cpufreq policy references in multiple cpufreq drivers (Zihuan Zhang) - Avoid calling get_governor() for the first policy in the cpufreq core to simplify the initial policy path (Zihuan Zhang) - Clean up the cpufreq core in multiple places (Zihuan Zhang) - Use int type to store negative error codes in the cpufreq core and update the speedstep-lib to use int for error codes (Qianfeng Rong) - Update the efficient idle check for Intel extended Families in the ondemand cpufreq governor (Sohil Mehta) - Replace sscanf() with kstrtouint() in the conservative cpufreq governor (Kaushlendra Kumar) - Rename CpumaskVar::as[_mut]_ref to from_raw[_mut] in the cpumask Rust code and mark CpumaskVar as transparent (Alice Ryhl, Baptiste Lepers) - Update ARef and AlwaysRefCounted imports from sync::aref in the OPP Rust code (Shankari Anand) - Add support for AN7583 SoC to the airoha cpufreq driver (Christian Marangi) - Enable cpufreq for ipq5424 in the qcom-nvmem cpufreq driver (Md Sadre Alam) - Add support for MT8196 to the mediatek-hw cpufreq driver, refactor that driver and add mediatek,mt8196-cpufreq-hw DT binding (Nicolas Frattaroli) - Avoid redundant conditions in the mediatek cpufreq driver (Liao Yuanhong) - Add support for AM62D2 to the ti cpufreq driver and blocklist ti,am62d2 SoC in dt-platdev (Paresh Bhagat) - Support more speed grades on AM62Px SoC in the ti cpufreq driver, allow all silicon revisions to support OPPs in it, and fix supported hardware for 1GHz OPP (Judith Mendez) - Add QCS615 compatible to DT bindings for cpufreq-qcom-hw (Taniya Das) - Minor assorted updates of the scmi, longhaul, CPPC, and armada-37xx cpufreq drivers (Akhilesh Patil, BowenYu, Dennis Beier, and Florian Fainelli) - Remove outdated cpufreq-dt.txt (Frank Li) - Fix python gnuplot package names in the amd_pstate_tracer utility (Kuan-Wei Chiu) - Saravana Kannan will maintain the virtual-cpufreq driver (Saravana Kannan) - Prevent CPU capacity updates after registering a perf domain from failing on a first CPU that is not present (Christian Loehle) - Add support for the cases in which frequency alone is not sufficient to uniquely identify an OPP (Krishna Chaitanya Chundru) - Use to_result() for OPP error handling in Rust (Onur Özkan) - Add support for LPDDR5 on Rockhip RK3588 SoC to rockchip-dfi devfreq driver (Nicolas Frattaroli) - Fix an issue where DDR cycle counts on RK3588/RK3528 with LPDDR4(X) are reported as half by adding a cycle multiplier to the DFI driver in rockchip-dfi devfreq-event driver (Nicolas Frattaroli) - Fix missing error pointer dereference check of regulator instance in the mtk-cci devfreq driver probe and remove a redundant condition from an if () statement in that driver (Dan Carpenter, Liao Yuanhong) - Fail cpuidle device registration if there is one already to avoid sysfs-related issues (Rafael Wysocki) - Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() in cpuidle (Vivek Yadav) - Fix device and OF node leaks at probe in the qcom-spm cpuidle driver and drop unnecessary initialisations from it (Johan Hovold) - Remove unnecessary address-of operators from the intel_idle cpuidle driver (Kaushlendra Kumar) - Rearrange main loop in menu_select() to make the code in that funtion easier to follow (Rafael Wysocki) - Convert values in microseconds to ktime using us_to_ktime() where applicable in the intel_idle power capping driver (Xichao Zhao) - Annotate loops walking device links in the power management core code as _srcu and add macros for walking device links to reduce the likelihood of coding mistakes related to them (Rafael Wysocki) - Document time units for *_time functions in the runtime PM API (Brian Norris) - Clear power.must_resume in noirq suspend error path to avoid resuming a dependant device under a suspended parent or supplier (Rafael Wysocki) - Fix GFP mask handling during hybrid suspend and make the amdgpu driver handle hybrid suspend correctly (Mario Limonciello, Rafael Wysocki) - Fix GFP mask handling after aborted hibernation in platform mode and combine exit paths in power_down() to avoid code duplication (Rafael Wysocki) - Use vmalloc_array() and vcalloc() in the hibernation core to avoid open-coded size computations (Qianfeng Rong) - Fix typo in hibernation core code comment (Li Jun) - Call pm_wakeup_clear() in the same place where other functions that do bookkeeping prior to suspend_prepare() are called (Samuel Wu) - Fix and clean up the x86_energy_perf_policy utility and update its documentation (Len Brown, Kaushlendra Kumar) - Fix incorrect sorting of PMT telemetry in turbostat (Kaushlendra Kumar) - Fix incorrect size in cpuidle_state_disable() and the error return value of cpupower_write_sysfs() in cpupower (Kaushlendra Kumar)" * tag 'pm-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (86 commits) PM: hibernate: Combine return paths in power_down() PM: hibernate: Restrict GFP mask in power_down() PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage PM: runtime: Documentation: ABI: Document time units for *_time tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry drm/amd: Fix hybrid sleep PM: hibernate: Add pm_hibernation_mode_is_suspend() PM: hibernate: Fix hybrid-sleep tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names cpufreq: Replace pointer subtraction with iteration macro cpuidle: Fail cpuidle device registration if there is one already ... commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f Author: Yuan Chen Date: Wed Oct 1 03:20:25 2025 +0100 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash. [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000 ... [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60 [1135630.286041] sp : ffffaeff4977fa40 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] Call trace: [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception+0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec : ldr x21, [x24,#120] include/linux/compiler.h: 294 0xffff3df8995039f0 : ldr x1, [x21,x0] kernel/trace/trace_kprobe.c 1308: head = this_cpu_ptr(call->perf_events); 1309: if (hlist_empty(head)) 1310: return 0; crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0 ... } Race Condition Analysis: The race occurs between kprobe activation and perf_events initialization: CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2)← KPROBE ACTIVE Debug exception triggers ... kprobe_dispatcher kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events is still NULL) Problem: 1. CPU0 executes (1) assigning tp_event->perf_events = list 2. CPU0 executes (2) enabling kprobe functionality via class->reg() 3. CPU1 triggers and reaches kprobe_dispatcher 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed) 5. CPU1 calls kprobe_perf_func() and crashes at (3) because call->perf_events is still NULL CPU1 sees that kprobe functionality is enabled but does not see that perf_events has been assigned. Add pairing read and write memory barriers to guarantee that if CPU1 sees that kprobe functionality is enabled, it must also see that perf_events has been assigned. Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/ Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use") Cc: stable@vger.kernel.org Signed-off-by: Yuan Chen Signed-off-by: Masami Hiramatsu (Google) commit f09f57c7467710144e7522c7fa1abca87af8f7c6 Author: Eric Biggers Date: Mon Sep 29 12:27:21 2025 -0700 selftests/bpf: Add test for libbpf_sha256() Test that libbpf_sha256() calculates SHA-256 digests correctly. Tested with: make -C tools/testing/selftests/bpf/ ./tools/testing/selftests/bpf/test_progs -t sha256 -v Signed-off-by: Eric Biggers Signed-off-by: Alexei Starovoitov commit 080ffb4bec4d49cdedca11810395f8cad812471e Merge: cf8da11679ec4e d6ddd9beb1a5c3 Author: Linus Torvalds Date: Wed Oct 1 15:50:27 2025 -0700 Merge tag 'i3c/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "New driver: - Analog Devices I3C Controller Subsystem: - fix big-endian FIFO transfers - fix default I2C adapter timeout value Drivers: - dw: shutdown support - mipi-i3c-hci: Intel Wildcat Lake-U support, IOMMU support - renesas: RZ/V2H(P) and RZ/V2N support" * tag 'i3c/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (22 commits) i3c: fix big-endian FIFO transfers i3c: master: adi: fix number of bytes written to fifo i3c: Remove superfluous FIXME i3c: master: adi: fix header location i3c: dw: Add shutdown support to dw_i3c_master driver i3c: renesas: Simplify return statement in 'renesas_i3c_daa' dt-bindings: i3c: renesas,i3c: Add RZ/V2H(P) and RZ/V2N support i3c: master: svc: Recycle unused IBI slot i3c: master: svc: Use manual response for IBI events i3c: master: Add driver for Analog Devices I3C Controller IP dt-bindings: i3c: Add adi-i3c-master i3c: Fix default I2C adapter timeout value i3c: mipi-i3c-hci: Convert remaining DBG() prints to dev_dbg() i3c: mipi-i3c-hci: Remove function enter DBG() printouts i3c: mipi-i3c-hci: Uniform ring number printouts i3c: mipi-i3c-hci: Remove nonexistent ring interrupt i3c: mipi-i3c-hci: Change interrupt status prints to dev_dbg() i3c: mipi-i3c-hci: Use own DMA bounce buffer management for I2C transfers i3c: mipi-i3c-hci: Use physical device pointer with DMA API i3c: mipi-i3c-hci: Use core helpers for DMA mapping and bounce buffering ... commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 Author: Yazhou Tang Date: Tue Sep 30 23:04:33 2025 +0800 bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Signed-off-by: Yazhou Tang Acked-by: Yonghong Song Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov commit 1bd3773aad5411f3542aa2e5328df58454706ca6 Merge: a1aca22d264cdc 4a1c9e544b8dd0 Author: Alexei Starovoitov Date: Wed Oct 1 15:27:25 2025 -0700 Merge branch 'libbpf-fix-libbpf_sha256-for-github-compatibility' Andrii Nakryiko says: ==================== libbpf: fix libbpf_sha256() for Github compatibility Recent reimplementation of libbpf_sha256() introduced issues for libbpf's Github mirror due to reliance on linux/unaligned.h header. This patch set fixes those issues to make libbpf source code compatible with Github mirror setup. This patch set starts with a bit of organization: we introduce libbpf_utils.c as a place for generic internal helpers like libbpf_errstr() and libbpf_sha256(), and move a few existing helpers there. We also clean up libbpf_strerror_r(), which seems to be a leftover of some previous refactorings. And finally, we move libbpf_sha256() from huge libbpf.c into libbpf_utils.c, following up with fix ups to make its code more Github-friendly. v1->v2: - add missed cpu_to_be32() and be32_to_cpu() conversions inside {get/put}_unaligned_be32() macros; - target bpf tree (Alexei); - applied Eric's libbpf_sha256 selftest locally and verified it works; v1: https://lore.kernel.org/bpf/20250930212619.1645410-1-andrii@kernel.org/ ==================== Link: https://patch.msgid.link/20251001171326.3883055-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 4a1c9e544b8dd0c5456e0feb614f427dc46c4835 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:26 2025 -0700 libbpf: remove linux/unaligned.h dependency for libbpf_sha256() linux/unaligned.h include dependency is causing issues for libbpf's Github mirror due to {get,put}_unaligned_be32() usage. So get rid of it by implementing custom variants of those macros that will work both in kernel and Github mirror repos. Also switch round_up() to roundup(), as the former is not available in Github mirror (and is just a subtly more specific variant of roundup() anyways). Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-6-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit a7f36f81d0bde9e274606f771f7bfd59b2c8c083 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:25 2025 -0700 libbpf: move libbpf_sha256() implementation into libbpf_utils.c Move sha256 implementation out of already large and unwieldy libbpf.c into libbpf_utils.c where we'll keep reusable helpers. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-5-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit c68b6fdc3600466e3c265bad34d099eb8c5280f1 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:24 2025 -0700 libbpf: move libbpf_errstr() into libbpf_utils.c Get rid of str_err.{c,h} by moving implementation of libbpf_errstr() into libbpf_utils.c and declarations into libbpf_internal.h. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-4-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit d05ab6181be0060ca259a49e69de9bc95b19edb7 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:23 2025 -0700 libbpf: remove unused libbpf_strerror_r and STRERR_BUFSIZE libbpf_strerror_r() is not exposed as public API and neither is it used inside libbpf itself. Remove it altogether. Same for STRERR_BUFSIZE, it's just an orphaned leftover constant which we missed to clean up some time earlier. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-3-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit 44d42bd80804d117fd83b849820e26dafd25a5f9 Author: Andrii Nakryiko Date: Wed Oct 1 10:13:22 2025 -0700 libbpf: make libbpf_errno.c into more generic libbpf_utils.c Libbpf is missing one convenient place to put common "utils"-like code that is generic and usable from multiple places. Use libbpf_errno.c as the base for more generic libbpf_utils.c. Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20251001171326.3883055-2-andrii@kernel.org Signed-off-by: Alexei Starovoitov Acked-by: Eduard Zingerman commit cf8da11679ec4e54e2dd3cb147fb310a2230be52 Merge: 5fb024931949f3 cb3005d4c490fe Author: Linus Torvalds Date: Wed Oct 1 15:11:00 2025 -0700 Merge tag 'i2c-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "Mostly DT bindings additions this time because Andi was super busy and I also could only partly cover it. - new ids for qcom-cci, mt65xx, exynos5, apple, tegra20, k1, i801 - drop support for already removed S3C2410 - introduce and use fwnode_for_each_child_node_scoped() - mmt65xx: improve write-then-read transactions - k1: various fixes around bus errors and resets - usual share of cleanups, minor improvements, PM fixes... at24 updates: - add the compatible for Giantec GT24C256C to the device-tree bindings" * tag 'i2c-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (33 commits) i2c: i801: Add support for Intel Wildcat Lake-U dt-bindings: i2c: i2c-mt65xx: Add MediaTek MT8196/6991 compatibles i2c: designware: Add disabling clocks when probe fails i2c: designware: Fix clock issue when PM is disabled i2c: busses: Fix some spelling errors i2c: mux: Simplify boolean assignment in i2c_mux_alloc i2c: designware: use dev_err_probe() when probing platform device i2c: designware: convert to dev_err_probe() on request IRQ error i2c: spacemit: ensure SDA is released after bus reset i2c: spacemit: check SDA instead of SCL after bus reset i2c: spacemit: disable SDA glitch fix to avoid restart delay i2c: spacemit: remove stop function to avoid bus error i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD i2c: boardinfo: Annotate code used in init phase only dt-bindings: i2c: i2c-mt65xx: Document MediaTek MT6878 I2C dt-bindings: i2c: samsung,s3c2410-i2c: Drop S3C2410 i2c: s3c2410: Drop S3C2410 OF support dt-bindings: i2c: spacemit,k1-i2c: Minor whitespace cleanup in example dt-bindings: i2c: exynos5: add samsung,exynos8890-hsi2c compatible ... commit 65d2419f931c08ead6722fbb9d4bd8cecb25a7e3 Author: Brian Masney Date: Wed Oct 1 08:11:00 2025 +0200 ARM: versatile: clock: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Acked-by: Sudeep Holla Reviewed-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20251001061100.372737-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 1f76c941c29bffdc97212969115f1fd5f91a4aed Author: Jihed Chaibi Date: Tue Sep 30 14:27:09 2025 +0200 ARM: configs: u8500: Set NFC_SHDLC as built-in The CONFIG_NFC_SHDLC=m setting in u8500_defconfig causes a Kconfig warning because the NFC_SHDLC symbol does not support being built as a module. Change the selection from 'm' to 'y' to build the driver in-kernel. Fixes: 344cad0660ea0 ("ARM: configs: Update U8500 defconfig") Signed-off-by: Jihed Chaibi Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250930122709.28987-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit a1aca22d264cdca5b20934a2413951ea7d73c594 Merge: 0c342bfc9949df 8709c1685220e7 Author: Alexei Starovoitov Date: Wed Oct 1 13:53:20 2025 -0700 Merge branch 'bpf-fix-verifier-crash-on-bpf_neg-with-pointer-register' Brahmajit Das says: ==================== bpf: Fix verifier crash on BPF_NEG with pointer register This patch fixes a crash in the BPF verifier triggered when the BPF_NEG operation is applied to a pointer-typed register. The verifier now checks that the destination register is not a pointer before performing the operation. Tested with syzkaller reproducer and new BPF sefltest. Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58 Changes v4: Cleaning up, instead of using __is_pointer_value it's further simplified by checking if regs[insn->dst_reg].type of SCALAR_VALUE Link: Changes in v3: using __is_pointer_value to check if register if of pointer type Link: https://lore.kernel.org/all/20251001095613.267475-1-listout@listout.xyz/ Changes in v2: Checking if reg->map_ptr is NULL in bpf/log.c but with cleaner approach (wrong approach) Link: https://lore.kernel.org/all/20250923174738.1713751-1-listout@listout.xyz/ Changes in v1: Checking if reg->map_ptr is NULL in bpf/log.c (wrong approach) Link: https://lore.kernel.org/all/20250923164144.1573636-1-listout@listout.xyz/ ==================== Link: https://patch.msgid.link/20251001191739.2323644-1-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 8709c1685220e766d4d9420f96b1e8ed3175f526 Author: KaFai Wan Date: Thu Oct 2 00:47:39 2025 +0530 selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP Add a test case for BPF_NEG operation on CONST_PTR_TO_MAP. Tests if BPF_NEG operation on map_ptr is rejected in unprivileged mode and is a scalar value and do not trigger Oops in privileged mode. Signed-off-by: KaFai Wan Signed-off-by: Brahmajit Das Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251001191739.2323644-3-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 34904582b502a86fdb4d7984b12cacd2faabbe0d Author: Brahmajit Das Date: Thu Oct 2 00:47:38 2025 +0530 bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer In check_alu_op(), the verifier currently calls check_reg_arg() and adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations. However, if the destination register holds a pointer, these scalar adjustments are unnecessary and potentially incorrect. This patch adds a check to skip the adjustment logic when the destination register contains a pointer. Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58 Fixes: aced132599b3 ("bpf: Add range tracking for BPF_NEG") Suggested-by: KaFai Wan Suggested-by: Eduard Zingerman Signed-off-by: Brahmajit Das Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251001191739.2323644-2-listout@listout.xyz Signed-off-by: Alexei Starovoitov commit 0c342bfc9949dffeaa83ebdde3b4b0ce59009348 Author: Jiri Olsa Date: Wed Oct 1 14:22:23 2025 +0200 selftests/bpf: Fix realloc size in bpf_get_addrs We will segfault once we call realloc in bpf_get_addrs due to wrong size argument. Fixes: 6302bdeb91df ("selftests/bpf: Add a kprobe_multi subtest to use addrs instead of syms") Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov commit 4b2b38ea20567d842607b7bca6d618d154c78d84 Author: Jiri Olsa Date: Wed Oct 1 14:22:22 2025 +0200 selftests/bpf: Fix typo in subtest_basic_usdt after merge conflict Use proper 'called' variable name. Fixes: ae28ed4578e6 ("Merge tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next") Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/bpf/aN0JVRynHxqKy4lw@krava/ Signed-off-by: Alexei Starovoitov commit f83fcec7843dedf3fcfdef119ccca78e8f24ee63 Author: Jiri Olsa Date: Wed Oct 1 14:22:21 2025 +0200 selftests/bpf: Fix open-coded gettid syscall in uprobe syscall tests Commit 0e2fb011a0ba ("selftests/bpf: Clean up open-coded gettid syscall invocations") addressed the issue that older libc may not have a gettid() function call wrapper for the associated syscall. The uprobe syscall tests got in from tip tree, using sys_gettid in there. Fixes: 0e2fb011a0ba ("selftests/bpf: Clean up open-coded gettid syscall invocations") Signed-off-by: Jiri Olsa Signed-off-by: Alexei Starovoitov commit 5fb024931949f3475260c84a0e4b0997af9c5530 Merge: 524c4a5daf9298 da3a88e9656c17 Author: Linus Torvalds Date: Wed Oct 1 13:14:48 2025 -0700 Merge tag 'pinctrl-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "We have GPIO awareness in the pin control core and an interesting AAEON driver. Core changes: - Allow pins to be identified/marked as GPIO mode with a special callback. The pin controller core is now "aware" if a pin is in GPIO mode if the callback is implemented in the driver, and can thus be marked as "strict", i.e. disallowing simultaneous use of a line as GPIO and another function such as I2C. This is enabled in the Qualcomm TLMM driver and also implemeted from day 1 in the new Broadcom STB driver - Rename the pin config option PIN_CONFIG_OUTPUT to PIN_CONFIG_LEVEL to better describe what the config is doing, as well as making it more intuitive what shall be returned when reading this property New drivers: - Qualcomm SDM660 LPASS LPI TLMM pin controller subdriver - Qualcomm Glymur family pin controller driver - Broadcom STB family pin controller driver - Tegra186 pin controller driver - AAEON UP pin controller support. This is some special pin controller that works as an external advanced line MUX and amplifier for signals from an Intel SoC. A cooperative effort with the GPIO maintainer was needed to reach a solution where we reuse code from the GPIO aggregator/forwarder driver - Renesas RZ/T2H and RZ/N2H pin controller support - Axis ARTPEC-8 subdriver for the Samsung pin controller driver Improvements: - Output enable (OEN) support in the Renesas RZG2L driver - Properly support bias pull up/down in the pinctrl-single driver - Move over all GPIO portions using generic MMIO GPIO to the new generic GPIO chip management which has a nice and separate API - Proper DT bindings for some older Broadcom SoCs - External GPIO (EGPIO) support in the Qualcomm SM8250 Deleted code: - Dropped the now unused Samsung S3C24xx drivers" * tag 'pinctrl-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (75 commits) pinctrl: use more common syntax for compound literals pinctrl: Simplify printks with pOF format pinctrl: qcom: Add SDM660 LPASS LPI TLMM dt-bindings: pinctrl: qcom: Add SDM660 LPI pinctrl pinctrl: qcom: lpass-lpi: Add ability to use custom pin offsets pinctrl: qcom: Add glymur pinctrl driver dt-bindings: pinctrl: qcom: Add Glymur pinctrl pinctrl: qcom: sm8250: Add egpio support pinctrl: generic: rename PIN_CONFIG_OUTPUT to LEVEL pinctrl: keembay: fix double free in keembay_build_functions() pinctrl: spacemit: fix typo in PRI_TDI pin name pinctrl: eswin: Fix regulator error check and Kconfig dependency pinctrl: bcm: Add STB family pin controller driver dt-bindings: pinctrl: Add support for Broadcom STB pin controller pinctrl: qcom: make the pinmuxing strict pinctrl: qcom: mark the `gpio` and `egpio` pins function as non-strict functions pinctrl: qcom: add infrastructure for marking pin functions as GPIOs pinctrl: allow to mark pin functions as requestable GPIOs pinctrl: qcom: use generic pin function helpers pinctrl: make struct pinfunction a pointer in struct function_desc ... commit 524c4a5daf92982cf16d9e6c8cdf8721abe35a11 Merge: 3ee22ad492a493 d46651d4e3c0ca Author: Linus Torvalds Date: Wed Oct 1 13:10:30 2025 -0700 Merge tag 'for-linus-6.18-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Bug fixes and enhancements for IPMI This fixes a number of small bugs, but has some more major changes: - Loongson-2K BMC support is added. This is an MFD device and is dependent on the changes coming from that tree. The way the driver handles BMCs that have become non-functional has been completely redone. A number of changes in the past have attempted to handle various issues around this, but nothing has been very good. After working with some people on this, the code has been reworked to disable the driver and fail all pending operations if the BMC becomes non functional. It will retry the BMC once a second to see if it's back up" * tag 'for-linus-6.18-1' of https://github.com/cminyard/linux-ipmi: ipmi: Add Loongson-2K BMC support ipmi:si: Gracefully handle if the BMC is non-functional ipmi: Rename "user_data" to "recv_msg" in an SMI message ipmi: Allow an SMI sender to return an error ipmi:si: Move flags get start to its own function ipmi:si: Merge some if statements ipmi: Set a timer for maintenance mode ipmi: Add a maintenance mode sysfs file ipmi: Disable sysfs access and requests in maintenance mode ipmi: Differentiate between reset and firmware update in maintenance dt-bindings: ipmi: aspeed,ast2400-kcs-bmc: Add missing "clocks" property ipmi: Rework user message limit handling Revert "ipmi: fix msg stack when IPMI is disconnected" ipmi:msghandler:Change seq_lock to a mutex commit 3ee22ad492a49303f54d4e1c5168327742ac7aaf Merge: dba8acc3ef34ca 41307ec7df0572 Author: Linus Torvalds Date: Wed Oct 1 13:02:59 2025 -0700 Merge tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - introduce adc-battery-helper for capacity estimation based on simple ADC readings of battery voltage and current - add new properties for battery internal resistance and state of health Power-supply drivers: - ug3105_battery: convert to adc-battery-helper - intel_dc_ti_battery: New driver for Intel Dollar Cove TI batteries - rt9467-charger: add voltage and current ADC support - sbs-charger: support multiple instances - qcom_battmgr: - add charge control support - add support for state of health and internal resistance - max77705_charger: - big driver cleanup - add support for setting charge current - misc minor fixes and cleanups" * tag 'for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (38 commits) power: supply: qcom_battmgr: handle charging state change notifications power: supply: max77705_charger: use REGMAP_IRQ_REG_LINE macro power: supply: max77705_charger: rework interrupts power: supply: max77705_charger: add writable properties power: supply: max77705_charger: return error when config fails power: supply: max77705_charger: use regfields for config registers power: supply: max77705_charger: refactoring: rename charger to chg mfd: max77705: max77705_charger: move active discharge setting to mfd parent power: supply: max77976_charger: fix constant current reporting power: supply: qcom_battmgr: Add charge control support dt-bindings: soc: qcom,pmic-glink: Add charge limit nvmem properties power: supply: qcom_battmgr: update compats for SM8550 and X1E80100 power: supply: qcom_battmgr: Add state_of_health property power: supply: qcom_battmgr: Add resistance power supply property power: supply: core: Add state_of_health power supply property power: supply: core: Add resistance power supply property power: supply: rx51: remove redundant condition checks dt-bindings: power: supply: bq24190: document charge enable pin dt-bindings: power: supply: bq27xxx: document optional interrupt power: supply: intel_dc_ti_battery: Drop no longer relevant comment ... commit dba8acc3ef34ca5189d393b0dc4d3cdf0058fe49 Merge: f07c3695bf6522 ca50b295fd473e Author: Linus Torvalds Date: Wed Oct 1 13:00:33 2025 -0700 Merge tag 'hsi-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI update from Sebastian Reichel: - Remove redundant pm_runtime_mark_last_busy() calls * tag 'hsi-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: Remove redundant pm_runtime_mark_last_busy() calls commit d18020cf1e92c9f77819c49b61e2d558ed9fad70 Author: Ian Rogers Date: Wed Sep 3 11:42:48 2025 -0700 perf test: Remove C python_use test Removed in favor of the shell script version. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Collin Funk Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Signed-off-by: Arnaldo Carvalho de Melo commit 33706fb0aa6c2f7eb869a0a9ad569e414ff11375 Author: Ian Rogers Date: Wed Sep 3 11:42:47 2025 -0700 perf test: Add an 'import perf' test shell script The 'import perf' test needs to set up a path to the python module as well as to know the python command to invoke. These are hard coded at build time to be build a directory and the python used in the build, which is less than desirable. Avoid the hard coded values by reusing the existing shell script python setup and determine a potential built python module via the path of the perf executable. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Collin Funk Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Signed-off-by: Arnaldo Carvalho de Melo commit 73cc6ec1a89a6c443a77b9b93ddcea63b7cea223 Author: NeilBrown Date: Mon Sep 8 11:37:25 2025 +1000 nfsd: discard nfserr_dropit nfserr_dropit hasn't been used for over a decade, since rq_dropme and the RQ_DROPME were introduced. Time to get rid of it completely. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d8e97cc476e33037ac69c5b09b351f5cc8d0589d Author: Eric Biggers Date: Sat Sep 6 16:00:19 2025 -0700 SUNRPC: Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it Make RPCSEC_GSS_KRB5 select CRYPTO instead of depending on it. This unblocks the eventual removal of the selection of CRYPTO from NFSD_V4, which will no longer be needed by nfsd itself due to switching to the crypto library functions. But NFSD_V4 selects RPCSEC_GSS_KRB5, which still needs CRYPTO. It makes more sense for RPCSEC_GSS_KRB5 to select CRYPTO itself, like most other kconfig options that need CRYPTO do. Signed-off-by: Eric Biggers Acked-by: Jeff Layton Signed-off-by: Chuck Lever commit 6304affe45648294229d18cab2b4ba6d40045570 Author: Mike Snitzer Date: Sat Sep 6 17:25:11 2025 -0400 NFSD: Add io_cache_{read,write} controls to debugfs Add 'io_cache_read' to NFSD's debugfs interface so that any data read by NFSD will either be: - cached using page cache (NFSD_IO_BUFFERED=0) - cached but removed from the page cache upon completion (NFSD_IO_DONTCACHE=1). io_cache_read may be set by writing to: /sys/kernel/debug/nfsd/io_cache_read Add 'io_cache_write' to NFSD's debugfs interface so that any data written by NFSD will either be: - cached using page cache (NFSD_IO_BUFFERED=0) - cached but removed from the page cache upon completion (NFSD_IO_DONTCACHE=1). io_cache_write may be set by writing to: /sys/kernel/debug/nfsd/io_cache_write The default value for both settings is NFSD_IO_BUFFERED, which is NFSD's existing behavior for both read and write. Changes to these settings take immediate effect for all exports and NFS versions. Currently only xfs and ext4 implement RWF_DONTCACHE. For file systems that do not implement RWF_DONTCACHE, NFSD use only buffered I/O when the io_cache setting is NFSD_IO_DONTCACHE. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d6e80d48f9c83fc766c1418c584dbba5a0bc9e8a Author: Chuck Lever Date: Fri Sep 5 10:30:37 2025 -0400 NFSD: Do the grace period check in ->proc_layoutget RFC 8881 Section 18.43.3 states: > If the metadata server is in a grace period, and does not persist > layouts and device ID to device address mappings, then it MUST > return NFS4ERR_GRACE (see Section 8.4.2.1). Jeff observed that this suggests the grace period check is better done by the individual layout type implementations, because checking for the server grace period is unnecessary for some layout types. Suggested-by: Jeff Layton Link: https://lore.kernel.org/linux-nfs/7h5p5ktyptyt37u6jhpbjfd5u6tg44lriqkdc7iz7czeeabrvo@ijgxz27dw4sg/T/#t Signed-off-by: Chuck Lever commit eafdd7e949bb412bb6daa1f8c71b61d11c23ca5f Author: Dan Carpenter Date: Thu Sep 4 21:59:30 2025 +0300 nfsd: delete unnecessary NULL check in __fh_verify() In commit 4a0de50a44bb ("nfsd: decouple the xprtsec policy check from check_nfsd_access()") we added a NULL check on "rqstp" to earlier in the function. This check is no longer required so delete it. Signed-off-by: Dan Carpenter Reviewed-by: Scott Mayhew Signed-off-by: Chuck Lever commit e0963ce53b0097a115ad35669b02cf5b87607ebf Author: Sergey Bashirov Date: Thu Sep 4 18:48:44 2025 +0300 NFSD: Allow layoutcommit during grace period If the loca_reclaim field is set to TRUE, this indicates that the client is attempting to commit changes to a layout after the restart of the metadata server during the metadata server's recovery grace period. This type of request may be necessary when the client has uncommitted writes to provisionally allocated byte-ranges of a file that were sent to the storage devices before the restart of the metadata server. See RFC 8881, section 18.42.3. Without this, the client is not able to increase the file size and commit preallocated extents when the block/scsi layout server is restarted during a write and is in a grace period. And when the grace period ends, the client also cannot perform layoutcommit because the old layout state becomes invalid, resulting in file corruption. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit f07c3695bf65220a69a848478bd9099bdeaafa78 Merge: d3479214c05dbd 40d4c761200b79 Author: Linus Torvalds Date: Wed Oct 1 12:52:43 2025 -0700 Merge tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This update includes the following changes: - Removal of the deprecated debug parameter from firewire-ohci module - Replacement of the module-local workqueue in 1394 OHCI PCI driver with a companion IRQ thread - Refactoring of bus management code - Additional minor code cleanup The existing tracepoints serve as an alternative to the removed debug parameter. The use of IRQ thread is experimental, as it handles 1394 OHCI SelfIDComplete event only. It may be replaced in the future releases with another approach; e.g. by providing workqueue from core functionality" * tag 'firewire-updates-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (43 commits) firewire: core: fix undefined reference error in ARM EABI Revert "firewire: core: disable bus management work temporarily during updating topology" Revert "firewire: core: shrink critical section of fw_card spinlock in bm_work" firewire: core: suppress overflow warning when computing jiffies from isochronous cycle firewire: core: minor code refactoring to delete useless local variable firewire: core; eliminate pick_me goto label firewire: core: code refactoring to split contention procedure for bus manager firewire: core: code refactoring for the case of generation mismatch firewire: core: use switch statement to evaluate transaction result to CSR_BUS_MANAGER_ID firewire: core: remove useless generation check firewire: core: use struct_size and flex_array_size in ioctl_add_descriptor firewire: core: shrink critical section of fw_card spinlock in bm_work firewire: core: disable bus management work temporarily during updating topology firewire: core: schedule bm_work item outside of spin lock firewire: core: annotate fw_destroy_nodes with must-hold-lock firewire: core: use spin lock specific to timer for split transaction firewire: core: use spin lock specific to transaction firewire: core: use spin lock specific to topology map firewire: core: maintain phy packet receivers locally in cdev layer firewire: core: use scoped_guard() to manage critical section to update topology ... commit d3479214c05dbd07bc56f8823e7bd8719fcd39a9 Merge: b386ef6286ace3 ba3b29a639fe51 Author: Linus Torvalds Date: Wed Oct 1 12:46:26 2025 -0700 Merge tag 'backlight-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "This set is comprised of a couple of small but important fixes and a number of clean-up and refactoring patches. The fixes correct an EPROM address for the LP8556 and improve memory allocation safety in the LED backlight driver. The remainder of the set is made up of refactoring work to the mp3309c driver and a series of patches to make a number of drivers more self-contained by including their own dependencies. Improvements & Fixes: - Correct the EPROM start address for the LP8556 to align with the device's datasheet. - Use devm_kcalloc() in the LED backlight driver for safer array allocation with overflow protection. Cleanups & Refactoring - Drop an unnecessary call to pwm_apply_args() in the mp3309c driver. - Modernize struct initialization in the mp3309c driver by using a compound literal instead of memset. - Make numerous drivers self-contained by including necessary headers directly rather than relying on transitive includes from the core backlight header" * tag 'backlight-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: rt4831: Include backlight: rave-sp: Include and backlight: led_bl: Include backlight: ktd2801: Include backlight: jornada720: Include backlight: da9052_bl: Include backlight: as3711_bl: Include backlight: apple_dwi_bl: Include backlight: Include video: backlight: lp855x_bl: Set correct EPROM start for LP8556 backlight: led_bl: Use devm_kcalloc() for array space allocation backlight: mp3309c: Initialize backlight properties without memset backlight: mp3309c: Drop pwm_apply_args() commit b386ef6286ace3b7546e641c2243f8d3d4dd3f28 Merge: b4918003cf54f9 64826db1e2e177 Author: Linus Torvalds Date: Wed Oct 1 12:42:13 2025 -0700 Merge tag 'leds-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "This submission is a mix of new features, a number of fixes, some clean-up/refactoring and a few Device Tree binding updates. The most significant changes include new device support for the IS31FL3236A and QNAP's status LEDs, a number of fixes for the Qualcomm flash, LP55xx, MAX77705 and QNAP MCU drivers, along with some generic LED consumer binding documentation and unification. New Support & Features: - Add support for the IS31FL3236A LED driver, including an optional 22kHz PWM frequency setting. - Add support for the red and green status LEDs on QNAP MCU devices. Improvements & Fixes: - Fix an issue in the MAX77705 driver where an error value was assigned but not returned. - Correctly update the torch current clamp setting in the Qualcomm flash LED driver to prevent unexpected clamping. - Add a separate register map for the PMI8998 to the Qualcomm flash LED driver to handle its unique register layout. - Fix the state numbering for the USB LED in the QNAP MCU driver to avoid command conflicts. - Correct the memory programming address calculation for non-paged devices like the LP5562 in the LP55xx driver. - Add Device Tree support to the generic led_get() function, allowing LEDs to be looked up by name. Cleanups & Refactoring: - Fix a spelling mistake in the Kconfig help text for the BD2606MVV driver. - Use devm_mutex_init() in the IS31FL319x driver to simplify code. Device Tree Bindings Updates: - Drop the redundant '-db' suffix from the IS31FL319x binding. - Introduce generic LED consumer bindings for referencing LEDs via phandles. - Unify the 'leds' property across several bindings to use the new generic consumer binding. - Convert the AMS AS3645A LED controller binding to the DT schema format" * tag 'leds-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: as3645: Convert to DT schema leds: led-class: Add Device Tree support to led_get() dt-bindings: leds: Unify 'leds' property dt-bindings: leds: Add generic LED consumer documentation leds: is31fl319x: Use devm_mutex_init() leds: leds-lp55xx: Use correct address for memory programming dt-bindings: leds: issi,is31fl319x: Drop 'db' suffix duplicating dtschema leds: qnap-mcu: Add support for the red and green status LEDs leds: qnap-mcu: Fix state numbering for USB LED leds: flash: leds-qcom-flash: Add a separate register map for PMI8998 leds: flash: leds-qcom-flash: Update torch current clamp setting leds: max77705: Function return instead of variable assignment leds: Kconfig: Fix spelling mistake "limitiation" -> "limitation" leds: leds-is31fl32xx: Add support for is31fl3236a commit b4918003cf54f99004c136c26f96b6df7ab49fac Merge: 2d274536245b58 b9d6cfe2ae699b Author: Linus Torvalds Date: Wed Oct 1 12:04:12 2025 -0700 Merge tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "This round of updates contains a fair amount of new device support, a couple of fixes and some refactoring. The most notable additions include new drivers for Loongson's Security Engine, RNG and TPM, new drivers for TI's TPS6594 Power Button and BQ257xx Charger ICs. The rest of the set provides a return value check fix and a refactoring to use a more modern GPIO API for the VEXPRESS sysreg driver, the removal of a deprecated IRQ ACK function from the MC13xxx RTC driver and a new DT binding for the aforementioned TI BQ257xx charger. New Support & Features: - Add a suite of drivers for the Loongson Security Engine, including the core controller, a Random Number Generator (RNG) and Trusted Platform Module (TPM) support. - Introduce support for the TI TPS6594 PMIC's power button, including the input driver, MFD cell registration, and a system power-off handler. - Add comprehensive support for the TI BQ257xx series of charger ICs, including the core MFD driver and a power supply driver for the charger functionality. Improvements & Fixes: - Check the return value of devm_gpiochip_add_data() in the VEXPRESS sysreg driver to prevent potential silent failures. Cleanups & Refactoring: - Add a MAINTAINERS entry for the new Loongson Security Engine drivers. - Convert the VEXPRESS sysreg driver to use the modern generic GPIO chip API. Removals: - Remove the deprecated and unused mc13xxx_irq_ack() function from the MC13xxx RTC, input and touchscreen drivers. Device Tree Bindings Updates: - Add device tree bindings for the TI BQ25703A charger" * tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (69 commits) mfd: simple-mfd-i2c: Add compatible string for LX2160ARDB mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order dt-bindings: mfd: twl: Add missing sub-nodes for TWL4030 & TWL603x dt-bindings: watchdog: Add SMARC-sAM67 support dt-bindings: mfd: tps6594: Allow gpio-line-names mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs mfd: 88pm886: Add GPADC cell mfd: vexpress-sysreg: Use more common syntax for compound literals mfd: rz-mtu3: Fix MTU5 NFCR register offset mfd: max77705: Setup the core driver as an interrupt controller mfd: cs42l43: Remove IRQ masking in suspend mfd: cs42l43: Move IRQ enable/disable to encompass force suspend mfd: ls2kbmc: Add Loongson-2K BMC reset function support mfd: ls2kbmc: Introduce Loongson-2K BMC core driver mfd: bd71828, bd71815: Prepare for power-supply support dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles dt-bindings: mfd: Convert aspeed,ast2400-p2a-ctrl to DT schema dt-bindings: mfd: fsl,mc13xxx: Add buttons node dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema mfd: macsmc: Add "apple,t8103-smc" compatible ... commit 2d274536245b58a43753a23d84dfadc9df1df489 Merge: e93bcbaa71f47b 7aada81cd75ad8 Author: Linus Torvalds Date: Wed Oct 1 11:54:40 2025 -0700 Merge tag 'mmc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Improve RPMB frame handling code - Add support for a new max-sd-hs-hz DT property to limit frequency - Add support to manage regulator-under-voltage events - Support regulator-under-voltage for eMMC to mitigate data corruptions - Add mmc_read_tuning() to allow a host to validate its tuning sequence - Add some helpers to align checks for CMD23 support - Read the CCCR register for SDIO over SPI rather than the unsupported CMD7 MMC host: - Add COMPILE_TEST option for a couple of drivers - Convert drivers to use the modern PM macros - dw_mmc-exynos: Enable support for the Exynos8890 variant - mmc_spi: Don't use crc ack during multiple block read - renesas_sdhi: Enable 64-bit polling mode for R-Car gen3 and RZ/G2L SoCs - rtsx_usb: Add support for over-current-protection - sdhci-cadence: Add support for multi-block read gap tuning - sdhci-msm: - Add support for tuning for SDR50 mode for SD cards - Enable support for the Lemans variant - sdhci-pci: Disable SD card clock before update for a few Intel platforms - sdhci-pxav3: Add support for UHS pinctrl settings - tmio: Add 64-bit read/write support in polling mode MEMSTICK: - Convert to use timeouts to prevent indefinite waiting - rtsx_usb: Add support for over-current-protection" * tag 'mmc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (77 commits) dt-bindings: mmc: samsung,exynos-dw-mshc: add specific compatible for exynos8890 mmc: select REGMAP_MMIO with MMC_LOONGSON2 mmc: add COMPILE_TEST to multiple drivers mmc: core: Improve RPMB frame handling code mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() mmc: core: Parse and use the new max-sd-hs-hz DT property dt-bindings: mmc: controller: Add max-sd-hs-hz property mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card dt-bindings: mmc: sdhci-msm: Document the Lemans compatible mmc: sh_mmcif: Remove dummy PM resume callback dt-bindings: mmc: sdhci-pxa: Add minItems to pinctrl-names mmc: sdio: Drop dev_pm_domain_detach() call mmc: dw_mmc-rockchip: use modern PM macros mmc: dw_mmc-pci: use modern PM macros mmc: dw_mmc-k3: use modern PM macros mmc: dw_mmc: exynos: use modern PM macros mmc: via-sdmmc: use modern PM macros mmc: sdhci-msm: use modern PM macros mmc: mtk-sd: use modern PM macros mmc: wmt-sdmmc: use modern PM macros ... commit e93bcbaa71f47bcee4972ae3b2ddb5964238bb96 Merge: ea1c6c59252220 bbc3110823eca2 Author: Linus Torvalds Date: Wed Oct 1 11:51:53 2025 -0700 Merge tag 'pmdomain-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: - amlogic: Add support for S6/S7/S7D power-domains controller - imx: Add support for i.MX91 power-domains - marvell: Add support for PXA1908 power-domains - mediatek: - Add support for modem power sequence - Add support for RTFF Hardware in MT8196/MT6991 - qcom: Align power-domain definitions for rpmpd - rockchip: Default to use power-domain support - thead: Create auxiliary device along with a corresponding reset driver - ti: Synchronize on/off state with HW-state for ti-sci power-domains * tag 'pmdomain-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (25 commits) pmdomain: thead: Fix error pointer vs NULL bug in th1520_pd_reboot_init() pmdomain: thead: create auxiliary device for rebooting driver: reset: th1520-aon: add driver for poweroff/reboot via AON FW pmdomain: mediatek: airoha: convert from round_rate() to determine_rate() pmdomain: rockchip: enable ROCKCHIP_PM_DOMAINS with ARCH_ROCKCHIP pmdomain: marvell: Add PXA1908 power domains dt-bindings: clock: marvell,pxa1908: Add syscon compatible to apmu pmdomain: ti-sci: Set PD on/off state according to the HW state pmdomain: amlogic: Add support for S6 S7 S7D power domains controller dt-bindings: power: add Amlogic S6 S7 S7D power domains pmdomain: mediatek: Convert all SoCs to new style regmap retrieval pmdomain: mediatek: Add support for RTFF Hardware in MT8196/MT6991 pmdomain: mediatek: Add support for modem power sequences pmdomain: mediatek: Move ctl sequences out of power_on/off functions pmdomain: mediatek: Handle SoCs with inverted SRAM power-down bits pmdomain: mediatek: Refactor bus protection regmaps retrieval dt-bindings: power: mediatek: Document access-controllers property pmdomain: remove unneeded 'fast_io' parameter in regmap_config pmdomain: imx93-blk-ctrl: mask DSI and PXP PD domain register on i.MX91 pmdomain: imx93-blk-ctrl: use ARRAY_SIZE() instead of hardcode number ... commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa Author: Sakari Ailus Date: Wed Oct 1 13:26:36 2025 +0300 ACPI: property: Return present device nodes only on fwnode interface fwnode_graph_get_next_subnode() may return fwnode backed by ACPI device nodes and there has been no check these devices are present in the system, unlike there has been on fwnode OF backend. In order to provide consistent behaviour towards callers, add a check for device presence by introducing a new function acpi_get_next_present_subnode(), used as the get_next_child_node() fwnode operation that also checks device node presence. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com [ rjw: Kerneldoc comment and changelog edits ] Signed-off-by: Rafael J. Wysocki commit ea1c6c592522208df1dcac9e8f1deb7cc56a51b7 Merge: ad6657804c10f7 2bfb20b65d9bc1 Author: Linus Torvalds Date: Wed Oct 1 11:46:31 2025 -0700 Merge tag 'spi-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "There's one big core change in this release, Jonas Gorski has addressed the issues with multiple chip selects which makes things more robust and stable. Otherwise there's quite a bit of driver work, as well as some new drivers several existing drivers have had quite a bit of work done on them. Possibly the most interesting thing is the VirtIO driver, this is apparently useful for some automotive applications which want to keep as small and robust a host system as they can, moving less critical functionality into guests. - James Clark has done some substantial updates on the Freescale DSPI driver, porting in code from the BSP and building onm top of that to fix some bugs and increase performance - Jonas Gorski has fixed the issues with handling multple chip selects, making things more robust and scalable - Support for higher performance modes in the NXP FSPI driver from Haibo Chen - Removal of the obsolete S3C2443 driver, the underlying SoC support has been removed from the kernel - Support for Amlogic AL113L2, Atmel SAMA7D65 and SAM9x7 and for VirtIO controllers" * tag 'spi-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (74 commits) spi: ljca: Remove Wentong's e-mail address spi: rename SPI_CS_CNT_MAX => SPI_DEVICE_CS_CNT_MAX spi: reduce device chip select limit again spi: don't check spi_controller::num_chipselect when parsing a dt device spi: drop check for validity of device chip selects spi: move unused device CS initialization to __spi_add_device() spi: keep track of number of chipselects in spi_device spi: fix return code when spi device has too many chipselects SPI: Add virtio SPI driver virtio-spi: Add virtio-spi.h virtio: Add ID for virtio SPI spi: rpc-if: Add resume support for RZ/G3E spi: rpc-if: Drop deprecated SIMPLE_DEV_PM_OPS spi: spi-qpic-snand: simplify clock handling by using devm_clk_get_enabled() spi: spi-nxp-fspi: Add OCT-DTR mode support spi: spi-nxp-fspi: add the support for sample data from DQS pad spi: spi-nxp-fspi: Add the DDR LUT command support spi: spi-nxp-fspi: set back to dll override mode when clock rate < 100MHz spi: spi-nxp-fspi: extract function nxp_fspi_dll_override() spi: atmel-quadspi: Add support for sama7d65 QSPI ... commit ad6657804c10f794228461683b6cf1585a313ac9 Merge: c252b8cf1228c7 e6094388519283 Author: Linus Torvalds Date: Wed Oct 1 11:43:54 2025 -0700 Merge tag 'regulator-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a very quiet release for regulator, almost all the changes are new drivers but we do also have some improvements for the Rust bindings. - Additional APIs added to the Rust bindings - Support for Maxim MAX77838, NXP PF0900 and PF5300, Richtek RT5133 and SpacemiT P1" * tag 'regulator-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (28 commits) regulator: dt-bindings: qcom,sdm845-refgen-regulator: document more platforms regulator: Fix MAX77838 selection regulator: spacemit: support SpacemiT P1 regulators regulator: max77838: add max77838 regulator driver dt-bindings: regulator: document max77838 pmic rust: regulator: add devm_enable and devm_enable_optional rust: regulator: remove Regulator regulator: dt-bindings: rpi-panel: Split 7" Raspberry Pi 720x1280 v2 binding regulator: pf530x: Add a driver for the NXP PF5300 Regulator regulator: dt-bindings: nxp,pf530x: Add NXP PF5300/PF5301/PF5302 PMICs regulator: scmi: Use int type to store negative error codes regulator: core: Remove redundant ternary operators rust: regulator: use `to_result` for error handling regulator: consumer.rst: document bulk operations regulator: rt5133: Fix IS_ERR() vs NULL bug in rt5133_validate_vendor_info() regulator: bd718x7: Use kcalloc() instead of kzalloc() regulator: rt5133: Fix spelling mistake "regualtor" -> "regulator" regulator: remove unneeded 'fast_io' parameter in regmap_config regulator: rt5133: Add RT5133 PMIC regulator Support regulator: dt-bindings: Add Richtek RT5133 Support ... commit c252b8cf1228c70f044b5706613950dc283017b7 Merge: d5f74114114cb2 f4672dc6e9c076 Author: Linus Torvalds Date: Wed Oct 1 11:41:51 2025 -0700 Merge tag 'regmap-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This just contains a few small fixes, there's been no substantial development on regmap this release cycle" * tag 'regmap-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: use int type to store negative error codes regmap: Remove superfluous check for !config in __regmap_init() regmap: mmio: Add missing MODULE_DESCRIPTION() commit d5f74114114cb2cdbed75b91ca2fa4482c1d5611 Merge: c050daf69f3edf bc061143637532 Author: Linus Torvalds Date: Wed Oct 1 11:34:12 2025 -0700 Merge tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "There are two new drivers and support for more models in existing ones. The generic GPIO API has been reworked and all users converted which allowed us to move the fields specific to the generic GPIO implementation out of the high-level struct gpio_chip into its own structure that wraps the gpio_chip. Other than that, there's nothing too exciting. Mostly minor tweaks and fixes all over the place, some refactoring and some small new features in helper modules. GPIO core: - add support for sparse pin ranges to the glue between GPIO and pinctrl - use a common prefix across all GPIO descriptor flags for improved namespacing New drivers: - add new GPIO driver for the Nuvoton NCT6694 - add new GPIO driver for MAX7360 Driver improvements: - add support for Tegra 256 to the gpio-tegra186 driver - add support for Loongson-2K0300 to the gpio-loongson-64bit driver - refactor the gpio-aggregator module to expose its GPIO forwarder API to other in-kernel users (to enable merging of a new pinctrl driver that uses it) - convert all remaining drivers to using the modernized generic GPIO chip API and remove the old interface - stop displaying global GPIO numbers in debugfs output of controller drivers - extend the gpio-regmap helper with a new config option and improve its support for GPIO interrupts - remove redundant fast_io parameter from regmap configs in GPIO drivers that already use MMIO regmaps which imply it - add support for a new model in gpio-mmio: ixp4xx expansion bus - order includes alphabetically in a few drivers for better readability - use generic device properties where applicable - use devm_mutex_init() where applicable - extend build coverage of drivers by enabling more to be compiled with COMPILE_TEST enabled - allow building gpio-stmpe as a module - use dev_err_probe() where it makes sense in drivers Late driver fixes: - fix setting GPIO direction to output in gpio-mpfs Documentation: - document the usage of software nodes with GPIO chips Device-tree bindings: - Add DT bindings documents for new hardware: Tegra256, MAX7360 - Document a new model in Loongson bindings: LS2K0300 - Document a new model using the generic GPIO binding: IXP4xx - Convert the DT binding for fsl,mxs-pinctrl to YAML - fix the schema ID in the "trivial" GPIO schema - describe GPIO hogs in the generic GPIO binding" * tag 'gpio-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (122 commits) gpio: mpfs: fix setting gpio direction to output gpio: generic: move GPIO_GENERIC_ flags to the correct header gpio: generic: rename BGPIOF_ flags to GPIO_GENERIC_ gpio: nomadik: fix the debugfs helper stub MAINTAINERS: Add entry on MAX7360 driver input: misc: Add support for MAX7360 rotary input: keyboard: Add support for MAX7360 keypad gpio: max7360: Add MAX7360 gpio support gpio: regmap: Allow to provide init_valid_mask callback gpio: regmap: Allow to allocate regmap-irq device pwm: max7360: Add MAX7360 PWM support pinctrl: Add MAX7360 pinctrl driver mfd: Add max7360 support dt-bindings: mfd: gpio: Add MAX7360 rtc: Add Nuvoton NCT6694 RTC support hwmon: Add Nuvoton NCT6694 HWMON support watchdog: Add Nuvoton NCT6694 WDT support can: Add Nuvoton NCT6694 CANFD support i2c: Add Nuvoton NCT6694 I2C support gpio: Add Nuvoton NCT6694 GPIO support ... commit 9f0fa213790e3633d37e981386da99149573135b Author: James Clark Date: Wed Aug 13 14:38:51 2025 +0100 perf test: Extend branch stack sampling test for Arm64 BRBE BRBE emits IRQ and ERET branches for branching and returning from trapped instructions. Add a test that loops on a trapped instruction (MRS - Read special register) for this. Extend the expected 'any_call' branches to include FAULT_DATA and FAULT_INST as these are emitted by BRBE. Reviewed-by: Ian Rogers Co-developed-by: German Gomez Signed-off-by: German Gomez Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit 11e59335b0d1c4bc259ee6f0533e04c4b3a9f1dd Author: James Clark Date: Wed Aug 13 14:38:50 2025 +0100 perf test: Add syscall and address tests to brstack test Test that SYSCALL type branches are emitted from the expected 'getppid' symbol. Test that when only 'k' is used, sources addresses are all in the kernel. Test that no kernel addresses leak by checking for them in the 'u' test. Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit f15548b277cc107d41b88b1a63bd4942b703666b Author: James Clark Date: Wed Aug 13 14:38:49 2025 +0100 perf test: Refactor brstack test check_branches() will be used by other tests in a later commit so make it a function. And the any_call filters are duplicated and will also be extended in a later commit, so move them to a variable. No functional changes intended. Reviewed-by: Ian Rogers Signed-off-by: James Clark Cc: Adam Young Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Anshuman Khandual Cc: German Gomez Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Rob Herring Cc: Will Deacon Signed-off-by: Arnaldo Carvalho de Melo commit b91917c0c6fa6df97ec0222d8d6285ab2d60c21b Author: Ian Rogers Date: Wed Oct 1 11:12:28 2025 -0700 perf bpf_counter: Fix handling of cpumap fixing hybrid Don't open evsels on all CPUs, open them just on the CPUs they support. This avoids opening say an e-core event on a p-core and getting a failure - achieve this by getting rid of the "all_cpu_map". In install_pe functions don't use the cpu_map_idx as a CPU number, translate the cpu_map_idx, which is a dense index into the cpu_map skipping holes at the beginning, to a proper CPU number. Before: ``` $ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 Performance counter stats for 'system wide': cpu_atom/cycles/ 566,270,672 cpu_core/cycles/ cpu_atom/instructions/ 572,792,836 cpu_core/instructions/ # 1.01 insn per cycle 1.001595384 seconds time elapsed ``` After: ``` $ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1 Performance counter stats for 'system wide': 443,299,201 cpu_atom/cycles/ 1,233,919,737 cpu_core/cycles/ 213,634,112 cpu_atom/instructions/ # 0.48 insn per cycle 2,758,965,527 cpu_core/instructions/ # 2.24 insn per cycle 1.001699485 seconds time elapsed ``` Fixes: 7fac83aaf2eecc9e ("perf stat: Introduce 'bperf' to share hardware PMCs with BPF") Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: bpf@vger.kernel.org Cc: Gabriele Monaco Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Tengda Wu Signed-off-by: Arnaldo Carvalho de Melo commit 8c519a825b4add85b63531869d4a813511e6234b Author: Ian Rogers Date: Wed Oct 1 11:12:27 2025 -0700 perf bpf_counter: Move header declarations into C code Reduce the API surface that is in bpf_counter.h, this helps compiler analysis like unused static function, makes it easier to set a breakpoint and just makes it easier to see the code is self contained. When code is shared between BPF C code, put it inside HAVE_BPF_SKEL. Move transitively found #includes into appropriate C files. No functional change. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Gabriele Monaco Cc: Howard Chu Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Song Liu Cc: Tengda Wu Signed-off-by: Arnaldo Carvalho de Melo commit ac3ad9845b9faf9cf29a736eaac00703bc821ac1 Author: Bharath SM Date: Tue Sep 2 16:46:03 2025 +0530 smb: client: show lease state as R/H/W (or NONE) in open_files Print the lease/oplock caching state for each open file as a compact string of letters: R (read), H (handle), W (write). Signed-off-by: Bharath SM Signed-off-by: Steve French commit c050daf69f3edf72e274eaa321f663b1779c4391 Merge: 989253cc46ff3f 8f2689f194b8d1 Author: Linus Torvalds Date: Wed Oct 1 10:33:17 2025 -0700 Merge tag 'pwm/for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "The core highlights for this cycle are: - The pca9586 driver was converted to the waveform API - Waveform drivers automatically provide a gpio chip to make PWMs usable as GPIOs (The pca9586 driver did that in a driver specific implementation before) Otherwise it's the usual mix of fixes and device tree and driver changes to support new hardware variants" * tag 'pwm/for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (30 commits) pwm: cros-ec: Avoid -Wflex-array-member-not-at-end warnings dt-bindings: pwm: samsung: add exynos8890 compatible dt-bindings: pwm: apple,s5l-fpwm: Add t6020-fpwm compatible dt-bindings: pwm: nxp,lpc1850-sct-pwm: Minor whitespace cleanup in example pwm: pca9586: Convert to waveform API pwm: pca9685: Drop GPIO support pwm: pca9685: Make use of register caching in regmap pwm: pca9685: Use bulk write to atomicially update registers pwm: pca9685: Don't disable hardware in .free() pwm: Add the S32G support in the Freescale FTM driver dt-bindings: pwm: fsl,vf610-ftm-pwm: Add compatible for s32g2 and s32g3 pwm: mediatek: Lock and cache clock rate pwm: mediatek: Fix various issues in the .apply() callback pwm: mediatek: Implement .get_state() callback pwm: mediatek: Initialize clks when the hardware is enabled at probe time pwm: mediatek: Rework parameters for clk helper function pwm: mediatek: Introduce and use a few more register defines pwm: mediatek: Simplify representation of channel offsets pwm: tiecap: Document behaviour of hardware disable pwm: Provide a gpio device for waveform drivers ... commit 989253cc46ff3f4973495b58e02c7fcb1ffb713e Merge: 57cf7a603b6d25 76bb6969a8cfc5 Author: Linus Torvalds Date: Wed Oct 1 09:42:51 2025 -0700 Merge tag 'hwmon-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Kontron SMARC-sAM67 - GPD device sensors - MP29502 - MP2869, MP29608, MP29612 and MP29816 series Added chip support to existing drivers: - asus-ec-sensors: Add B650E-I Add PRIME Z270-A Add Pro WS WRX90E-SAGE SE Add ROG STRIX X670E-E GAMING WIFI Add ROG STRIX X870-I GAMING WIFI Add ROG STRIX X870E-E GAMING WIFI Add ROG STRIX Z690-E GAMING WIFI Add ROG STRIX Z790E GAMING WIFI II Add STRIX B850-I GAMING WIFI Add TUF GAMING X670E PLUS WIFI Add X670E-I GAMING WIFI Add Z790-I GAMING WIFI - dell-smm: Add support for Dell OptiPlex 7040 - ina238: Major cleanup, and Add support for INA700 Add support for INA780 - k10temp: Add device ID for Strix Halo Add support for AMD Family 1Ah-based models - lenovo-ec-sensors: Update P8 supprt - lm75: Add NXP P3T1750 support - pmbus/adm1275: Add sq24905c support - pmbus/isl68137: Add support for Renesas RAA228244 and RAA228246 - pmbus/mp5990: Add support for MP5998 - sht21: Add support for SHT20, SHT25 - sl28cpld: Add sa67mcu compatible Other notable changes: - core: Handle locking internally Introduce 64-bit energy attribute support - cros_ec: Register into thermal framework, improve PWM control - lm75: allow interrupt for ti,tmp75 - mlxreg-fan: Add support for new flavour of capability register - sbtsi_temp: AMD CPU extended temperature range support - sht21: Add devicetree support Various other minor improvements and fixes" * tag 'hwmon-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (86 commits) dt-bindings: hwmon: (lm75) allow interrupt for ti,tmp75 hwmon: (mlxreg-fan) Add support for new flavour of capability register hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems hwmon: (cros_ec) register fans into thermal framework cooling devices hwmon: (cros_ec) add PWM control over fans platform/chrome: update pwm fan control host commands hwmon: add SMARC-sAM67 support dt-bindings: hwmon: sl28cpld: add sa67mcu compatible hwmon: (asus-ec-sensors) add TUF GAMING X670E PLUS WIFI hwmon: (dell-smm) Add support for Dell OptiPlex 7040 hwmon: (dell-smm) Add support for automatic fan mode hwmon: (gpd-fan) complete Kconfig dependencies hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex hwmon: (asus-ec-sensors) add ROG STRIX X870E-E GAMING WIFI hwmon: (dell-smm) Move clamping of fan speed out of i8k_set_fan() hwmon: (dell-smm) Remove Dell Precision 490 custom config data hwmon: (asus-ec-sensors) add ROG STRIX X670E-E GAMING WIFI hwmon: (gpd-fan) Fix range check for pwm input hwmon: (pmbus/mp5990) add support for MP5998 dt-bindings: trivial-devices: add mps,mp5998 ... commit 57cf7a603b6d2524edffaa3068d9aa7a41641d93 Merge: eb3289fc474f74 48633acccf38d7 Author: Linus Torvalds Date: Wed Oct 1 09:16:28 2025 -0700 Merge tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New: - Add a new API cros_ec_device_registered() for checking if the cros_ec_deivce is ready Improvements: - Use TRAILING_OVERLAP() to fix -Wflex-array-member-not-at-end warning - Defer probe until parent EC device is ready in cros_ec_keyb Cleanups: - Remove redundant and simplify code in cros_ec_chardev - Centralize cros_ec_device allocation and initialization to remove duplicate code" * tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: Input: cros_ec_keyb - Defer probe until parent EC device is registered platform/chrome: cros_ec: Add a flag to track registration state platform/chrome: cros_ec: Separate initialization from cros_ec_register() platform/chrome: Centralize common cros_ec_device initialization platform/chrome: Centralize cros_ec_device allocation platform/chrome: wilco_ec: Remove redundant semicolons platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warning platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev platform/chrome: cros_ec_chardev: Remove redundant struct field commit eb3289fc474f74105e0627bf508e3f9742fd3b63 Merge: 50c19e20ed2ef3 6d97171ac6585d Author: Linus Torvalds Date: Wed Oct 1 08:39:23 2025 -0700 Merge tag 'driver-core-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Auxiliary: - Drop call to dev_pm_domain_detach() in auxiliary_bus_probe() - Optimize logic of auxiliary_match_id() Rust: - Auxiliary: - Use primitive C types from prelude - DebugFs: - Add debugfs support for simple read/write files and custom callbacks through a File-type-based and directory-scope-based API - Sample driver code for the File-type-based API - Sample module code for the directory-scope-based API - I/O: - Add io::poll module and implement Rust specific read_poll_timeout() helper - IRQ: - Implement support for threaded and non-threaded device IRQs based on (&Device, IRQ number) tuples (IrqRequest) - Provide &Device cookie in IRQ handlers - PCI: - Support IRQ requests from IRQ vectors for a specific pci::Device - Implement accessors for subsystem IDs, revision, devid and resource start - Provide dedicated pci::Vendor and pci::Class types for vendor and class ID numbers - Implement Display to print actual vendor and class names; Debug to print the raw ID numbers - Add pci::DeviceId::from_class_and_vendor() helper - Use primitive C types from prelude - Various minor inline and (safety) comment improvements - Platform: - Support IRQ requests from IRQ vectors for a specific platform::Device - Nova: - Use pci::DeviceId::from_class_and_vendor() to avoid probing non-display/compute PCI functions - Misc: - Add helper for cpu_relax() - Update ARef import from sync::aref sysfs: - Remove bin_attrs_new field from struct attribute_group - Remove read_new() and write_new() from struct bin_attribute Misc: - Document potential race condition in get_dev_from_fwnode() - Constify node_group argument in software node registration functions - Fix order of kernel-doc parameters in various functions - Set power.no_pm flag for faux devices - Set power.no_callbacks flag along with the power.no_pm flag - Constify the pmu_bus bus type - Minor spelling fixes" * tag 'driver-core-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (43 commits) rust: pci: display symbolic PCI vendor names rust: pci: display symbolic PCI class names rust: pci: fix incorrect platform reference in PCI driver probe doc comment rust: pci: fix incorrect platform reference in PCI driver unbind doc comment perf: make pmu_bus const samples: rust: Add scoped debugfs sample driver rust: debugfs: Add support for scoped directories samples: rust: Add debugfs sample driver rust: debugfs: Add support for callback-based files rust: debugfs: Add support for writable files rust: debugfs: Add support for read-only files rust: debugfs: Add initial support for directories driver core: auxiliary bus: Optimize logic of auxiliary_match_id() driver core: auxiliary bus: Drop dev_pm_domain_detach() call driver core: Fix order of the kernel-doc parameters driver core: get_dev_from_fwnode(): document potential race drivers: base: fix "publically"->"publicly" driver core/PM: Set power.no_callbacks along with power.no_pm driver core: faux: Set power.no_pm for faux devices rust: pci: inline several tiny functions ... commit c86a24dfa902fc27dd4d7ce138b25315f7241d47 Author: Christian Bruel Date: Wed Aug 20 09:54:07 2025 +0200 MAINTAINERS: Add entry for ST STM32MP25 PCIe drivers Add myself as maintainer of STM32MP25 PCIe host and PCIe endpoint drivers. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-8-christian.bruel@foss.st.com commit 151f3d29baf405bc203f0a02beb4d33604410943 Author: Christian Bruel Date: Wed Aug 20 09:54:06 2025 +0200 PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25 Add driver to configure the STM32MP25 SoC PCIe controller based on the DesignWare PCIe core in endpoint mode. Controller support 2.5 and 5 GT/s data rates and uses the common reference clock provided by the host. The PCIe core_clk receives the pipe0_clk from the ComboPHY as input, and the ComboPHY PLL must be locked for pipe0_clk to be ready. Consequently, PCIe core registers cannot be accessed until the ComboPHY is fully initialised and REFCLK is enabled and ready. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash in https://patch.msgid.link/20250902122641.269725-1-christian.bruel@foss.st.com to remove redundant link_status checks] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-7-christian.bruel@foss.st.com commit b8ef623f18da24ee9e1cf9bef66dacd2e8574902 Author: Christian Bruel Date: Wed Aug 20 09:54:05 2025 +0200 dt-bindings: PCI: Add STM32MP25 PCIe Endpoint bindings STM32MP25 PCIe Controller is based on the DesignWare core configured as endpoint mode from the SYSCFG register. Signed-off-by: Christian Bruel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250820075411.1178729-6-christian.bruel@foss.st.com commit 63a562b33a9c6b4359bfb5a9c7f5d26a85c40fe1 Author: Christian Bruel Date: Wed Aug 20 09:54:04 2025 +0200 PCI: stm32: Add PCIe host support for STM32MP25 Add driver for the STM32MP25 SoC PCIe controller based on the DesignWare PCIe core. Controller supports 2.5 and 5 GT/s data rates, MSI via GICv2m, Single Virtual Channel, Single Function and WAKE# GPIO. Signed-off-by: Christian Bruel [mani: reworded description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash error handling cleanup from Christophe JAILLET : https://patch.msgid.link/e69ade3edcec4da2d5bfc66e0d03bbcb5a857021.1759169956.git.christophe.jaillet@wanadoo.fr] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250820075411.1178729-5-christian.bruel@foss.st.com commit a8de554774ae48efbe48ace79f8badae2daa2bf1 Author: Ma Ke Date: Tue Sep 30 16:16:18 2025 +0800 of: unittest: Fix device reference count leak in of_unittest_pci_node_verify In of_unittest_pci_node_verify(), when the add parameter is false, device_find_any_child() obtains a reference to a child device. This function implicitly calls get_device() to increment the device's reference count before returning the pointer. However, the caller fails to properly release this reference by calling put_device(), leading to a device reference count leak. Add put_device() in the else branch immediately after child_dev is no longer needed. As the comment of device_find_any_child states: "NOTE: you will need to drop the reference with put_device() after use". Found by code review. Cc: stable@vger.kernel.org Fixes: 26409dd04589 ("of: unittest: Add pci_dt_testdrv pci driver") Signed-off-by: Ma Ke Signed-off-by: Rob Herring (Arm) commit 4335c4496b1bcf8e85761af23550a180e937bac6 Author: Nathan Chancellor Date: Thu Sep 25 19:03:04 2025 -0400 btrfs: fix PAGE_SIZE format specifier in open_ctree() There is an instance of -Wformat when targeting 32-bit architectures due to using a 'size_t' specifier (which is 'unsigned int' for 32-bit platforms) to print PAGE_SIZE: In file included from fs/btrfs/compression.h:17, from fs/btrfs/extent_io.h:15, from fs/btrfs/locking.h:13, from fs/btrfs/ctree.h:19, from fs/btrfs/disk-io.c:22: fs/btrfs/disk-io.c: In function 'open_ctree': include/linux/kern_levels.h:5:25: error: format '%zu' expects argument of type 'size_t', but argument 4 has type 'long unsigned int' [-Werror=format=] ... fs/btrfs/disk-io.c:3398:17: note: in expansion of macro 'btrfs_warn' 3398 | btrfs_warn(fs_info, | ^~~~~~~~~~ PAGE_SIZE is consistently defined as an 'unsigned long' in include/vsdo/page.h so use '%lu' to clear up the warning. Fixes: 98077f7f2180 ("btrfs: enable experimental bs > ps support") Reviewed-by: Qu Wenruo Tested-by: Geert Uytterhoeven Signed-off-by: Nathan Chancellor Reviewed-by: David Sterba Signed-off-by: David Sterba commit 60c38a6d38053be24deca331f9f35cf368400352 Author: Suchit Karunakaran Date: Tue Sep 23 23:12:36 2025 +0530 perf annotate: Use architecture-agnostic register limit Remove the arch-specific guard around TYPE_STATE_MAX_REGS and define it as 32 for all architectures. The architecture that perf is built on may not match the architecture that produced the perf.data file, so relying on __powerpc__ or similar is fragile. Using 32 as a fixed upper bound is safe since it is greater than the previous maximum of 16. Add a comment to clarify that TYPE_STATE_MAX_REGS is an arch-independent maximum rather than a build-time choice. Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Suchit Karunakaran Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Shuah Khan Signed-off-by: Arnaldo Carvalho de Melo commit 6c153cc4684a13af86780cfe293db7b4b4d6739d Author: Kan Liang Date: Thu Sep 25 09:24:28 2025 -0700 MAINTAINERS: Remove myself from perf_events subsystem I'm stepping down as the Reviewer of perf_events subsystem. It has been an honor and a pleasure to work with everyone to improve the perf_events subsystem. However, due to personal reasons, I have to leave Intel. I believe it would be difficult for me to continue in this role any further. Signed-off-by: Kan Liang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dave Hansen Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit a0dfb18f7d20ae0b7b5f513fd65882af105bb771 Author: Athira Rajeev Date: Tue Sep 16 10:55:36 2025 +0530 perf script: Enable to present DTL entries The process_event() function in "builtin-script.c" invokes perf_sample__fprintf_synth() for displaying PERF_TYPE_SYNTH type events. if (attr->type == PERF_TYPE_SYNTH && PRINT_FIELD(SYNTH)) perf_sample__fprintf_synth(sample, evsel, fp); perf_sample__fprintf_synth() process the sample depending on the value in evsel->core.attr.config. Introduce perf_sample__fprintf_synth_vpadtl() and invoke this for PERF_SYNTH_POWERPC_VPA_DTL Sample output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf script perf 13322 [002] 233.835807: sched:sched_switch: perf:13322 [120] R ==> migration/2:27 [0] migration/2 27 [002] 233.835811: sched:sched_migrate_task: comm=perf pid=13322 prio=120 orig_cpu=2 dest_cpu=3 migration/2 27 [002] 233.835818: sched:sched_stat_runtime: comm=migration/2 pid=27 runtime=9214 [ns] migration/2 27 [002] 233.835819: sched:sched_switch: migration/2:27 [0] S ==> swapper/2:0 [120] swapper 0 [002] 233.835822: vpa-dtl: timebase: 338954486062657 dispatch_reason:decrementer_interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:435, ready_to_enqueue_time:0, waiting_to_ready_time:34775058, processor_id: 202 c0000000000f8094 plpar_hcall_norets_notrace+0x18 ([kernel.kallsyms]) swapper 0 [001] 233.835886: vpa-dtl: timebase: 338954486095398 dispatch_reason:priv_doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:542, ready_to_enqueue_time:0, waiting_to_ready_time:1245360, processor_id: 201 c0000000000f8094 plpar_hcall_norets_notrace+0x18 ([kernel.kallsyms]) Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 8644834a482a94e7da391a09af4d7f3672a5a400 Author: Athira Rajeev Date: Tue Sep 16 10:55:35 2025 +0530 perf powerpc: Process the DTL entries in queue and deliver samples Create samples from DTL entries for displaying in 'perf report' and 'perf script'. When the different PERF_RECORD_XX records are processed from perf session, powerpc_vpadtl_process_event() will be invoked. For each of the PERF_RECORD_XX record, compare the timestamp of perf record with timestamp of top element in the auxtrace heap. Process the auxtrace queue if the timestamp of element from heap is lower than timestamp from entry in perf record. Sometimes it could happen that one buffer is only partially processed. if the timestamp of occurrence of another event is more than currently processed element in the queue, it will move on to next perf record. So keep track of position of buffer to continue processing next time. Update the timestamp of the auxtrace heap with the timestamp of last processed entry from the auxtrace buffer. Generate perf sample for each entry in the dispatch trace log. Fill in the sample details: - sample ip is picked from srr0 field of dtl_entry - sample cpu is picked from processor_id of dtl_entry - sample id is from sample_id of powerpc_vpadtl - cpumode is set to PERF_RECORD_MISC_KERNEL - Additionally save the details in raw_data of sample. This is to print the relevant fields in perf_sample__fprintf_synth() when called from builtin-script The sample is processed by calling perf_session__deliver_synth_event() so that it gets included in perf report. Sample Output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf report # Samples: 321 of event 'vpa-dtl' # Event count (approx.): 321 # # Children Self Command Shared Object Symbol # ........ ........ ....... ................. .............................. # 100.00% 100.00% swapper [kernel.kallsyms] [k] plpar_hcall_norets_notrace Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit cd1c3b730a2a0455b405d7ecbd02a63b51cdc04b Author: Athira Rajeev Date: Tue Sep 16 10:55:34 2025 +0530 perf powerpc: Allocate and setup aux buffer queue to help co-relate with other events across CPU's When the Dispatch Trace Log data is collected along with other events like sched tracepoint events, it needs to be correlated and present interleaved along with these events. Perf events can be collected parallely across the CPUs. Hence it needs to be ensured events/dtl entries are processed in timestamp order. An auxtrace_queue is created for each CPU. Data within each queue is in increasing order of timestamp. Each auxtrace queue has a array/list of auxtrace buffers. When processing the auxtrace buffer, the data is mmapp'ed. All auxtrace queues is maintained in auxtrace heap. Each queue has a queue number and a timestamp. The queues are sorted/added to head based on the time stamp. So always the lowest timestamp (entries to be processed first) is on top of the heap. The auxtrace queue needs to be allocated and heap needs to be populated in the sorted order of timestamp. The queue needs to be filled with data only once via powerpc_vpadtl__update_queues() function. powerpc_vpadtl__setup_queues() iterates through all the entries to allocate and setup the auxtrace queue. To add to auxtrace heap, it is required to fetch the timebase of first entry for each of the queue. The first entry in the queue for VPA DTL PMU has the boot timebase, frequency details which are needed to get timestamp which is required to correlate with other events. The very next entry is the actual trace data that provides timestamp for occurrence of DTL event. Formula used to get the timestamp from dtl entry is: ((timbase from DTL entry - boot time) / frequency) * 1000000000 powerpc_vpadtl_decode() adds the boot time and frequency as part of powerpc_vpadtl_queue structure so that it can be reused. Each of the dtl_entry is of 48 bytes size. Sometimes it could happen that one buffer is only partially processed (if the timestamp of occurrence of another event is more than currently processed element in queue, it will move on to next event). In order to keep track of position of buffer, additional fields is added to powerpc_vpadtl_queue structure. Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 71feffa9c08675f65192a6b0d6ce168c620ba49a Author: Athira Rajeev Date: Tue Sep 16 10:55:33 2025 +0530 perf powerpc: Add event name as vpa-dtl of PERF_TYPE_SYNTH type to present DTL samples Dispatch Trace Log details are captured as-is in PERF_RECORD_AUXTRACE records. To present dtl entries as samples, create an event with name as "vpa-dtl" and type PERF_TYPE_SYNTH. Add perf_synth_id, "PERF_SYNTH_POWERPC_VPA_DTL" as config value for the event. Create a sample id to be a fixed offset from evsel id. To present the relevant fields from the "struct dtl_entry", prepare the entries as events of type PERF_TYPE_SYNTH. By defining as PERF_TYPE_SYNTH type, samples can be printed as part of perf_sample__fprintf_synth in builtin-script.c From powerpc_vpadtl_process_auxtrace_info(), invoke auxtrace_queues__process_index() function which will queue the auxtrace buffers by invoke auxtrace_queues__add_event(). Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit c4bbd4ec2e50a9ed7cc379556223977147c59278 Author: Athira Rajeev Date: Tue Sep 16 10:55:32 2025 +0530 perf powerpc: Process auxtrace events and display in 'perf report -D' Add VPA DTL PMU auxtrace process function for "perf report -D". The auxtrace event processing functions are defined in file "util/powerpc-vpadtl.c". Data structures used includes "struct powerpc_vpadtl_queue", "struct powerpc_vpadtl" to store the auxtrace buffers in queue. Different PERF_RECORD_XXX are generated during recording. PERF_RECORD_AUXTRACE_INFO is processed first since it is of type perf_user_event_type and perf session event delivers perf_session__process_user_event() first. Define function powerpc_vpadtl_process_auxtrace_info() to handle the processing of PERF_RECORD_AUXTRACE_INFO records. In this function, initialize the aux buffer queues using auxtrace_queues__init(). Setup the required infrastructure for aux data processing. The data is collected per CPU and auxtrace_queue is created for each CPU. Define powerpc_vpadtl_process_event() function to process PERF_RECORD_AUXTRACE records. In this, add the event to queue using auxtrace_queues__add_event() and process the buffer in powerpc_vpadtl_dump_event(). The first entry in the buffer with timebase as zero has boot timebase and frequency. Remaining data is of format for "struct powerpc_vpadtl_entry". Define the translation for dispatch_reasons and preempt_reasons, report this when dump trace is invoked via powerpc_vpadtl_dump() Sample output: ./perf record -a -e sched:*,vpa_dtl/dtl_all/ -c 1000000000 sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.300 MB perf.data ] ./perf report -D 0 0 0x39b10 [0x30]: PERF_RECORD_AUXTRACE size: 0x690 offset: 0 ref: 0 idx: 0 tid: -1 cpu: 0 . . ... VPA DTL PMU data: size 1680 bytes, entries is 35 . 00000000: boot_tb: 21349649546353231, tb_freq: 512000000 . 00000030: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:7064, ready_to_enqueue_time:187, waiting_to_ready_time:6611773 . 00000060: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:146, ready_to_enqueue_time:0, waiting_to_ready_time:15359437 . 00000090: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:4868, ready_to_enqueue_time:232, waiting_to_ready_time:5100709 . 000000c0: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:179, ready_to_enqueue_time:0, waiting_to_ready_time:30714243 . 000000f0: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:197, ready_to_enqueue_time:0, waiting_to_ready_time:15350648 . 00000120: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:213, ready_to_enqueue_time:0, waiting_to_ready_time:15353446 . 00000150: dispatch_reason:priv doorbell, preempt_reason:H_CEDE, enqueue_to_dispatch_time:212, ready_to_enqueue_time:0, waiting_to_ready_time:15355126 . 00000180: dispatch_reason:decrementer interrupt, preempt_reason:H_CEDE, enqueue_to_dispatch_time:6368, ready_to_enqueue_time:164, waiting_to_ready_time:5104665 Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 1dbfaf94cf66ec4b19945aa4c76901e4af292a48 Author: Athira Rajeev Date: Tue Sep 16 10:55:31 2025 +0530 perf powerpc: Add basic CONFIG_AUXTRACE support for VPA pmu on powerpc The powerpc PMU collecting Dispatch Trace Log (DTL) entries makes use of AUX support in perf infrastructure. The PMU driver has the functionality to collect trace entries in the aux buffer. On the tools side, this data is made available as PERF_RECORD_AUXTRACE records. This record is generated by "perf record" command. To enable the creation of PERF_RECORD_AUXTRACE, add functions to initialize auxtrace records ie "auxtrace_record__init()". Fill in fields for other callbacks like info_priv_size, info_fill, free, recording options etc. Define auxtrace_type as PERF_AUXTRACE_VPA_DTL. Add header file to define vpa dtl pmu specific details. Reviewed-by: Adrian Hunter Signed-off-by: Athira Rajeev Tested-by: Tejas Manhas Tested-by: Venkat Rao Bagalkote Cc: Aboorva Devarajan Cc: Aditya Bodkhe Cc: Hari Bathini Cc: Ian Rogers Cc: Jiri Olsa Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: Shrikanth Hegde Signed-off-by: Arnaldo Carvalho de Melo commit 58a606149c60d5da554302a7a08234cf3ca259f4 Author: Ian Rogers Date: Sun Sep 14 11:33:53 2025 -0700 perf sched: Avoid union type punning undefined behavior A union is used to set the priv value in thread (a void*) to a boolean value through type punning. Undefined behavior sanitizer fails on this. Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit 4e66293bb141df33d5eb1f922e16fe05913bf296 Author: Bhanu Seshu Kumar Valluri Date: Wed Oct 1 14:27:16 2025 +0530 of: doc: Fix typo in doc comments. synthetized => synthesized definied => defined sucess => success Signed-off-by: Bhanu Seshu Kumar Valluri Signed-off-by: Rob Herring (Arm) commit f9a68cf7b9afeb1780527f840995fc4292a2202a Author: Akiyoshi Kurita Date: Tue Sep 30 22:45:47 2025 +0900 dt-bindings: mmc: Correct typo "upto" to "up to" The word "upto" is a typo for "up to". Correct this typo in the mmc-controller-common binding documentation. Signed-off-by: Akiyoshi Kurita Signed-off-by: Rob Herring (Arm) commit 241f21be7d0fdf3c1792ed7e61f90a9f5eecd03e Author: Veronika Molnarova Date: Tue Sep 30 18:09:17 2025 +0200 perf test perftool_testsuite: Use absolute paths Test cases from perftool_testsuite are affected by the current directory where the test are run. For this reason, the test driver has to change the directory to the base_dir for references to work correctly. Utilize absolute paths when sourcing and referencing other scripts so that the current working directory doesn't impact the test cases. Reviewed-by: Ian Rogers Signed-off-by: Jakub Brnak Signed-off-by: Michael Petlan Signed-off-by: Veronika Molnarova Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo commit a93b9ccb03a2b27c49bdadb0e2da036451794f92 Author: Markus Heidelberg Date: Thu Sep 25 13:26:13 2025 +0200 perf tools: Fix duplicated words in documentation and comments - "the the" - "in in" - "a a" Reviewed-by: Ian Rogers Signed-off-by: Markus Heidelberg Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit fa06c482790ce425dd090c051934023c0b49dcc2 Merge: 950c6451a5c38d ba6018929165fc Author: Rafael J. Wysocki Date: Wed Oct 1 13:59:28 2025 +0200 Merge tag 'cpufreq-arm-updates-6.18-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge CPUFreq fixes for 6.18 from Viresh Kumar: "- Update frequency for all tegra CPUs (Aaron Kling). - Fix device leak in mediatek driver (Johan Hovold). - Rust cpufreq helper cleanup (Thorsten Blum)." * tag 'cpufreq-arm-updates-6.18-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: tegra186: Initialize all cores to max frequencies cpufreq: tegra186: Set target frequency for all cpus in policy rust: cpufreq: streamline find_supply_names cpufreq: mediatek: fix device leak on probe failure commit 950c6451a5c38d375993c3b9da427e2e69b01c30 Author: Rafael J. Wysocki Date: Fri Sep 26 12:31:47 2025 +0200 cpufreq: Drop unused symbol CPUFREQ_ETERNAL Drop CPUFREQ_ETERNAL that has no users any more along with all references to it in the documentation. No functional impact. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit c28a280bd465690981099cd6e43dfcfa5c28b133 Author: Rafael J. Wysocki Date: Fri Sep 26 12:29:50 2025 +0200 ACPI: CPPC: Do not use CPUFREQ_ETERNAL as an error value Instead of using CPUFREQ_ETERNAL for signaling an error condition in cppc_get_transition_latency(), change the return value type of that function to int and make it return a proper negative error code on failures. No intentional functional impact. Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit f965d111e68f4a993cc44d487d416e3d954eea11 Author: Rafael J. Wysocki Date: Fri Sep 26 12:19:41 2025 +0200 cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay If cppc_get_transition_latency() returns CPUFREQ_ETERNAL to indicate a failure to retrieve the transition latency value from the platform firmware, the CPPC cpufreq driver will use that value (converted to microseconds) as the policy transition delay, but it is way too large for any practical use. Address this by making the driver use the cpufreq's default transition latency value (in microseconds) as the transition delay if CPUFREQ_ETERNAL is returned by cppc_get_transition_latency(). Fixes: d4f3388afd48 ("cpufreq / CPPC: Set platform specific transition_delay_us") Cc: 5.19+ # 5.19 Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Acked-by: Viresh Kumar Reviewed-by: Qais Yousef commit f97aef092e199c10a3da96ae79b571edd5362faa Author: Rafael J. Wysocki Date: Fri Sep 26 12:12:37 2025 +0200 cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency Commit a755d0e2d41b ("cpufreq: Honour transition_latency over transition_delay_us") caused platforms where cpuinfo.transition_latency is CPUFREQ_ETERNAL to get a very large transition latency whereas previously it had been capped at 10 ms (and later at 2 ms). This led to a user-observable regression between 6.6 and 6.12 as described by Shawn: "The dbs sampling_rate was 10000 us on 6.6 and suddently becomes 6442450 us (4294967295 / 1000 * 1.5) on 6.12 for these platforms because the default transition delay was dropped [...]. It slows down dbs governor's reacting to CPU loading change dramatically. Also, as transition_delay_us is used by schedutil governor as rate_limit_us, it shows a negative impact on device idle power consumption, because the device gets slightly less time in the lowest OPP." Evidently, the expectation of the drivers using CPUFREQ_ETERNAL as cpuinfo.transition_latency was that it would be capped by the core, but they may as well return a default transition latency value instead of CPUFREQ_ETERNAL and the core need not do anything with it. Accordingly, introduce CPUFREQ_DEFAULT_TRANSITION_LATENCY_NS and make all of the drivers in question use it instead of CPUFREQ_ETERNAL. Also update the related Rust binding. Fixes: a755d0e2d41b ("cpufreq: Honour transition_latency over transition_delay_us") Closes: https://lore.kernel.org/linux-pm/20250922125929.453444-1-shawnguo2@yeah.net/ Reported-by: Shawn Guo Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Jie Zhan Acked-by: Viresh Kumar Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2264949.irdbgypaU6@rafael.j.wysocki [ rjw: Fix typo in new symbol name, drop redundant type cast from Rust binding ] Tested-by: Shawn Guo # with cpufreq-dt driver Reviewed-by: Qais Yousef Signed-off-by: Rafael J. Wysocki commit ed9f3ab9f3d3655e7447239cac80e4e0388faea8 Author: Xichao Zhao Date: Mon Aug 18 18:28:48 2025 +0800 virtio-vdpa: Drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. Signed-off-by: Xichao Zhao Message-Id: <20250818102848.578875-1-zhao.xichao@vivo.com> Signed-off-by: Michael S. Tsirkin commit 3fc3068e7247c94dec08e93fea422a1bb649bfe5 Author: Sheng Zhao Date: Thu Sep 25 19:35:16 2025 +0800 vduse: Use fixed 4KB bounce pages for non-4KB page size The allocation granularity of bounce pages is PAGE_SIZE. This may cause even small IO requests to occupy an entire bounce page exclusively. The kind of memory waste will be more significant when PAGE_SIZE is larger than 4KB (e.g. arm64 with 64KB pages). So, optimize it by using fixed 4KB bounce maps and iova allocation granularity. A single IO request occupies at least a 4KB bounce page instead of the entire memory page of PAGE_SIZE. Signed-off-by: Sheng Zhao Message-Id: <20250925113516.60305-1-sheng.zhao@bytedance.com> Signed-off-by: Michael S. Tsirkin commit 1c14b0e4ba988381e362ad8a9651eff0b21bd47f Author: Jason Wang Date: Wed Sep 24 15:00:45 2025 +0800 vduse: switch to use virtio map API instead of DMA API Lacking the support of device specific mapping supported in virtio, VDUSE must trick the DMA API in order to make virtio-vdpa transport work. This is done by advertising vDPA device as dma device with a VDUSE specific dma_ops even if it doesn't do DMA at all. This will be fixed by this patch. Thanks to the new mapping operations support by virtio and vDPA. VDUSE can simply switch to advertise its specific mappings operations to virtio via virtio-vdpa then DMA API is not needed for VDUSE any more and iova domain could be used as the mapping token instead. Signed-off-by: Jason Wang Message-Id: <20250924070045.10361-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Eugenio Pérez commit 0d16cc439f36355d04b17ac45c3001d90969aa44 Author: Jason Wang Date: Wed Sep 24 15:00:44 2025 +0800 vdpa: introduce map ops Virtio core allows the transport to provide device or transport specific mapping functions. This patch adds this support to vDPA. We can simply do this by allowing the vDPA parent to register a virtio_map_ops. Reviewed-by: Christoph Hellwig Signed-off-by: Jason Wang Message-Id: <20250924070045.10361-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Eugenio Pérez commit 58aca3dbc7d8891a016cb17d488af3002812793b Author: Jason Wang Date: Thu Aug 21 14:46:39 2025 +0800 vdpa: support virtio_map Virtio core switches from DMA device to virtio_map, let's do that as well for vDPA. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-8-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit bee8c7c24b737338216dc0f87d6c47a4abaf609a Author: Jason Wang Date: Thu Aug 21 14:46:38 2025 +0800 virtio: introduce map ops in virtio core This patch introduces map operations for virtio device. Virtio used to use DMA API which is not necessarily the case since some devices doesn't do DMA. Instead of using tricks and abusing DMA API, let's simply abstract the current mapping logic into a virtio specific mapping operations. For the device or transport that doesn't do DMA, they can implement their own mapping logic without the need to trick DMA core. In this case the mapping metadata is opaque to the virtio core that will be passed back to the transport or device specific map operations. For other devices, DMA API will still be used, so map token will still be the dma device to minimize the changeset and performance impact. The mapping operations are abstracted as a independent structure instead of reusing virtio_config_ops. This allows the transport can simply reuse the structure for lower layers like vDPA. A set of new mapping helpers were introduced for the device that want to do mapping by themselves. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-7-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 201e52ffe3349396303f741d098a9d285c52f44e Author: Jason Wang Date: Thu Aug 21 14:46:37 2025 +0800 virtio_ring: rename dma_handle to map_handle Following patch will introduce virtio map operations which means the address is not necessarily used for DMA. Let's rename the dma_handle to map_handle first. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-6-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit b16060c5c7d56455da3c3c50b4a20a83c2a30810 Author: Jason Wang Date: Thu Aug 21 14:46:36 2025 +0800 virtio: introduce virtio_map container union Following patch will introduce the mapping operations for virtio device. In order to achieve this, besides the dma device, virtio core needs to support a transport or device specific mapping metadata as well. So this patch introduces a union container of a dma device. The idea is the allow the transport layer to pass device specific mapping metadata which will be used as a parameter for the virtio mapping operations. For the transport or device that is using DMA, dma device is still being used. Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-5-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit b41cb3bcf67fcb7b8297e5acc5bb3309c96c2ff2 Author: Jason Wang Date: Thu Aug 21 14:46:35 2025 +0800 virtio: rename dma helpers Following patch will introduce virtio mapping function to avoid abusing DMA API for device that doesn't do DMA. To ease the introduction, this patch rename "dma" to "map" for the current dma mapping helpers. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 447beec8065b7505c09d1c16257ff9057ec29672 Author: Jason Wang Date: Thu Aug 21 14:46:34 2025 +0800 virtio_ring: switch to use dma_{map|unmap}_page() This patch switches to use dma_{map|unmap}_page() to reduce the coverage of DMA operations. This would help for the following rework on the virtio map operations. Reviewed-by: Christoph Hellwig Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 7d096cb3e16f09d9762ae8cef897cdbc13a40029 Author: Jason Wang Date: Thu Aug 21 14:46:33 2025 +0800 virtio_ring: constify virtqueue pointer for DMA helpers This patch constifies the virtqueue pointer for DMA helpers. Reviewed-by: Christoph Hellwig Reviewed-by: Xuan Zhuo Reviewed-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20250821064641.5025-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang Reviewed-by: Eugenio Pérez commit 642d82e3c3f0166a0742f65356c4358c4936a1ca Author: Qianfeng Rong Date: Thu Aug 7 21:26:42 2025 +0800 virtio_balloon: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Signed-off-by: Qianfeng Rong Message-Id: <20250807132643.546237-1-rongqianfeng@vivo.com> Signed-off-by: Michael S. Tsirkin commit c0e1116189acfec74c8f5032da257b954d3f757f Author: Michael S. Tsirkin Date: Tue Sep 23 17:44:26 2025 -0400 vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values. Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Cc: "Stefano Garzarella" Cc: zhang jiao Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com Message-ID: Signed-off-by: Michael S. Tsirkin commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b Author: zhang jiao Date: Wed Sep 10 17:17:38 2025 +0800 vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal. Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Cc: "Stefano Garzarella" Signed-off-by: zhang jiao Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com> Signed-off-by: Michael S. Tsirkin commit b9d6cfe2ae699bbf230a6c8e0e32212b04bff661 Author: Ioana Ciornei Date: Mon Sep 22 17:24:20 2025 +0300 mfd: simple-mfd-i2c: Add compatible string for LX2160ARDB Extend the list of supported devices with the QIXIS FPGA found on the LX2160ARDB board. Signed-off-by: Ioana Ciornei Signed-off-by: Lee Jones commit 3ed50d77924ff2e35918739df145dd429cee0ce4 Author: Ioana Ciornei Date: Mon Sep 22 17:24:19 2025 +0300 mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order Reorder the of_device_id structures so that they are in alphabetical order. Signed-off-by: Ioana Ciornei Signed-off-by: Lee Jones commit 02dde2c4c32e8c8404a890d6092a66dbe0f36564 Author: Jihed Chaibi Date: Sun Sep 14 21:25:14 2025 +0200 dt-bindings: mfd: twl: Add missing sub-nodes for TWL4030 & TWL603x Update the main TI TWL-family binding to be self-contained and to fix pre-existing validation errors. To ensure future patches are bisectable, child nodes whose bindings are in other patches (audio, keypad, usb, etc.) are now defined using a flexible 'additionalProperties: true' pattern. This removes hard dependencies between the MFD and subsystem bindings. The complete dtbs_check for this binding is clean except for two warnings originating from pre-existing bugs in the OMAP DTS files, for which fixes have already been submitted separately [1][2]. Reviewed-by: Rob Herring Acked-by: Uwe Kleine-König Signed-off-by: Jihed Chaibi Reviewed-by: Andreas Kemnade Signed-off-by: Lee Jones commit 354f31e9d2a3e4799d3d057a9e1c9f7ae7348bba Author: Michael Walle Date: Fri Sep 12 14:07:43 2025 +0200 dt-bindings: watchdog: Add SMARC-sAM67 support The SMARC-sAM67 board has an on-board uC which has the same register interface as the older CPLD implementation on the SMARC-sAL28 board. Although the MCU emulates the same behavior, be prepared for any quirks and add a board specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Lee Jones commit 59863239e09f435e4dd3393637adc4d657772de5 Author: Michael Walle Date: Fri Sep 12 14:07:40 2025 +0200 dt-bindings: mfd: tps6594: Allow gpio-line-names Setting the signal names in the device tree was already possible, but it will lead to a warning. Allow the gpio-line-names property to fix that. Signed-off-by: Michael Walle Acked-by: "Rob Herring (Arm)" Signed-off-by: Lee Jones commit c91a0e4e549d0457c61f2199fcd84d699400bee1 Author: Ilpo Järvinen Date: Mon Sep 15 14:29:36 2025 +0300 mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs Add Intel Wildcat Lake PCI IDs. Signed-off-by: Ilpo Järvinen Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250915112936.10696-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Lee Jones commit 73ba00d86a9800d8f5ab1f2e1eb4b852da85aad4 Author: Duje Mihanović Date: Thu Sep 11 14:43:46 2025 +0200 mfd: 88pm886: Add GPADC cell Add a cell for the PMIC's onboard General Purpose ADC. Acked-by: Karel Balej # for the PMIC Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250911-88pm886-gpadc-v4-3-60452710d3a0@dujemihanovic.xyz Signed-off-by: Lee Jones commit 800d2c631c2496b676b2ffa969b4cab1d59d5a9b Author: Bartosz Golaszewski Date: Wed Sep 10 09:25:45 2025 +0200 mfd: vexpress-sysreg: Use more common syntax for compound literals The (typeof(foo)) construct is unusual in the kernel, use a more typical syntax by explicitly spelling out the type. Link: https://lore.kernel.org/all/20250909-gpio-mmio-gpio-conv-part4-v1-13-9f723dc3524a@linaro.org/ Suggested-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Acked-by: Sudeep Holla Link: https://lore.kernel.org/r/20250910-make-compound-literals-normal-again-v1-1-076ee7738a0b@linaro.org Signed-off-by: Lee Jones commit da32b0e82c523b76265ba1ad25d7ea74f0ece402 Author: Cosmin Tanislav Date: Wed Sep 10 20:59:06 2025 +0300 mfd: rz-mtu3: Fix MTU5 NFCR register offset The NFCR register for MTU5 is at 0x1a95 offset according to Datasheet Page 725, Table 16.4. The address of all registers is offset by 0x1200, making the proper address of MTU5 NFCR register be 0x895. Cc: stable@vger.kernel.org Fixes: 654c293e1687 ("mfd: Add Renesas RZ/G2L MTU3a core driver") Signed-off-by: Cosmin Tanislav Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20250910175914.12956-1-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Lee Jones commit 605c9820e44de2da7d67acf66484136561da63a2 Author: Dzmitry Sankouski Date: Tue Sep 9 21:23:07 2025 +0300 mfd: max77705: Setup the core driver as an interrupt controller Current implementation describes only MFD's own topsys interrupts. However, max77705 has a register which indicates interrupt source, i.e. it acts as an interrupt controller. There's 4 interrupt sources in max77705: topsys, charger, fuelgauge, usb type-c manager. Setup max77705 MFD parent as an interrupt controller. Delete topsys interrupts because currently unused. Remove shared interrupt flag, because we're are an interrupt controller now, and subdevices should request interrupts from us. Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC") Signed-off-by: Dzmitry Sankouski Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com Signed-off-by: Lee Jones commit afe0f94992dbe6cc6a38fdb2c8ed2f0f265e3e6e Author: Charles Keepax Date: Wed Sep 3 10:45:49 2025 +0100 mfd: cs42l43: Remove IRQ masking in suspend Now the individual child drivers mask their own IRQs there is no need for the MFD code to do so anymore. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250903094549.271068-7-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones commit 62aec8a0a5b61f149bbe518c636e38e484812499 Author: Charles Keepax Date: Wed Sep 3 10:45:48 2025 +0100 mfd: cs42l43: Move IRQ enable/disable to encompass force suspend As pm_runtime_force_suspend() will force the device state to suspend, the driver needs to ensure no IRQ handlers are currently running. If not those handlers may find they are now running on suspended hardware despite holding a PM runtime reference. disable_irq() will sync any currently running handlers, so move the IRQ disabling to cover the whole of the forced suspend state to avoid such race conditions. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250903094549.271068-6-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones commit d952bba3fbb5d8a3c961e32bae3f7ff19a18762f Author: Binbin Zhou Date: Thu Sep 4 20:35:06 2025 +0800 mfd: ls2kbmc: Add Loongson-2K BMC reset function support Since the display is a sub-function of the Loongson-2K BMC, when the BMC reset, the entire BMC PCIe is disconnected, including the display which is interrupted. Quick overview of the entire LS2K BMC reset process: There are two types of reset methods: soft reset (BMC-initiated reboot of IPMI reset command) and BMC watchdog reset (watchdog timeout). First, regardless of the method, an interrupt is generated (PCIe interrupt for soft reset/GPIO interrupt for watchdog reset); Second, during the interrupt process, the system enters bmc_reset_work, clears the bus/IO/mem resources of the LS7A PCI-E bridge, waits for the BMC reset to begin, then restores the parent device's PCI configuration space, waits for the BMC reset to complete, and finally restores the BMC PCI configuration space. Display restoration occurs last. Co-developed-by: Chong Qiao Signed-off-by: Chong Qiao Reviewed-by: Huacai Chen Acked-by: Corey Minyard Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/de4e04b42ff9ee282f86f9bb9efbf959a9848205.1756987761.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones commit 0d64f6d1ffe96f59145481f7413344b1fa3ad1ce Author: Binbin Zhou Date: Thu Sep 4 20:35:05 2025 +0800 mfd: ls2kbmc: Introduce Loongson-2K BMC core driver The Loongson-2K Board Management Controller provides an PCIe interface to the host to access the feature implemented in the BMC. The BMC is assembled on a server similar to the server machine with Loongson-3 CPU. It supports multiple sub-devices like DRM and IPMI. Co-developed-by: Chong Qiao Signed-off-by: Chong Qiao Reviewed-by: Huacai Chen Acked-by: Corey Minyard Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/0dc1fd53020ce2562453961ffed2cd9eb8f359e1.1756987761.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones commit 719d02a25a24601c6fb8a7b1627e1abf015b6c2a Author: Matti Vaittinen Date: Thu Aug 21 20:23:34 2025 +0200 mfd: bd71828, bd71815: Prepare for power-supply support Add core support for ROHM BD718(15/28/78) PMIC's charger blocks. Signed-off-by: Matti Vaittinen Signed-off-by: Andreas Kemnade Link: https://lore.kernel.org/r/20250821-bd71828-charger-v3-1-cc74ac4e0fb9@kemnade.info Signed-off-by: Lee Jones commit b445c14ac7eb39447a364c142aa85b6487b30c67 Author: Ryan Chen Date: Sun Aug 31 10:14:36 2025 +0800 dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles Add SCU interrupt controller compatible strings for the AST2700 SoC: scu-ic0 to 3. This extends the MFD binding to support AST2700-based platforms. Signed-off-by: Ryan Chen Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250831021438.976893-3-ryan_chen@aspeedtech.com Signed-off-by: Lee Jones commit 99e2f00cf418c2e12fc934ae2ba790870e98fd67 Author: Rob Herring (Arm) Date: Fri Aug 29 18:04:49 2025 -0500 dt-bindings: mfd: Convert aspeed,ast2400-p2a-ctrl to DT schema Convert the aspeed,ast2x00-p2a-ctrl binding to DT schema format. The schema is simple enough to just add it to the parent aspeed,ast2x00-scu binding. Signed-off-by: "Rob Herring (Arm)" Acked-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250829230450.1496151-1-robh@kernel.org Signed-off-by: Lee Jones commit 5872dcccc5ade97bc27aafe13e361bb8e7c73da1 Author: Alexander Kurz Date: Fri Aug 29 20:15:16 2025 +0000 dt-bindings: mfd: fsl,mc13xxx: Add buttons node Add a buttons node and properties describing the "ONOFD" (MC13783) and "PWRON" (MC13892/MC34708) buttons available in the fsl,mc13xxx PMIC ICs. Signed-off-by: Alexander Kurz Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250829201517.15374-7-akurz@blala.de Signed-off-by: Lee Jones commit 1160f9f88be2a911a8d7a27a896b24360a1763c9 Author: Alexander Kurz Date: Fri Aug 29 20:15:15 2025 +0000 dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema Convert the txt mc13xxx bindings to DT schema attempting to keep most information. The nodes codec and touchscreen are not part of the new schema since it was only briefly mentioned before. Following the convention, rename led-control to fsl,led-control. Signed-off-by: Alexander Kurz Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250829201517.15374-6-akurz@blala.de Signed-off-by: Lee Jones commit 9b959e525fa7e8518e57554b6e17849942938dfc Author: Janne Grunau Date: Thu Aug 28 16:01:37 2025 +0200 mfd: macsmc: Add "apple,t8103-smc" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,smc" anymore [1]. Use "apple,t8103-smc" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Signed-off-by: Janne Grunau Link: https://lore.kernel.org/r/20250828-dt-apple-t6020-v1-18-507ba4c4b98e@jannau.net Signed-off-by: Lee Jones commit 5f4bbee069836e51ed0b6d7e565a292f070ababc Author: Bastien Curutchet Date: Wed Aug 20 16:21:13 2025 +0200 mfd: core: Increment of_node's refcount before linking it to the platform device When an MFD device is added, a platform_device is allocated. If this device is linked to a DT description, the corresponding OF node is linked to the new platform device but the OF node's refcount isn't incremented. As of_node_put() is called during the platform device release, it leads to a refcount underflow. Call of_node_get() to increment the OF node's refcount when the node is linked to the newly created platform device. Signed-off-by: Bastien Curutchet Link: https://lore.kernel.org/r/20250820-mfd-refcount-v1-1-6dcb5eb41756@bootlin.com Signed-off-by: Lee Jones commit 8a498184e2e8aac24db0faf295b7d0fb62dfe90d Author: Conor Dooley Date: Mon Sep 1 12:04:13 2025 +0100 dt-bindings: mfd: syscon: Document the control-scb syscon on PolarFire SoC The "control-scb" region, contains the "tvs" temperature and voltage sensors and the control/status registers for the system controller's mailbox. The mailbox has a dedicated node, so there's no need for a child node describing it, looking the syscon up by compatible is sufficient. Acked-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20250901-shorten-yahoo-223aeaecd290@spud Signed-off-by: Lee Jones commit 6fc5d415c10e98ac1b31dd1d5653443e691cdcff Author: Alex Elder Date: Mon Aug 25 12:20:51 2025 -0500 mfd: simple-mfd-i2c: Add SpacemiT P1 support Enable support for the RTC and regulators found in the SpacemiT P1 PMIC. Support is implemented by the simple I2C MFD driver. The P1 PMIC is normally implemented with the SpacemiT K1 SoC. This PMIC provides 6 buck converters and 12 LDO regulators. It also implements a switch, watchdog timer, real-time clock, and more. Initially its RTC and regulators are supported. Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20250825172057.163883-3-elder@riscstar.com Signed-off-by: Lee Jones commit 8566de1cf6892647c034c576caec772e6cf2c952 Author: Alex Elder Date: Mon Aug 25 12:20:50 2025 -0500 dt-bindings: mfd: Add support the SpacemiT P1 PMIC Enable the SpacemiT P1, which is an I2C-controlled PMIC. Initially only the RTC and regulators will be supported. Signed-off-by: Alex Elder Reviewed-by: "Rob Herring (Arm)" Acked-by: Troy Mitchell Link: https://lore.kernel.org/r/20250825172057.163883-2-elder@riscstar.com Signed-off-by: Lee Jones commit a598ae45f48d7d5a17f8290f2f5bd46046fd0b9b Author: Michael Walle Date: Fri Aug 22 15:15:26 2025 +0200 dt-bindings: mfd: sl28cpld: Add sa67mcu compatible The Kontron SMARC-sAM67 module features an on-board house keeping uC. It's designed to be compatible with the older on-board CPLD used on the SMARC-sAL28 board. To be prepared for any board specific quirks, add a specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250822131531.1366437-3-mwalle@kernel.org Signed-off-by: Lee Jones commit eca0259e3b9c0d532051727d3d85fd8a42138f71 Author: Arnd Bergmann Date: Fri Aug 8 17:17:58 2025 +0200 mfd: aat2870: Add GPIOLIB_LEGACY dependency This driver uses the legacy gpiolib interfaces to get gpio numbers from platform data. There are no in-tree users of this driver, so nothing defines the platform data. Add a dependency on GPIOLIB_LEGACY for the moment to avoid the build failure, and make sure the sound driver does not get built without the mfd portion either pass that dependency along. Alternatively, we could remove the mfd driver along with the backlight and regulator portions. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-15-arnd@kernel.org Signed-off-by: Lee Jones commit e399d779c9acf277488c5b306b71dcbc71e160ca Author: Arnd Bergmann Date: Fri Aug 8 17:17:57 2025 +0200 mfd: si476x: Add GPIOLIB_LEGACY dependency This driver uses the legacy gpiolib interfaces to get gpio numbers from platform data: drivers/mfd/si476x-i2c.c: In function 'si476x_core_start': drivers/mfd/si476x-i2c.c:133:21: error: implicit declaration of function 'gpio_is_valid'; did you mean 'uuid_is_valid'? [-Werror=implicit-function-declaration] 133 | if (gpio_is_valid(core->gpio_reset)) There are no in-tree users of this driver, so nothing defines the platform data. Add a dependency on GPIOLIB_LEGACY for the moment to avoid the build failure, and make sure the sound driver does not get built without the mfd portion either pass that dependency along. Alternatively, we could remove the mfd driver along with the radio and sound portions. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507231653.UFlH2dMO-lkp@intel.com/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-14-arnd@kernel.org Signed-off-by: Lee Jones commit 3d6a17fccc2832d8bc84420a634330941509d6e1 Author: Krzysztof Kozlowski Date: Mon Aug 25 10:12:02 2025 +0200 dt-bindings: mfd: Move embedded controllers to own directory Move several embedded controller bindings (like ChromeOS EC, Gateworks System Controller and Kontron sl28cpld Board Management) to new subdirectory "embedded-controller" matching their purpose. An embedded controller (EC) is a discrete component that contains a microcontroller (i.e. a small CPU running a small firmware without operating system) mounted into a larger computer system running a fully fledged operating system that needs to utilize the embedded controller as part of its operation. So far the EC bindings were split between "mfd" and "platform" directory. MFD name comes from Linux, not hardware, and "platform" is a bit too generic. Rename Gateworks GSC and Huawei Gaokun filenames to match compatible, as preferred for bindings. Acked-by: Michael Walle # for sl28cpld Reviewed-by: Linus Walleij Signed-off-by: Krzysztof Kozlowski Acked-by: Mark Brown Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250825081201.9775-2-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit fcbe47a83a41cfbf49eb96649acea38605aeaba6 Author: Wolfram Sang Date: Wed Aug 13 18:14:55 2025 +0200 mfd: Remove unneeded 'fast_io' parameter in regmap_config When using MMIO with regmap, fast_io is implied. No need to set it again. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250813161517.4746-10-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 9c5ad8374b1fe0c8c9eaabc1146d96a543858c4a Author: Arnd Bergmann Date: Fri Aug 8 17:17:56 2025 +0200 mfd: arizona: Make legacy gpiolib interface optional The only machine that still uses the old gpio number based interface is the wlf_cragg_6410 board file. In order to remove the dependency on the interfaces, add #ifdef blocks here. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250808151822.536879-13-arnd@kernel.org Signed-off-by: Lee Jones commit a5b03d81c23ef2aae8a88dc9da009a56b4bbb8f6 Author: Xichao Zhao Date: Fri Aug 15 18:06:01 2025 +0800 mfd: max899x: Use dedicated interrupt wake setters Use enable_irq_wake() and disable_irq_wake() instead of calling low-level irq_set_irq_wake() with a parameter. No functional changes. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250815100601.622923-1-zhao.xichao@vivo.com Signed-off-by: Lee Jones commit c1c8ed81e200126b711ee5b012e1fa9a0da2cbe1 Author: Rob Herring (Arm) Date: Tue Aug 12 15:33:18 2025 -0500 dt-bindings: mfd: syscon: Add "marvell,armada-3700-usb2-host-device-misc" compatible Add the "marvell,armada-3700-usb2-host-device-misc" compatible which is already in use. Signed-off-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250812203319.729300-1-robh@kernel.org Signed-off-by: Lee Jones commit ec9b6f054d9de2bc7a713741980c84886a39cd7a Author: Xichao Zhao Date: Tue Aug 12 17:31:04 2025 +0800 mfd: kempld: Use PTR_ERR_OR_ZERO() to simplify code Use the standard error pointer macro to shorten the code and simplify. Signed-off-by: Xichao Zhao Link: https://lore.kernel.org/r/20250812093104.103193-1-zhao.xichao@vivo.com Signed-off-by: Lee Jones commit 58091331b59eebc9bf725178be87021d20e4ec2d Author: Rob Herring (Arm) Date: Thu Aug 7 08:29:08 2025 -0500 dt-bindings: mfd: aspeed-lpc: Add missing "clocks" property on lpc-snoop node The ASpeed lpc-snoop nodes have a "clocks" property which isn't documented. It looks like all the LPC child devices have the same clock source. Perhaps it is the parent device that should have the clock, but it's too late for that. The driver for lpc-snoop requires a clock to be present. Signed-off-by: "Rob Herring (Arm)" Acked-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250807132909.3291770-1-robh@kernel.org Signed-off-by: Lee Jones commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 Author: Arnd Bergmann Date: Thu Aug 7 09:19:28 2025 +0200 mfd: madera: Work around false-positive -Wininitialized warning clang-21 warns about one uninitialized variable getting dereferenced in madera_dev_init: drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized] 739 | mfd_devs, n_devs, | ^~~~~~~~ drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning 459 | const struct mfd_cell *mfd_devs; | ^ | = NULL The code is actually correct here because n_devs is only nonzero when mfd_devs is a valid pointer, but this is impossible for the compiler to see reliably. Change the logic to check for the pointer as well, to make this easier for the compiler to follow. Signed-off-by: Arnd Bergmann Reviewed-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org Signed-off-by: Lee Jones commit 99767a0c8bb4e206f6cea37f5162073d1899168c Author: Waqar Hameed Date: Tue Aug 5 11:33:34 2025 +0200 mfd: macsmc: Remove error prints for devm_add_action_or_reset() When `devm_add_action_or_reset()` fails, it is due to a failed memory allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do anything when error is `-ENOMEM`. Therefore, remove the useless call to `dev_err_probe()` when `devm_add_action_or_reset()` fails, and just return the value instead. Signed-off-by: Waqar Hameed Reviewed-by: Sven Peter Link: https://lore.kernel.org/r/pnd8qjym7td.a.out@axis.com Signed-off-by: Lee Jones commit 9ac4890ac39352ccea132109e32911495574c3ec Author: Jens Kehne Date: Mon Aug 4 15:37:54 2025 +0200 mfd: da9063: Split chip variant reading in two bus transactions We observed the initial probe of the da9063 failing in da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based board. The problem originates in da9063_i2c_blockreg_read, which uses a single bus transaction to turn the register page and then read a register. On the bus, this should translate to a write to register 0, followed by a read to the target register, separated by a repeated start. However, we found that after the write to register 0, the controller sometimes continues directly with the register address of the read request, without sending the chip address or a repeated start in between, which makes the read request invalid. To fix this, separate turning the page and reading the register into two separate transactions. This brings the initialization code in line with the rest of the driver, which uses register maps (which to my knowledge do not use repeated starts after turning the page). This has been included in our kernel for several months and was recently included in a shipped product. For us, it reliably fixes the issue, and we have not observed any new issues. While the underlying problem is probably with the i2c controller or its driver, I still propose a change here in the interest of robustness: First, I'm not sure this issue can be fixed on the controller side, since there are other issues related to repeated start which can't (AR# 60695, AR# 61664). Second, similar problems might exist with other controllers. Signed-off-by: Jens Kehne Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com Signed-off-by: Lee Jones commit 64e0d839c589f4f2ecd2e3e5bdb5cee6ba6bade9 Author: Hans de Goede Date: Mon Aug 4 15:32:40 2025 +0200 mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag Testing has shown that reading multiple registers at once (for 10-bit ADC values) does not work. Set the use_single_read regmap_config flag to make regmap split these for us. This should fix temperature opregion accesses done by drivers/acpi/pmic/intel_pmic_chtdc_ti.c and is also necessary for the upcoming drivers for the ADC and battery MFD cells. Fixes: 6bac0606fdba ("mfd: Add support for Cherry Trail Dollar Cove TI PMIC") Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250804133240.312383-1-hansg@kernel.org Signed-off-by: Lee Jones commit 71f529e9fedc377b43b73ec9d28ec59d9a3a2792 Author: Heiko Stuebner Date: Mon Aug 4 15:07:26 2025 +0200 mfd: qnap-mcu: Improve structure in qnap_mcu_exec Now with guard(mutex) in place, we can make the function's structure a bit easier to read, by removing the nested if-else-clauses. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-5-heiko@sntech.de Signed-off-by: Lee Jones commit 21c5ffb4211203de0a91de8a1c4a329e508a2ffb Author: Heiko Stuebner Date: Mon Aug 4 15:07:25 2025 +0200 mfd: qnap-mcu: Convert to guard(mutex) in qnap_mcu_exec guard() makes sure that the mutex gets unlocked when the function returns and thus removes the need for unlock gotos or similar mechanisms and therefore allows for a simpler function structure. So convert the qnap_mcu_exec function to use it. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-4-heiko@sntech.de Signed-off-by: Lee Jones commit bf2de43060d528e52e372c63182a94b95c80d305 Author: Heiko Stuebner Date: Mon Aug 4 15:07:24 2025 +0200 mfd: qnap-mcu: Handle errors returned from qnap_mcu_write qnap_mcu_write can return errors and those were not checked before. So do that now. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-3-heiko@sntech.de Signed-off-by: Lee Jones commit 5e1c88679174e4bfe5d152060b06d370bd85de80 Author: Heiko Stuebner Date: Mon Aug 4 15:07:23 2025 +0200 mfd: qnap-mcu: Include linux/types.h in qnap-mcu.h shared header Relying on other components to include those basic types is unreliable and may cause compile errors like: ../include/linux/mfd/qnap-mcu.h:13:9: error: unknown type name ‘u32’ 13 | u32 baud_rate; | ^~~ ../include/linux/mfd/qnap-mcu.h:17:9: error: unknown type name ‘bool’ 17 | bool usb_led; | ^~~~ So make sure, the types used in the header are available. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250804130726.3180806-2-heiko@sntech.de Signed-off-by: Lee Jones commit 309e65d151ab9be1e7b01d822880cd8c4e611dff Author: Heijligen, Thomas Date: Thu Jul 31 14:45:00 2025 +0000 mfd: kempld: Switch back to earlier ->init() behavior Commit 9e36775c22c7 ("mfd: kempld: Remove custom DMI matching code") removes the ability to load the driver if no matching system DMI data is found. Before this commit the driver could be loaded using alternative methods such as ACPI or `force_device_id` in the absence of a matching system DMI entry. Restore this ability while keeping the refactored `platform_device_info` table. Signed-off-by: Thomas Heijligen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/7d2c7e92253d851194a781720051536cca2722b8.camel@secunet.com Signed-off-by: Lee Jones commit 597b398bc27c84f3998c2169ad7ce74e8404533a Author: Heiko Stuebner Date: Wed Jul 30 19:22:47 2025 +0200 dt-bindings: mfd: qnap,ts433-mcu: Allow nvmem-layout child node The MCU has an eeprom memory connected internally, that for example contains some mac-addresses for the soc gmac controllers. Therefore allow defining the nvmem-layout for the eeprom. Signed-off-by: Heiko Stuebner Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250730172248.1875122-2-heiko@sntech.de Signed-off-by: Lee Jones commit 865417d5652d9e6de021c558e38fe94db0a778ea Author: Heiko Stuebner Date: Wed Jul 30 19:34:23 2025 +0200 mfd: qnap-mcu: Add driver data for TS233 variant Add the TS233 compatible and affiliated driver data to qnap-mcu. The TS233 is mostly similar to the TS433, except not having any of the PCIe components, so there are only 2 drives. The fan pwm-limits from the vendor-configuration also are the same as for the ts433 variant. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250730173423.1878599-3-heiko@sntech.de Signed-off-by: Lee Jones commit 9d602da0c9919f36d55b051951c1fd4f3dc24593 Author: Heiko Stuebner Date: Wed Jul 30 19:34:22 2025 +0200 dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts233-mcu compatible The same MCU is used on other devices of the series with a slightly different set of features, like the number of LEDs. Add a compatible for the MCU used in the TS233 variant. Signed-off-by: Heiko Stuebner Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250730173423.1878599-2-heiko@sntech.de Signed-off-by: Lee Jones commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 Author: Alexander Stein Date: Fri Jul 25 09:11:50 2025 +0200 mfd: stmpe-i2c: Add missing MODULE_LICENSE This driver is licensed GPL-2.0-only, so add the corresponding module flag. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit d00c9120414c3d908c0507fe26dd3b401a02c30a Author: Alexander Stein Date: Fri Jul 25 09:11:49 2025 +0200 mfd: stmpe-spi: Add missing MODULE_LICENSE This driver is licensed GPL-2.0-only, so add the corresponding module flag. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725071153.338912-2-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 557b09699b06f88ad2cb64747e4e8b6fc6e7141b Author: Alexander Stein Date: Fri Jul 25 09:07:50 2025 +0200 mfd: stmpe-i2c: Use module_i2c_driver to remove boilerplate Driver implements feature of module_i2c_driver() manually. Replace it by that macro instead. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-3-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 57b1fec0be8590278d81786eba11eb74252f784a Author: Alexander Stein Date: Fri Jul 25 09:07:49 2025 +0200 mfd: stmpe-spi: Use module_spi_driver to remove boilerplate Driver implements feature of module_spi_driver() manually. Replace it by that macro instead. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-2-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d Author: Alexander Stein Date: Fri Jul 25 09:07:48 2025 +0200 mfd: stmpe: Remove IRQ domain upon removal The IRQ domain is (optionally) added during stmpe_probe, but never removed. Add the call to stmpe_remove. Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com Signed-off-by: Lee Jones commit ba2b3de78fe63cd3bb169f98c7d92fa09c79ca16 Author: Colin Ian King Date: Thu Jul 24 12:14:59 2025 +0100 mfd: Kconfig: Fix spelling mistake "infontainment" -> "infotainment" There is a spelling mistake in the MFD_TIMBERDALE description. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724111459.141633-1-colin.i.king@gmail.com Signed-off-by: Lee Jones commit 0b9483bf7f319468bd37351c112c8f0bfe242028 Author: Nuno Sá Date: Thu Jul 17 15:51:34 2025 +0100 mfd: adp5585: Drop useless return statement In adp5585_reset_ev_parse(), when parsing the adi,reset-pulse-width-us property, we were returning in case it was found and valid. No point in doing that as we'll be returning anyways after the exiting the property scope. And it could actually lead to bugs if new properties happen to added after this one. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-gpio/c85604d9e077511b8aa6ee0786579594cc0103d4.camel@gmail.com/T/#ma25557bd06ccd2531dc9c85ba6be74af781b81aa Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250717-adp5585-drop-ret-v1-1-2ae65bd780aa@analog.com Signed-off-by: Lee Jones commit 81a2c31257411296862487aaade98b7d9e25dc72 Author: Ioana Ciornei Date: Mon Jul 7 18:31:20 2025 +0300 mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA The QIXIS FPGA found on Layerscape boards such as LX2160AQDS, LS1028AQDS etc deals with power-on-reset timing, muxing etc. Use the simple-mfd-i2c as its core driver by adding its compatible string (already found in some dt files). By using the simple-mfd-i2c driver, any child device will have access to the i2c regmap created by it. Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250707153120.1371719-1-ioana.ciornei@nxp.com Signed-off-by: Lee Jones commit e8c81284032ad9ba9ec3a89311c587aad0c84beb Merge: 017bdcdb3af941 9b33bbc084accb d463bb14058360 32d4cedd24ed34 a377b1be3a0ed5 f0addd325ef692 981dd162b63578 Author: Lee Jones Date: Wed Oct 1 10:27:35 2025 +0100 Merge branches 'ib-mfd-char-crypto-6.18', 'ib-mfd-gpio-6.18', 'ib-mfd-gpio-hwmon-i2c-can-rtc-watchdog-6.18', 'ib-mfd-gpio-input-pinctrl-pwm-6.18', 'ib-mfd-input-6.18', 'ib-mfd-input-rtc-6.18' and 'ib-mfd-power-regulator-6.18' into ibs-for-mfd-merged commit f1455695d2d99894b65db233877acac9a0e120b9 Merge: 936f160a95cddd daa26ea63c6f84 Author: Paolo Abeni Date: Wed Oct 1 10:10:50 2025 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc8). Conflicts: tools/testing/selftests/drivers/net/bonding/Makefile 87951b566446 selftests: bonding: add test for passive LACP mode c2377f1763e9 selftests: bonding: add test for LACP actor port priority Adjacent changes: drivers/net/ethernet/cadence/macb.h fca3dc859b20 net: macb: remove illusion about TBQPH/RBQPH being per-queue 89934dbf169e net: macb: Add TAPRIO traffic scheduling support drivers/net/ethernet/cadence/macb_main.c fca3dc859b20 net: macb: remove illusion about TBQPH/RBQPH being per-queue 89934dbf169e net: macb: Add TAPRIO traffic scheduling support Signed-off-by: Paolo Abeni commit 936f160a95cddd361d9c70798464e87a9cc57a37 Merge: 1a98f5699bd57c f603808a98afd3 Author: Paolo Abeni Date: Wed Oct 1 10:01:37 2025 +0200 Merge branch 'net-stmmac-add-support-for-allwinner-a523-gmac200' Chen-Yu Tsai says: ==================== net: stmmac: Add support for Allwinner A523 GMAC200 This is v8 of my Allwinner A523 GMAC200 support series. This is based on next-20250925. This version only contains the DT binding and driver patches. The device tree patches are basically the same as the previous version. This series adds support for the second Ethernet controller found on the Allwinner A523 SoC family. This controller, dubbed GMAC200, is a DWMAC4 core with an integration layer around it. The integration layer is similar to older Allwinner generations, but with an extra memory bus gate and separate power domain. Patch 1 adds a new compatible string combo to the existing Allwinner EMAC binding. Patch 2 adds a new driver for this core and integration combo. ==================== Link: https://patch.msgid.link/20250925191600.3306595-1-wens@kernel.org Signed-off-by: Paolo Abeni commit f603808a98afd37c50a736f1d3c8e186b625b115 Author: Chen-Yu Tsai Date: Fri Sep 26 03:15:59 2025 +0800 net: stmmac: Add support for Allwinner A523 GMAC200 The Allwinner A523 SoC family has a second Ethernet controller, called the GMAC200 in the BSP and T527 datasheet, and referred to as GMAC1 for numbering. This controller, according to BSP sources, is fully compatible with a slightly newer version of the Synopsys DWMAC core. The glue layer around the controller is the same as found around older DWMAC cores on Allwinner SoCs. The only slight difference is that since this is the second controller on the SoC, the register for the clock delay controls is at a different offset. Last, the integration includes a dedicated clock gate for the memory bus and the whole thing is put in a separately controllable power domain. Add a new driver for this hardware supporting the integration layer. Reviewed-by: Jernej Skrabec Signed-off-by: Chen-Yu Tsai Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250925191600.3306595-3-wens@kernel.org Signed-off-by: Paolo Abeni commit d9fcb34f8b3bf793fadb591aafc76f27ecb48ff0 Author: Chen-Yu Tsai Date: Fri Sep 26 03:15:58 2025 +0800 dt-bindings: net: sun8i-emac: Add A523 GMAC200 compatible The Allwinner A523 SoC family has a second Ethernet controller, called the GMAC200 in the BSP and T527 datasheet, and referred to as GMAC1 for numbering. This controller, according to BSP sources, is fully compatible with a slightly newer version of the Synopsys DWMAC core. The glue layer around the controller is the same as found around older DWMAC cores on Allwinner SoCs. The only slight difference is that since this is the second controller on the SoC, the register for the clock delay controls is at a different offset. Last, the integration includes a dedicated clock gate for the memory bus and the whole thing is put in a separately controllable power domain. Add a compatible string entry for it, and work in the requirements for a second clock and a power domain. Reviewed-by: Rob Herring (Arm) Acked-by: Conor Dooley Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250925191600.3306595-2-wens@kernel.org Signed-off-by: Paolo Abeni commit 1a98f5699bd57c9b3f66ec54cc38571d5e42ffb1 Author: Paolo Abeni Date: Tue Sep 30 15:45:06 2025 +0200 Revert "Documentation: net: add flow control guide and document ethtool API" This reverts commit 7bd80ed89d72285515db673803b021469ba71ee8. I should not have merged it to begin with due to pending review and changes to be addressed. Link: https://patch.msgid.link/c6f3af12df9b7998920a02027fc8893ce82afc4c.1759239721.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit 7d85cd8730ab7701a1cafd0db0d7b6b1f6cfbb91 Author: Brian Masney Date: Sat Sep 27 20:34:34 2025 -0400 clk: microchip: core: remove duplicate roclk_determine_rate() Fix compiler error caused by the round_rate() to determine_rate() migration. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509280327.jsapR0Ww-lkp@intel.com/ Signed-off-by: Brian Masney Fixes: e9f039c08cdc ("clk: microchip: core: convert from round_rate() to determine_rate()") Signed-off-by: Stephen Boyd commit e28c5bc45640bc851e8f7f0b8d5431fdaa420c8e Author: Namjae Jeon Date: Mon Aug 25 08:27:12 2025 +0900 ksmbd: increase session and share hash table bits Increases the number of bits for the hash table from 3 to 12. The thousands of sessions and shares can be connected. So the current 3-bit size can lead to frequent hash collisions. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0bcc831be535269556f59cb70396f7e34f03a276 Author: Namjae Jeon Date: Wed Oct 1 09:55:56 2025 +0900 ksmbd: replace connection list with hash table Replace connection list with hash table to improve lookup performance. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 67478857817be1585900ec49662e5b8f6ab6e3ef Author: Namjae Jeon Date: Mon Sep 29 09:08:36 2025 +0900 ksmbd: add an error print when maximum IP connections limit is reached This change introduces an error print using pr_info_ratelimited() to prevent excessive logging. This message will inform the user that the limit for maximum IP connections has been hit and what that current count is, which can be useful for debugging and monitoring connection limits. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d8b6dc9256762293048bf122fc11c4e612d0ef5d Author: Namjae Jeon Date: Wed Oct 1 09:25:35 2025 +0900 ksmbd: add max ip connections parameter This parameter set the maximum number of connections per ip address. The default is 8. Cc: stable@vger.kernel.org Fixes: c0d41112f1a5 ("ksmbd: extend the connection limiting mechanism to support IPv6") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 Author: Matvey Kovalev Date: Thu Sep 25 15:12:34 2025 +0300 ksmbd: fix error code overwriting in smb2_get_info_filesystem() If client doesn't negotiate with SMB3.1.1 POSIX Extensions, then proper error code won't be returned due to overwriting. Return error immediately. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Matvey Kovalev Acked-by: Namjae Jeon Signed-off-by: Steve French commit c20988c21751ef67df4191e262675e231610e9ab Author: Namjae Jeon Date: Thu Sep 25 21:15:20 2025 +0900 ksmbd: copy overlapped range within the same file cifs.ko request to copy overlapped range within the same file. ksmbd is using vfs_copy_file_range for this, vfs_copy_file_range() does not allow overlapped copying within the same file. This patch use do_splice_direct() if offset and length are overlapped. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 Author: Namjae Jeon Date: Thu Sep 25 21:12:05 2025 +0900 ksmbd: use sock_create_kern interface to create kernel socket we should use sock_create_kern() if the socket resides in kernel space. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5da92a251e41f824d7e6b4d54d65dcdcfd69fda3 Author: Namjae Jeon Date: Sun Sep 28 09:26:48 2025 +0900 ksmbd: make ksmbd thread names distinct by client IP This patch makes ksmbd thread names distinct by client IP address. 100943 ? S 0:00 [ksmbd:::ffff:10.177.110.57] or 101752 ? S 0:00 [ksmbd:10.177.110.57] Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 305853cce379407090a73b38c5de5ba748893aee Author: Yunseong Kim Date: Mon Sep 15 22:44:09 2025 +0000 ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup. Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open") Fixes: b685757c7b08 ("ksmbd: Implements sess->rpc_handle_list as xarray") Cc: stable@vger.kernel.org Signed-off-by: Yunseong Kim Acked-by: Namjae Jeon Signed-off-by: Steve French commit 50c19e20ed2ef359cf155a39c8462b0a6351b9fa Merge: f4e0ff7e45c30f 2d965c1ae4135e Author: Linus Torvalds Date: Tue Sep 30 19:18:17 2025 -0700 Merge tag 'nolibc-20250928-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: "Only small bugfixes and cleanups" * tag 'nolibc-20250928-for-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: tools/nolibc: add stdbool.h to nolibc includes tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers selftests/nolibc: remove outdated comment about construct order selftests/nolibc: fix EXPECT_NZ macro tools/nolibc: drop wait4() support kselftest/arm64: tpidr2: Switch to waitpid() over wait4() tools/nolibc: fold llseek fallback into lseek() tools/nolibc: remove __nolibc_enosys() fallback from fork functions tools/nolibc: remove __nolibc_enosys() fallback from dup2() tools/nolibc: remove __nolibc_enosys() fallback from *at() functions tools/nolibc: remove __nolibc_enosys() fallback from time64-related functions tools/nolibc: use tabs instead of spaces for indentation tools/nolibc: avoid error in dup2() if old fd equals new fd selftests/nolibc: always compile the kernel with GCC selftests/nolibc: don't pass CC to toplevel Makefile selftests/nolibc: deduplicate invocations of toplevel Makefile selftests/nolibc: be more specific about variables affecting nolibc-test tools/nolibc: fix error return value of clock_nanosleep() commit f4e0ff7e45c30f4665cfbbe2f0538e9c5789bebc Merge: ae28ed4578e6d5 f3f6b3664302e1 Author: Linus Torvalds Date: Tue Sep 30 19:12:49 2025 -0700 Merge tag 'rust-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Derive 'Zeroable' for all structs and unions generated by 'bindgen' where possible and corresponding cleanups. To do so, add the 'pin-init' crate as a dependency to 'bindings' and 'uapi'. It also includes its first use in the 'cpufreq' module, with more to come in the next cycle. - Add warning to the 'rustdoc' target to detect broken 'srctree/' links and fix existing cases. - Remove support for unused (since v6.16) host '#[test]'s, simplifying the 'rusttest' target. Tests should generally run within KUnit. 'kernel' crate: - Add 'ptr' module with a new 'Alignment' type, which is always a power of two and is used to validate that a given value is a valid alignment and to perform masking and alignment operations: // Checked at build time. assert_eq!(Alignment::new::<16>().as_usize(), 16); // Checked at runtime. assert_eq!(Alignment::new_checked(15), None); assert_eq!(Alignment::of::().log2(), 0); assert_eq!(0x25u8.align_down(Alignment::new::<0x10>()), 0x20); assert_eq!(0x5u8.align_up(Alignment::new::<0x10>()), Some(0x10)); assert_eq!(u8::MAX.align_up(Alignment::new::<0x10>()), None); It also includes its first use in Nova. - Add 'core::mem::{align,size}_of{,_val}' to the prelude, matching Rust 1.80.0. - Keep going with the steps on our migration to the standard library 'core::ffi::CStr' type (use 'kernel::{fmt, prelude::fmt!}' and use upstream method names). - 'error' module: improve 'Error::from_errno' and 'to_result' documentation, including examples/tests. - 'sync' module: extend 'aref' submodule documentation now that it exists, and more updates to complete the ongoing move of 'ARef' and 'AlwaysRefCounted' to 'sync::aref'. - 'list' module: add an example/test for 'ListLinksSelfPtr' usage. - 'alloc' module: - Implement 'Box::pin_slice()', which constructs a pinned slice of elements. - Provide information about the minimum alignment guarantees of 'Kmalloc', 'Vmalloc' and 'KVmalloc'. - Take minimum alignment guarantees of allocators for 'ForeignOwnable' into account. - Remove the 'allocator_test' (including 'Cmalloc'). - Add doctest for 'Vec::as_slice()'. - Constify various methods. - 'time' module: - Add methods on 'HrTimer' that can only be called with exclusive access to an unarmed timer, or from timer callback context. - Add arithmetic operations to 'Instant' and 'Delta'. - Add a few convenience and access methods to 'HrTimer' and 'Instant'. 'macros' crate: - Reduce collections in 'quote!' macro. And a few other cleanups and improvements" * tag 'rust-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (58 commits) gpu: nova-core: use Alignment for alignment-related operations rust: add `Alignment` type rust: macros: reduce collections in `quote!` macro rust: acpi: use `core::ffi::CStr` method names rust: of: use `core::ffi::CStr` method names rust: net: use `core::ffi::CStr` method names rust: miscdevice: use `core::ffi::CStr` method names rust: kunit: use `core::ffi::CStr` method names rust: firmware: use `core::ffi::CStr` method names rust: drm: use `core::ffi::CStr` method names rust: cpufreq: use `core::ffi::CStr` method names rust: configfs: use `core::ffi::CStr` method names rust: auxiliary: use `core::ffi::CStr` method names drm/panic: use `core::ffi::CStr` method names rust: device: use `kernel::{fmt,prelude::fmt!}` rust: sync: use `kernel::{fmt,prelude::fmt!}` rust: seq_file: use `kernel::{fmt,prelude::fmt!}` rust: kunit: use `kernel::{fmt,prelude::fmt!}` rust: file: use `kernel::{fmt,prelude::fmt!}` rust: device: use `kernel::{fmt,prelude::fmt!}` ... commit ae28ed4578e6d5a481e39c5a9827f27048661fdd Merge: 4b81e2eb9e4db8 4ef77dd584cfd9 Author: Linus Torvalds Date: Tue Sep 30 17:58:11 2025 -0700 Merge tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Support pulling non-linear xdp data with bpf_xdp_pull_data() kfunc (Amery Hung) Applied as a stable branch in bpf-next and net-next trees. - Support reading skb metadata via bpf_dynptr (Jakub Sitnicki) Also a stable branch in bpf-next and net-next trees. - Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann) - Replace path-sensitive with path-insensitive live stack analysis in the verifier (Eduard Zingerman) This is a significant change in the verification logic. More details, motivation, long term plans are in the cover letter/merge commit. - Support signed BPF programs (KP Singh) This is another major feature that took years to materialize. Algorithm details are in the cover letter/marge commit - Add support for may_goto instruction to s390 JIT (Ilya Leoshkevich) - Add support for may_goto instruction to arm64 JIT (Puranjay Mohan) - Fix USDT SIB argument handling in libbpf (Jiawei Zhao) - Allow uprobe-bpf program to change context registers (Jiri Olsa) - Support signed loads from BPF arena (Kumar Kartikeya Dwivedi and Puranjay Mohan) - Allow access to union arguments in tracing programs (Leon Hwang) - Optimize rcu_read_lock() + migrate_disable() combination where it's used in BPF subsystem (Menglong Dong) - Introduce bpf_task_work_schedule*() kfuncs to schedule deferred execution of BPF callback in the context of a specific task using the kernel’s task_work infrastructure (Mykyta Yatsenko) - Enforce RCU protection for KF_RCU_PROTECTED kfuncs (Kumar Kartikeya Dwivedi) - Add stress test for rqspinlock in NMI (Kumar Kartikeya Dwivedi) - Improve the precision of tnum multiplier verifier operation (Nandakumar Edamana) - Use tnums to improve is_branch_taken() logic (Paul Chaignon) - Add support for atomic operations in arena in riscv JIT (Pu Lehui) - Report arena faults to BPF error stream (Puranjay Mohan) - Search for tracefs at /sys/kernel/tracing first in bpftool (Quentin Monnet) - Add bpf_strcasecmp() kfunc (Rong Tao) - Support lookup_and_delete_elem command in BPF_MAP_STACK_TRACE (Tao Chen) * tag 'bpf-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (197 commits) libbpf: Replace AF_ALG with open coded SHA-256 selftests/bpf: Add stress test for rqspinlock in NMI selftests/bpf: Add test case for different expected_attach_type bpf: Enforce expected_attach_type for tailcall compatibility bpftool: Remove duplicate string.h header bpf: Remove duplicate crypto/sha2.h header libbpf: Fix error when st-prefix_ops and ops from differ btf selftests/bpf: Test changing packet data from kfunc selftests/bpf: Add stacktrace map lookup_and_delete_elem test case selftests/bpf: Refactor stacktrace_map case with skeleton bpf: Add lookup_and_delete_elem for BPF_MAP_STACK_TRACE selftests/bpf: Fix flaky bpf_cookie selftest selftests/bpf: Test changing packet data from global functions with a kfunc bpf: Emit struct bpf_xdp_sock type in vmlinux BTF selftests/bpf: Task_work selftest cleanup fixes MAINTAINERS: Delete inactive maintainers from AF_XDP bpf: Mark kfuncs as __noclone selftests/bpf: Add kprobe multi write ctx attach test selftests/bpf: Add kprobe write ctx attach test selftests/bpf: Add uprobe context ip register change test ... commit daa26ea63c6f848159821cd9b3cbe47cddbb0a1c Merge: 2aff4420efc291 92e9f4faffca70 Author: Jakub Kicinski Date: Tue Sep 30 17:27:01 2025 -0700 Merge branch 'octeontx2-fix-bitmap-leaks-in-pf-and-vf' Bo Sun says: ==================== octeontx2: fix bitmap leaks in PF and VF Two small patches that free the AF_XDP bitmap in the PF and VF remove paths. Both carry the same Fixes tag and should go to stable. ==================== Link: https://patch.msgid.link/20250930061236.31359-1-bo@mboxify.com Signed-off-by: Jakub Kicinski commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 Author: Bo Sun Date: Tue Sep 30 14:12:36 2025 +0800 octeontx2-pf: fix bitmap leak The bitmap allocated with bitmap_zalloc() in otx2_probe() was not released in otx2_remove(). Unbinding and rebinding the driver therefore triggers a kmemleak warning: unreferenced object (size 8): backtrace: bitmap_zalloc otx2_probe Call bitmap_free() in the remove path to fix the leak. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Bo Sun Signed-off-by: Jakub Kicinski commit cd9ea7da41a449ff1950230a35990155457b9879 Author: Bo Sun Date: Tue Sep 30 14:12:35 2025 +0800 octeontx2-vf: fix bitmap leak The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not released in otx2vf_remove(). Unbinding and rebinding the driver therefore triggers a kmemleak warning: unreferenced object (size 8): backtrace: bitmap_zalloc otx2vf_probe Call bitmap_free() in the remove path to fix the leak. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Bo Sun Signed-off-by: Jakub Kicinski commit 3cfb33f92dfb118ccaec5613c677f444af12bcc7 Merge: fd8c8216648cd8 a833538d1d8db9 Author: Jakub Kicinski Date: Tue Sep 30 17:21:17 2025 -0700 Merge branch 'net-mlx5-misc-changes-2025-09-28' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-09-28 This series contains misc enhancements to the mlx5 driver. v1: https://lore.kernel.org/1758531671-819655-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/1759094723-843774-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a833538d1d8db96b78bac04eec9be51b297f1d23 Author: Gal Pressman Date: Mon Sep 29 00:25:23 2025 +0300 net/mlx5e: Use extack in set rxfh callback The ->set/create/modify_rxfh() callbacks now pass a valid extack instead of NULL through netlink [1]. In case of an error, reflect it through extack instead of a dmesg print. [1] commit c0ae03588bbb ("ethtool: rss: initial RSS_SET (indirection table handling)") Signed-off-by: Gal Pressman Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-8-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c40a94ccfdc76fa26c620d1748ebda35c2153dd9 Author: Carolina Jubran Date: Mon Sep 29 00:25:22 2025 +0300 net/mlx5e: Introduce mlx5e_rss_params for RSS configuration Group RSS-related parameters into a dedicated mlx5e_rss_params struct. Pass this struct instead of individual arguments when initializing RSS. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-7-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit fc92cddd7a833d51ef857eca672214cab755ceaa Author: Carolina Jubran Date: Mon Sep 29 00:25:21 2025 +0300 net/mlx5e: Introduce mlx5e_rss_init_params Introduce a dedicated structure to group RSS initialization parameters that are only used during RSS creation, and drop the "init" prefix from pkt_merge_param. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a3f69641cbbc36015eb50ad6170caeb26f9022de Author: Carolina Jubran Date: Mon Sep 29 00:25:20 2025 +0300 net/mlx5e: Remove unused mdev param from RSS indir init The mdev parameter is not used in mlx5e_rss_params_indir_init, so drop it from the function and update all callers accordingly. No functional changes. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 33dbaa54ef431b416c1ddb2c25b9b201634edcfa Author: Carolina Jubran Date: Mon Sep 29 00:25:19 2025 +0300 net/mlx5: Improve QoS error messages with actual depth values Enhance error messages in MLX5 QoS scheduling depth validation by including the actual values that caused the validation to fail. Suggested-by: Paolo Abeni Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 06fdc45f16c392dc3394c67e7c17ae63935715d3 Author: Jianbo Liu Date: Mon Sep 29 00:25:18 2025 +0300 net/mlx5e: Prevent entering switchdev mode with inconsistent netns When a PF enters switchdev mode, its netdevice becomes the uplink representor but remains in its current network namespace. All other representors (VFs, SFs) are created in the netns of the devlink instance. If the PF's netns has been moved and differs from the devlink's netns, enabling switchdev mode would create a state where the OVS control plane (ovs-vsctl) cannot manage the switch because the PF uplink representor and the other representors are split across different namespaces. To prevent this inconsistent configuration, block the request to enter switchdev mode if the PF netdevice's netns does not match the netns of its devlink instance. As part of this change, the PF's netns is first marked as immutable. This prevents race conditions where the netns could be changed after the check is performed but before the mode transition is complete, and it aligns the PF's behavior with that of the final uplink representor. Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Jiri Pirko Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 906154caa7d3d750d47cd18f9349b75b77e12854 Author: Vlad Dogaru Date: Mon Sep 29 00:25:17 2025 +0300 net/mlx5: HWS, Generalize complex matchers The existing solution of complex matchers splits the match parameters across two, and exactly two, matchers. For some rather extreme cases (e.g. IPv6-in-IPv6 tunnels), even two matchers are not enough. Generalize complex matchers to up to 4 submatchers, and allow easy extension to more if needed. This resulted in rewriting a large part of the high-level complex matchers logic, but the original concepts were rock solid and still hold. Key characteristics of the new implementation: * Rework complex matchers to include multiple submatchers. All submatchers but the first are isolated, in keeping with the existing paradigm of handing off to specialized matchers that are not otherwise reachable by regular rules. * Similarly, rework complex rules to allow splitting them into more than two simple rules. Rules continue to be refcounted to allow for multiple complex rules matching on identical parts of the match params. * Rely on the match tag, as opposed to the entire match_param, to hash subrules. This results in lower memory usage. * Prefer to split the original user-supplied match parameters rather than the internal field descriptors. This avoids the awkward transition back and forth between the two formats. * Allow splitting multi-dword fields across matchers. The only restrictions that the new implementation impose are: a) any fragment of an IP address must be accompanied by a match on the IP version; and b) a single lower dword of an IPv6 address cannot be present in a submatcher as it would be interpreted as an IPv4 address. * Employ a greedy algorithm to split the match params, as opposed to complete search. The results are not optimal, but the algorithm is now linear compared to exponential. Consequently, we see complex matcher creation time drops two orders of magnitude in our tests. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759094723-843774-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e3ec97c3abaf2fb68cc755cae3229288696b9f3d Author: Mukesh Rathor Date: Mon Sep 15 16:46:04 2025 -0700 Drivers: hv: Make CONFIG_HYPERV bool With CONFIG_HYPERV and CONFIG_HYPERV_VMBUS separated, change CONFIG_HYPERV to bool from tristate. CONFIG_HYPERV now becomes the core Hyper-V hypervisor support, such as hypercalls, clocks/timers, Confidential Computing setup, PCI passthru, etc. that doesn't involve VMBus or VMBus devices. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 94b04355e6397a0a70b69c2571fa5c7d9990b835 Author: Mukesh Rathor Date: Mon Sep 15 16:46:03 2025 -0700 Drivers: hv: Add CONFIG_HYPERV_VMBUS option At present VMBus driver is hinged off of CONFIG_HYPERV which entails lot of builtin code and encompasses too much. It's not always clear what depends on builtin hv code and what depends on VMBus. Setting CONFIG_HYPERV as a module and fudging the Makefile to switch to builtin adds even more confusion. VMBus is an independent module and should have its own config option. Also, there are scenarios like baremetal dom0/root where support is built in with CONFIG_HYPERV but without VMBus. Lastly, there are more features coming down that use CONFIG_HYPERV and add more dependencies on it. So, create a fine grained HYPERV_VMBUS option and update Kconfigs for dependency on VMBus. Signed-off-by: Mukesh Rathor Acked-by: Bjorn Helgaas # drivers/pci Signed-off-by: Wei Liu commit 4b81e2eb9e4db8f6094c077d0c8b27c264901c1b Merge: 70de5572a82b3d e82bf7570d5ca3 Author: Linus Torvalds Date: Tue Sep 30 16:58:21 2025 -0700 Merge tag 'timers-vdso-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull VDSO updates from Thomas Gleixner: - Further consolidation of the VDSO infrastructure and the common data store - Simplification of the related Kconfig logic - Improve the VDSO selftest suite * tag 'timers-vdso-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests: vDSO: Drop vdso_test_clock_getres selftests: vDSO: vdso_test_abi: Add tests for clock_gettime64() selftests: vDSO: vdso_test_abi: Test CPUTIME clocks selftests: vDSO: vdso_test_abi: Use explicit indices for name array selftests: vDSO: vdso_test_abi: Drop clock availability tests selftests: vDSO: vdso_test_abi: Use ksft_finished() selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper vdso: Add struct __kernel_old_timeval forward declaration to gettime.h vdso: Gate VDSO_GETRANDOM behind HAVE_GENERIC_VDSO vdso: Drop Kconfig GENERIC_VDSO_TIME_NS vdso: Drop Kconfig GENERIC_VDSO_DATA_STORE vdso: Drop kconfig GENERIC_COMPAT_VDSO vdso: Drop kconfig GENERIC_VDSO_32 riscv: vdso: Untangle Kconfig logic time: Build generic update_vsyscall() only with generic time vDSO vdso/gettimeofday: Remove !CONFIG_TIME_NS stubs vdso: Move ENABLE_COMPAT_VDSO from core to arm64 ARM: VDSO: Remove cntvct_ok global variable vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY commit 70de5572a82b3d510df31d2c572c15cd53a00870 Merge: c5448d46b3995c 749b61c2d6a91c Author: Linus Torvalds Date: Tue Sep 30 16:53:59 2025 -0700 Merge tag 'timers-clocksource-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clocksource updates from Thomas Gleixner: - Further preparations for modular clocksource/event drivers - The usual device tree updates to support new chip variants and the related changes to thise drivers - Avoid a 64-bit division in the TEGRA186 driver, which caused a build fail on 32-bit machines. - Small fixes, improvements and cleanups all over the place * tag 'timers-clocksource-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits) dt-bindings: timer: exynos4210-mct: Add compatible for ARTPEC-9 SoC clocksource/drivers/sh_cmt: Split start/stop of clock source and events clocksource/drivers/clps711x: Fix resource leaks in error paths clocksource/drivers/arm_global_timer: Add auto-detection for initial prescaler values clocksource/drivers/ingenic-sysost: Convert from round_rate() to determine_rate() clocksource/drivers/timer-tegra186: Don't print superfluous errors clocksource/drivers/timer-rtl-otto: Simplify documentation clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts clocksource/drivers/timer-rtl-otto: Drop set_counter function clocksource/drivers/timer-rtl-otto: Work around dying timers clocksource/drivers/timer-ti-dm : Capture functionality for OMAP DM timer clocksource/drivers/arm_arch_timer_mmio: Add MMIO clocksource clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver clocksource/drivers/arm_arch_timer: Add standalone MMIO driver ACPI: GTDT: Generate platform devices for MMIO timers clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support dt: bindings: fsl,vf610-pit: Add compatible for s32g2 and s32g3 clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT clocksource/drivers/vf-pit: Unify the function name for irq ack clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable ... commit a3a4d6cb0b968e5d842e79f5dd9d7e07670e9b8a Author: Alok Tiwari Date: Sat Sep 13 12:24:44 2025 -0700 Drivers: hv: vmbus: Fix typos in vmbus_drv.c Fix two minor typos in vmbus_drv.c: - Correct "reponsible" -> "responsible" in a comment. - Add missing newline in pr_err() message ("channeln" -> "channel\n"). These are cosmetic changes only and do not affect functionality. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 332bf98d6c5a198d3078110b9000841dac3fd7b2 Author: Alok Tiwari Date: Sat Sep 13 12:24:42 2025 -0700 Drivers: hv: vmbus: Fix sysfs output format for ring buffer index The sysfs attributes out_read_index and out_write_index in vmbus_drv.c currently use %d to print outbound.current_read_index and outbound.current_write_index. These fields are u32 values, so printing them with %d (signed) is not logically correct. Update the format specifier to %u to correctly match their type. No functional change, only fixes the sysfs output format. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit fd9be098f7eb4bb6b1768145fd48e74a292e3730 Author: Alok Tiwari Date: Wed Sep 17 01:59:31 2025 -0700 Drivers: hv: vmbus: Clean up sscanf format specifier in target_cpu_store() The target_cpu_store() function parses the target CPU from the sysfs buffer using sscanf(). The format string currently uses "%uu", which is redundant. The compiler ignores the extra "u", so there is no incorrect parsing at runtime. Update the format string to use "%u" for clarity and consistency. Signed-off-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit c5448d46b3995c0b477f6bb04f313af3d57665c4 Merge: c574fb2ed7c96f 391253b25f078d Author: Linus Torvalds Date: Tue Sep 30 16:09:27 2025 -0700 Merge tag 'timers-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - Address the inconsistent shutdown sequence of per CPU clockevents on CPU hotplug, which only removed it from the core but failed to invoke the actual device driver shutdown callback. This kept the timer active, which prevented power savings and caused pointless noise in virtualization. - Encapsulate the open coded access to the hrtimer clock base, which is a private implementation detail, so that the implementation can be changed without breaking a lot of usage sites. - Enhance the debug output of the clocksource watchdog to provide better information for analysis. - The usual set of cleanups and enhancements all over the place * tag 'timers-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time: Fix spelling mistakes in comments clocksource: Print durations for sync check unconditionally LoongArch: Remove clockevents shutdown call on offlining tick: Do not set device to detached state in tick_shutdown() hrtimer: Reorder branches in hrtimer_clockid_to_base() hrtimer: Remove hrtimer_clock_base:: Get_time hrtimer: Use hrtimer_cb_get_time() helper media: pwm-ir-tx: Avoid direct access to hrtimer clockbase ALSA: hrtimer: Avoid direct access to hrtimer clockbase lib: test_objpool: Avoid direct access to hrtimer clockbase sched/core: Avoid direct access to hrtimer clockbase timers/itimer: Avoid direct access to hrtimer clockbase posix-timers: Avoid direct access to hrtimer clockbase jiffies: Remove obsolete SHIFTED_HZ comment commit c574fb2ed7c96f87fc0e5295e910e646a7ee4dfa Merge: d8de3685f1a287 4386f71623b772 Author: Linus Torvalds Date: Tue Sep 30 16:07:10 2025 -0700 Merge tag 'locking-futex-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex updates from Thomas Gleixner: "A set of updates for futexes and related selftests: - Plug the ptrace_may_access() race against a concurrent exec() which allows to pass the check before the target's process transition in exec() by taking a read lock on signal->ext_update_lock. - A large set of cleanups and enhancement to the futex selftests. The bulk of changes is the conversion to the kselftest harness" * tag 'locking-futex-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) selftest/futex: Fix spelling mistake "boundarie" -> "boundary" selftests/futex: Remove logging.h file selftests/futex: Drop logging.h include from futex_numa selftests/futex: Refactor futex_numa_mpol with kselftest_harness.h selftests/futex: Refactor futex_priv_hash with kselftest_harness.h selftests/futex: Refactor futex_waitv with kselftest_harness.h selftests/futex: Refactor futex_requeue with kselftest_harness.h selftests/futex: Refactor futex_wait with kselftest_harness.h selftests/futex: Refactor futex_wait_private_mapped_file with kselftest_harness.h selftests/futex: Refactor futex_wait_unitialized_heap with kselftest_harness.h selftests/futex: Refactor futex_wait_wouldblock with kselftest_harness.h selftests/futex: Refactor futex_wait_timeout with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi_signal_restart with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi_mismatched_ops with kselftest_harness.h selftests/futex: Refactor futex_requeue_pi with kselftest_harness.h selftests: kselftest: Create ksft_print_dbg_msg() futex: Don't leak robust_list pointer on exec race selftest/futex: Compile also with libnuma < 2.0.16 selftest/futex: Reintroduce "Memory out of range" numa_mpol's subtest selftest/futex: Make the error check more precise for futex_numa_mpol ... commit d8de3685f1a28722a4ba4f1f06a0987822750fb9 Merge: 03a53e09cd7232 ccf09357ffef2a Author: Linus Torvalds Date: Tue Sep 30 16:04:52 2025 -0700 Merge tag 'smp-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull smp doc fixlet from Thomas Gleixner: "An update of the stale smp_call_function_many() documentation to bring it back in sync with the actual implementation" * tag 'smp-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Fix up and expand the smp_call_function_many() kerneldoc commit 03a53e09cd723295ac1ddd16d9908d1680e7a1bf Merge: 3b2074c77d25f4 c33c43f71bda36 Author: Linus Torvalds Date: Tue Sep 30 16:00:29 2025 -0700 Merge tag 'irq-drivers-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq chip driver updates from Thomas Gleixner: - Use the startup/shutdown callbacks for the PCI/MSI per device interrupt domains. This allows us to initialize the RISCV PLIC interrupt hierarchy correctly and provides a mechanism to decouple the masking and unmasking during run-time from the expensive PCI mask and unmask when the underlying MSI provider implementation allows the interrupt to be masked. - Initialize the RISCV PLIC MSI interrupt hierarchy correctly so that the affinity assignment works correctly by switching it over to the startup/shutdown scheme - Allow MSI providers to opt out from masking a PCI/MSI interrupt at the PCI device during operation when the provider can mask the interrupt at the underlying interrupt chip. This reduces the overhead in scenarios where disable_irq()/enable_irq() is utilized frequently by a driver. The PCI/MSI device level [un]masking is only required on startup and shutdown in this case. - Remove the conditional mask/unmask logic in the PCI/MSI layer as this is now handled unconditionally. - Replace the hardcoded interrupt routing in the Loongson EIOINTC interrupt driver to respect the firmware settings and spread them out to different CPU interrupt inputs so that the demultiplexing handler only needs to read only a single 64-bit status register instead of four, which significantly reduces the overhead in VMs as the status register access causes a VM exit. - Add support for the new AST2700 SCU interrupt controllers - Use the legacy interrupt domain setup for the Loongson PCH-LPC interrupt controller, which resembles the x86 legacy PIC setup and has the same hardcoded legacy requirements. - The usual set of cleanups, fixes and improvements all over the place * tag 'irq-drivers-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (25 commits) irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller PCI/MSI: Remove the conditional parent [un]mask logic irqchip/msi-lib: Honor the MSI_FLAG_PCI_MSI_MASK_PARENT flag irqchip/aspeed-scu-ic: Add support for AST2700 SCU interrupt controllers dt-bindings: interrupt-controller: aspeed: Add AST2700 SCU IC compatibles dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles irqchip/aspeed-scu-ic: Refactor driver to support variant-based initialization irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc() irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup path irqchip/gic-v5: Delete a stray tab irqchip/sg2042-msi: Set irq type according to DT configuration riscv: sophgo: dts: sg2044: Change msi irq type to IRQ_TYPE_EDGE_RISING riscv: sophgo: dts: sg2042: Change msi irq type to IRQ_TYPE_EDGE_RISING irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment irqchip/renesas-rzg2l: Remove dev_err_probe() if error is -ENOMEM irqchip: Use int type to store negative error codes irqchip/gic-v5: Remove the redundant ITS cache invalidation PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in cond_[startup|shutdown]_parent() irqchip/loongson-eiointc: Add multiple interrupt pin routing support irqchip/loongson-eiointc: Route interrupt parsed from bios table ... commit 3b2074c77d25f453247163300d5638adfab4e4fa Merge: 1d17e808cf2aad 3253cb49cbad47 Author: Linus Torvalds Date: Tue Sep 30 15:55:25 2025 -0700 Merge tag 'irq-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq core updates from Thomas Gleixner: "A set of updates for the interrupt core subsystem: - Introduce irq_chip_[startup|shutdown]_parent() to prepare for addressing a few short comings in the PCI/MSI interrupt subsystem. It allows to utilize the interrupt chip startup/shutdown callbacks for initializing the interrupt chip hierarchy properly on certain RISCV implementations and provides a mechanism to reduce the overhead of masking and unmasking PCI/MSI interrupts during operation when the underlying MSI provider can mask the interrupt. The actual usage comes with the interrupt driver pull request. - Add generic error handling for devm_request_*_irq() This allows to remove the zoo of random error printk's all over the usage sites. - Add a mechanism to warn about long-running interrupt handlers Long running interrupt handlers can introduce latencies and tracking them down is a tedious task. The tracking has to be enabled with a threshold on the kernel command line and utilizes a static branch to remove the overhead when disabled. - Update and extend the selftests which validate the CPU hotplug interrupt migration logic - Allow dropping the per CPU softirq lock on PREEMPT_RT kernels, which causes contention and latencies all over the place. The serialization requirements have been pushed down into the actual affected usage sites already. - The usual small cleanups and improvements" * tag 'irq-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: softirq: Allow to drop the softirq-BKL lock on PREEMPT_RT softirq: Provide a handshake for canceling tasklets via polling genirq/test: Ensure CPU 1 is online for hotplug test genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions genirq/test: Depend on SPARSE_IRQ genirq/test: Fail early if interrupt request fails genirq/test: Factor out fake-virq setup genirq/test: Select IRQ_DOMAIN genirq/test: Fix depth tests on architectures with NOREQUEST by default. genirq: Add support for warning on long-running interrupt handlers genirq/devres: Add error handling in devm_request_*_irq() genirq: Add irq_chip_(startup/shutdown)_parent() genirq: Remove GENERIC_IRQ_LEGACY commit 4691db0704ac1c266377c99f00288a014fdb7af1 Author: Nam Cao Date: Fri Jul 18 21:57:50 2025 +0200 x86/hyperv: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). While doing the conversion, I noticed that hv_irq_compose_msi_msg() is doing more than it is supposed to (composing message content). The interrupt allocation bits should be moved into hv_msi_domain_alloc(). However, I have no hardware to test this change, therefore I leave a TODO note. Signed-off-by: Nam Cao Acked-by: Thomas Gleixner Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit c5eebe075e1129748f74e567da7bd8fbe77e485b Author: Sean Christopherson Date: Wed Aug 27 17:01:55 2025 -0700 mshv: Use common "entry virt" APIs to do work in root before running guest Use the kernel's common "entry virt" APIs to handle pending work prior to (re)entering guest mode, now that the virt APIs don't have a superfluous dependency on KVM. No functional change intended. Signed-off-by: Sean Christopherson Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 9be7e1e320ff2e7db4b23c8ec5f599bbfac94ede Author: Sean Christopherson Date: Wed Aug 27 17:01:54 2025 -0700 entry: Rename "kvm" entry code assets to "virt" to genericize APIs Rename the "kvm" entry code files and Kconfigs to use generic "virt" nomenclature so that the code can be reused by other hypervisors (or rather, their root/dom0 partition drivers), without incorrectly suggesting the code somehow relies on and/or involves KVM. No functional change intended. Signed-off-by: Sean Christopherson Reviewed-by: Thomas Gleixner Reviewed-by: Joel Fernandes Signed-off-by: Wei Liu commit 6d0386ea99875313fdfd074eb74013b6e3b48a76 Author: Sean Christopherson Date: Wed Aug 27 17:01:53 2025 -0700 entry/kvm: KVM: Move KVM details related to signal/-EINTR into KVM proper Move KVM's morphing of pending signals into userspace exits into KVM proper, and drop the @vcpu param from xfer_to_guest_mode_handle_work(). How KVM responds to -EINTR is a detail that really belongs in KVM itself, and invoking kvm_handle_signal_exit() from kernel code creates an inverted module dependency. E.g. attempting to move kvm_handle_signal_exit() into kvm_main.c would generate an linker error when building kvm.ko as a module. Dropping KVM details will also converting the KVM "entry" code into a more generic virtualization framework so that it can be used when running as a Hyper-V root partition. Lastly, eliminating usage of "struct kvm_vcpu" outside of KVM is also nice to have for KVM x86 developers, as keeping the details of kvm_vcpu purely within KVM allows changing the layout of the structure without having to boot into a new kernel, e.g. allows rebuilding and reloading kvm.ko with a modified kvm_vcpu structure as part of debug/development. Signed-off-by: Sean Christopherson Reviewed-by: Thomas Gleixner Signed-off-by: Wei Liu commit 0ebac01a00be972020c002a7fe0bb6b6fca8410f Author: Sean Christopherson Date: Wed Aug 27 17:01:50 2025 -0700 mshv: Handle NEED_RESCHED_LAZY before transferring to guest Check for NEED_RESCHED_LAZY, not just NEED_RESCHED, prior to transferring control to a guest. Failure to check for lazy resched can unnecessarily delay rescheduling until the next tick when using a lazy preemption model. Note, ideally both the checking and processing of TIF bits would be handled in common code, to avoid having to keep three separate paths synchronized, but defer such cleanups to the future to keep the fix as standalone as possible. Cc: Nuno Das Neves Cc: Mukesh R Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Sean Christopherson Tested-by: Nuno Das Neves Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 7ad8c34f2435137e2a0dfd0a5dd000e219c642ce Author: Vitaly Kuznetsov Date: Thu Aug 28 12:16:18 2025 +0300 x86/hyperv: Add kexec/kdump support on Azure CVMs Azure CVM instance types featuring a paravisor hang upon kdump. The investigation shows that makedumpfile causes a hang when it steps on a page which was previously share with the host (HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY). The new kernel has no knowledge of these 'special' regions (which are Vmbus connection pages, GPADL buffers, ...). There are several ways to approach the issue: - Convey the knowledge about these regions to the new kernel somehow. - Unshare these regions before accessing in the new kernel (it is unclear if there's a way to query the status for a given GPA range). - Unshare these regions before jumping to the new kernel (which this patch implements). To make the procedure as robust as possible, store PFN ranges of shared regions in a linked list instead of storing GVAs and re-using hv_vtom_set_host_visibility(). This also allows to avoid memory allocation on the kdump/kexec path. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Michael Kelley Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit fd8c8216648cd8c047bd3bcad65424ed44b5b450 Author: Patrisious Haddad Date: Mon Sep 29 00:08:08 2025 +0300 net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs Write combining is an optimization feature in CPUs that is frequently used by modern devices to generate 32 or 64 byte TLPs at the PCIe level. These large TLPs allow certain optimizations in the driver to HW communication that improve performance. As WC is unpredictable and optional the HW designs all tolerate cases where combining doesn't happen and simply experience a performance degradation. Unfortunately many virtualization environments on all architectures have done things that completely disable WC inside the VM with no generic way to detect this. For example WC was fully blocked in ARM64 KVM until commit 8c47ce3e1d2c ("KVM: arm64: Set io memory s2 pte as normalnc for vfio pci device"). Trying to use WC when it is known not to work has a measurable performance cost (~5%). Long ago mlx5 developed an boot time algorithm to test if WC is available or not by using unique mlx5 HW features to measure how many large TLPs the device is receiving. The SW generates a large number of combining opportunities and if any succeed then WC is declared working. In mlx5 the WC optimization feature is never used by the kernel except for the boot time test. The WC is only used by userspace in rdma-core. Sadly modern ARM CPUs, especially NVIDIA Grace, have a combining implementation that is very unreliable compared to pretty much everything prior. This is being fixed architecturally in new CPUs with a new ST64B instruction, but current shipping devices suffer this problem. Unreliable means the SW can present thousands of combining opportunities and the HW will not combine for any of them, which creates a performance degradation, and critically fails the mlx5 boot test. However, the CPU is very sensitive to the instruction sequence used, with the better options being sufficiently good that the performance loss from the unreliable CPU is not measurable. Broadly there are several options, from worst to best: 1) A C loop doing a u64 memcpy. This was used prior to commit ef302283ddfc ("IB/mlx5: Use __iowrite64_copy() for write combining stores") and failed almost all the time on Grace CPUs. 2) ARM64 assembly with consecutive 8 byte stores. This was implemented as an arch-generic __iowriteXX_copy() family of functions suitable for performance use in drivers for WC. commit ead79118dae6 ("arm64/io: Provide a WC friendly __iowriteXX_copy()") provided the ARM implementation. 3) ARM64 assembly with consecutive 16 byte stores. This was rejected from kernel use over fears of virtualization failures. Common ARM VMMs will crash if STP is used against emulated memory. 4) A single NEON store instruction. Userspace has used this option for a very long time, it performs well. 5) For future silicon the new ST64B instruction is guaranteed to generate a 64 byte TLP 100% of the time The past upgrade from #1 to #2 was thought to be sufficient to solve this problem. However, more testing on more systems shows that #3 is still problematic at a low frequency and the kernel test fails. Thus, make the mlx5 use the same instructions as userspace during the boot time WC self test. This way the WC test matches the userspace and will properly detect the ability of HW to support the WC workload that userspace will generate. While #4 still has imperfect combining performance, it is substantially better than #2, and does actually give a performance win to applications. Self-test failures with #2 are like 3/10 boots, on some systems, #4 has never seen a boot failure. There is no real general use case for a NEON based WC flow in the kernel. This is not suitable for any performance path work as getting into/out of a NEON context is fairly expensive compared to the gain of WC. Future CPUs are going to fix this issue by using an new ARM instruction and __iowriteXX_copy() will be updated to use that automatically, probably using the ALTERNATES mechanism. Since this problem is constrained to mlx5's unique situation of needing a non-performance code path to duplicate what mlx5 userspace is doing as a matter of self-testing, implement it as a one line inline assembly in the driver directly. Lastly, this was concluded from the discussion with ARM maintainers which confirms that this is the best approach for the solution: https://lore.kernel.org/r/aHqN_hpJl84T1Usi@arm.com Signed-off-by: Patrisious Haddad Reviewed-by: Michael Guralnik Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1759093688-841357-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1d17e808cf2aad182f0eb2ea83e329e4a6795428 Merge: 7601d18be06943 a001cd248ab244 Author: Linus Torvalds Date: Tue Sep 30 15:06:33 2025 -0700 Merge tag 'core-rseq-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq updates from Thomas Gleixner: "Two fixes for RSEQ: - Protect the event mask modification against the membarrier() IPI as otherwise the RmW operation is unprotected and events might be lost - Fix the weak symbol reference in rseq selftests The current weak RSEQ symbols definitions which were added to allow static linkage are not working correctly as they effectively re-define the glibc symbols leading to multiple versions of the symbols when compiled with -fno-common. Mark them as 'extern' to convert them from weak symbol definitions to weak symbol references. That works with static and dynamic linkage independent of -fcommon and -fno-common" * tag 'core-rseq-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq/selftests: Use weak symbol reference, not definition, to link with glibc rseq: Protect event mask against membarrier IPI commit 7601d18be06943d5ac2b1802899ff6c303544936 Merge: 22bdd6e68bbe27 3ec09344b01a15 Author: Linus Torvalds Date: Tue Sep 30 14:36:20 2025 -0700 Merge tag 'core-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull TIF bit unification updates from Thomas Gleixner: "A set of changes to consolidate the generic TIF (thread info flag) bits accross architectures. All architectures define the same set of generic TIF bits. This makes it pointlessly hard to add a new generic TIF bit or to change an existing one. Provide a generic variant and convert the architectures which utilize the generic entry code over to use it. The TIF space is divided into 16 generic bits and 16 architecture specific bits, which turned out to provide enough space on both sides" * tag 'core-core-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: LoongArch: Fix bitflag conflict for TIF_FIXADE riscv: Use generic TIF bits loongarch: Use generic TIF bits s390/entry: Remove unused TIF flags s390: Use generic TIF bits x86: Use generic TIF bits asm-generic: Provide generic TIF infrastructure commit 2378a191f440a06e4c60fb8a50f4cb708c10ba40 Author: Michal Koutný Date: Wed Sep 24 13:38:09 2025 +0200 tracing: Ensure optimized hashing works If ever PID_MAX_DEFAULT changes, it must be compatible with tracing hashmaps assumptions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250924113810.2433478-1-mkoutny@suse.com Link: https://lore.kernel.org/r/20240409110126.651e94cb@gandalf.local.home/ Signed-off-by: Michal Koutný Signed-off-by: Steven Rostedt (Google) commit 4099b98203d6b33d990586542fa5beee408032a3 Author: Vladimir Riabchun Date: Fri Sep 12 13:28:55 2025 +0200 ftrace: Fix softlockup in ftrace_module_enable A soft lockup was observed when loading amdgpu module. If a module has a lot of tracable functions, multiple calls to kallsyms_lookup can spend too much time in RCU critical section and with disabled preemption, causing kernel panic. This is the same issue that was fixed in commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to ftrace_graph_set_hash()"). Fix it the same way by adding cond_resched() in ftrace_module_enable. Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc Signed-off-by: Vladimir Riabchun Signed-off-by: Steven Rostedt (Google) commit da1bb9135213744e7ec398826c8f2e843de4fb94 Author: Janne Grunau Date: Mon Sep 15 08:36:41 2025 +0200 fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by framebuffer_alloc(). This allocation is explicitly freed by unregister_framebuffer() in simplefb_remove(). Devres managed cleanup runs after the device remove call and thus can no longer access struct simplefb_par. Call simplefb_detach_genpds() explicitly from simplefb_destroy() like the cleanup functions for clocks and regulators. Fixes an use after free on M2 Mac mini during aperture_remove_conflicting_devices() using the downstream asahi kernel with Debian's kernel config. For unknown reasons this started to consistently dereference an invalid pointer in v6.16.3 based kernels. [ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220 [ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227 [ 6.750697] [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY [ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC [ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT) [ 6.752189] Call trace: [ 6.752190] show_stack+0x34/0x98 (C) [ 6.752194] dump_stack_lvl+0x60/0x80 [ 6.752197] print_report+0x17c/0x4d8 [ 6.752201] kasan_report+0xb4/0x100 [ 6.752206] __asan_report_load4_noabort+0x20/0x30 [ 6.752209] simplefb_detach_genpds+0x58/0x220 [ 6.752213] devm_action_release+0x50/0x98 [ 6.752216] release_nodes+0xd0/0x2c8 [ 6.752219] devres_release_all+0xfc/0x178 [ 6.752221] device_unbind_cleanup+0x28/0x168 [ 6.752224] device_release_driver_internal+0x34c/0x470 [ 6.752228] device_release_driver+0x20/0x38 [ 6.752231] bus_remove_device+0x1b0/0x380 [ 6.752234] device_del+0x314/0x820 [ 6.752238] platform_device_del+0x3c/0x1e8 [ 6.752242] platform_device_unregister+0x20/0x50 [ 6.752246] aperture_detach_platform_device+0x1c/0x30 [ 6.752250] aperture_detach_devices+0x16c/0x290 [ 6.752253] aperture_remove_conflicting_devices+0x34/0x50 ... [ 6.752343] [ 6.967409] Allocated by task 62: [ 6.970724] kasan_save_stack+0x3c/0x70 [ 6.974560] kasan_save_track+0x20/0x40 [ 6.978397] kasan_save_alloc_info+0x40/0x58 [ 6.982670] __kasan_kmalloc+0xd4/0xd8 [ 6.986420] __kmalloc_noprof+0x194/0x540 [ 6.990432] framebuffer_alloc+0xc8/0x130 [ 6.994444] simplefb_probe+0x258/0x2378 ... [ 7.054356] [ 7.055838] Freed by task 227: [ 7.058891] kasan_save_stack+0x3c/0x70 [ 7.062727] kasan_save_track+0x20/0x40 [ 7.066565] kasan_save_free_info+0x4c/0x80 [ 7.070751] __kasan_slab_free+0x6c/0xa0 [ 7.074675] kfree+0x10c/0x380 [ 7.077727] framebuffer_release+0x5c/0x90 [ 7.081826] simplefb_destroy+0x1b4/0x2c0 [ 7.085837] put_fb_info+0x98/0x100 [ 7.089326] unregister_framebuffer+0x178/0x320 [ 7.093861] simplefb_remove+0x3c/0x60 [ 7.097611] platform_remove+0x60/0x98 [ 7.101361] device_remove+0xb8/0x160 [ 7.105024] device_release_driver_internal+0x2fc/0x470 [ 7.110256] device_release_driver+0x20/0x38 [ 7.114529] bus_remove_device+0x1b0/0x380 [ 7.118628] device_del+0x314/0x820 [ 7.122116] platform_device_del+0x3c/0x1e8 [ 7.126302] platform_device_unregister+0x20/0x50 [ 7.131012] aperture_detach_platform_device+0x1c/0x30 [ 7.136157] aperture_detach_devices+0x16c/0x290 [ 7.140779] aperture_remove_conflicting_devices+0x34/0x50 ... Reported-by: Daniel Huhardeaux Cc: stable@vger.kernel.org Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains") Signed-off-by: Janne Grunau Reviewed-by: Hans de Goede Signed-off-by: Helge Deller commit 2e3da8cfe3b281d503ef0e968af131323562ae7c Author: Zsolt Kajtar Date: Wed Sep 3 21:14:15 2025 +0200 fbdev: s3fb: Revert mclk stop in suspend There are systems which want to wait for as long as it takes for the stopped video memory to answer. Mapping it out helps to avoid that while the system is running but standby still hangs somehow. So just leave the memory on in standby same as it was before my change. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 4d23d9f7fa7c9ed10b5b32a4e4871ddce02b2337 Author: Qianfeng Rong Date: Sat Aug 30 20:47:00 2025 +0800 fbdev: mb862xxfb: Use int type to store negative error codes Change the 'ret' variable in of_platform_mb862xx_probe() from unsigned long to int, as it needs to store either negative error codes or zero. Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong Signed-off-by: Helge Deller commit c7d655ef2e0ca25ae2c46df47eb62ada9e820c78 Author: Chelsy Ratnawat Date: Sun Aug 24 08:23:27 2025 -0700 fbdev: Use string choices helpers Use string_choices.h helpers instead of hard-coded strings. Signed-off-by: Chelsy Ratnawat Signed-off-by: Helge Deller commit aad1d99beaaf132e2024a52727c24894cdf9474a Author: Zsolt Kajtar Date: Thu Aug 21 04:42:48 2025 +0200 fbdev: core: Fix ubsan warning in pixel_to_pat It could be triggered on 32 bit big endian machines at 32 bpp in the pattern realignment. In this case just return early as the result is an identity. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 69c9820d40892f7c10db03c5364795f5bb12aced Author: Zsolt Kajtar Date: Mon Aug 18 22:44:26 2025 +0200 fbdev: s3fb: Implement 1 and 2 BPP modes, improve 4 BPP With the right setup S3 cards can display 1 and 2 BPP packed pixel modes, even in high resolutions. So this patch makes them available. The 4 BPP packed pixel mode had one pixel column of garbage on the left side due to how the shift register works, this is fixed now. There was a limitation that only 8 pixel wide fonts could be used at 4 BPP. Since the CFB routines were updated to handle reverse pixel ordering correctly that limitation doesn't exists and was removed now. In 4 BPP interleaved planes mode font widths of multiply of 8 are accepted now, not just 8 pixels. The horizontal screen position will not move as much between modes as it used to. That was caused by the various amount of pipeline delay which is compensated now as much as possible. While adjusting the code direct port access of PEL registers was corrected. Should work now on systems where these are memory mapped. I've noticed that when in 1 BPP mode the console is used with Unicode fonts erasing might be done with non-blanks. That's a bug in the VT code and so not part of this patch. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit 43b30be2e7211d982b005d118dd6a12f97b9d458 Author: Zsolt Kajtar Date: Sun Aug 10 17:47:54 2025 +0200 fbdev: s3fb: Implement powersave for S3 FB This patch implements power saving for S3 cards by powering down the RAMDAC and stopping MCLK and DCLK while the card is supposed to be suspended. The RAMDAC is also disabled while the screen is blanked and the DCLK in stopped while in DPMS power off. The practical difference it makes is that on a machine with such a card the display will be placed in DPMS power off while standby is activated (due to stopped DCLK). Same like when using other cards with implemented power saving functionality. Without it on my setup the connected display powers up and stays that way showing VT63 while in standby. Sort of annoying as before standby it's specifically placed into DPMS off in Xorg for a while. The used functionality should exists for sure on Trio32 to Aurora64V (according to the documentation) so I think it's generally applicable. I'm using this on S3 Trio 3D and S3 Virge DX. Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller commit d391bb1955747edc9f92e67d35c79ada996a93eb Author: Qianfeng Rong Date: Mon Aug 4 15:24:11 2025 +0800 fbdev: xenfb: Use vmalloc_array to simplify code Use vmalloc_array() instead of vmalloc() to simplify the function xenfb_probe(). Signed-off-by: Qianfeng Rong Signed-off-by: Helge Deller commit 22bdd6e68bbe270a916233ec5f34a13ae5e80ed9 Merge: 2cb8eeaf00efc0 1f6113ae5ac492 Author: Linus Torvalds Date: Tue Sep 30 13:40:35 2025 -0700 Merge tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV and apic updates from Borislav Petkov: - Add functionality to provide runtime firmware updates for the non-x86 parts of an AMD platform like the security processor (ASP) firmware, modules etc, for example. The intent being that these updates are interim, live fixups before a proper BIOS update can be attempted - Add guest support for AMD's Secure AVIC feature which gives encrypted guests the needed protection against a malicious hypervisor generating unexpected interrupts and injecting them into such guest, thus interfering with its operation in an unexpected and negative manner. The advantage of this scheme is that the guest determines which interrupts and when to accept them vs leaving that to the benevolence (or not) of the hypervisor - Strictly separate the startup code from the rest of the kernel where former is executed from the initial 1:1 mapping of memory. The problem was that the toolchain-generated version of the code was being executed from a different mapping of memory than what was "assumed" during code generation, needing an ever-growing pile of fixups for absolute memory references which are invalid in the early, 1:1 memory mapping during boot. The major advantage of this is that there's no need to check the 1:1 mapping portion of the code for absolute relocations anymore and get rid of the RIP_REL_REF() macro sprinkling all over the place. For more info, see Ard's very detailed writeup on this [1] - The usual cleanups and fixes Link: https://lore.kernel.org/r/CAMj1kXEzKEuePEiHB%2BHxvfQbFz0sTiHdn4B%2B%2BzVBJ2mhkPkQ4Q@mail.gmail.com [1] * tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (49 commits) x86/boot: Drop erroneous __init annotation from early_set_pages_state() crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver crypto: ccp - Add new HV-Fixed page allocation/free API x86/sev: Add new dump_rmp parameter to snp_leak_pages() API x86/startup/sev: Document the CPUID flow in the boot #VC handler objtool: Ignore __pi___cfi_ prefixed symbols x86/sev: Zap snp_abort() x86/apic/savic: Do not use snp_abort() x86/boot: Get rid of the .head.text section x86/boot: Move startup code out of __head section efistub/x86: Remap inittext read-execute when needed x86/boot: Create a confined code area for startup code x86/kbuild: Incorporate boot/startup/ via Kbuild makefile x86/boot: Revert "Reject absolute references in .head.text" x86/boot: Check startup code for absence of absolute relocations objtool: Add action to check for absence of absolute relocations x86/sev: Export startup routines for later use x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object x86/sev: Provide PIC aliases for SEV related data objects x86/boot: Provide PIC aliases for 5-level paging related constants ... commit 2cb8eeaf00efc037988910de17ffe592b23941a6 Merge: a65879b4584f98 dd86b69d20fb9f Author: Linus Torvalds Date: Tue Sep 30 13:29:42 2025 -0700 Merge tag 'x86_cache_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: "Add support on AMD for assigning QoS bandwidth counters to resources (RMIDs) with the ability for those resources to be tracked by the counters as long as they're assigned to them. Previously, due to hw limitations, bandwidth counts from untracked resources would get lost when those resources are not tracked. Refactor the code and user interfaces to be able to also support other, similar features on ARM, for example" * tag 'x86_cache_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (35 commits) fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled MAINTAINERS: resctrl: Add myself as reviewer x86/resctrl: Configure mbm_event mode if supported fs/resctrl: Introduce the interface to switch between monitor modes fs/resctrl: Disable BMEC event configuration when mbm_event mode is enabled fs/resctrl: Introduce the interface to modify assignments in a group fs/resctrl: Introduce mbm_L3_assignments to list assignments in a group fs/resctrl: Auto assign counters on mkdir and clean up on group removal fs/resctrl: Introduce mbm_assign_on_mkdir to enable assignments on mkdir fs/resctrl: Provide interface to update the event configurations fs/resctrl: Add event configuration directory under info/L3_MON/ fs/resctrl: Support counter read/reset with mbm_event assignment mode x86/resctrl: Implement resctrl_arch_reset_cntr() and resctrl_arch_cntr_read() x86/resctrl: Refactor resctrl_arch_rmid_read() fs/resctrl: Introduce counter ID read, reset calls in mbm_event mode fs/resctrl: Pass struct rdtgroup instead of individual members fs/resctrl: Add the functionality to unassign MBM events fs/resctrl: Add the functionality to assign MBM events x86,fs/resctrl: Implement resctrl_arch_config_cntr() to assign a counter with ABMC fs/resctrl: Introduce event configuration field in struct mon_evt ... commit d655a684c24dde9e9f3f98f3dbae5a4f592117d4 Author: Dan Carpenter Date: Tue Sep 30 15:25:33 2025 +0300 Input: aw86927 - fix error code in probe() Fix this copy and paste bug. Return "err" instead of PTR_ERR(haptics->regmap). Fixes: 52e06d564ce6 ("Input: aw86927 - add driver for Awinic AW86927") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aNvMPTnOovdBitdP@stanley.mountain Signed-off-by: Dmitry Torokhov commit a65879b4584f98e6c1b80380f55ca8cfca82cb47 Merge: d7ec0cf1cd79a7 27b1fd62012dfe Author: Linus Torvalds Date: Tue Sep 30 13:19:08 2025 -0700 Merge tag 'x86_cpu_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Make UMIP instruction detection more robust - Correct and cleanup AMD CPU topology detection; document the relevant CPUID leaves topology parsing precedence on AMD - Add support for running the kernel as guest on FreeBSD's Bhyve hypervisor - Cleanups and improvements * tag 'x86_cpu_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) x86/umip: Check that the instruction opcode is at least two bytes Documentation/x86/topology: Detail CPUID leaves used for topology enumeration x86/cpu/topology: Define AMD64_CPUID_EXT_FEAT MSR x86/cpu/topology: Check for X86_FEATURE_XTOPOLOGY instead of passing has_xtopology x86/cpu/cacheinfo: Simplify cacheinfo_amd_init_llc_id() using _cpuid4_info x86/cpu: Rename and move CPU model entry for Diamond Rapids x86/cpu: Detect FreeBSD Bhyve hypervisor commit 1f0d4ab0f5326ab6f940482b1941d2209d61285a Author: Mike Snitzer Date: Fri Sep 19 10:36:31 2025 -0400 NFS: add basic STATX_DIOALIGN and STATX_DIO_READ_ALIGN support NFS doesn't have DIO alignment constraints, so have NFS respond with accommodating DIO alignment attributes (rather than plumb in GETATTR support for STATX_DIOALIGN and STATX_DIO_READ_ALIGN). The most coarse-grained dio_offset_align is the most accommodating (e.g. PAGE_SIZE, in future larger may be supported). Now that NFS has support, NFS reexport will now handle unaligned DIO (NFSD's NFSD_IO_DIRECT support requires the underlying filesystem support STATX_DIOALIGN and/or STATX_DIO_READ_ALIGN). Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit cda94457c224915845b1d209ff71cad3c61ce194 Author: Mike Snitzer Date: Fri Sep 19 10:36:30 2025 -0400 nfs/localio: add tracepoints for misaligned DIO READ and WRITE support Add nfs_local_dio_class and use it to create nfs_local_dio_read, nfs_local_dio_write and nfs_local_dio_misaligned trace events. These trace events show how NFS LOCALIO splits a given misaligned IO into a mix of misaligned head and/or tail extents and a DIO-aligned middle extent. The misaligned head and/or tail extents are issued using buffered IO and the DIO-aligned middle is issued using O_DIRECT. This combination of trace events is useful for LOCALIO DIO READs: echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_read/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_misaligned/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_initiate_read/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_readpage_done/enable echo 1 > /sys/kernel/tracing/events/xfs/xfs_file_direct_read/enable This combination of trace events is useful for LOCALIO DIO WRITEs: echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_write/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_local_dio_misaligned/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_initiate_write/enable echo 1 > /sys/kernel/tracing/events/nfs/nfs_writeback_done/enable echo 1 > /sys/kernel/tracing/events/xfs/xfs_file_direct_write/enable Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit c817248fc831f5494d076421672b70a6ec1a92dc Author: Mike Snitzer Date: Fri Sep 19 10:36:29 2025 -0400 nfs/localio: add proper O_DIRECT support for READ and WRITE Because the NFS client will already happily handle misaligned O_DIRECT IO (by sending it out to NFSD via RPC) this commit's new capabilities are for the benefit of LOCALIO. LOCALIO will make best effort to transform misaligned IO to DIO-aligned extents when possible. LOCALIO's READ and WRITE DIO that is misaligned will be split into as many as 3 component IOs (@start, @middle and @end) as needed -- IFF the @middle extent is verified to be DIO-aligned, and then the @start and/or @end are misaligned (due to each being a partial page). Otherwise if the @middle isn't DIO-aligned the code will fallback to issuing only a single contiguous buffered IO. The @middle is only DIO-aligned if both the memory and on-disk offsets for the IO are aligned relative to the underlying local filesystem's block device limits (@dma_alignment and @logical_block_size respectively). The misaligned @start and/or @end extents are issued using buffered IO and the DIO-aligned @middle is issued using O_DIRECT. The @start and @end IOs are issued first using buffered IO with IOCB_SYNC and then the @middle is issued last using direct IO with async completion (AIO). This out of order IO completion means that LOCALIO's IO completion code (nfs_local_read_done and nfs_local_write_done) is only called for the IO's last associated iov_iter completion. And in the case of DIO-aligned @middle it completes last using AIO. nfs_local_pgio_done() is updated to handle piece-wise partial completion of each iov_iter. This implementation for LOCALIO's misaligned DIO handling uses 3 iov_iter that share the same backing pages in their bio_vecs (so unfortunately 'struct nfs_local_kiocb' has 3 instead of only 1). [Reducing LOCALIO's per-IO (struct nfs_local_kiocb) memory use can be explored in the future. One logical progression to improve this code, and eliminate explicit loops over up to 3 iov_iter, is by extending 'struct iov_iter' to support iov_iter_clone() and iov_iter_chain() interfaces that are comparable to what 'struct bio' is able to support in the block layer. But even that wouldn't avoid the need to allocate/use up to 3 iov_iter] Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit e43e9a3a3d6652047808d6fadff5c3703f5ce90d Author: Mike Snitzer Date: Fri Sep 19 10:36:28 2025 -0400 nfs/localio: refactor iocb initialization The goal of this commit's various refactoring is to have LOCALIO's per IO initialization occur in process context so that we don't get into a situation where IO fails to be issued from workqueue (e.g. due to lack of memory, etc). Better to have LOCALIO's iocb initialization fail early. There isn't immediate need but this commit makes it possible for LOCALIO to fallback to NFS pagelist code in process context to allow for immediate retry over RPC. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 091bdcfcece0963a9a6590ba7cfcc9e1d454165f Author: Mike Snitzer Date: Fri Sep 19 10:36:27 2025 -0400 nfs/localio: refactor iocb and iov_iter_bvec initialization nfs_local_iter_init() is updated to follow the same pattern to initializing LOCALIO's iov_iter_bvec as was established by nfsd_iter_read(). Other LOCALIO iocb initialization refactoring in this commit offers incremental cleanup that will be taken further by the next commit. No functional change. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit 558ae4579810fa0fef011944230c65a6f3087f85 Author: Hoyoung Seo Date: Tue Sep 30 15:14:28 2025 +0900 scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS When a UTP error occurs in isolation, UFS is not currently recoverable. This is because the UTP error is not considered fatal in the error handling code, leading to either an I/O timeout or an OCS error. Add the UTP error flag to INT_FATAL_ERRORS so the controller will be reset in this situation. sd 0:0:0:0: [sda] tag#38 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#38 CDB: opcode=0x28 28 00 00 51 24 e2 00 00 08 00 I/O error, dev sda, sector 42542864 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 2 OCS error from controller = 9 for tag 39 pa_err[1] = 0x80000010 at 2667224756 us pa_err: total cnt=2 dl_err[0] = 0x80000002 at 2667148060 us dl_err[1] = 0x80002000 at 2667282844 us No record of nl_err No record of tl_err No record of dme_err No record of auto_hibern8_err fatal_err[0] = 0x804 at 2667282836 us --------------------------------------------------- REGISTER --------------------------------------------------- NAME OFFSET VALUE STD HCI SFR 0xfffffff0 0x0 AHIT 0x18 0x814 INTERRUPT STATUS 0x20 0x1000 INTERRUPT ENABLE 0x24 0x70ef5 [mkp: commit desc] Signed-off-by: Hoyoung Seo Reviewed-by: Bart Van Assche Message-Id: <20250930061428.617955-1-hy50.seo@samsung.com> Signed-off-by: Martin K. Petersen commit 25ba2b84c38f624151a3ba36e56d41c39b9223ad Author: Mike Snitzer Date: Fri Sep 19 10:36:26 2025 -0400 nfs/localio: avoid issuing misaligned IO using O_DIRECT Add nfsd_file_dio_alignment and use it to avoid issuing misaligned IO using O_DIRECT. Any misaligned DIO falls back to using buffered IO. Because misaligned DIO is now handled safely, remove the nfs modparam 'localio_O_DIRECT_semantics' that was added to require users opt-in to the requirement that all O_DIRECT be properly DIO-aligned. Also, introduce nfs_iov_iter_aligned_bvec() which is a variant of iov_iter_aligned_bvec() that also verifies the offset associated with an iov_iter is DIO-aligned. NOTE: in a parallel effort, iov_iter_aligned_bvec() is being removed along with iov_iter_is_aligned(). Lastly, add pr_info_ratelimited if underlying filesystem returns -EINVAL because it was made to try O_DIRECT for IO that is not DIO-aligned (shouldn't happen, so its best to be louder if it does). Fixes: 3feec68563d ("nfs/localio: add direct IO enablement with sync and async IO support") Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit fd6d93c2b79ded0a447502ce5c8a9a549c697819 Author: Mike Snitzer Date: Fri Sep 19 10:36:25 2025 -0400 nfs/localio: make trace_nfs_local_open_fh more useful Always trigger trace event when LOCALIO opens a file. Signed-off-by: Mike Snitzer Signed-off-by: Anna Schumaker commit d11f6cd1bb4a416b4515702d020a7480ac667f0f Author: Mike Snitzer Date: Mon Sep 29 11:56:41 2025 -0400 NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support Use STATX_DIOALIGN and STATX_DIO_READ_ALIGN to get DIO alignment attributes from the underlying filesystem and store them in the associated nfsd_file. This is done when the nfsd_file is first opened for each regular file. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever Acked-by: Chuck Lever Signed-off-by: Anna Schumaker commit ffe381923d87c8cf5d4372c12eea6127dc36fd3a Author: Jeff Layton Date: Mon Sep 22 17:36:48 2025 -0400 sunrpc: unexport rpc_malloc() and rpc_free() These are not used outside of sunrpc code. Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker commit d7ec0cf1cd79a74399b53453f9c48acbca7d6fce Merge: d9c43b6e43643e 930f2361fe542a Author: Linus Torvalds Date: Tue Sep 30 12:46:57 2025 -0700 Merge tag 'x86_bugs_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mitigation updates from Borislav Petkov: - Add VMSCAPE to the attack vector controls infrastructure - A bunch of the usual cleanups and fixlets, some of them resulting from fuzzing the different mitigation options * tag 'x86_bugs_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Report correct retbleed mitigation status x86/bugs: Fix reporting of LFENCE retpoline x86/bugs: Fix spectre_v2 forcing x86/bugs: Remove uses of cpu_mitigations_off() x86/bugs: Simplify SSB cmdline parsing x86/bugs: Use early_param() for spectre_v2 x86/bugs: Use early_param() for spectre_v2_user x86/bugs: Add attack vector controls for VMSCAPE x86/its: Move ITS indirect branch thunks to .text..__x86.indirect_thunk commit bb7663dec67b691528f104894429b3859fb16c14 Author: Daniel Lee Date: Mon Sep 29 18:09:39 2025 -0700 scsi: ufs: sysfs: Make HID attributes visible Call sysfs_update_group() after reading the device descriptor to ensure the HID sysfs attributes are visible when the feature is supported. Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support") Signed-off-by: Daniel Lee Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d9c43b6e43643e0c884179fd4598e2003f1a04a3 Merge: bd91417a962db2 5c6f123c419b6e Author: Linus Torvalds Date: Tue Sep 30 12:43:17 2025 -0700 Merge tag 'ras_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - Unify and refactor the MCA arch side and better separate code - Cleanup and simplify the AMD RAS side, unify code, drop unused stuff * tag 'ras_core_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Add a clear_bank() helper x86/mce: Move machine_check_poll() status checks to helper functions x86/mce: Separate global and per-CPU quirks x86/mce: Do 'UNKNOWN' vendor check early x86/mce: Define BSP-only SMCA init x86/mce: Define BSP-only init x86/mce: Set CR4.MCE last during init x86/mce: Remove __mcheck_cpu_init_early() x86/mce: Cleanup bank processing on init x86/mce/amd: Put list_head in threshold_bank x86/mce/amd: Remove smca_banks_map x86/mce/amd: Remove return value for mce_threshold_{create,remove}_device() x86/mce/amd: Rename threshold restart function commit bd91417a962db247d41a22720a79e68a509a9353 Merge: 45d96dd2c62899 43181a47263dd9 Author: Linus Torvalds Date: Tue Sep 30 12:41:10 2025 -0700 Merge tag 'x86_microcode_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislav Petkov: - Add infrastructure to be able to debug the microcode loader in a guest - Refresh Intel old microcode revisions * tag 'x86_microcode_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Add microcode loader debugging functionality x86/microcode: Add microcode= cmdline parsing x86/microcode/intel: Refresh the revisions that determine old_microcode commit 45d96dd2c62899ff8a3f07e3b8109656062b457a Merge: 163d9c6b339c4b ac9c408ed19d53 Author: Linus Torvalds Date: Tue Sep 30 12:19:29 2025 -0700 Merge tag 'x86_asm_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm update from Borislav Petkov: - Fix RDPID's output operand size in inline asm and use the insn mnemonic because the minimum binutils version supports it * tag 'x86_asm_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Fix output operand size of RDPID commit 163d9c6b339c4bbe1a7a877ed8c99702da96d994 Merge: 98afd4dd3dd385 2c6a28f3ef729e Author: Linus Torvalds Date: Tue Sep 30 12:17:22 2025 -0700 Merge tag 'x86_build_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Borislav Petkov: - Remove and simplify a bunch of cc-option and compiler version checks in the build machinery now that the minimal version of both compilers supports them * tag 'x86_build_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/Kconfig: Clean up LLVM version checks in IBT configurations x86/build: Remove cc-option from -mskip-rax-setup x86/build: Remove cc-option from -mno-fp-ret-in-387 x86/build: Clean up stack alignment flags in CC_FLAGS_FPU x86/build: Remove cc-option from stack alignment flags x86/build: Remove cc-option for GCC retpoline flags commit 98afd4dd3dd385623e8e7c88394e352b0fbf0c3f Merge: 03f76ddff5b04a 26178b713f2b3f Author: Linus Torvalds Date: Tue Sep 30 11:48:33 2025 -0700 Merge tag 'x86_misc_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 instruction decoder update from Borislav Petkov: - Add instruction decoding support for the XOP-prefixed instruction set present on the AMD Bulldozer uarch [ These instructions don't normally happen, but a X86_NATIVE_CPU build on a bulldozer host can make the compiler then use these unusual instruction encodings ] * tag 'x86_misc_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/insn: Add XOP prefix instructions decoder support commit 03f76ddff5b04a808ae16c06418460151e2fdd4b Merge: 88b489385bfe37 69ed025aeb4c8f Author: Linus Torvalds Date: Tue Sep 30 11:41:03 2025 -0700 Merge tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Add support for new AMD family 0x1a models to amd64_edac - Add an EDAC driver for the AMD VersalNET memory controller which reports hw errors from different IP blocks in the fabric using an IPC-type transport - Drop the silly static number of memory controllers in the Intel EDAC drivers (skx, i10nm) in favor of a flexible array so that former doesn't need to be increased with every new generation which adds more memory controllers; along with a proper refactoring - Add support for two Alder Lake-S SOCs to ie31200_edac - Add an EDAC driver for ADM Cortex A72 cores, and specifically for reporting L1 and L2 cache errors - Last but not least, the usual fixes, cleanups and improvements all over the subsystem * tag 'edac_updates_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (23 commits) EDAC/versalnet: Return the correct error in mc_probe() EDAC/mc_sysfs: Increase legacy channel support to 16 EDAC/amd64: Add support for AMD family 1Ah-based newer models EDAC: Add a driver for the AMD Versal NET DDR controller dt-bindings: memory-controllers: Add support for Versal NET EDAC RAS: Export log_non_standard_event() to drivers cdx: Export Symbols for MCDI RPC and Initialization cdx: Split mcdi.h and reorganize headers EDAC/skx_common: Use topology_physical_package_id() instead of open coding EDAC: Fix wrong executable file modes for C source files EDAC/altera: Use dev_fwnode() EDAC/skx_common: Remove unused *NUM*_IMC macros EDAC/i10nm: Reallocate skx_dev list if preconfigured cnt != runtime cnt EDAC/skx_common: Remove redundant upper bound check for res->imc EDAC/skx_common: Make skx_dev->imc[] a flexible array EDAC/skx_common: Swap memory controller index mapping EDAC/skx_common: Move mc_mapping to be a field inside struct skx_imc EDAC/{skx_common,skx}: Use configuration data, not global macros EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller EDAC/ie31200: Add two more Intel Alder Lake-S SoCs for EDAC support ... commit 88b489385bfe3713497a63c0dcf4dd7852cf4568 Merge: e4dcbdff114e2c 17d9f8eaa87d40 Author: Linus Torvalds Date: Tue Sep 30 11:33:21 2025 -0700 Merge tag 'locking-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Mostly Rust runtime enhancements: - Add initial support for generic LKMM atomic variables in Rust (Boqun Feng) - Add the wrapper for `refcount_t` in Rust (Gary Guo) - Add a new reviewer, Gary Guo" * tag 'locking-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: update atomic infrastructure entry to include Rust rust: block: convert `block::mq` to use `Refcount` rust: convert `Arc` to use `Refcount` rust: make `Arc::into_unique_or_drop` associated function rust: implement `kernel::sync::Refcount` rust: sync: Add memory barriers rust: sync: atomic: Add Atomic<{usize,isize}> rust: sync: atomic: Add Atomic rust: sync: atomic: Add the framework of arithmetic operations rust: sync: atomic: Add atomic {cmp,}xchg operations rust: sync: atomic: Add generic atomics rust: sync: atomic: Add ordering annotation types rust: sync: Add basic atomic operation mapping framework rust: Introduce atomic API helpers commit e4dcbdff114e2c0a8059c396e233aa5d9637afce Merge: 6c7340a7a8d2b6 6d48436560e91b Author: Linus Torvalds Date: Tue Sep 30 11:11:21 2025 -0700 Merge tag 'perf-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: "Core perf code updates: - Convert mmap() related reference counts to refcount_t. This is in reaction to the recently fixed refcount bugs, which could have been detected earlier and could have mitigated the bug somewhat (Thomas Gleixner, Peter Zijlstra) - Clean up and simplify the callchain code, in preparation for sframes (Steven Rostedt, Josh Poimboeuf) Uprobes updates: - Add support to optimize usdt probes on x86-64, which gives a substantial speedup (Jiri Olsa) - Cleanups and fixes on x86 (Peter Zijlstra) PMU driver updates: - Various optimizations and fixes to the Intel PMU driver (Dapeng Mi) Misc cleanups and fixes: - Remove redundant __GFP_NOWARN (Qianfeng Rong)" * tag 'perf-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (57 commits) selftests/bpf: Fix uprobe_sigill test for uprobe syscall error value uprobes/x86: Return error from uprobe syscall when not called from trampoline perf: Skip user unwind if the task is a kernel thread perf: Simplify get_perf_callchain() user logic perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL perf: Have get_perf_callchain() return NULL if crosstask and user are set perf: Remove get_perf_callchain() init_nr argument perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error perf/x86/intel: Use early_initcall() to hook bts_init() uprobes: Remove redundant __GFP_NOWARN selftests/seccomp: validate uprobe syscall passes through seccomp seccomp: passthrough uprobe systemcall without filtering selftests/bpf: Fix uprobe syscall shadow stack test selftests/bpf: Change test_uretprobe_regs_change for uprobe and uretprobe selftests/bpf: Add uprobe_regs_equal test selftests/bpf: Add optimized usdt variant for basic usdt test ... commit 6b36119b94d0b2bb8cea9d512017efafd461d6ac Author: Sean Christopherson Date: Thu Sep 18 17:33:03 2025 -0700 KVM: x86: Export KVM-internal symbols for sub-modules only Rework almost all of KVM x86's exports to expose symbols only to KVM's vendor modules, i.e. to kvm-{amd,intel}.ko. Keep the generic exports that are guarded by CONFIG_KVM_EXTERNAL_WRITE_TRACKING=y, as they're explicitly designed/intended for external usage. Link: https://lore.kernel.org/r/20250919003303.1355064-6-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 6560468305da263c35ff51cde1dd74d6a228b286 Author: Sean Christopherson Date: Thu Sep 18 17:33:02 2025 -0700 KVM: x86: Drop pointless exports of kvm_arch_xxx() hooks Drop the exporting of several kvm_arch_xxx() hooks that are only called from arch-neutral code, i.e. that are only called from kvm.ko. Link: https://lore.kernel.org/r/20250919003303.1355064-5-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit d273b52b6fad95b6b00b93250151c323c19de50d Author: Sean Christopherson Date: Thu Sep 18 17:33:01 2025 -0700 KVM: x86: Move kvm_intr_is_single_vcpu() to lapic.c Move kvm_intr_is_single_vcpu() to lapic.c, drop its export, and make its "fast" helper local to lapic.c. kvm_intr_is_single_vcpu() is only usable if the local APIC is in-kernel, i.e. it most definitely belongs in the local APIC code. No functional change intended. Fixes: cf04ec393ed0 ("KVM: x86: Dedup AVIC vs. PI code for identifying target vCPU") Link: https://lore.kernel.org/r/20250919003303.1355064-4-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 20c48920583675e67b3824f147726e0fbda735ce Author: Sean Christopherson Date: Thu Sep 18 17:33:00 2025 -0700 KVM: Export KVM-internal symbols for sub-modules only Rework the vast majority of KVM's exports to expose symbols only to KVM submodules, i.e. to x86's kvm-{amd,intel}.ko and PPC's kvm-{pr,hv}.ko. With few exceptions, KVM's exported APIs are intended (and safe) for KVM- internal usage only. Keep kvm_get_kvm(), kvm_get_kvm_safe(), and kvm_put_kvm() as normal exports, as they are needed by VFIO, and are generally safe for external usage (though ideally even the get/put APIs would be KVM-internal, and VFIO would pin a VM by grabbing a reference to its associated file). Implement a framework in kvm_types.h in anticipation of providing a macro to restrict KVM-specific kernel exports, i.e. to provide symbol exports for KVM if and only if KVM is built as one or more modules. Link: https://lore.kernel.org/r/20250919003303.1355064-3-seanjc@google.com Cc: Nathan Chancellor Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 15463eece957be34da64b4d6fe18fc98981bf487 Author: Sean Christopherson Date: Thu Sep 18 17:32:59 2025 -0700 KVM: s390/vfio-ap: Use kvm_is_gpa_in_memslot() instead of open coded equivalent Use kvm_is_gpa_in_memslot() to check the validity of the notification indicator byte address instead of open coding equivalent logic in the VFIO AP driver. Opportunistically use a dedicated wrapper that exists and is exported expressly for the VFIO AP module. kvm_is_gpa_in_memslot() is generally unsuitable for use outside of KVM; other drivers typically shouldn't rely on KVM's memslots, and using the API requires kvm->srcu (or slots_lock) to be held for the entire duration of the usage, e.g. to avoid TOCTOU bugs. handle_pqap() is a bit of a special case, as it's explicitly invoked from KVM with kvm->srcu already held, and the VFIO AP driver is in many ways an extension of KVM that happens to live in a separate module. Providing a dedicated API for the VFIO AP driver will allow restricting the vast majority of generic KVM's exports to KVM submodules (e.g. to x86's kvm-{amd,intel}.ko vendor mdoules). No functional change intended. Acked-by: Anthony Krowiak Reviewed-by: Christian Borntraeger Link: https://lore.kernel.org/r/20250919003303.1355064-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 12abeb81c87331bf53940947694cc51b7507aa38 Merge: d05ca6b7931e15 d292035fb5d209 Author: Paolo Bonzini Date: Tue Sep 30 13:37:14 2025 -0400 Merge tag 'kvm-x86-cet-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 CET virtualization support for 6.18 Add support for virtualizing Control-flow Enforcement Technology (CET) on Intel (Shadow Stacks and Indirect Branch Tracking) and AMD (Shadow Stacks). CET is comprised of two distinct features, Shadow Stacks (SHSTK) and Indirect Branch Tracking (IBT), that can be utilized by software to help provide Control-flow integrity (CFI). SHSTK defends against backward-edge attacks (a.k.a. Return-oriented programming (ROP)), while IBT defends against forward-edge attacks (a.k.a. similarly CALL/JMP-oriented programming (COP/JOP)). Attackers commonly use ROP and COP/JOP methodologies to redirect the control- flow to unauthorized targets in order to execute small snippets of code, a.k.a. gadgets, of the attackers choice. By chaining together several gadgets, an attacker can perform arbitrary operations and circumvent the system's defenses. SHSTK defends against backward-edge attacks, which execute gadgets by modifying the stack to branch to the attacker's target via RET, by providing a second stack that is used exclusively to track control transfer operations. The shadow stack is separate from the data/normal stack, and can be enabled independently in user and kernel mode. When SHSTK is is enabled, CALL instructions push the return address on both the data and shadow stack. RET then pops the return address from both stacks and compares the addresses. If the return addresses from the two stacks do not match, the CPU generates a Control Protection (#CP) exception. IBT defends against backward-edge attacks, which branch to gadgets by executing indirect CALL and JMP instructions with attacker controlled register or memory state, by requiring the target of indirect branches to start with a special marker instruction, ENDBRANCH. If an indirect branch is executed and the next instruction is not an ENDBRANCH, the CPU generates a #CP. Note, ENDBRANCH behaves as a NOP if IBT is disabled or unsupported. From a virtualization perspective, CET presents several problems. While SHSTK and IBT have two layers of enabling, a global control in the form of a CR4 bit, and a per-feature control in user and kernel (supervisor) MSRs (U_CET and S_CET respectively), the {S,U}_CET MSRs can be context switched via XSAVES/XRSTORS. Practically speaking, intercepting and emulating XSAVES/XRSTORS is not a viable option due to complexity, and outright disallowing use of XSTATE to context switch SHSTK/IBT state would render the features unusable to most guests. To limit the overall complexity without sacrificing performance or usability, simply ignore the potential virtualization hole, but ensure that all paths in KVM treat SHSTK/IBT as usable by the guest if the feature is supported in hardware, and the guest has access to at least one of SHSTK or IBT. I.e. allow userspace to advertise one of SHSTK or IBT if both are supported in hardware, even though doing so would allow a misbehaving guest to use the unadvertised feature. Fully emulating SHSTK and IBT would also require significant complexity, e.g. to track and update branch state for IBT, and shadow stack state for SHSTK. Given that emulating large swaths of the guest code stream isn't necessary on modern CPUs, punt on emulating instructions that meaningful impact or consume SHSTK or IBT. However, instead of doing nothing, explicitly reject emulation of such instructions so that KVM's emulator can't be abused to circumvent CET. Disable support for SHSTK and IBT if KVM is configured such that emulation of arbitrary guest instructions may be required, specifically if Unrestricted Guest (Intel only) is disabled, or if KVM will emulate a guest.MAXPHYADDR that is smaller than host.MAXPHYADDR. Lastly disable SHSTK support if shadow paging is enabled, as the protections for the shadow stack are novel (shadow stacks require Writable=0,Dirty=1, so that they can't be directly modified by software), i.e. would require non-trivial support in the Shadow MMU. Note, AMD CPUs currently only support SHSTK. Explicitly disable IBT support so that KVM doesn't over-advertise if AMD CPUs add IBT, and virtualizing IBT in SVM requires KVM modifications. commit d05ca6b7931e15d882af9ca4a609957cae7aac96 Merge: 10ef74c06bb1f5 86bcd23df9cec9 Author: Paolo Bonzini Date: Tue Sep 30 13:36:41 2025 -0400 Merge tag 'kvm-x86-misc-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 changes for 6.18 - Don't (re)check L1 intercepts when completing userspace I/O to fix a flaw where a misbehaving usersepace (a.k.a. syzkaller) could swizzle L1's intercepts and trigger a variety of WARNs in KVM. - Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 guests, as the MSR is supposed to exist for v2 PMUs. - Allow Centaur CPU leaves (base 0xC000_0000) for Zhaoxin CPUs. - Clean up KVM's vector hashing code for delivering lowest priority IRQs. - Clean up the fastpath handler code to only handle IPIs and WRMSRs that are actually "fast", as opposed to handling those that KVM _hopes_ are fast, and in the process of doing so add fastpath support for TSC_DEADLINE writes on AMD CPUs. - Clean up a pile of PMU code in anticipation of adding support for mediated vPMUs. - Add support for the immediate forms of RDMSR and WRMSRNS, sans full emulator support (KVM should never need to emulate the MSRs outside of forced emulation and other contrived testing scenarios). - Clean up the MSR APIs in preparation for CET and FRED virtualization, as well as mediated vPMU support. - Rejecting a fully in-kernel IRQCHIP if EOIs are protected, i.e. for TDX VMs, as KVM can't faithfully emulate an I/O APIC for such guests. - KVM_REQ_MSR_FILTER_CHANGED into a generic RECALC_INTERCEPTS in preparation for mediated vPMU support, as KVM will need to recalculate MSR intercepts in response to PMU refreshes for guests with mediated vPMUs. - Misc cleanups and minor fixes. commit 6c7340a7a8d2b6ecad1ad108f6daa73ba1dc082f Merge: 755fa5b4fb3662 45b7f780739a31 Author: Linus Torvalds Date: Tue Sep 30 10:35:11 2025 -0700 Merge tag 'sched-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Core scheduler changes: - Make migrate_{en,dis}able() inline, to improve performance (Menglong Dong) - Move STDL_INIT() functions out-of-line (Peter Zijlstra) - Unify the SCHED_{SMT,CLUSTER,MC} Kconfig (Peter Zijlstra) Fair scheduling: - Defer throttling to when tasks exit to user-space, to reduce the chance & impact of throttle-preemption with held locks and other resources (Aaron Lu, Valentin Schneider) - Get rid of sched_domains_curr_level hack for tl->cpumask(), as the warning was getting triggered on certain topologies (Peter Zijlstra) Misc cleanups & fixes: - Header cleanups (Menglong Dong) - Fix race in push_dl_task() (Harshit Agarwal)" * tag 'sched-core-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Fix some typos in include/linux/preempt.h sched: Make migrate_{en,dis}able() inline rcu: Replace preempt.h with sched.h in include/linux/rcupdate.h arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c sched/fair: Do not balance task to a throttled cfs_rq sched/fair: Do not special case tasks in throttled hierarchy sched/fair: update_cfs_group() for throttled cfs_rqs sched/fair: Propagate load for throttled cfs_rq sched/fair: Get rid of throttled_lb_pair() sched/fair: Task based throttle time accounting sched/fair: Switch to task based throttle model sched/fair: Implement throttle task work and related helpers sched/fair: Add related data structure for task based throttle sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig sched: Move STDL_INIT() functions out-of-line sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask() sched/deadline: Fix race in push_dl_task() commit 10ef74c06bb1f51e706018f2939722e881192eff Merge: a104e0a3052d5e 6c7c620585c653 Author: Paolo Bonzini Date: Tue Sep 30 13:34:32 2025 -0400 Merge tag 'kvm-x86-ciphertext-6.18' of https://github.com/kvm-x86/linux into HEAD KVM SEV-SNP CipherText Hiding support for 6.18 Add support for SEV-SNP's CipherText Hiding, an opt-in feature that prevents unauthorized CPU accesses from reading the ciphertext of SNP guest private memory, e.g. to attempt an offline attack. Instead of ciphertext, the CPU will always read back all FFs when CipherText Hiding is enabled. Add new module parameter to the KVM module to enable CipherText Hiding and control the number of ASIDs that can be used for VMs with CipherText Hiding, which is in effect the number of SNP VMs. When CipherText Hiding is enabled, the shared SEV-ES/SEV-SNP ASID space is split into separate ranges for SEV-ES and SEV-SNP guests, i.e. ASIDs that can be used for CipherText Hiding cannot be used to run SEV-ES guests. commit a104e0a3052d5e5d764e3e057c42ebaed17b53bd Merge: 0f68fe44550cf1 ca2967de5a5b09 Author: Paolo Bonzini Date: Tue Sep 30 13:34:12 2025 -0400 Merge tag 'kvm-x86-svm-6.18' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.18 - Require a minimum GHCB version of 2 when starting SEV-SNP guests via KVM_SEV_INIT2 so that invalid GHCB versions result in immediate errors instead of latent guest failures. - Add support for Secure TSC for SEV-SNP guests, which prevents the untrusted host from tampering with the guest's TSC frequency, while still allowing the the VMM to configure the guest's TSC frequency prior to launch. - Mitigate the potential for TOCTOU bugs when accessing GHCB fields by wrapping all accesses via READ_ONCE(). - Validate the XCR0 provided by the guest (via the GHCB) to avoid tracking a bogous XCR0 value in KVM's software model. - Save an SEV guest's policy if and only if LAUNCH_START fully succeeds to avoid leaving behind stale state (thankfully not consumed in KVM). - Explicitly reject non-positive effective lengths during SNP's LAUNCH_UPDATE instead of subtly relying on guest_memfd to do the "heavy" lifting. - Reload the pre-VMRUN TSC_AUX on #VMEXIT for SEV-ES guests, not the host's desired TSC_AUX, to fix a bug where KVM could clobber a different vCPU's TSC_AUX due to hardware not matching the value cached in the user-return MSR infrastructure. - Enable AVIC by default for Zen4+ if x2AVIC (and other prereqs) is supported, and clean up the AVIC initialization code along the way. commit 0f68fe44550cf165b7af5744617447ab038a89b5 Merge: 5b0d0d85422df8 510c47f165f0c1 Author: Paolo Bonzini Date: Tue Sep 30 13:32:57 2025 -0400 Merge tag 'kvm-x86-vmx-6.18' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.18 - Add read/write helpers for MSRs that need to be accessed with preemption disable to prepare for virtualizing FRED RSP0. - Fix a bug where KVM would return 0/success from __tdx_bringup() on error, i.e. where KVM would load with enable_tdx=true despite TDX not being usable. - Minor cleanups. commit 5b0d0d85422df8dbfeb02fb248e61e4d60228842 Merge: 99cab80208809c 2bc2694fe20bf0 Author: Paolo Bonzini Date: Tue Sep 30 13:32:27 2025 -0400 Merge tag 'kvm-x86-mmu-6.18' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.18 - Recover possible NX huge pages within the TDP MMU under read lock to reduce guest jitter when restoring NX huge pages. - Return -EAGAIN during prefault if userspace concurrently deletes/moves the relevant memslot to fix an issue where prefaulting could deadlock with the memslot update. - Don't retry in TDX's anti-zero-step mitigation if the target memslot is invalid, i.e. is being deleted or moved, to fix a deadlock scenario similar to the aforementioned prefaulting case. commit 99cab80208809cb918d6e579e6165279096f058a Merge: 3c5d19a365b71e cf6a8401b6a12c Author: Paolo Bonzini Date: Tue Sep 30 13:27:59 2025 -0400 Merge tag 'kvm-x86-generic-6.18' of https://github.com/kvm-x86/linux into HEAD KVM common changes for 6.18 Remove a redundant __GFP_NOWARN from kvm_setup_async_pf() as __GFP_NOWARN is now included in GFP_NOWAIT. commit 3c5d19a365b71e9775c831b9d3ab053dd591d9dd Merge: 473badf5c47817 96055050396509 Author: Paolo Bonzini Date: Tue Sep 30 13:24:59 2025 -0400 Merge tag 'kvm-x86-guest-6.18' of https://github.com/kvm-x86/linux into HEAD x86/kvm guest side changes for 6.18 - For the legacy PCI hole (memory between TOLUD and 4GiB) to UC when overriding guest MTRR for TDX/SNP to fix an issue where ACPI auto-mapping could map devices as WB and prevent the device drivers from mapping their devices with UC/UC-. - Make kvm_async_pf_task_wake() a local static helper and remove its export. - Use native qspinlocks when running in a VM with dedicated vCPU=>pCPU bindings even when PV_UNHALT is unsupported. commit 473badf5c478174754580bfa9d3207cf9b8d412e Merge: 6a137497178720 df1f294013da71 Author: Paolo Bonzini Date: Tue Sep 30 13:23:54 2025 -0400 Merge tag 'kvm-x86-selftests-6.18' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.18 - Add #DE coverage in the fastops test (the only exception that's guest- triggerable in fastop-emulated instructions). - Fix PMU selftests errors encountered on Granite Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF). - Minor cleanups and improvements commit 6a137497178720da8f454c81d2e9fcebc3137b51 Merge: 924ccf1d093a0c 66e2d96b1c5875 Author: Paolo Bonzini Date: Tue Sep 30 13:23:44 2025 -0400 Merge tag 'loongarch-kvm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.18 1. Add PTW feature detection on new hardware. 2. Add sign extension with kernel MMIO/IOCSR emulation. 3. Improve in-kernel IPI emulation. 4. Improve in-kernel PCH-PIC emulation. 5. Move kvm_iocsr tracepoint out of generic code. commit 924ccf1d093a0c688eba9da1adff9a290d7bd7d8 Merge: 924ebaefcec282 dbdadd943a278f Author: Paolo Bonzini Date: Tue Sep 30 13:23:36 2025 -0400 Merge tag 'kvm-riscv-6.18-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.18 - Added SBI FWFT extension for Guest/VM with misaligned delegation and pointer masking PMLEN features - Added ONE_REG interface for SBI FWFT extension - Added Zicbop and bfloat16 extensions for Guest/VM - Enabled more common KVM selftests for RISC-V such as access_tracking_perf_test, dirty_log_perf_test, memslot_modification_stress_test, memslot_perf_test, mmu_stress_test, and rseq_test - Added SBI v3.0 PMU enhancements in KVM and perf driver commit 924ebaefcec28289c210cad92551ae900e8fc220 Merge: 8cbb0df2945a0f 10fd0285305d0b Author: Paolo Bonzini Date: Tue Sep 30 13:23:28 2025 -0400 Merge tag 'kvmarm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.18 - Add support for FF-A 1.2 as the secure memory conduit for pKVM, allowing more registers to be used as part of the message payload. - Change the way pKVM allocates its VM handles, making sure that the privileged hypervisor is never tricked into using uninitialised data. - Speed up MMIO range registration by avoiding unnecessary RCU synchronisation, which results in VMs starting much quicker. - Add the dump of the instruction stream when panic-ing in the EL2 payload, just like the rest of the kernel has always done. This will hopefully help debugging non-VHE setups. - Add 52bit PA support to the stage-1 page-table walker, and make use of it to populate the fault level reported to the guest on failing to translate a stage-1 walk. - Add NV support to the GICv3-on-GICv5 emulation code, ensuring feature parity for guests, irrespective of the host platform. - Fix some really ugly architecture problems when dealing with debug in a nested VM. This has some bad performance impacts, but is at least correct. - Add enough infrastructure to be able to disable EL2 features and give effective values to the EL2 control registers. This then allows a bunch of features to be turned off, which helps cross-host migration. - Large rework of the selftest infrastructure to allow most tests to transparently run at EL2. This is the first step towards enabling NV testing. - Various fixes and improvements all over the map, including one BE fix, just in time for the removal of the feature. commit 8cbb0df2945a0fcb1f0b4384e65f13ec727baef4 Merge: 68f6051098f9b1 e6157256ee1a6a Author: Paolo Bonzini Date: Tue Sep 30 13:23:06 2025 -0400 Merge tag 'kvmarm-fixes-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.17, round #3 - Invalidate nested MMUs upon freeing the PGD to avoid WARNs when visiting from an MMU notifier - Fixes to the TLB match process and TLB invalidation range for managing the VCNR pseudo-TLB - Prevent SPE from erroneously profiling guests due to UNKNOWN reset values in PMSCR_EL1 - Fix save/restore of host MDCR_EL2 to account for eagerly programming at vcpu_load() on VHE systems - Correct lock ordering when dealing with VGIC LPIs, avoiding scenarios where an xarray's spinlock was nested with a *raw* spinlock - Permit stage-2 read permission aborts which are possible in the case of NV depending on the guest hypervisor's stage-2 translation - Call raw_spin_unlock() instead of the internal spinlock API - Fix parameter ordering when assigning VBAR_EL1 [Pull into kvm/master to fix conflicts. - Paolo] commit 68f6051098f9b12bf0e227f753cf60e2f751b03d Merge: a6ad54137af925 5deafa27d9ae04 Author: Paolo Bonzini Date: Tue Sep 30 13:09:20 2025 -0400 Merge tag 'kvm-s390-next-6.18-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: A bugfix and a performance improvement * Improve interrupt cpu for wakeup, change the heuristic to decide wich vCPU to deliver a floating interrupt to. * Clear the pte when discarding a swapped page because of CMMA; this bug was introduced in 6.16 when refactoring gmap code. commit 755fa5b4fb36627796af19932a432d343220ec63 Merge: 77fc3f6696554a 8f0fdbd4a06bf7 Author: Linus Torvalds Date: Tue Sep 30 09:55:41 2025 -0700 Merge tag 'cgroup-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Extensive cpuset code cleanup and refactoring work with no functional changes: CPU mask computation logic refactoring, introducing new helpers, removing redundant code paths, and improving error handling for better maintainability. - A few bug fixes to cpuset including fixes for partition creation failures when isolcpus is in use, missing error returns, and null pointer access prevention in free_tmpmasks(). - Core cgroup changes include replacing the global percpu_rwsem with per-threadgroup rwsem when writing to cgroup.procs for better scalability, workqueue conversions to use WQ_PERCPU and system_percpu_wq to prepare for workqueue default switching from percpu to unbound, and removal of unused code including the post_attach callback. - New cgroup.stat.local time accounting feature that tracks frozen time duration. - Misc changes including selftests updates (new freezer time tests and backward compatibility fixes), documentation sync, string function safety improvements, and 64-bit division fixes. * tag 'cgroup-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (39 commits) cpuset: remove is_prs_invalid helper cpuset: remove impossible warning in update_parent_effective_cpumask cpuset: remove redundant special case for null input in node mask update cpuset: fix missing error return in update_cpumask cpuset: Use new excpus for nocpu error check when enabling root partition cpuset: fix failure to enable isolated partition when containing isolcpus Documentation: cgroup-v2: Sync manual toctree cpuset: use partition_cpus_change for setting exclusive cpus cpuset: use parse_cpulist for setting cpus.exclusive cpuset: introduce partition_cpus_change cpuset: refactor cpus_allowed_validate_change cpuset: refactor out validate_partition cpuset: introduce cpus_excl_conflict and mems_excl_conflict helpers cpuset: refactor CPU mask buffer parsing logic cpuset: Refactor exclusive CPU mask computation logic cpuset: change return type of is_partition_[in]valid to bool cpuset: remove unused assignment to trialcs->partition_root_state cpuset: move the root cpuset write check earlier cgroup/cpuset: Remove redundant rcu_read_lock/unlock() in spin_lock cgroup: Remove redundant rcu_read_lock/unlock() in spin_lock ... commit 3f20f98e2a542fba932d374253b7c81c0f0957e9 Author: Ian Rogers Date: Thu Sep 25 10:27:36 2025 -0700 perf vendor events intel: Update sierraforest events to v1.12 Update sierraforest events to v1.12 released in: https://github.com/intel/perfmon/commit/8279984b0b2eef35412c0281983ef59ae74f19ed Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 0c32e2748c2968d51ab735e5ea19d867c7019828 Author: Ian Rogers Date: Thu Sep 25 10:27:35 2025 -0700 perf vendor events intel: Update sapphirerapids events to v1.35 Update sapphirerapids events to v1.35 released in: https://github.com/intel/perfmon/commit/94ed947d7b5966e50a685118f69e8942976ec397 https://github.com/intel/perfmon/commit/9d993957a2a8fc1d4f843013c979a413141e9839 Also adds cpu_cstate_c0 and cpu_cstate_c6 metrics. Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit dd171167f220d01331b40b1c6c1cff820e861cf2 Author: Ian Rogers Date: Thu Sep 25 10:27:34 2025 -0700 perf vendor events intel: Update pantherlake events to v1.00 Update pantherlake events to v1.00 released in: https://github.com/intel/perfmon/commit/b149786b6f9db18c09e6c89f3eb4fdb849ead2cf Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 53366556aab277688b325994953ca0e91e4c7120 Author: Ian Rogers Date: Thu Sep 25 10:27:33 2025 -0700 perf vendor events intel: Update meteorlake events to v1.17 Update lunarlake events to v1.17 released in: https://github.com/intel/perfmon/commit/ec387ac70602283d01da32c2ff5fe9cb15d3d25b Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit b4e77a135c039a37b6b15d443b32885508a30ebe Author: Ian Rogers Date: Thu Sep 25 10:27:32 2025 -0700 perf vendor events intel: Update lunarlake events to v1.18 Update lunarlake events to v1.18 released in: https://github.com/intel/perfmon/commit/04e11e566618d781b854f526d7e394ed50420638 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 399464cc90aac5ddde00b4da6ed68f971978b78f Author: Ian Rogers Date: Thu Sep 25 10:27:31 2025 -0700 perf vendor events intel: Update graniterapids events to v1.15 Update graniterapids events to v1.15 released in: https://github.com/intel/perfmon/commit/8af960a34864d291ad5a5a9f8fdf5a40486b78a1 https://github.com/intel/perfmon/commit/943667ba5b3f3203e47aede6bc7d017a26b89a26 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 3c393a11695cf62faca423e7e4b4b70057f4cd8d Author: Ian Rogers Date: Thu Sep 25 10:27:30 2025 -0700 perf vendor events intel: Update grandridge events to v1.10 Update grandridge events to v1.10 released in: https://github.com/intel/perfmon/commit/c3028836415b8b5d31b8439eefc087492148c19f Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 26bc991c8a95c72db37656d844c82f7f3dcfcfb1 Author: Ian Rogers Date: Thu Sep 25 10:27:29 2025 -0700 perf vendor events intel: Update emeraldrapids events to v1.20 Update emeraldrapids events to v1.20 released in: https://github.com/intel/perfmon/commit/868b433955f3e94126420ee9374b9e0a6ce2d83e https://github.com/intel/perfmon/commit/43681e2817a960d06c5b8870cc6d3e5b7b6feeb9 Also adds cpu_cstate_c0 and cpu_cstate_c6 metrics. Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo commit d41129fe5476664e927ca9e8825e39138f269d18 Author: Ian Rogers Date: Thu Sep 25 10:27:28 2025 -0700 perf vendor events intel: Update arrowlake events to v1.13 Update arrowlake events to v1.13 released in: https://github.com/intel/perfmon/commit/718cdcec8b9637819af5e9eff8f705f731b0f971 Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit 76619e81a8f83c266ab454f11c32725881c955c4 Author: Ian Rogers Date: Thu Sep 25 10:27:27 2025 -0700 perf vendor events intel: Update alderlake events to v1.34 Update alderlake events to v1.34 released in: https://github.com/intel/perfmon/commit/80b773ebcf601b0e48e31f2184ffef933c4d842e Event JSON automatically generated by: https://github.com/intel/perfmon/blob/main/scripts/create_perf_json.py Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Andreas Färber Cc: Caleb Biggers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Manivannan Sadhasivam Cc: Namhyung Kim Cc: Perry Taylor Cc: Peter Zijlstra Cc: Thomas Falcon Signed-off-by: Arnaldo Carvalho de Melo commit aacaf65bb11598669f8bfff413c63eaf7bcbb6f1 Author: Arnaldo Carvalho de Melo Date: Fri Sep 19 18:02:23 2025 -0300 perf bpf: Check libbpf version to use btf_dump_type_data_opts.emit_strings When building perf with LIBBPF_DYNAMIC=1 on a fedora system with libbpf-devel 1.5 I it was breaking with: util/bpf-event.c: In function ‘format_btf_variable’: util/bpf-event.c:291:18: error: ‘const struct btf_dump_type_data_opts’ has no member named ‘emit_strings’ 291 | .emit_strings = 1, | ^~~~~~~~~~~~ util/bpf-event.c:291:33: error: initialized field overwritten [-Werror=override-init] 291 | .emit_strings = 1, | ^ util/bpf-event.c:291:33: note: (near initialization for ‘opts.skip_names’) Check the version before using that feature. Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Signed-off-by: Arnaldo Carvalho de Melo commit 5a022bf88fb0f4edde14b1f6f9029d96bffbf3e6 Author: Arnaldo Carvalho de Melo Date: Fri Sep 19 17:59:25 2025 -0300 perf bpf: Move the LIBBPF_CURRENT_VERSION_GEQ macro to bpf-utils.h We need it to fix some other libbpf version dependent issues when building with LIBBPF_DYNAMIC=1. Reviewed-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Andrii Nakryiko Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Signed-off-by: Arnaldo Carvalho de Melo commit 77fc3f6696554a10cf7557c89bb3f1892ec29559 Merge: a23cd25baed231 0950c64ae38661 Author: Linus Torvalds Date: Tue Sep 30 09:31:09 2025 -0700 Merge tag 'wq-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - WQ_PERCPU was added to remaining alloc_workqueue() users and system_wq usage was replaced with system_percpu_wq and system_unbound_wq with system_dfl_wq. These are equivalent conversions with no functional changes, preparing for switching default to unbound workqueues from percpu. - A handshake mechanism was added for canceling BH workers to avoid live lock scenarios under PREEMPT_RT. - Unnecessary rcu_read_lock/unlock() calls were dropped in wq_watchdog_timer_fn() and workqueue_congested(). - Documentation was fixed to resolve texinfodocs warnings. * tag 'wq-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: fix texinfodocs warning for WQ_* flags reference workqueue: WQ_PERCPU added to alloc_workqueue users workqueue: replace use of system_wq with system_percpu_wq workqueue: replace use of system_unbound_wq with system_dfl_wq workqueue: Provide a handshake for canceling BH workers workqueue: Remove rcu_read_lock/unlock() in wq_watchdog_timer_fn() workqueue: Remove redundant rcu_read_lock/unlock() in workqueue_congested() commit 3a0f56d72a7575f03187a85b7869c76a862b40ab Author: Ian Rogers Date: Fri Aug 29 22:35:49 2025 -0700 perf bpf-filter: Fix opts declaration on older libbpfs Building perf with LIBBPF_DYNAMIC (ie not the default static linking of libbpf with perf) is breaking as the libbpf isn't version 1.7 or newer, where dont_enable is added to bpf_perf_event_opts. To avoid this breakage add a compile time version check and don't declare the variable when not present. Fixes: 5e2ac8e8571df54d ("perf bpf-filter: Enable events manually") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alexei Starovoitov Cc: bpf@vger.kernel.org Cc: Hao Ge Cc: Ilya Leoshkevich Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Richter Signed-off-by: Arnaldo Carvalho de Melo commit a23cd25baed2316e50597f8b67192bdc904f955b Merge: 76f01a4f22c465 df10932ad740ba Author: Linus Torvalds Date: Tue Sep 30 09:05:07 2025 -0700 Merge tag 'sched_ext-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - Code organization cleanup. Separate internal types and accessors to ext_internal.h to reduce the size of ext.c and improve maintainability. - Prepare for cgroup sub-scheduler support by adding @sch parameter to various functions and helpers, reorganizing scheduler instance handling, and dropping obsolete helpers like scx_kf_exit() and kf_cpu_valid(). - Add new scx_bpf_cpu_curr() and scx_bpf_locked_rq() BPF helpers to provide safer access patterns with proper RCU protection. scx_bpf_cpu_rq() is deprecated with warnings due to potential race conditions. - Improve debugging with migration-disabled counter in error state dumps, SCX_EFLAG_INITIALIZED flag, bitfields for warning flags, and other enhancements to help diagnose issues. - Use cgroup_lock/unlock() for cgroup synchronization instead of scx_cgroup_rwsem based synchronization. This is simpler and allows enable/disable paths to synchronize against cgroup changes independent of the CPU controller. - rhashtable_lookup() replacement to avoid redundant RCU locking was reverted due to RCU usage warnings. Will be redone once rhashtable is updated to use rcu_dereference_all(). - Other misc updates and fixes including bypass handling improvements, scx_task_iter_relock() improvements, tools/sched_ext updates, and compatibility helpers. * tag 'sched_ext-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (28 commits) Revert "sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast()" sched_ext: Misc updates around scx_sched instance pointer sched_ext: Drop scx_kf_exit() and scx_kf_error() sched_ext: Add the @sch parameter to scx_dsq_insert_preamble/commit() sched_ext: Drop kf_cpu_valid() sched_ext: Add the @sch parameter to ext_idle helpers sched_ext: Add the @sch parameter to __bstr_format() sched_ext: Separate out scx_kick_cpu() and add @sch to it tools/sched_ext: scx_qmap: Make debug output quieter by default sched_ext: Make qmap dump operation non-destructive sched_ext: Add SCX_EFLAG_INITIALIZED to indicate successful ops.init() sched_ext: Use bitfields for boolean warning flags sched_ext: Fix stray scx_root usage in task_can_run_on_remote_rq() sched_ext: Improve SCX_KF_DISPATCH comment sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast() sched_ext: Verify RCU protection in scx_bpf_cpu_curr() sched_ext: Add migration-disabled counter to error state dump sched_ext: Fix NULL dereference in scx_bpf_cpu_rq() warning tools/sched_ext: Add compat helper for scx_bpf_cpu_curr() sched_ext: deprecation warn for scx_bpf_cpu_rq() ... commit 76f01a4f22c465bdb63ee19aaf5b682c5893ba96 Merge: 57bc683896c55f 54d94c422fed95 Author: Linus Torvalds Date: Tue Sep 30 08:48:29 2025 -0700 Merge tag 'lsm-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Move the management of the LSM BPF security blobs into the framework In order to enable multiple LSMs we need to allocate and free the various security blobs in the LSM framework and not the individual LSMs as they would end up stepping all over each other. - Leverage the lsm_bdev_alloc() helper in lsm_bdev_alloc() Make better use of our existing helper functions to reduce some code duplication. - Update the Rust cred code to use 'sync::aref' Part of a larger effort to move the Rust code over to the 'sync' module. - Make CONFIG_LSM dependent on CONFIG_SECURITY As the CONFIG_LSM Kconfig setting is an ordered list of the LSMs to enable a boot, it obviously doesn't make much sense to enable this when CONFIG_SECURITY is disabled. - Update the LSM and CREDENTIALS sections in MAINTAINERS with Rusty bits Add the Rust helper files to the associated LSM and CREDENTIALS entries int the MAINTAINERS file. We're trying to improve the communication between the two groups and making sure we're all aware of what is going on via cross-posting to the relevant lists is a good way to start. * tag 'lsm-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: CONFIG_LSM can depend on CONFIG_SECURITY MAINTAINERS: add the associated Rust helper to the CREDENTIALS section MAINTAINERS: add the associated Rust helper to the LSM section rust,cred: update AlwaysRefCounted import to sync::aref security: use umax() to improve code lsm,selinux: Add LSM blob support for BPF objects lsm: use lsm_blob_alloc() in lsm_bdev_alloc() commit 57bc683896c55ff348e1a592175e76f9478035d6 Merge: 56a0810d8ca406 68e1e908cb7682 Author: Linus Torvalds Date: Tue Sep 30 08:30:32 2025 -0700 Merge tag 'selinux-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Support per-file labeling for functionfs Both genfscon and user defined labeling methods are supported. This should help users who want to provide separation between the control endpoint file, "ep0", and other endpoints. - Remove our use of get_zeroed_page() in sel_read_bool() Update sel_read_bool() to use a four byte stack buffer instead of a memory page fetched via get_zeroed_page(), and fix a memory in the process. Needless to say we should have done this a long time ago, but it was in a very old chunk of code that "just worked" and I don't think anyone had taken a real look at it in many years. - Better use of the netdev skb/sock helper functions Convert a sk_to_full_sk(skb->sk) into a skb_to_full_sk(skb) call. - Remove some old, dead, and/or redundant code * tag 'selinux-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: enable per-file labeling for functionfs selinux: fix sel_read_bool() allocation and error handling selinux: Remove redundant __GFP_NOWARN selinux: use a consistent method to get full socket from skb selinux: Remove unused function selinux_policycap_netif_wildcard() commit 03faea8466713f04a522c52c386124755be960bc Author: Gopi Krishna Menon Date: Mon Sep 29 22:01:38 2025 +0530 selftests/net: add tcp_port_share to .gitignore Add the tcp_port_share test binary to .gitignore to avoid accidentally staging the build artifact. Signed-off-by: Gopi Krishna Menon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250929163140.122383-1-krishnagopi487@gmail.com Signed-off-by: Jakub Kicinski commit adefb2ccea1e96b452cbbc39150bc0ccf1688b99 Author: Melissa Wen Date: Tue Sep 16 14:18:28 2025 -0300 drm/v3d: create a dedicated lock for dma fence Don't mix dma fence lock with the active_job lock. Use fence_lock to protect the dma fence used by drm scheduler when signalling a job completion and queue_lock to protect concurrent access to active bin job in OOM and stats collection for a given file priv. The issue was uncovered when PREEMPT_RT on with a system freeze when opening multiple Chromium tabs on Raspberry Pi 5. Link: https://github.com/raspberrypi/linux/issues/7035 Fixes: fa6a20c87470 ("drm/v3d: Address race-condition between per-fd GPU stats and fd release") Signed-off-by: Melissa Wen Acked-by: Iago Toral Quiroga Reviewed-by: Maíra Canal Signed-off-by: Melissa Wen Link: https://lore.kernel.org/r/20250916172022.2779837-1-mwen@igalia.com commit 56a0810d8ca406648fe01ec996ade1d61bf8ec8d Merge: f3827213abae92 d2c773159327f4 Author: Linus Torvalds Date: Tue Sep 30 08:22:16 2025 -0700 Merge tag 'audit-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Proper audit support for multiple LSMs As the audit subsystem predated the work to enable multiple LSMs, some additional work was needed to support logging the different LSM labels for the subjects/tasks and objects on the system. Casey's patches add new auxillary records for subjects and objects that convey the additional labels. - Ensure fanotify audit events are always generated Generally speaking security relevant subsystems always generate audit events, unless explicitly ignored. However, up to this point fanotify events had been ignored by default, but starting with this pull request fanotify follows convention and generates audit events by default. - Replace an instance of strcpy() with strscpy() - Minor indentation, style, and comment fixes * tag 'audit-pr-20250926' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix skb leak when audit rate limit is exceeded audit: init ab->skb_list earlier in audit_buffer_alloc() audit: add record for multiple object contexts audit: add record for multiple task security contexts lsm: security_lsmblob_to_secctx module selection audit: create audit_stamp structure audit: add a missing tab audit: record fanotify event regardless of presence of rules audit: fix typo in auditfilter.c comment audit: Replace deprecated strcpy() with strscpy() audit: fix indentation in audit_log_exit() commit f3827213abae9291b7525b05e6fd29b1f0536ce6 Merge: 30d4efb2f5a515 45c222468d3320 Author: Linus Torvalds Date: Tue Sep 30 08:14:49 2025 -0700 Merge tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "There are no new features, the changes are in the core code, notably tree-log error handling and reporting improvements, and initial support for block size > page size. Performance improvements: - search data checksums in the commit root (previous transaction) to avoid locking contention, this improves parallelism of read heavy/low write workloads, and also reduces transaction commit time; on real and reproducer workload the sync time went from minutes to tens of seconds (workload and numbers are in the changelog) Core: - tree-log updates: - error handling improvements, transaction aborts - add new error state 'O' (printed in status messages) when log replay fails and is aborted - reduced number of btrfs_path allocations when traversing the tree - 'block size > page size' support - basic implementation with limitations, under experimental build - limitations: no direct io, raid56, encoded read (standalone and in send ioctl), encoded write - preparatory work for compression, removing implicit assumptions of page and block sizes - compression workspaces are now per-filesystem, we cannot assume common block size for work memory among different filesystems - tree-checker now verifies INODE_EXTREF item (which is implementing hardlinks) - tree leaf pretty printer updates, there were missing data from items, keys/items - move config option CONFIG_BTRFS_REF_VERIFY to CONFIG_BTRFS_DEBUG, it's a debugging feature and not needed to be enabled separately - more struct btrfs_path auto free updates - use ref_tracker API for tracking delayed inodes, enabled by mount option 'ref_verify', allowing to better pinpoint leaking references - in zoned mode, avoid selecting data relocation zoned for ordinary data block groups - updated and enhanced error messages - lots of cleanups and refactoring" * tag 'for-6.18-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (113 commits) btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() btrfs: add unlikely annotations to branches leading to transaction abort btrfs: add unlikely annotations to branches leading to EIO btrfs: add unlikely annotations to branches leading to EUCLEAN btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions btrfs: zoned: don't fail mount needlessly due to too many active zones btrfs: use kmalloc_array() for open-coded arithmetic in kmalloc() btrfs: enable experimental bs > ps support btrfs: add extra ASSERT()s to catch unaligned bios btrfs: fix symbolic link reading when bs > ps btrfs: prepare scrub to support bs > ps cases btrfs: prepare zlib to support bs > ps cases btrfs: prepare lzo to support bs > ps cases btrfs: prepare zstd to support bs > ps cases btrfs: prepare compression folio alloc/free for bs > ps cases btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() btrfs: remove pointless key offset setup in create_pending_snapshot() btrfs: annotate btrfs_is_testing() as unlikely and make it return bool btrfs: make the rule checking more readable for should_cow_block() btrfs: simplify inline extent end calculation at replay_one_extent() ... commit cd3770675874ae72e4d26dd34f4e02dfc7ed8067 Merge: 6a88bb252b66b4 0b1fca9dce44d0 Author: Benjamin Tissoires Date: Tue Sep 30 16:58:07 2025 +0200 Merge branch 'for-6.18/intel-thc-hid' into for-linus - quicki2c: support ACPI config for advanced features: max input size and interrupt delay (Xinpeng Sun) - some more str_true_false() conversions commit 6a88bb252b66b43b5cc0828efe3e8ec3af27e57a Merge: 41a9d4fef6b284 be66a27b4f391e Author: Benjamin Tissoires Date: Tue Sep 30 16:51:38 2025 +0200 Merge branch 'for-6.18/selftests' into for-linus - update vmtest.sh (Benjamin Tissoires) commit 41a9d4fef6b284e243b000b591fadc86f5ff7da1 Merge: 8e32aa658ba59f b31e3bd7447a6e Author: Benjamin Tissoires Date: Tue Sep 30 16:50:51 2025 +0200 Merge branch 'for-6.18/uclogic' into for-linus - make use of str_true_or_false() (Liu Song) commit 8e32aa658ba59f239dc33cc32df3882b1149c8e2 Merge: a9328a16caa5f8 2910913ef87dd9 Author: Benjamin Tissoires Date: Tue Sep 30 16:48:36 2025 +0200 Merge branch 'for-6.18/steelseries' into for-linus - Make use of devm API for steelseries (Jeongjun Park) commit a9328a16caa5f8d3d3b035ef3cb440dbcac151c6 Merge: 6b7f7e43f6c4ad 8aa035a8407f6b Author: Benjamin Tissoires Date: Tue Sep 30 16:47:40 2025 +0200 Merge branch 'for-6.18/playstation' into for-linus - Add support for audio jack handling on DualSense (Cristian Ciocaltea) commit 6b7f7e43f6c4ad92beeb84b0d86d2618799472a9 Merge: 8e73e4cd021032 d927909d4d7a57 Author: Benjamin Tissoires Date: Tue Sep 30 16:46:30 2025 +0200 Merge branch 'for-6.18/pidff' into for-linus - hid-pidff improvements and fixes (Tomasz Pakuła) commit 8e73e4cd021032f45cee54efd13aef9ae7a6d697 Merge: b3f126f40016c6 b595974b4afe0e Author: Benjamin Tissoires Date: Tue Sep 30 16:45:07 2025 +0200 Merge branch 'for-6.18/asus' into for-linus - Fix Z13 folio touchpad not binding to hid-multitouch (Antheas Kapenekakis) commit b3f126f40016c6fbdcf31c8250ef359887f1dee1 Merge: b4b6bdd7fc79ab 8d0bf7908b5a65 Author: Benjamin Tissoires Date: Tue Sep 30 16:43:15 2025 +0200 Merge branch 'for-6.18/haptic' into for-linus - Implement haptic touchpad support (Angela Czubak and Jonathan Denose) commit b4b6bdd7fc79abec53da7d6d5ac0e178334ab5e8 Merge: 4965e2c75a36ae 8931f7b2799344 Author: Benjamin Tissoires Date: Tue Sep 30 16:38:06 2025 +0200 Merge branch 'for-6.18/intel-ish-ipc' into for-linus - Remove redundant ready check after timeout (Zhang Lixu) commit 4965e2c75a36ae3e38693ca956a6e36cdff3676e Merge: f6c53923e067d3 7d62beb102d6fa Author: Benjamin Tissoires Date: Tue Sep 30 16:36:47 2025 +0200 Merge branch 'for-6.18/i2c-hid' into for-linus - Resolve touchpad issues on Dell systems during S4 by invoking the _DSM on resume from hibernate (Mario Limonciello) commit f6c53923e067d3f23b14a71062ba912135aeba01 Merge: d325efac5938ef 75d5546f60b369 Author: Benjamin Tissoires Date: Tue Sep 30 16:34:33 2025 +0200 Merge branch 'for-6.18/hidraw' into for-linus - rework hidraw ioctls (Benjamin Tissoires) commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 Author: Jakub Kicinski Date: Mon Sep 29 11:15:29 2025 -0700 Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb. Commit in question breaks the mapping of PGs to pools for some SKUs. Specifically multi-host NICs seem to be shipped with a custom buffer configuration which maps the lossy PG to pool 4. But the bad commit overrides this with pool 0 which does not have sufficient buffer space reserved. Resulting in ~40% packet loss. The commit also breaks BMC / OOB connection completely (100% packet loss). Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set""). The breakage is exactly the same, the only difference is that quoted commit would break the NIC immediately on boot, and the currently reverted commit only when MTU is changed. Note: "good" kernels do not restore the configuration, so downgrade isn't enough to recover machines. A NIC power cycle seems to be necessary to return to a healthy state (or overriding the relevant registers using a custom patch). Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set") Signed-off-by: Jakub Kicinski Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit d325efac5938efa3c2a25df72a1bd1af16cd0ed8 Merge: bba920e6f80313 d1dd75c6500c74 Author: Benjamin Tissoires Date: Tue Sep 30 16:31:10 2025 +0200 Merge branch 'for-6.18/core' into for-linus - allow HID-BPF to rebind a driver to hid-multitouch (Benjamin Tissoires) - Change hid_driver to use a const char* for .name (Rahul Rameshbabu) commit 11f6bce77e27e82015a0d044e6c1eec8b139831a Author: Thorsten Blum Date: Thu Sep 18 17:08:10 2025 +0200 fs/orangefs: Replace kzalloc + copy_from_user with memdup_user_nul Replace kzalloc() followed by copy_from_user() with memdup_user_nul() to simplify and improve orangefs_debug_write(). Allocate only 'count' bytes instead of the maximum size ORANGEFS_MAX_DEBUG_STRING_LEN, and set 'buf' to NULL to ensure kfree(buf) still works. No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Mike Marshall commit 025e880759c279ec64d0f754fe65bf45961da864 Author: Mike Marshall Date: Mon Sep 15 17:40:46 2025 -0400 orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper `xattr_key()` uses the pointer variable in the loop condition > rather than dereferencing it. As `key` is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate on > valid C strings and will walk memory indefinitely, consuming CPU or hanging > the thread. I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on. After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed. I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture. Signed-off-by: Mike Marshall Reported-by: Stanislav Fort of Aisle Research commit 3dffadfa99f7ba2e9bee69d1e0bb42fd2d2d6022 Author: Zhen Ni Date: Mon Sep 1 10:58:18 2025 +0800 orangefs: Remove unused type in macro fill_default_sys_attrs Remove the unused type parameter from the macro definition and all its callers, making the interface consistent with its actual usage. Fixes: 69a23de2f3de ("orangefs: clean up fill_default_sys_attrs") Signed-off-by: Zhen Ni Signed-off-by: Mike Marshall commit 5deafa27d9ae040b75d392f60b12e300b42b4792 Author: Gautam Gala Date: Wed Sep 24 13:26:44 2025 +0200 KVM: s390: Fix to clear PTE when discarding a swapped page KVM run fails when guests with 'cmm' cpu feature and host are under memory pressure and use swap heavily. This is because npages becomes ENOMEN (out of memory) in hva_to_pfn_slow() which inturn propagates as EFAULT to qemu. Clearing the page table entry when discarding an address that maps to a swap entry resolves the issue. Fixes: 200197908dc4 ("KVM: s390: Refactor and split some gmap helpers") Cc: stable@vger.kernel.org Suggested-by: Claudio Imbrenda Signed-off-by: Gautam Gala Reviewed-by: Claudio Imbrenda Signed-off-by: Claudio Imbrenda commit c18b0f5af42f8f98d4d629e578608188c0ce4652 Merge: 2c0592bd5cadfc 5628f3fe3b1611 Author: Paolo Abeni Date: Tue Sep 30 15:45:54 2025 +0200 Merge branch 'net-lockless-skb_attempt_defer_free' Eric Dumazet says: ==================== net: lockless skb_attempt_defer_free() Platforms with many cpus and relatively slow inter connect show a significant spinlock contention in skb_attempt_defer_free(). This series refactors this infrastructure to be NUMA aware, and lockless. Tested on various platforms, including AMD Zen 2/3/4 and Intel Granite Rapids, showing significant cost reductions under network stress (more than 20 Mpps). ==================== Link: https://patch.msgid.link/20250928084934.3266948-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 5628f3fe3b16114e8424bbfcf0594caef8958a06 Author: Eric Dumazet Date: Sun Sep 28 08:49:34 2025 +0000 net: add NUMA awareness to skb_attempt_defer_free() Instead of sharing sd->defer_list & sd->defer_count with many cpus, add one pair for each NUMA node. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-4-edumazet@google.com Signed-off-by: Paolo Abeni commit 844c9db7f7f5fe1b0b53ed9f1c2bc7313b3021c8 Author: Eric Dumazet Date: Sun Sep 28 08:49:33 2025 +0000 net: use llist for sd->defer_list Get rid of sd->defer_lock and adopt llist operations. We optimize skb_attempt_defer_free() for the common case, where the packet is queued. Otherwise sd->defer_count is increasing, until skb_defer_free_flush() clears it. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-3-edumazet@google.com Signed-off-by: Paolo Abeni commit 9c94ae6bb0b2895024b6e29fcc1cbec968b4776a Author: Eric Dumazet Date: Sun Sep 28 08:49:32 2025 +0000 net: make softnet_data.defer_count an atomic This is preparation work to remove the softnet_data.defer_lock, as it is contended on hosts with large number of cores. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250928084934.3266948-2-edumazet@google.com Signed-off-by: Paolo Abeni commit 2c0592bd5cadfcd5337eafa07e3145a097cfd880 Merge: 9ebef94cf67967 b3820e0e6c1251 Author: Paolo Abeni Date: Tue Sep 30 15:17:23 2025 +0200 Merge branch 'psp-add-a-kselftest-suite-and-netdevsim-implementation' Jakub Kicinski says: ==================== psp: add a kselftest suite and netdevsim implementation Add a basic test suite for drivers that support PSP. Also, add a PSP implementation in the netdevsim driver. The netdevsim implementation does encapsulation and decapsulation of PSP packets, but no crypto. The tests cover the basic usage of the uapi, and demonstrate key exchange and connection setup. The tests and netdevsim support IPv4 and IPv6. Here is an example run on a system with a CX7 NIC. TAP version 13 1..28 ok 1 psp.data_basic_send_v0_ip4 ok 2 psp.data_basic_send_v0_ip6 ok 3 psp.data_basic_send_v1_ip4 ok 4 psp.data_basic_send_v1_ip6 ok 5 psp.data_basic_send_v2_ip4 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-128') ok 6 psp.data_basic_send_v2_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-128') ok 7 psp.data_basic_send_v3_ip4 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-256') ok 8 psp.data_basic_send_v3_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-256') ok 9 psp.data_mss_adjust_ip4 ok 10 psp.data_mss_adjust_ip6 ok 11 psp.dev_list_devices ok 12 psp.dev_get_device ok 13 psp.dev_get_device_bad ok 14 psp.dev_rotate ok 15 psp.dev_rotate_spi ok 16 psp.assoc_basic ok 17 psp.assoc_bad_dev ok 18 psp.assoc_sk_only_conn ok 19 psp.assoc_sk_only_mismatch ok 20 psp.assoc_sk_only_mismatch_tx ok 21 psp.assoc_sk_only_unconn ok 22 psp.assoc_version_mismatch ok 23 psp.assoc_twice ok 24 psp.data_send_bad_key ok 25 psp.data_send_disconnect ok 26 psp.data_stale_key ok 27 psp.removal_device_rx # XFAIL Test only works on netdevsim ok 28 psp.removal_device_bi # XFAIL Test only works on netdevsim # Totals: pass:22 fail:0 xfail:2 xpass:0 skip:4 error:0 # # Responder logs (0): # STDERR: # Set PSP enable on device 1 to 0x3 # Set PSP enable on device 1 to 0x0 v2: https://lore.kernel.org/20250925211647.3450332-1-daniel.zahka@gmail.com v1: https://lore.kernel.org/20250924194959.2845473-1-daniel.zahka@gmail.com ==================== Link: https://patch.msgid.link/20250927225420.1443468-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit b3820e0e6c1251689318dcc831b7a07403fd923c Author: Jakub Kicinski Date: Sat Sep 27 15:54:20 2025 -0700 selftests: drv-net: psp: add tests for destroying devices Add tests for making sure device can disappear while associations exist. This is netdevsim-only since destroying real devices is more tricky. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-9-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 81236c74dba6f4966d76c471ef4434846c2fc05c Author: Jakub Kicinski Date: Sat Sep 27 15:54:19 2025 -0700 selftests: drv-net: psp: add test for auto-adjusting TCP MSS Test TCP MSS getting auto-adjusted. PSP adds an encapsulation overhead of 40B per packet, when used in transport mode without any virtualization cookie or other optional PSP header fields. The kernel should adjust the MSS for a connection after PSP tx state is reached. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-8-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2748087cf12d800db142eaefd2b0f4eccee8c943 Author: Jakub Kicinski Date: Sat Sep 27 15:54:18 2025 -0700 selftests: drv-net: psp: add connection breaking tests Add test checking conditions which lead to connections breaking. Using bad key or connection gets stuck if device key is rotated twice. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-7-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 81b89085319b2b20426d8c9468d8c508dcefdaaf Author: Jakub Kicinski Date: Sat Sep 27 15:54:17 2025 -0700 selftests: drv-net: psp: add association tests Add tests for exercising PSP associations for TCP sockets. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-6-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 8f90dc6e417a64144d06405ee0404965139c825a Author: Jakub Kicinski Date: Sat Sep 27 15:54:16 2025 -0700 selftests: drv-net: psp: add basic data transfer and key rotation tests Add basic tests for sending data over PSP and making sure that key rotation toggles the MSB of the spi. Deploy PSP responder on the remote end. We also need a healthy dose of common helpers for setting up the connections, assertions and interrogating socket state on the Python side. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-5-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2aeb71b2f9e864d3e4ff76bc93ab8cb1b6d56ced Author: Jakub Kicinski Date: Sat Sep 27 15:54:15 2025 -0700 selftests: drv-net: add PSP responder PSP tests need the remote system to support PSP, and some PSP capable application to exchange data with. Create a simple PSP responder app which we can build and deploy to the remote host. The tests themselves can be written in Python but for ease of deploying the responder is in C (using C YNL). Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-4-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 8a5f956a9fb7d74fff681145082acfad5afa6bb8 Author: Jakub Kicinski Date: Sat Sep 27 15:54:14 2025 -0700 selftests: drv-net: base device access API test Simple PSP test to getting info about PSP devices. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-3-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit f857478d62066ee94831a5e0679fc18c246cd534 Author: Jakub Kicinski Date: Sat Sep 27 15:54:13 2025 -0700 netdevsim: a basic test PSP implementation Provide a PSP implementation for netdevsim. Use psp_dev_encapsulate() and psp_dev_rcv() to do actual encapsulation and decapsulation on skbs, but perform no encryption or decryption. In order to make encryption with a bad key result in a drop on the peer's rx side, we stash our psd's generation number in the first byte of each key before handing to the peer. Signed-off-by: Jakub Kicinski Co-developed-by: Daniel Zahka Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250927225420.1443468-2-kuba@kernel.org Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni commit 2a918911ed3d0841923525ed0fe707762ee78844 Author: Guixin Liu Date: Thu Sep 25 13:47:30 2025 +0800 iommufd: Register iommufd mock devices with fwspec Since the bus ops were retired the iommu subsystem changed to using fwspec to match the iommu driver to the iommu device. If a device has a NULL fwspec then it is matched to the first iommu driver with a NULL fwspec, effectively disabling support for systems with more than one non-fwspec iommu driver. Thus, if the iommufd selfest are run in an x86 system that registers a non-fwspec iommu driver they fail to bind their mock devices to the mock iommu driver. Fix this by allocating a software fwnode for mock iommu driver's iommu_device, and set it to the device which mock iommu driver created. This is done by adding a new helper iommu_mock_device_add() which abuses the internals of the fwspec system to establish a fwspec before the device is added and is careful not to leak it. A matching dummy fwspec is automatically added to the mock iommu driver. Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests": PASSED: 229 / 229 tests passed. In addition, this issue is also can be found on amd platform, and also tested on a amd machine. Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com Fixes: 17de3f5fdd35 ("iommu: Retire bus ops") Signed-off-by: Guixin Liu Reviewed-by: Lu Baolu Tested-by: Qinyun Tan Signed-off-by: Jason Gunthorpe commit 74662f9f92b67c0ca55139c5aa392da0f0a26c08 Author: Steven 'Steve' Kendall Date: Mon Sep 29 21:33:34 2025 +0000 ALSA: hda/hdmi: Add pin fix for HP ProDesk model The HP ProDesk 400 (SSID 103c:83f3) also needs a quirk for enabling HDMI outputs. This patch adds the required quirk entry. Signed-off-by: Steven 'Steve' Kendall Cc: Signed-off-by: Takashi Iwai commit 9ebef94cf67967fd739eb90289b5b2c7774bd551 Author: Heiner Kallweit Date: Sat Sep 27 22:23:19 2025 +0200 net: sfp: improve poll interval handling The poll interval is a fixed value, so we don't need a static variable for it. The change also allows to use standard macro module_platform_driver, avoiding some boilerplate code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/b8079f96-6865-431c-a908-a0b9e9bd5379@gmail.com Signed-off-by: Paolo Abeni commit df7dcf5ebf347fd9d59ce2ccf40dd48b2d106144 Author: Heiner Kallweit Date: Sat Sep 27 22:03:35 2025 +0200 net: sfp: don't include swphy.h Nothing from swphy.h is used here, so don't include it. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/19921899-f0a8-4752-a897-1b6d62ade6eb@gmail.com Signed-off-by: Paolo Abeni commit 49ac3d7826936b30eaa5dbe1bec6dad58f7d2476 Author: Heiner Kallweit Date: Sat Sep 27 21:57:07 2025 +0200 net: phy: annotate linkmode initializers as not used after init phase Code and data used from phy_init() only, can be annotated accordingly. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/5fb9c41b-bf44-4915-a3c3-f20952fce6de@gmail.com Signed-off-by: Paolo Abeni commit e211c463b748c4e2e8364c10bc216ca775fcc943 Author: Heiner Kallweit Date: Sat Sep 27 21:52:30 2025 +0200 net: phy: stop exporting phy_driver_unregister After 42e2a9e11a1d ("net: phy: dp83640: improve phydev and driver removal handling") we can stop exporting also phy_driver_unregister(). Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/2bab950e-4b70-4030-b997-03f48379586f@gmail.com Signed-off-by: Paolo Abeni commit a1b501a8c6a87c9265fd03bd004035199e2e8128 Author: Dragos Tatulea Date: Fri Sep 26 16:16:05 2025 +0300 page_pool: Clamp pool size to max 16K pages page_pool_init() returns E2BIG when the page_pool size goes above 32K pages. As some drivers are configuring the page_pool size according to the MTU and ring size, there are cases where this limit is exceeded and the queue creation fails. The page_pool size doesn't have to cover a full queue, especially for larger ring size. So clamp the size instead of returning an error. Do this in the core to avoid having each driver do the clamping. The current limit was deemed to high [1] so it was reduced to 16K to avoid page waste. [1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/ Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com Signed-off-by: Paolo Abeni commit 2ade91705b596b7b6b7de84c0ca59eced7acd1f6 Author: Dmitry Antipov Date: Fri Sep 26 10:41:13 2025 +0300 tipc: adjust tipc_nodeid2string() to return string length Since the value returned by 'tipc_nodeid2string()' is not used, the function may be adjusted to return the length of the result, which is helpful to drop a few calls to 'strlen()' in 'tipc_link_create()' and 'tipc_link_bc_create()'. Compile tested only. Signed-off-by: Dmitry Antipov Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250926074113.914399-1-dmantipov@yandex.ru Signed-off-by: Paolo Abeni commit 2aff4420efc2910e905ee5b000e04e87422aebc4 Author: Wei Fang Date: Fri Sep 26 09:39:53 2025 +0800 net: enetc: initialize SW PIR and CIR based HW PIR and CIR values Software can only initialize the PIR and CIR of the command BD ring after a FLR, and these two registers can only be set to 0. But the reset values of these two registers are 0, so software does not need to update them. If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or other values by software will cause the command BD ring to work abnormally. This is because of an internal context in the ring prefetch logic that will retain the state from the first incarnation of the ring and continue prefetching from the stale location when the ring is reinitialized. The internal context can only be reset by the FLR. In addition, there is a logic error in the implementation, next_to_clean indicates the software CIR and next_to_use indicates the software PIR. But the current driver uses next_to_clean to set PIR and use next_to_use to set CIR. This does not cause a problem in actual use, because the current command BD ring is only initialized after FLR, and the initial values of next_to_use and next_to_clean are both 0. Therefore, this patch removes the initialization of PIR and CIR. Instead, next_to_use and next_to_clean are initialized by reading the values of PIR and CIR. Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 Author: Deepak Sharma Date: Thu Sep 25 18:58:46 2025 +0530 net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools"). This bug arises due to very limited and poor input validation that was done at nic_valid_size(). This validation only validates the skb->len (directly reflects size provided at the userspace interface) with the length provided in the buffer itself (interpreted as NCI_HEADER). This leads to the processing of memory content at the address assuming the correct layout per what opcode requires there. This leads to the accesses to buffer of `skb_buff->data` which is not assigned anything yet. Following the same silent drop of packets of invalid sizes at `nic_valid_size()`, add validation of the data in the respective handlers and return error values in case of failure. Release the skb if error values are returned from handlers in `nci_nft_packet` and effectively do a silent drop Possible TODO: because we silently drop the packets, the call to `nci_request` will be waiting for completion of request and will face timeouts. These timeouts can get excessively logged in the dmesg. A proper handling of them may require to export `nci_request_cancel` (or propagate error handling from the nft packets handlers). Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Tested-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Deepak Sharma Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250925132846.213425-1-deepak.sharma.472935@gmail.com Signed-off-by: Paolo Abeni commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 Author: Qingfang Deng Date: Thu Sep 25 13:10:59 2025 +0800 6pack: drop redundant locking and refcounting The TTY layer already serializes line discipline operations with tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack are unnecessary. Removing them simplifies the code and also resolves a lockdep warning reported by syzbot. The warning did not indicate a real deadlock, since the write-side lock was only taken in process context with hardirqs disabled. Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/ Signed-off-by: Qingfang Deng Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 99e4c35eada98d5959e61e7d3e049f64b2f0e4e1 Author: Hangbin Liu Date: Thu Sep 25 02:33:04 2025 +0000 selftests: bonding: add ipsec offload test This introduces a test for IPSec offload over bonding, utilizing netdevsim for the testing process, as veth interfaces do not support IPSec offload. The test will ensure that the IPSec offload functionality remains operational even after a failover event occurs in the bonding configuration. Here is the test result: TEST: bond_ipsec_offload (active_slave eth0) [ OK ] TEST: bond_ipsec_offload (active_slave eth1) [ OK ] Reviewed-by: Petr Machata Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250925023304.472186-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 5b66169f6be4847008c0aea50885ff0632151479 Author: Hangbin Liu Date: Thu Sep 25 02:33:03 2025 +0000 bonding: fix xfrm offload feature setup on active-backup mode The active-backup bonding mode supports XFRM ESP offload. However, when a bond is added using command like `ip link add bond0 type bond mode 1 miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is disabled. This occurs because, in bond_newlink(), we change bond link first and register bond device later. So the XFRM feature update in bond_option_mode_set() is not called as the bond device is not yet registered, leading to the offload feature not being set successfully. To resolve this issue, we can modify the code order in bond_newlink() to ensure that the bond device is registered first before changing the bond link parameters. This change will allow the XFRM ESP offload feature to be correctly enabled. Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 7bd80ed89d72285515db673803b021469ba71ee8 Author: Oleksij Rempel Date: Wed Sep 24 14:02:41 2025 +0200 Documentation: net: add flow control guide and document ethtool API Introduce a new document, flow_control.rst, to provide a comprehensive guide on Ethernet Flow Control in Linux. The guide explains how flow control works, how autonegotiation resolves pause capabilities, and how to configure it using ethtool and Netlink. In parallel, document the pause and pause-stat attributes in the ethtool.yaml netlink spec. This enables the ynl tool to generate kernel-doc comments for the corresponding enums in the UAPI header, making the C interface self-documenting. Finally, replace the legacy flow control section in phy.rst with a reference to the new document and add pointers in the relevant C source files. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250924120241.724850-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit d01579d590f72d2d91405b708e96f6169f24775a Author: Ethan Ferguson Date: Tue Sep 30 13:49:00 2025 +0900 exfat: Add support for FS_IOC_{GET,SET}FSLABEL Add support for reading / writing to the exfat volume label from the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls Co-developed-by: Yuezhang Mo Signed-off-by: Yuezhang Mo Signed-off-by: Ethan Ferguson Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 29c063658d532dfad22d4ef8aea9a494037ceab1 Author: Sang-Heon Jeon Date: Sat Sep 27 00:35:22 2025 +0900 exfat: combine iocharset and utf8 option setup Currently, exfat utf8 mount option depends on the iocharset option value. After exfat remount, utf8 option may become inconsistent with iocharset option. If the options are inconsistent; (specifically, iocharset=utf8 but utf8=0) readdir may reference uninitalized NLS, leading to a null pointer dereference. Extract and combine utf8/iocharset setup logic into exfat_set_iocharset(). Then Replace iocharset setup logic to exfat_set_iocharset to prevent utf8/iocharset option inconsistentcy after remount. Reported-by: syzbot+3e9cb93e3c5f90d28e19@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3e9cb93e3c5f90d28e19 Signed-off-by: Sang-Heon Jeon Fixes: acab02ffcd6b ("exfat: support modifying mount options via remount") Tested-by: syzbot+3e9cb93e3c5f90d28e19@syzkaller.appspotmail.com Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit e6fd5d3a431708df8f43d970bd3ba8a70a034fd5 Author: Yuezhang Mo Date: Thu Sep 11 16:54:31 2025 +0800 exfat: support modifying mount options via remount Before this commit, all exfat-defined mount options could not be modified dynamically via remount, and no error was returned. After this commit, these three exfat-defined mount options (discard, zero_size_dir, and errors) can be modified dynamically via remount. While other exfat-defined mount options cannot be modified dynamically via remount because their old settings are cached in inodes or dentries, modifying them will be rejected with an error. Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 9fd688678dd86e3be32a35e3b2c5cc3ef0c4e257 Author: Namjae Jeon Date: Sat Sep 6 08:13:04 2025 +0900 exfat: optimize allocation bitmap loading time Loading the allocation bitmap is very slow if user set the small cluster size on large partition. For optimizing it, This patch uses sb_breadahead() read the allocation bitmap. It will improve the mount time. The following is the result of about 4TB partition(2KB cluster size) on my target. without patch: real 0m41.746s user 0m0.011s sys 0m0.000s with patch: real 0m2.525s user 0m0.008s sys 0m0.008s Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit cb8d6d4aa015a8dace68d129baf7a4d7042a667d Author: Liao Yuanhong Date: Mon Aug 25 21:35:18 2025 +0800 exfat: Remove unnecessary parentheses When using &, it's unnecessary to have parentheses afterward. Remove redundant parentheses to enhance readability. Signed-off-by: Liao Yuanhong Signed-off-by: Namjae Jeon commit 2c88607ac82d1e375e4c85577fe54e69b0be43a9 Author: Xichao Zhao Date: Mon Aug 18 17:28:15 2025 +0800 exfat: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Signed-off-by: Xichao Zhao Signed-off-by: Namjae Jeon commit 79c1587b6cda74deb0c86fc7ba194b92958c793c Author: Namjae Jeon Date: Sat Aug 30 14:44:35 2025 +0900 exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is that if the start cluster of the allocation bitmap is 6, cluster 6 can be allocated when creating a directory with mkdir. exfat zeros out this cluster in exfat_mkdir, which can delete existing entries. This can reallocate the allocated entries. In addition, the allocation bitmap is also zeroed out, so cluster 6 can be reallocated. This patch adds exfat_test_bitmap_range to validate that clusters used for the allocation bitmap are correctly marked as in-use. Reported-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com Tested-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com Reviewed-by: Yuezhang Mo Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 Author: Chi Zhiling Date: Fri Aug 15 17:32:45 2025 +0800 exfat: limit log print for IO error For exFAT filesystems with 4MB read_ahead_size, removing the storage device when the read operation is in progress, which cause the last read syscall spent 150s [1]. The main reason is that exFAT generates excessive log messages [2]. After applying this patch, approximately 300,000 lines of log messages were suppressed, and the delay of the last read() syscall was reduced to about 4 seconds. [1]: write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120> read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032> write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119> read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215> [2]: [ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) [ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5) Signed-off-by: Chi Zhiling Signed-off-by: Namjae Jeon commit 30d4efb2f5a515a60fe6b0ca85362cbebea21e2f Merge: 417552999d0b66 9d52b0b41be5b9 Author: Linus Torvalds Date: Mon Sep 29 19:42:03 2025 -0700 Merge tag 'for-linus-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix the migration of a Xen virq to another cpu plus some related cleanup work - clean up Xen-PV mode specific code, resulting in removing some of that code in the resulting binary in case CONFIG_XEN_PV is not set - fixes and cleanup for suspend handling under Xen * tag 'for-linus-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: take system_transition_mutex on suspend xen/manage: Fix suspend error path xen/events: Update virq_to_irq on migration xen/events: Return -EEXIST for bound VIRQs xen/events: Cleanup find_virq() return codes x86/xen: select HIBERNATE_CALLBACKS more directly drivers/xen/gntdev: use xen_pv_domain() instead of cached value xen: replace XENFEAT_auto_translated_physmap with xen_pv_domain() xen: rework xen_pv_domain() commit 417552999d0b6681ac30e117ae890828ca7e46b3 Merge: 9cc220a422113f ef104054a31260 Author: Linus Torvalds Date: Mon Sep 29 19:28:50 2025 -0700 Merge tag 'powerpc-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - powerpc support for BPF arena and arena atomics - Patches to switch to msi parent domain (per-device MSI domains) - Add a lock contention tracepoint in the queued spinlock slowpath - Fixes for underflow in pseries/powernv msi and pci paths - Switch from legacy-of-mm-gpiochip dependency to platform driver - Fixes for handling TLB misses - Introduce support for powerpc papr-hvpipe - Add vpa-dtl PMU driver for pseries platform - Misc fixes and cleanups Thanks to Aboorva Devarajan, Aditya Bodkhe, Andrew Donnellan, Athira Rajeev, Cédric Le Goater, Christophe Leroy, Erhard Furtner, Gautam Menghani, Geert Uytterhoeven, Haren Myneni, Hari Bathini, Joe Lawrence, Kajol Jain, Kienan Stewart, Linus Walleij, Mahesh Salgaonkar, Nam Cao, Nicolas Schier, Nysal Jan K.A., Ritesh Harjani (IBM), Ruben Wauters, Saket Kumar Bhaskar, Shashank MS, Shrikanth Hegde, Tejas Manhas, Thomas Gleixner, Thomas Huth, Thorsten Blum, Tyrel Datwyler, and Venkat Rao Bagalkote. * tag 'powerpc-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (49 commits) powerpc/pseries: Define __u{8,32} types in papr_hvpipe_hdr struct genirq/msi: Remove msi_post_free() powerpc/perf/vpa-dtl: Add documentation for VPA dispatch trace log PMU powerpc/perf/vpa-dtl: Handle the writing of perf record when aux wake up is needed powerpc/perf/vpa-dtl: Add support to capture DTL data in aux buffer powerpc/perf/vpa-dtl: Add support to setup and free aux buffer for capturing DTL data docs: ABI: sysfs-bus-event_source-devices-vpa-dtl: Document sysfs event format entries for vpa_dtl pmu powerpc/vpa_dtl: Add interface to expose vpa dtl counters via perf powerpc/time: Expose boot_tb via accessor powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure powerpc/fprobe: fix updated fprobe for function-graph tracer powerpc/ftrace: support CONFIG_FUNCTION_GRAPH_RETVAL powerpc64/modules: replace stub allocation sentinel with an explicit counter powerpc64/modules: correctly iterate over stubs in setup_ftrace_ool_stubs powerpc/ftrace: ensure ftrace record ops are always set for NOPs powerpc/603: Really copy kernel PGD entries into all PGDIRs powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler powerpc/pseries: HVPIPE changes to support migration powerpc/pseries: Enable hvpipe with ibm,set-system-parameter RTAS powerpc/pseries: Enable HVPIPE event message interrupt ... commit 998a67b954680f26f3734040aeeed08642d49721 Author: Enzo Matsumiya Date: Thu Sep 25 12:10:33 2025 -0300 smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf() for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests) or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn't need it. Backtrace: [ 945.272081] ------------[ cut here ]------------ [ 945.272774] kernel BUG at include/linux/scatterlist.h:209! [ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 [ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [ 945.286683] Call Trace: [ 945.286952] [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [ 945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103] __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140] __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397] ? __pfx_worker_thread+0x10/0x10 [ 945.299900] kthread+0x119/0x210 [ 945.300285] ? __pfx_kthread+0x10/0x10 [ 945.300729] ret_from_fork+0x119/0x1b0 [ 945.301163] ? __pfx_kthread+0x10/0x10 [ 945.301601] ret_from_fork_asm+0x1a/0x30 [ 945.302055] Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: Enzo Matsumiya Signed-off-by: Steve French commit 8e979aab34d766986f6d14f50cebf5f5dd87ab8e Author: Eric Biggers Date: Sat Sep 6 20:20:03 2025 -0700 smb: Use arc4 library instead of duplicate arc4 code fs/smb/common/cifs_arc4.c has an implementation of ARC4, but a copy of this same code is also present in lib/crypto/arc4.c to serve the other users of this legacy algorithm in the kernel. Remove the duplicate implementation in fs/smb/, which seems to have been added because of a misunderstanding, and just use the lib/crypto/ one. Signed-off-by: Eric Biggers Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 02696ac0906540715dd4a0bb86b1117a1d00da4e Author: Henrique Carvalho Date: Tue Sep 23 13:20:48 2025 -0300 smb: client: add tcon information to smb2_reconnect() debug messages smb2_reconnect() debug messages lack tcon context, making it hard to identify which tcon is reconnecting in multi-share environments. Change cifs_dbg() to cifs_tcon_dbg() to include tcon information. Closes: https://bugzilla.suse.com/show_bug.cgi?id=1234066 Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit 9cc220a422113f665e13364be1411c7bba9e3e30 Merge: f1004b2f19d7e9 088bb10e372520 Author: Linus Torvalds Date: Mon Sep 29 19:14:25 2025 -0700 Merge tag 's390-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Refactor SCLP memory hotplug code - Introduce common boot_panic() decompressor helper macro and use it to get rid of nearly few identical implementations - Take into account additional key generation flags and forward it to the ep11 implementation. With that allow users to modify the key generation process, e.g. provide valid combinations of XCP_BLOB_* flags - Replace kmalloc() + copy_from_user() with memdup_user_nul() in s390 debug facility and HMC driver - Add DAX support for DCSS memory block devices - Make the compiler statement attribute "assume" available with a new __assume macro - Rework ffs() and fls() family bitops functions, including source code improvements and generated code optimizations. Use the newly introduced __assume macro for that - Enable additional network features in default configurations - Use __GFP_ACCOUNT flag for user page table allocations to add missing kmemcg accounting - Add WQ_PERCPU flag to explicitly request the use of the per-CPU workqueue for 3590 tape driver - Switch power reading to the per-CPU and the Hiperdispatch to the default workqueue - Add memory allocation profiling hooks to allow better profiling data and the /proc/allocinfo output similar to other architectures * tag 's390-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (21 commits) s390/mm: Add memory allocation profiling hooks s390: Replace use of system_wq with system_dfl_wq s390/diag324: Replace use of system_wq with system_percpu_wq s390/tape: Add WQ_PERCPU to alloc_workqueue users s390/bitops: Switch to generic ffs() if supported by compiler s390/bitops: Switch to generic fls(), fls64(), etc. s390/mm: Use __GFP_ACCOUNT for user page table allocations s390/configs: Enable additional network features s390/bitops: Cleanup __flogr() s390/bitops: Use __assume() for __flogr() inline assembly return value compiler_types: Add __assume macro s390/bitops: Limit return value range of __flogr() s390/dcssblk: Add DAX support s390/hmcdrv: Replace kmalloc() + copy_from_user() with memdup_user_nul() s390/debug: Replace kmalloc() + copy_from_user() with memdup_user_nul() s390/pkey: Forward keygenflags to ep11_unwrapkey s390/boot: Add common boot_panic() code s390/bitops: Optimize inlining s390/bitops: Slightly optimize ffs() and fls64() s390/sclp: Move memory hotplug code for better modularity ... commit f1004b2f19d7e9add9d707f64d9fcbc50f67921b Merge: cb7e3669c68366 695f2c0c25f3c8 Author: Linus Torvalds Date: Mon Sep 29 19:05:58 2025 -0700 Merge tag 'm68k-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Fix whitespace in Zorro name macros - Fix find_*_bit() signatures - defconfig updates * tag 'm68k-for-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.17-rc1 m68k: bitops: Fix find_*_bit() signatures zorro: Remove extra whitespace in macro definitions commit cb7e3669c683669d93139184adff68a7d9000536 Merge: feafee284579d2 0b0ca959d20689 Author: Linus Torvalds Date: Mon Sep 29 19:01:08 2025 -0700 Merge tag 'riscv-for-linus-6.18-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley - Replacement of __ASSEMBLY__ with __ASSEMBLER__ in header files (other architectures have already merged this type of cleanup) - The introduction of ioremap_wc() for RISC-V - Cleanup of the RISC-V kprobes code to use mostly-extant macros rather than open code - A RISC-V kprobes unit test - An architecture-specific endianness swap macro set implementation, leveraging some dedicated RISC-V instructions for this purpose if they are available - The ability to identity and communicate to userspace the presence of a MIPS P8700-specific ISA extension, and to leverage its MIPS-specific PAUSE implementation in cpu_relax() - Several other miscellaneous cleanups * tag 'riscv-for-linus-6.18-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits) riscv: errata: Fix the PAUSE Opcode for MIPS P8700 riscv: hwprobe: Document MIPS xmipsexectl vendor extension riscv: hwprobe: Add MIPS vendor extension probing riscv: Add xmipsexectl instructions riscv: Add xmipsexectl as a vendor extension dt-bindings: riscv: Add xmipsexectl ISA extension description riscv: cpufeature: add validation for zfa, zfh and zfhmin perf: riscv: skip empty batches in counter start selftests: riscv: Add README for RISC-V KSelfTest riscv: sbi: Switch to new sys-off handler API riscv: Move vendor errata definitions to new header RISC-V: ACPI: enable parsing the BGRT table riscv: Enable ARCH_HAVE_NMI_SAFE_CMPXCHG riscv: pi: use 'targets' instead of extra-y in Makefile riscv: introduce asm/swab.h riscv: mmap(): use unsigned offset type in riscv_sys_mmap drivers/perf: riscv: Remove redundant ternary operators riscv: mm: Use mmu-type from FDT to limit SATP mode riscv: mm: Return intended SATP mode for noXlvl options riscv: kprobes: Remove duplication of RV_EXTRACT_ITYPE_IMM ... commit c5cb31c99257aacd5cc2ff72a3b6f0c660046c9b Merge: 377ea331281f2c 9363b4837659d1 Author: Jakub Kicinski Date: Mon Sep 29 18:57:43 2025 -0700 Merge branch 'dpll-add-phase-offset-averaging-factor' Ivan Vecera says: ==================== dpll: add phase offset averaging factor For some hardware, the phase shift may result from averaging previous values and the newly measured value. In this case, the averaging is controlled by a configurable averaging factor. Add new device level attribute phase-offset-avg-factor, appropriate callbacks and implement them in zl3073x driver. ==================== Link: https://patch.msgid.link/20250927084912.2343597-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9363b4837659d1b7ee04cfa714373ce4b4b8269f Author: Ivan Vecera Date: Sat Sep 27 10:49:12 2025 +0200 dpll: zl3073x: Allow to configure phase offset averaging factor The DPLL phase measurement block uses an exponential moving average with a configurable averaging factor. Measurements are taken at approximately 40 Hz or at the reference frequency, whichever is lower. Currently, factor=2 is used to prioritize fast response for dynamic phase changes. For applications needing a stable, precise average phase offset where rapid changes are unlikely, a higher factor is recommended. Implement the .phase_offset_avg_factor_get/set callbacks to allow a user to adjust this factor. Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit e28d5a68b6519ec6b2118a3f604295b5534eeb51 Author: Ivan Vecera Date: Sat Sep 27 10:49:11 2025 +0200 dpll: add phase_offset_avg_factor_get/set callback ops Add new callback operations for a dpll device: - phase_offset_avg_factor_get(...) - to obtain current phase offset averaging factor from dpll device, - phase_offset_avg_factor_set(...) - to set phase offset averaging factor Obtain the factor value using the get callback and provide it to the user if the device driver implement this callback. Execute the set callback upon user requests, if the driver implement it. Signed-off-by: Ivan Vecera v2: * do not require 'set' callback to retrieve current value * always call 'set' callback regardless of current value Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit a680581f6a131fd8c62d284ed4a24d4bc1cc553e Author: Ivan Vecera Date: Sat Sep 27 10:49:10 2025 +0200 dpll: add phase-offset-avg-factor device attribute to netlink spec Add dpll device level attribute DPLL_A_PHASE_OFFSET_AVG_FACTOR to allow control over a calculation of reported phase offset value. Attribute is present, if the driver provides such capability, otherwise attribute shall not be present. Signed-off-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250927084912.2343597-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit eb11f02f3151e86f41bb15cc47b7400e91c07a4f Merge: 8169a6011c5fec 5cfbe7ebfa42fd Author: Jakub Kicinski Date: Mon Sep 29 18:50:51 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-09-28' Tariq Toukan says: ==================== mlx5 misc fixes 2025-09-28 misc bug fixes from the team to the mlx5 core driver. ==================== Signed-off-by: Jakub Kicinski commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 Author: Moshe Shemesh Date: Mon Sep 29 00:02:09 2025 +0300 net/mlx5: fw reset, add reset timeout work Add sync reset timeout to stop poll_sync_reset in case there was no reset done or abort event within timeout. Otherwise poll sync reset will just continue and in case of fw fatal error no health reporting will be done. Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 Author: Shay Drory Date: Mon Sep 29 00:02:08 2025 +0300 net/mlx5: pagealloc: Fix reclaim race during command interface teardown The reclaim_pages_cmd() function sends a command to the firmware to reclaim pages if the command interface is active. A race condition can occur if the command interface goes down (e.g., due to a PCI error) while the mlx5_cmd_do() call is in flight. In this case, mlx5_cmd_do() will return an error. The original code would propagate this error immediately, bypassing the software-based page reclamation logic that is supposed to run when the command interface is down. Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark that command interface is down. If this is the case, fall through to the software reclamation path. If the command failed for any another reason, or finished successfully, return as before. Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 Author: Moshe Shemesh Date: Mon Sep 29 00:02:07 2025 +0300 net/mlx5: Stop polling for command response if interface goes down Stop polling on firmware response to command in polling mode if the command interface got down. This situation can occur, for example, if a firmware fatal error is detected during polling. This change halts the polling process when the command interface goes down, preventing unnecessary waits. Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 377ea331281f2c63dc281a6ea2dc318e4e1fc2d1 Merge: 6d3728d424a2ad 137d1a63551314 Author: Jakub Kicinski Date: Mon Sep 29 18:49:58 2025 -0700 Merge tag 'mlx5-next-lag' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-09-28 * tag 'mlx5-next-lag' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: IFC add balance ID and LAG per MP group bits net/mlx5: Add IFC bit for TIR/SQ order capability ==================== Link: https://patch.msgid.link/1759093989-841873-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit feafee284579d29537a5a56ba8f23894f0463f3d Merge: fe68bb2861808e ea0b39168d3a23 Author: Linus Torvalds Date: Mon Sep 29 18:48:39 2025 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Will Deacon: "There's good stuff across the board, including some nice mm improvements for CPUs with the 'noabort' BBML2 feature and a clever patch to allow ptdump to play nicely with block mappings in the vmalloc area. Confidential computing: - Add support for accepting secrets from firmware (e.g. ACPI CCEL) and mapping them with appropriate attributes. CPU features: - Advertise atomic floating-point instructions to userspace - Extend Spectre workarounds to cover additional Arm CPU variants - Extend list of CPUs that support break-before-make level 2 and guarantee not to generate TLB conflict aborts for changes of mapping granularity (BBML2_NOABORT) - Add GCS support to our uprobes implementation. Documentation: - Remove bogus SME documentation concerning register state when entering/exiting streaming mode. Entry code: - Switch over to the generic IRQ entry code (GENERIC_IRQ_ENTRY) - Micro-optimise syscall entry path with a compiler branch hint. Memory management: - Enable huge mappings in vmalloc space even when kernel page-table dumping is enabled - Tidy up the types used in our early MMU setup code - Rework rodata= for closer parity with the behaviour on x86 - For CPUs implementing BBML2_NOABORT, utilise block mappings in the linear map even when rodata= applies to virtual aliases - Don't re-allocate the virtual region between '_text' and '_stext', as doing so confused tools parsing /proc/vmcore. Miscellaneous: - Clean-up Kconfig menuconfig text for architecture features - Avoid redundant bitmap_empty() during determination of supported SME vector lengths - Re-enable warnings when building the 32-bit vDSO object - Avoid breaking our eggs at the wrong end. Perf and PMUs: - Support for v3 of the Hisilicon L3C PMU - Support for Hisilicon's MN and NoC PMUs - Support for Fujitsu's Uncore PMU - Support for SPE's extended event filtering feature - Preparatory work to enable data source filtering in SPE - Support for multiple lanes in the DWC PCIe PMU - Support for i.MX94 in the IMX DDR PMU driver - MAINTAINERS update (Thank you, Yicong) - Minor driver fixes (PERF_IDX2OFF() overflow, CMN register offsets). Selftests: - Add basic LSFE check to the existing hwcaps test - Support nolibc in GCS tests - Extend SVE ptrace test to pass unsupported regsets and invalid vector lengths - Minor cleanups (typos, cosmetic changes). System registers: - Fix ID_PFR1_EL1 definition - Fix incorrect signedness of some fields in ID_AA64MMFR4_EL1 - Sync TCR_EL1 definition with the latest Arm ARM (L.b) - Be stricter about the input fed into our AWK sysreg generator script - Typo fixes and removal of redundant definitions. ACPI, EFI and PSCI: - Decouple Arm's "Software Delegated Exception Interface" (SDEI) support from the ACPI GHES code so that it can be used by platforms booted with device-tree - Remove unnecessary per-CPU tracking of the FPSIMD state across EFI runtime calls - Fix a node refcount imbalance in the PSCI device-tree code. CPU Features: - Ensure register sanitisation is applied to fields in ID_AA64MMFR4 - Expose AIDR_EL1 to userspace via sysfs, primarily so that KVM guests can reliably query the underlying CPU types from the VMM - Re-enabling of SME support (CONFIG_ARM64_SME) as a result of fixes to our context-switching, signal handling and ptrace code" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (93 commits) arm64: cpufeature: Remove duplicate asm/mmu.h header arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN perf/dwc_pcie: Fix use of uninitialized variable arm/syscalls: mark syscall invocation as likely in invoke_syscall Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU Documentation: hisi-pmu: Fix of minor format error drivers/perf: hisi: Add support for L3C PMU v3 drivers/perf: hisi: Refactor the event configuration of L3C PMU drivers/perf: hisi: Extend the field of tt_core drivers/perf: hisi: Extract the event filter check of L3C PMU drivers/perf: hisi: Simplify the probe process of each L3C PMU version drivers/perf: hisi: Export hisi_uncore_pmu_isr() drivers/perf: hisi: Relax the event ID check in the framework perf: Fujitsu: Add the Uncore PMU driver arm64: map [_text, _stext) virtual address range non-executable+read-only arm64/sysreg: Update TCR_EL1 register arm64: Enable vmalloc-huge with ptdump arm64: cpufeature: add Neoverse-V3AE to BBML2 allow list arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions ... commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 Author: Yeounsu Moon Date: Mon Sep 29 04:01:24 2025 +0900 net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 6d3728d424a2ad6c1af03ae597db6b5aca929cf2 Author: Russell King (Oracle) Date: Mon Sep 29 08:43:55 2025 +0100 net: stmmac: remove stmmac_hw_setup() excess documentation parameter The kernel build bot reports: Warning: drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3438 Excess function parameter 'ptp_register' description in 'stmmac_hw_setup' Fix it. Reported-by: kernel test robot Fixes: 98d8ea566b85 ("net: stmmac: move timestamping/ptp init to stmmac_hw_setup() caller") Closes: https://lore.kernel.org/oe-kbuild-all/202509290927.svDd6xuw-lkp@intel.com/ Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1v38Y7-00000008UCQ-3w27@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fe68bb2861808ed5c48d399bd7e670ab76829d55 Merge: 46a1b6b2aaae96 438f7cd41765db Author: Linus Torvalds Date: Mon Sep 29 18:45:42 2025 -0700 Merge tag 'microblaze-v6.18' of git://git.monstr.eu/linux-2.6-microblaze Pull microblaze updates from Michal Simek: - Fix typos in Kconfig - s/__ASSEMBLY__/__ASSEMBLER__/g * tag 'microblaze-v6.18' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers microblaze: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers microblaze: fix typos in Kconfig commit 4363d182191c0ea5d9461104955e296ba0490222 Merge: 4ed9db2dc5d898 9b62d53cc8b4f0 Author: Jakub Kicinski Date: Mon Sep 29 18:41:39 2025 -0700 Merge branch 'selftest-packetdrill-import-tfo-server-tests' Kuniyuki Iwashima says: ==================== selftest: packetdrill: Import TFO server tests. The series imports 15 TFO server tests from google/packetdrill and adds 2 more tests. The repository has two versions of tests for most scenarios; one uses the non-experimental option (34), and the other uses the experimental option (255) with 0xF989. Basically, we only import the non-experimental version of tests, and for the experimental option, tcp_fastopen_server_experimental_option.pkt is added. The following tests are not (yet) imported: * icmp-baseline.pkt * simple1.pkt / simple2.pkt / simple3.pkt The former is completely covered by icmp-before-accept.pkt. The later's delta is the src/dst IP pair to generate a different cookie, but supporting dualstack requires churn in ksft_runner.sh, so defered to future series. Also, sockopt-fastopen-key.pkt covers the same function. The following tests have the experimental version only, so converted to the non-experimental option: * client-ack-dropped-then-recovery-ms-timestamps.pkt * sockopt-fastopen-key.pkt For the imported tests, these common changes are applied. * Add SPDX header * Adjust path to default.sh * Adjust sysctl w/ set_sysctls.py * Use TFO_COOKIE instead of a raw hex value * Use SOCK_NONBLOCK for socket() not to block accept() * Add assertions for TCP state if commented * Remove unnecessary delay (e.g. +0.1 setsockopt(SO_REUSEADDR), etc) With this series, except for simple{1,2,3}.pkt, we can remove TFO server tests in google/packetdrill. ==================== Link: https://patch.msgid.link/20250927213022.1850048-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9b62d53cc8b4f089a1d069e1b6753b544d480212 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:51 2025 +0000 selftest: packetdrill: Import client-ack-dropped-then-recovery-ms-timestamps.pkt This also does not have the non-experimental version, so converted to FO. The comment in .pkt explains the detailed scenario. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-14-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 05b9f505fbe760416afa555bdfd0c461291ed69c Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:50 2025 +0000 selftest: packetdrill: Import sockopt-fastopen-key.pkt sockopt-fastopen-key.pkt does not have the non-experimental version, so the Experimental version is converted, FOEXP -> FO. The test sets net.ipv4.tcp_fastopen_key=0-0-0-0 and instead sets another key via setsockopt(TCP_FASTOPEN_KEY). The first listener generates a valid cookie in response to TFO option without cookie, and the second listner creates a TFO socket using the valid cookie. TCP_FASTOPEN_KEY is adjusted to use the common key in default.sh so that we can use TFO_COOKIE and support dualstack. Similarly, TFO_COOKIE_ZERO for the 0-0-0-0 key is defined. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-13-kuniyu@google.com Signed-off-by: Jakub Kicinski commit be90c7b3d5c8f3343d2402b883e7ec673538a302 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:49 2025 +0000 selftest: packetdrill: Refine tcp_fastopen_server_reset-after-disconnect.pkt. These changes are applied to follow the imported packetdrill tests. * Call setsockopt(TCP_FASTOPEN) * Remove unnecessary accept() delay * Add assertion for TCP states * Rename to tcp_fastopen_server_trigger-rst-reconnect.pkt. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-12-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 21f7fb31aef878df52c4575f3b71cbbea935d48a Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:48 2025 +0000 selftest: packetdrill: Import opt34/*-trigger-rst.pkt. This imports the non-experimental version of opt34/*-trigger-rst.pkt. | accept() | SYN data | -----------------------------------+----------+----------+ listener-closed-trigger-rst.pkt | no | unread | unread-data-closed-trigger-rst.pkt | yes | unread | Both files test that close()ing a SYN_RECV socket with unread SYN data triggers RST. The files are renamed to have the common prefix, trigger-rst. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5920f154e144c1e62b581454397e0f88fbd3b58d Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:47 2025 +0000 selftest: packetdrill: Import opt34/reset-* tests. This imports the non-experimental version of opt34/reset-*.pkt. | Child | RST | sk_err | ---------------------------------+---------+-------------------------------+---------+ reset-after-accept.pkt | TFO | after accept(), SYN_RECV | read() | reset-close-with-unread-data.pkt | TFO | after accept(), SYN_RECV | write() | reset-before-accept.pkt | TFO | before accept(), SYN_RECV | read() | reset-non-tfo-socket.pkt | non-TFO | before accept(), ESTABLISHED | write() | The first 3 files test scenarios where a SYN_RECV socket receives RST before/after accept() and data in SYN must be read() without error, but the following read() or fist write() will return ECONNRESET. The last test is similar but with non-TFO socket. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a8b1750e68f5fd6fe4bdff6f5d59d157c87a9b99 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:46 2025 +0000 selftest: packetdrill: Import opt34/icmp-before-accept.pkt. This imports the non-experimental version of icmp-before-accept.pkt. This file tests the scenario where an ICMP unreachable packet for a not-yet-accept()ed socket changes its state to TCP_CLOSE, but the SYN data must be read without error, and the following read() returns EHOSTUNREACH. Note that this test support only IPv4 as icmp is used. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 5ed080f85a33ad76288711c64ec2d8699de65ff9 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:45 2025 +0000 selftest: packetdrill: Import opt34/fin-close-socket.pkt. This imports the non-experimental version of fin-close-socket.pkt. This file tests the scenario where a TFO child socket's state transitions from SYN_RECV to CLOSE_WAIT before accept()ed. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e57b3933abcec26255fd9b4405badfc22af67da2 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:44 2025 +0000 selftest: packetdrill: Add test for experimental option. The only difference between non-experimental vs experimental TFO option handling is SYN+ACK generation. When tcp_parse_fastopen_option() parses a TFO option, it sets tcp_fastopen_cookie.exp to false if the option number is 34, and true if 255. The value is carried to tcp_options_write() to generate a TFO option with the same option number. Other than that, all the TFO handling is the same and the kernel must generate the same cookie regardless of the option number. Let's add a test for the handling so that we can consolidate fastopen/server/ tests and fastopen/server/opt34 tests. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 399e0a7ed930c9d64e10dba2ac8bed0a5793e264 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:43 2025 +0000 selftest: packetdrill: Add test for TFO_SERVER_WO_SOCKOPT1. TFO_SERVER_WO_SOCKOPT1 is no longer enabled by default, and each server test requires setsockopt(TCP_FASTOPEN). Let's add a basic test for TFO_SERVER_WO_SOCKOPT1. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0b8f164eb264184bf8820cc0c59cf6089d0201b3 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:42 2025 +0000 selftest: packetdrill: Import TFO server basic tests. This imports basic TFO server tests from google/packetdrill. The repository has two versions of tests for most scenarios; one uses the non-experimental option (34), and the other uses the experimental option (255) with 0xF989. This only imports the following tests of the non-experimental version placed in [0]. I will add a specific test for the experimental option handling later. | TFO | Cookie | Payload | ---------------------------+-----+--------+---------+ basic-rw.pkt | yes | yes | yes | basic-zero-payload.pkt | yes | yes | no | basic-cookie-not-reqd.pkt | yes | no | yes | basic-non-tfo-listener.pkt | no | yes | yes | pure-syn-data.pkt | yes | no | yes | The original pure-syn-data.pkt missed setsockopt(TCP_FASTOPEN) and did not test TFO server in some scenarios unintentionally, so setsockopt() is added where needed. In addition, non-TFO scenario is stripped as it is covered by basic-non-tfo-listener.pkt. Also, I added basic- prefix. Link: https://github.com/google/packetdrill/tree/bfc96251310f/gtests/net/tcp/fastopen/server/opt34 #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 97b3b8306f782af80b4666d7137c75be9dba9219 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:41 2025 +0000 selftest: packetdrill: Define common TCP Fast Open cookie. TCP Fast Open cookie is generated in __tcp_fastopen_cookie_gen_cipher(). The cookie value is generated from src/dst IPs and a key configured by setsockopt(TCP_FASTOPEN_KEY) or net.ipv4.tcp_fastopen_key. The default.sh sets net.ipv4.tcp_fastopen_key, and the original packetdrill defines the corresponding cookie as TFO_COOKIE in run_all.py. [0] Then, each test does not need to care about the value, and we can easily update TFO_COOKIE in case __tcp_fastopen_cookie_gen_cipher() changes the algorithm. However, some tests use the bare hex value for specific IPv4 addresses and do not support IPv6. Let's define the same TFO_COOKIE in ksft_runner.sh. We will replace such bare hex values with TFO_COOKIE except for a single test for setsockopt(TCP_FASTOPEN_KEY). Link: https://github.com/google/packetdrill/blob/7230b3990f94/gtests/net/packetdrill/run_all.py#L65 #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 261cb8b12376d1c06c2840280fc602dc065ed924 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:40 2025 +0000 selftest: packetdrill: Require explicit setsockopt(TCP_FASTOPEN). To enable TCP Fast Open on a server, net.ipv4.tcp_fastopen must have 0x2 (TFO_SERVER_ENABLE), and we need to do either 1. Call setsockopt(TCP_FASTOPEN) for the socket 2. Set 0x400 (TFO_SERVER_WO_SOCKOPT1) additionally to net.ipv4.tcp_fastopen The default.sh sets 0x70403 so that each test does not need setsockopt(). (0x1 is TFO_CLIENT_ENABLE, and 0x70000 is ...???) However, some tests overwrite net.ipv4.tcp_fastopen without TFO_SERVER_WO_SOCKOPT1 and forgot setsockopt(TCP_FASTOPEN). For example, pure-syn-data.pkt [0] tests non-TFO servers unintentionally, except in the first scenario. To prevent such an accident, let's require explicit setsockopt(). TFO_CLIENT_ENABLE is necessary for tcp_syscall_bad_arg_fastopen-invalid-buf-ptr.pkt. Link: https://github.com/google/packetdrill/blob/bfc96251310f/gtests/net/tcp/fastopen/server/opt34/pure-syn-data.pkt #[0] Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 70dd4775db7fe33669bff6998e4b363298810127 Author: Kuniyuki Iwashima Date: Sat Sep 27 21:29:39 2025 +0000 selftest: packetdrill: Set ktap_set_plan properly for single protocol test. The cited commit forgot to update the ktap_set_plan call. ktap_set_plan sets the number of tests (KSFT_NUM_TESTS), which must match the number of executed tests (KTAP_CNT_PASS + KTAP_CNT_SKIP + KTAP_CNT_XFAIL) in ktap_finished. Otherwise, the selftest exit()s with 1. Let's adjust KSFT_NUM_TESTS based on supported protocols. While at it, misalignment is fixed up. Fixes: a5c10aa3d1ba ("selftests/net: packetdrill: Support single protocol test.") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250927213022.1850048-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 46a1b6b2aaae965b27b3bb34cf88d441f6aef20e Merge: e129e479f2e444 a20b83cf45be20 Author: Linus Torvalds Date: Mon Sep 29 18:40:11 2025 -0700 Merge tag 'nios2_update_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 updates from Dinh Nguyen: - Replace __ASSEMBLY__ with __ASSEMBLER__ in headers - Set memblock.current_limit when setting pfn limits * tag 'nios2_update_for_v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: ensure that memblock.current_limit is set when setting pfn limits nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers nios2: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers commit f017156aea60db8720e47591ed1e041993381ad2 Author: Kohei Enju Date: Mon Sep 29 14:02:22 2025 +0900 net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable In EC2 instances where the RSS hash key is not configurable, ethtool shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally returns ENA_HASH_KEY_SIZE. Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") added proper handling for devices that don't support RSS hash key configuration, but ena_get_rxfh_key_size() has been unchanged. When the RSS hash key is not configurable, return 0 instead of ENA_HASH_KEY_SIZE to clarify getting the value is not supported. Tested on m5 instance families. Without patch: # ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 With patch: # ethtool -x ens5 | grep -A 1 "RSS hash key" RSS hash key: Operation not supported Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported") Signed-off-by: Kohei Enju Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit 8425161ac1204d2185e0a10f5ae652bae75d2451 Author: Kohei Enju Date: Mon Sep 29 14:42:15 2025 +0900 nfp: fix RSS hash key size when RSS is not supported The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when devices don't support RSS, and callers treat the negative value as a large positive value since the return type is u32. Return 0 when devices don't support RSS, aligning with the ethtool interface .get_rxfh_key_size() that requires returning 0 in such cases. Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function") Signed-off-by: Kohei Enju Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit 4ed9db2dc5d8981ecb7042f084f5cff43ba539d6 Author: Alok Tiwari Date: Mon Sep 29 01:54:12 2025 -0700 net: rtnetlink: fix typo in rtnl_unregister_all() comment Corrected "rtnl_unregster()" -> "rtnl_unregister()" in the documentation comment of "rtnl_unregister_all()" Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250929085418.49200-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 7d452516b67add4a53e63bfa496d8df930a66b9a Author: Eric Dumazet Date: Mon Sep 29 18:21:12 2025 +0000 Revert "net: group sk_backlog and sk_receive_queue" This reverts commit 4effb335b5dab08cb6e2c38d038910f8b527cfc9. This was a benefit for UDP flood case, which was later greatly improved with commits 6471658dc66c ("udp: use skb_attempt_defer_free()") and b650bf0977d3 ("udp: remove busylock and add per NUMA queues"). Apparently blamed commit added a regression for RAW sockets, possibly because they do not use the dual RX queue strategy that UDP has. sock_queue_rcv_skb_reason() and RAW recvmsg() compete for sk_receive_buf and sk_rmem_alloc changes, and them being in the same cache line reduce performance. Fixes: 4effb335b5da ("net: group sk_backlog and sk_receive_queue") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509281326.f605b4eb-lkp@intel.com Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: David Ahern Cc: Kuniyuki Iwashima Link: https://patch.msgid.link/20250929182112.824154-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9dd4e022bfffe0fbc6eaccdb52fc25554be5c367 Author: Furong Xu <0x1207@gmail.com> Date: Sat Sep 27 16:10:36 2025 +0800 net: stmmac: Convert open-coded register polling to helper macro Drop the open-coded register polling routines. Use readl_poll_timeout_atomic() in atomic state. Also adjust the delay time to 10us which seems more reasonable. Tested on NXP i.MX8MP and ROCKCHIP RK3588 boards, the break condition was met right after the first polling, no delay involved at all. So the 10us delay should be long enough for most cases. Reviewed-by: Simon Horman Signed-off-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250927081036.10611-1-0x1207@gmail.com Signed-off-by: Jakub Kicinski commit 74f7c5233e09a8b10ccf94f2fef42f95961c288b Merge: f017c1f768b670 c912f935a5c7e4 Author: Jakub Kicinski Date: Mon Sep 29 18:23:37 2025 -0700 Merge branch 'mptcp-receive-path-improvement' Matthieu Baerts says: ==================== mptcp: receive path improvement This series includes several changes to the MPTCP RX path. The main goals are improving the RX performances, and increase the long term maintainability. Some changes reflects recent(ish) improvements introduced in the TCP stack: patch 1, 2 and 3 are the MPTCP counter part of SKB deferral free and auto-tuning improvements. Note that patch 3 could possibly fix additional issues, and overall such patch should protect from similar issues to arise in the future. Patches 4-7 are aimed at introducing the socket backlog usage which will be done in a later series to process the packets received by the different subflows while the msk socket is owned. Patch 8 is not related to the RX path, but it contains additional tests for new features recently introduced in net-next. ==================== Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-0-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit c912f935a5c7e43f2b6be94d76e4ddbb6ff14c6d Author: Matthieu Baerts (NGI0) Date: Sat Sep 27 11:40:44 2025 +0200 selftests: mptcp: join: validate new laminar endp Here are a few sub-tests for mptcp_join.sh, validating the new 'laminar' endpoint type. In a setup where subflows created using the routing rules would be rejected by the listener, and where the latter announces one IP address, some cases are verified: - Without any 'laminar' endpoints: no new subflows are created. - With one 'laminar' endpoint: a second subflow is created. - With multiple 'laminar' endpoints: 2 IPv4 subflows are created. - With one 'laminar' endpoint, but the server announcing a second IP address, only one subflow is created. - With one 'laminar' + 'subflow' endpoint, the same endpoint is only used once. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-8-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 59701b1870032c1bf32244d87476bcd4b5ecb41b Author: Paolo Abeni Date: Sat Sep 27 11:40:43 2025 +0200 mptcp: minor move_skbs_to_msk() cleanup Such function is called only by __mptcp_data_ready(), which in turn is always invoked when msk is not owned by the user: we can drop the redundant, related check. Additionally mptcp needs to propagate the socket error only for current subflow. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-7-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 68c7af988bd137479101e2b40ab5fdd0e0365364 Author: Paolo Abeni Date: Sat Sep 27 11:40:42 2025 +0200 mptcp: factor out a basic skb coalesce helper The upcoming patch will introduced backlog processing for MPTCP socket, and we want to leverage coalescing in such data path. Factor out the relevant bits not touching memory accounting to deal with such use-case. Co-developed-by: Geliang Tang Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-6-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit c4ebc4ee4e751c6430604c52344d932bf1fde379 Author: Paolo Abeni Date: Sat Sep 27 11:40:41 2025 +0200 mptcp: remove unneeded mptcp_move_skb() Since commit b7535cfed223 ("mptcp: drop legacy code around RX EOF"), sk_shutdown can't change during the main recvmsg loop, we can drop the related race breaker. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-5-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 9a0afe0db46720ce1a009c7dac168aa0584bd732 Author: Paolo Abeni Date: Sat Sep 27 11:40:40 2025 +0200 mptcp: introduce the mptcp_init_skb helper Factor out all the skb initialization step in a new helper and use it. Note that this change moves the MPTCP CB initialization earlier: we can do such step as soon as the skb leaves the subflow socket receive queues. Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-4-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit e118cdc34dd109562b64f6a397f68cd33b041d5b Author: Paolo Abeni Date: Sat Sep 27 11:40:39 2025 +0200 mptcp: rcvbuf auto-tuning improvement Apply to the MPTCP auto-tuning the same improvements introduced for the TCP protocol by the merge commit 2da35e4b4df9 ("Merge branch 'tcp-receive-side-improvements'"). The main difference is that TCP subflow and the main MPTCP socket need to account separately for OoO: MPTCP does not care for TCP-level OoO and vice versa, as a consequence do not reflect MPTCP-level rcvbuf increase due to OoO packets at the subflow level. This refeactor additionally allow dropping the msk receive buffer update at receive time, as the latter only intended to cope with subflow receive buffer increase due to OoO packets. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/487 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/559 Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-3-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit a7556779745c047efb7b0ce8732889b0cdc80936 Author: Paolo Abeni Date: Sat Sep 27 11:40:38 2025 +0200 tcp: make tcp_rcvbuf_grow() accessible to mptcp code To leverage the auto-tuning improvements brought by commit 2da35e4b4df9 ("Merge branch 'tcp-receive-side-improvements'"), the MPTCP stack need to access the mentioned helper. Acked-by: Geliang Tang Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-2-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit 9aa59323f2709370cb4f01acbba599a9167f317b Author: Paolo Abeni Date: Sat Sep 27 11:40:37 2025 +0200 mptcp: leverage skb deferral free Usage of the skb deferral API is straight-forward; with multiple subflows actives this allow moving part of the received application load into multiple CPUs. Also fix a typo in the related comment. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250927-net-next-mptcp-rcv-path-imp-v1-1-5da266aa9c1a@kernel.org Signed-off-by: Jakub Kicinski commit f017c1f768b670bced4464476655b27dfb937e67 Author: Eric Dumazet Date: Sat Sep 27 09:28:27 2025 +0000 tcp: use skb->len instead of skb->truesize in tcp_can_ingest() Some applications are stuck to the 20th century and still use small SO_RCVBUF values. After the blamed commit, we can drop packets especially when using LRO/hw-gro enabled NIC and small MSS (1500) values. LRO/hw-gro NIC pack multiple segments into pages, allowing tp->scaling_ratio to be set to a high value. Whenever the receive queue gets full, we can receive a small packet filling RWIN, but with a high skb->truesize, because most NIC use 4K page plus sk_buff metadata even when receiving less than 1500 bytes of payload. Even if we refine how tp->scaling_ratio is estimated, we could have an issue at the start of the flow, because the first round of packets (IW10) will be sent based on the initial tp->scaling_ratio (1/2) Relax tcp_can_ingest() to use skb->len instead of skb->truesize, allowing the peer to use final RWIN, assuming a 'perfect' scaling_ratio of 1. Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250927092827.2707901-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d210ee58da1eff63626982ade65632a291aff941 Merge: c39d6d4d933381 be812ace0378a9 Author: Jakub Kicinski Date: Mon Sep 29 18:13:51 2025 -0700 Merge tag 'for-net-next-2025-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver - Avoid a couple dozen -Wflex-array-member-not-at-end warnings - bcsp: receive data only if registered - HCI: Fix using LE/ACL buffers for ISO packets - hci_core: Detect if an ISO link has stalled - ISO: Don't initiate CIS connections if there are no buffers - ISO: Use sk_sndtimeo as conn_timeout drivers: - btusb: Check for unexpected bytes when defragmenting HCI frames - btusb: Add new VID/PID 13d3/3627 for MT7925 - btusb: Add new VID/PID 13d3/3633 for MT7922 - btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - btintel: Add support for BlazarIW core - btintel_pcie: Add support for _suspend() / _resume() - btintel_pcie: Define hdev->wakeup() callback - btintel_pcie: Add Bluetooth core/platform as comments - btintel_pcie: Add id of Scorpious, Panther Lake-H484 - btintel_pcie: Refactor Device Coredump * tag 'for-net-next-2025-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (30 commits) Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements Bluetooth: ISO: don't leak skb in ISO_CONT RX Bluetooth: ISO: free rx_skb if not consumed Bluetooth: ISO: Fix possible UAF on iso_conn_free Bluetooth: SCO: Fix UAF on sco_conn_free Bluetooth: bcsp: receive data only if registered Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925 Bluetooth: remove duplicate h4_recv_buf() in header Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Bluetooth: hci_core: Print information of hcon on hci_low_sent Bluetooth: hci_core: Print number of packets in conn->data_q Bluetooth: Add function and line information to bt_dbg Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO Bluetooth: hci_core: Detect if an ISO link has stalled Bluetooth: ISO: Use sk_sndtimeo as conn_timeout Bluetooth: HCI: Fix using LE/ACL buffers for ISO packets Bluetooth: ISO: Don't initiate CIS connections if there are no buffers MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver ... ==================== Link: https://patch.msgid.link/20250927154616.1032839-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c39d6d4d933381714b6e5d735545256558ec6c05 Author: Michael S. Tsirkin Date: Sat Sep 27 08:29:35 2025 -0400 ptr_ring: __ptr_ring_zero_tail micro optimization __ptr_ring_zero_tail currently does the - 1 operation twice: - during initialization of head - at each loop iteration Let's just do it in one place, all we need to do is adjust the loop condition. this is better: - a slightly clearer logic with less duplication - uses prefix -- we don't need to save the old value - one less - 1 operation - for example, when ring is empty we now don't do - 1 at all, existing code does it once Text size shrinks from 15081 to 15050 bytes. Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman Link: https://patch.msgid.link/bcd630c7edc628e20d4f8e037341f26c90ab4365.1758976026.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit e8c4840d0c198215866728626b5c197048d4368b Merge: 1fb0e471611dc6 2a251b85ce918e Author: Jakub Kicinski Date: Mon Sep 29 18:11:18 2025 -0700 Merge branch 'net-wangxun-support-to-configure-rss' Jiawen Wu says: ==================== net: wangxun: support to configure RSS Implement ethtool ops for RSS configuration, and support multiple RSS for multiple pools. ==================== Link: https://patch.msgid.link/20250926023843.34340-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 2a251b85ce918e8552c604df4770040eae4432be Author: Jiawen Wu Date: Fri Sep 26 10:38:43 2025 +0800 net: libwx: restrict change user-set RSS configuration Enable/disable SR-IOV will change the number of rings, thereby changing the RSS configuration that the user has set. So reject these attempts if netif_is_rxfh_configured() returns true. And remind the user to reset the RSS configuration. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-5-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 2556f80a6abc69cb4f980ebcf5ca82ad383fef35 Author: Jiawen Wu Date: Fri Sep 26 10:38:42 2025 +0800 net: wangxun: add RSS reta and rxfh fields support Add ethtool ops for Rx flow hashing, query and set RSS indirection table and hash key. Disable UDP RSS by default, and support to configure L4 header fields with TCP/UDP/SCTP for flow hasing. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-4-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 58f244b25688bc0d891a1e52f13bd26cefbd8dae Author: Jiawen Wu Date: Fri Sep 26 10:38:41 2025 +0800 net: libwx: move rss_field to struct wx For global RSS and multiple RSS scheme, the RSS type fields are defined identically in the registers. So they can be defined as the macros WX_RSS_FIELD_* to cleanup the codes. And to prepare for the RXFH support in the next patch, move the rss_field to struct wx. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-3-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 1be6db04979944a05224807150038bab937521c8 Author: Jiawen Wu Date: Fri Sep 26 10:38:40 2025 +0800 net: libwx: support separate RSS configuration for every pool For those devices which support 64 pools, they also support PF and VF (i.e. different pools) to configure different RSS key and hash table. Enable multiple RSS, use up to 64 RSS configurations and each pool has a specific configuration. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20250926023843.34340-2-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit e129e479f2e444eaccd822717d418119d39d3d5c Merge: a5ba183bdeeeed d679c2e1e8d96f Author: Linus Torvalds Date: Mon Sep 29 18:08:34 2025 -0700 Merge tag 'pstore-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull tiny pstore update from Kees Cook: - Clarify various comments for better understanding (Eugen Hristev) * tag 'pstore-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/zone: rewrite some comments for better understanding commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 Author: Alok Tiwari Date: Thu Sep 25 11:02:10 2025 -0700 idpf: fix mismatched free function for dma_alloc_coherent The mailbox receive path allocates coherent DMA memory with dma_alloc_coherent(), but frees it with dmam_free_coherent(). This is incorrect since dmam_free_coherent() is only valid for buffers allocated with dmam_alloc_coherent(). Fix the mismatch by using dma_free_coherent() instead of dmam_free_coherent Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg") Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Reviewed-by: Madhu Chittim Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 1fb0e471611dc6a79dee609a7e0037eb1d124400 Author: Eric Dumazet Date: Thu Sep 25 23:09:29 2025 +0000 net: remove one stac/clac pair from move_addr_to_user() Convert the get_user() and __put_user() code to the fast masked_user_access_begin()/unsafe_{get|put}_user() variant. This patch increases the performance of an UDP recvfrom() receiver (netserver) on 120 bytes messages by 7 % on an AMD EPYC 7B12 64-Core Processor platform. Presence of audit_sockaddr() makes difficult to avoid the stac/clac pair in the copy_to_user() call, this is left for a future patch. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250925230929.3727873-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2b235765e9d4426cf56d7fd1a331f81a4dbbd85a Author: Eric Dumazet Date: Thu Sep 25 22:49:14 2025 +0000 scm: use masked_user_access_begin() in put_cmsg() Use the greatest and latest uaccess construct to get an optimal code. Before : lea (%r9,%rcx,1),%r10 movabs $,%r11 mov $0xfffffff2,%eax cmp %rcx,%r10 jb ffffffff81cdc312 cmp %r11,%r10 ja ffffffff81cdc312 stac lfence mov %r9,(%rcx) After: movabs $,%r9 cmp %r9,%rax cmova %r9,%rax stac mov %rcx,(%rax) Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250925224914.3590290-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3806446f609e111abf10b9a28c9e9762fafe56f4 Merge: 96ccc93744f826 de17376cad9706 Author: Jakub Kicinski Date: Mon Sep 29 17:49:35 2025 -0700 Merge branch 'net-stmmac-drop-frames-causing-hlbs-error' Rohan G Thomas says: ==================== net: stmmac: Drop frames causing HLBS error This patchset consists of following patchset to avoid netdev watchdog reset due to Head-of-Line Blocking due to EST scheduling error. 1. Drop those frames causing HLBS error 2. Add HLBS frame drops to taprio stats v2: https://lore.kernel.org/r/20250915-hlbs_2-v2-1-27266b2afdd9@altera.com ==================== Link: https://patch.msgid.link/20250925-hlbs_2-v3-0-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit de17376cad9706911f2d5a58a8c0f02b9665025d Author: Rohan G Thomas Date: Thu Sep 25 22:06:14 2025 +0800 net: stmmac: tc: Add HLBS drop count to taprio stats Add the count of the frames dropped by Head-Of-Line Blocking due to Scheduling(HLBS) error to taprio window drop count stats. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250925-hlbs_2-v3-2-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit 7ce48d497475d7222bd8258c5c055eb7d928793c Author: Rohan G Thomas Date: Thu Sep 25 22:06:13 2025 +0800 net: stmmac: est: Drop frames causing HLBS error Drop those frames causing Head-of-Line Blocking due to Scheduling (HLBS) error to avoid HLBS interrupt flooding and netdev watchdog timeouts due to blocked packets. Tx queues can be configured to drop those blocked packets by setting Drop Frames causing Scheduling Error (DFBS) bit of EST_CONTROL register. Also, add per queue HLBS drop count. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Furong Xu <0x1207@gmail.com> Link: https://patch.msgid.link/20250925-hlbs_2-v3-1-3b39472776c2@altera.com Signed-off-by: Jakub Kicinski commit a5ba183bdeeeedd5f5b683c02561072848258496 Merge: a240a79d435ae7 c8a935a31bc787 Author: Linus Torvalds Date: Mon Sep 29 17:48:27 2025 -0700 Merge tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "One notable addition is the creation of the 'transitional' keyword for kconfig so CONFIG renaming can go more smoothly. This has been a long-standing deficiency, and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will soon have KCFI support), this came up again. The breadth of the diffstat is mainly this renaming. - Clean up usage of TRAILING_OVERLAP() (Gustavo A. R. Silva) - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure (Junjie Cao) - Add str_assert_deassert() helper (Lad Prabhakar) - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - kconfig: Fix BrokenPipeError warnings in selftests - kconfig: Add transitional symbol attribute for migration support - kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI" * tag 'hardening-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: lib/string_choices: Add str_assert_deassert() helper kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI kconfig: Add transitional symbol attribute for migration support kconfig: Fix BrokenPipeError warnings in selftests gcc-plugins: Remove TODO_verify_il for GCC >= 16 stddef: Introduce __TRAILING_OVERLAP() stddef: Remove token-pasting in TRAILING_OVERLAP() lkdtm: fortify: Fix potential NULL dereference on kmalloc failure commit 96ccc93744f8260f62841ee1de7153bb1b8cfd83 Author: Alok Tiwari Date: Mon Sep 29 05:44:01 2025 -0700 ixgbe: fix typos and docstring inconsistencies Corrected function and variable name typos in comments and docstrings: ixgbe_write_ee_hostif_X550 -> ixgbe_write_ee_hostif_data_X550 ixgbe_get_lcd_x550em -> ixgbe_get_lcd_t_x550em "Determime" -> "Determine" "point to hardware structure" -> "pointer to hardware structure" "To turn on the LED" -> "To turn off the LED" These changes improve readability, consistency. Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Acked-by: Jacob Keller Link: https://patch.msgid.link/20250929124427.79219-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit a240a79d435ae7206a5c5101033f3f81d68bc3b4 Merge: 50157eaa0c13bb b0c9bfbab925ac Author: Linus Torvalds Date: Mon Sep 29 17:44:09 2025 -0700 Merge tag 'seccomp-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp update from Kees Cook: - Fix race with WAIT_KILLABLE_RECV (Johannes Nixdorf) * tag 'seccomp-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Add a test for the WAIT_KILLABLE_RECV fast reply race seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast commit 50157eaa0c13bb5aac5cc45330bf055d95d4af57 Merge: 8c1ed3021883f5 8c94db0ae97c72 Author: Linus Torvalds Date: Mon Sep 29 17:19:35 2025 -0700 Merge tag 'execve-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - binfmt_elf: preserve original ELF e_flags for core dumps (Svetlana Parfenova) - exec: Fix incorrect type for ret (Xichao Zhao) - binfmt_elf: Replace offsetof() with struct_size() in fill_note_info() (Xichao Zhao) * tag 'execve-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_elf: preserve original ELF e_flags for core dumps binfmt_elf: Replace offsetof() with struct_size() in fill_note_info() exec: Fix incorrect type for ret commit 8c1ed3021883f5e49f74dfb41ce0a24e5d07fdf0 Merge: 1896ce8eb6c618 95719dfa323709 Author: Linus Torvalds Date: Mon Sep 29 16:31:35 2025 -0700 Merge tag 'ffs-const-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull ffs const-attribute cleanups from Kees Cook: "While working on various hardening refactoring a while back we encountered inconsistencies in the application of __attribute_const__ on the ffs() family of functions. This series fixes this across all archs and adds KUnit tests. Notably, this found a theoretical underflow in PCI (also fixed here) and uncovered an inefficiency in ARC (fixed in the ARC arch PR). I kept the series separate from the general hardening PR since it is a stand-alone "topic". - PCI: Fix theoretical underflow in use of ffs(). - Universally apply __attribute_const__ to all architecture's ffs()-family of functions. - Add KUnit tests for ffs() behavior and const-ness" * tag 'ffs-const-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: KUnit: ffs: Validate all the __attribute_const__ annotations sparc: Add __attribute_const__ to ffs()-family implementations xtensa: Add __attribute_const__ to ffs()-family implementations s390: Add __attribute_const__ to ffs()-family implementations parisc: Add __attribute_const__ to ffs()-family implementations mips: Add __attribute_const__ to ffs()-family implementations m68k: Add __attribute_const__ to ffs()-family implementations openrisc: Add __attribute_const__ to ffs()-family implementations riscv: Add __attribute_const__ to ffs()-family implementations hexagon: Add __attribute_const__ to ffs()-family implementations alpha: Add __attribute_const__ to ffs()-family implementations sh: Add __attribute_const__ to ffs()-family implementations powerpc: Add __attribute_const__ to ffs()-family implementations x86: Add __attribute_const__ to ffs()-family implementations csky: Add __attribute_const__ to ffs()-family implementations bitops: Add __attribute_const__ to generic ffs()-family implementations KUnit: Introduce ffs()-family tests PCI: Test for bit underflow in pcie_set_readrq() commit b2ec5ca9d5c2c019e2316f7ba447596d1dcd8fde Merge: 62bea0e1d5c71a df2ba5709416ac Author: Dave Airlie Date: Tue Sep 30 09:26:24 2025 +1000 Merge tag 'amd-drm-next-6.18-2025-09-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.18-2025-09-26: amdgpu: - Misc fixes - Misc cleanups - SMU 13.x fixes - MES fix - VCN 5.0.1 reset fixes - DCN 3.2 watermark fixes - AVI infoframe fixes - PSR fix - Brightness fixes - DCN 3.1.4 fixes - DCN 3.1+ DTM fixes - DCN powergating fixes - DMUB fixes - DCN/SMU cleanup - DCN stutter fixes - DCN 3.5 fixes - GAMMA_LUT fixes - Add UserQ documentation - GC 9.4 reset fixes - Enforce isolation cleanups - UserQ fixes - DC/non-DC common modes cleanup - DCE6-10 fixes amdkfd: - Fix a race in sw_fini - Switch partition fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250926143918.2030854-1-alexander.deucher@amd.com commit 1896ce8eb6c61824f6c1125d69d8fda1f44a22f8 Merge: d8768fb12a14c3 a1f692fd69ccdb Author: Linus Torvalds Date: Mon Sep 29 15:55:20 2025 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull interleaved SHA-256 hashing support from Eric Biggers: "Optimize fsverity with 2-way interleaved hashing Add support for 2-way interleaved SHA-256 hashing to lib/crypto/, and make fsverity use it for faster file data verification. This improves fsverity performance on many x86_64 and arm64 processors. Later, I plan to make dm-verity use this too" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: Use 2-way interleaved SHA-256 hashing when supported fsverity: Remove inode parameter from fsverity_hash_block() lib/crypto: tests: Add tests and benchmark for sha256_finup_2x() lib/crypto: x86/sha256: Add support for 2-way interleaved hashing lib/crypto: arm64/sha256: Add support for 2-way interleaved hashing lib/crypto: sha256: Add support for 2-way interleaved hashing commit d8768fb12a14c30436bd0466b4fc28edeef45078 Merge: e2fffe1d958b36 b94bc4398beccd Author: Linus Torvalds Date: Mon Sep 29 15:48:56 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Add a RISC-V optimized implementation of Poly1305. This code was written by Andy Polyakov and contributed by Zhihang Shao. - Migrate the MD5 code into lib/crypto/, and add KUnit tests for MD5. Yes, it's still the 90s, and several kernel subsystems are still using MD5 for legacy use cases. As long as that remains the case, it's helpful to clean it up in the same way as I've been doing for other algorithms. Later, I plan to convert most of these users of MD5 to use the new MD5 library API instead of the generic crypto API. - Simplify the organization of the ChaCha, Poly1305, BLAKE2s, and Curve25519 code. Consolidate these into one module per algorithm, and centralize the configuration and build process. This is the same reorganization that has already been successful for SHA-1 and SHA-2. - Remove the unused crypto_kpp API for Curve25519. - Migrate the BLAKE2s and Curve25519 self-tests to KUnit. - Always enable the architecture-optimized BLAKE2s code. * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (38 commits) crypto: md5 - Implement export_core() and import_core() wireguard: kconfig: simplify crypto kconfig selections lib/crypto: tests: Enable Curve25519 test when CRYPTO_SELFTESTS lib/crypto: curve25519: Consolidate into single module lib/crypto: curve25519: Move a couple functions out-of-line lib/crypto: tests: Add Curve25519 benchmark lib/crypto: tests: Migrate Curve25519 self-test to KUnit crypto: curve25519 - Remove unused kpp support crypto: testmgr - Remove curve25519 kpp tests crypto: x86/curve25519 - Remove unused kpp support crypto: powerpc/curve25519 - Remove unused kpp support crypto: arm/curve25519 - Remove unused kpp support crypto: hisilicon/hpre - Remove unused curve25519 kpp support lib/crypto: tests: Add KUnit tests for BLAKE2s lib/crypto: blake2s: Consolidate into single C translation unit lib/crypto: blake2s: Move generic code into blake2s.c lib/crypto: blake2s: Always enable arch-optimized BLAKE2s code lib/crypto: blake2s: Remove obsolete self-test lib/crypto: x86/blake2s: Reduce size of BLAKE2S_SIGMA2 lib/crypto: chacha: Consolidate into single module ... commit e2fffe1d958b3660bc4e07e6542d97b6cc168826 Merge: d60ac92c105fd8 136d029662cdde Author: Linus Torvalds Date: Mon Sep 29 15:36:42 2025 -0700 Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull CRC updates from Eric Biggers: "Update crc_kunit to test the CRC functions in softirq and hardirq contexts, similar to what the lib/crypto/ KUnit tests do. Move the helper function needed to do this into a common header. This is useful mainly to test fallback code paths for when FPU/SIMD/vector registers are unusable" * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: Documentation/staging: Fix typo and incorrect citation in crc32.rst lib/crc: Drop inline from all *_mod_init_arch() functions lib/crc: Use underlying functions instead of crypto_simd_usable() lib/crc: crc_kunit: Test CRC computation in interrupt contexts kunit, lib/crypto: Move run_irq_test() to common header commit d60ac92c105fd8c09224b92c3e34dd03327ba3f4 Merge: a769648f464c9f 19591f7e781fd1 Author: Linus Torvalds Date: Mon Sep 29 15:33:50 2025 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "Make fs/crypto/ use the HMAC-SHA512 library functions instead of crypto_shash. This is simpler, faster, and more reliable" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: use HMAC-SHA512 library for HKDF fscrypt: Remove redundant __GFP_NOWARN commit a769648f464c9f453b3dc5c2bb8559b28c5d78a1 Merge: 5928397f5739fb 8e402107886366 Author: Linus Torvalds Date: Mon Sep 29 15:24:58 2025 -0700 Merge tag 'dlm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This adds a dlm_release_lockspace() flag to request that node-failure recovery be performed for the node leaving the lockspace. The implementation of this flag requires coordination with userland clustering components. It's been requested for use by GFS2" * tag 'dlm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: check for undefined release_option values dlm: handle release_option as unsigned dlm: move to rinfo for all middle conversion cases dlm: handle invalid lockspace member remove dlm: add new flag DLM_RELEASE_RECOVER for dlm_lockspace_release dlm: add new configfs entry release_recover for lockspace members dlm: add new RELEASE_RECOVER uevent attribute for release_lockspace dlm: use defines for force values in dlm_release_lockspace dlm: check for defined force value in dlm_lockspace_release commit 5928397f5739fb94559350575826d94fa8c35929 Merge: b3e1c7855e8e1c e2d3af0d64e5fe Author: Linus Torvalds Date: Mon Sep 29 15:19:45 2025 -0700 Merge tag 'erofs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: - Support FS_IOC_GETFSLABEL ioctl - Stop meaningless read-more policy on fragment extents - Remove a duplicate check for ztailpacking inline * tag 'erofs-for-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: drop redundant sanity check for ztailpacking inline erofs: Add support for FS_IOC_GETFSLABEL erofs: avoid reading more for fragment maps commit b3e1c7855e8e1c4d77685ce4a8cd9cdd576058eb Merge: a9401710a5f568 f32a26fab3672e Author: Linus Torvalds Date: Mon Sep 29 15:03:07 2025 -0700 Merge tag 'hfs-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfs updates from Viacheslav Dubeyko: "This contains several fixes of syzbot reported issues, HFS/HFS+ fixes of xfstests failures, and rework of HFS/HFS+ debug output subsystem. - Kang Chen fixed a slab-out-of-bounds issue in hfsplus_uni2asc() when hfsplus_uni2asc() is called from hfsplus_listxattr(). - Yang Chenzhi fixed a crash in hfsplus_bmap_alloc() if record offset or length is larger than node_size. - Yangtao Li corrected the error code from hfsplus_fill_super() if Catalog File contains corrupted record for the case of hidden directory's type. - KMSAN uninit-value fixes: hfs_find_set_zero_bits() and __hfsplus_ext_cache_extent() use kzalloc() instead of kmalloc(), and in hfsplus_delete_cat() by proper initialization of struct hfsplus_inode_info in the hfsplus_iget() logic. - A slab-out-of-bounds issue could happen in hfsplus_strcasecmp() if the length field of struct hfsplus_unistr is bigger than HFSPLUS_MAX_STRLEN. Fixed by checking the length of comparing strings, and if the strings' length is bigger than HFSPLUS_MAX_STRLEN, then the length is corrected to this value. - The generic/736 xfstest failed for HFS because the HFS volume becomes corrupted after the test run. The main reason was the absence of logic that corrects mdb->drNxtCNID/HFS_SB(sb)->next_id (next unused CNID) after deleting a record in Catalog File. That was fixed by implementing the necessary logic in hfs_correct_next_unused_CNID()" * tag 'hfs-v6.18-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfs/hfsplus: rework debug output subsystem hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfs: clear offset and space out of valid records in b-tree node hfs: add logic of correcting a next unused CNID hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() hfs: make proper initalization of struct hfs_find_data hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() hfs: validate record offset in hfsplus_bmap_alloc hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() MAINTAINERS: update location of hfs&hfsplus trees commit a9401710a5f5681abd2a6f21f9e76bc9f2e81891 Merge: e445fba2d76369 1b53426334c3c9 Author: Linus Torvalds Date: Mon Sep 29 14:57:08 2025 -0700 Merge tag 'v6.18-rc-part1-smb3-common' of git://git.samba.org/ksmbd Pull smb restructuring updates from Steve French: "Large set of small restructuring smbdirect related patches for cifs.ko and ksmbd.ko. This is the next step in order to use common structures for smbdirect handling across both modules. And also includes improved handling of broken connections, as well as fixed negotiation as rdma resources. Moving to common functions is planned for 6.19, as well as also providing smbdirect via sockets to userspace (e.g. for samba to also be able to use smbdirect for userspace server and userspace client tools). This was heavily reviewed and tested at the recent SMB3.1.1 test event at SDC" * tag 'v6.18-rc-part1-smb3-common' of git://git.samba.org/ksmbd: (159 commits) smb: server: let smb_direct_flush_send_list() invalidate a remote key first smb: server: make use of ib_alloc_cq_any() instead of ib_alloc_cq() smb: server: make consitent use of spin_lock_irq{save,restore}() in transport_rdma.c smb: server: let {free_transport,smb_direct_disconnect_rdma_{work,connection}}() wake up all wait queues smb: server: let smb_direct_disconnect_rdma_connection() disable all work but disconnect_work smb: server: fill in smbdirect_socket.first_error on error smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smb: server: pass struct smbdirect_socket to smb_direct_send_negotiate_response() smb: server: pass struct smbdirect_socket to {enqueue,get_first}_reassembly() smb: server: pass struct smbdirect_socket to smb_direct_post_send_data() smb: server: pass struct smbdirect_socket to post_sendmsg() smb: server: pass struct smbdirect_socket to smb_direct_create_header() smb: server: pass struct smbdirect_socket to manage_keep_alive_before_sending() smb: server: pass struct smbdirect_socket to manage_credits_prior_sending() smb: server: pass struct smbdirect_socket to calc_rw_credits() smb: server: pass struct smbdirect_socket to wait_for_rw_credits() smb: server: pass struct smbdirect_socket to wait_for_send_credits() smb: server: pass struct smbdirect_socket to wait_for_credits() smb: server: pass struct smbdirect_socket to smb_direct_flush_send_list() smb: server: pass struct smbdirect_socket to smb_direct_post_send() ... commit 98a4f5b7359205ced1b6a626df3963bf7c5e5052 Author: Jani Nurminen Date: Fri Sep 12 11:09:48 2025 +0200 PCI: xilinx-nwl: Fix ECAM programming When PCIe has been set up by the bootloader, the ecam_size field in the E_ECAM_CONTROL register already contains a value. The driver previously programmed it to 0xc (for 16 busses; 16 MB), but bumped to 0x10 (for 256 busses; 256 MB) by the commit 2fccd11518f1 ("PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses"). Regardless of what the bootloader has programmed, the driver ORs in a new maximal value without doing a proper RMW sequence. This can lead to problems. For example, if the bootloader programs in 0xc and the driver uses 0x10, the ORed result is 0x1c, which is beyond the ecam_max_size limit of 0x10 (from E_ECAM_CAPABILITIES). Avoid the problems by doing a proper RMW. Fixes: 2fccd11518f1 ("PCI: xilinx-nwl: Modify ECAM size to enable support for 256 buses") Signed-off-by: Jani Nurminen [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/e83a2af2-af0b-4670-bcf5-ad408571c2b0@windriver.com commit e445fba2d76369d72b497ecadf6b9787930693d9 Merge: a40eb50a956631 c91d38b57f2c47 Author: Linus Torvalds Date: Mon Sep 29 14:35:44 2025 -0700 Merge tag 'xfs-merge-6.18' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "For this merge window, there are really no new features, but there are a few things worth to emphasize: - Deprecated for years already, the (no)attr2 and (no)ikeep mount options have been removed for good - Several cleanups (specially from typedefs) and bug fixes - Improvements made in the online repair reap calculations - online fsck is now enabled by default" * tag 'xfs-merge-6.18' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (53 commits) xfs: rework datasync tracking and execution xfs: rearrange code in xfs_inode_item_precommit xfs: scrub: use kstrdup_const() for metapath scan setups xfs: use bt_nr_sectors in xfs_dax_translate_range xfs: track the number of blocks in each buftarg xfs: constify xfs_errortag_random_default xfs: improve default maximum number of open zones xfs: improve zone statistics message xfs: centralize error tag definitions xfs: remove pointless externs in xfs_error.h xfs: remove the expr argument to XFS_TEST_ERROR xfs: remove xfs_errortag_set xfs: remove xfs_errortag_get xfs: move the XLOG_REG_ constants out of xfs_log_format.h xfs: adjust the hint based zone allocation policy xfs: refactor hint based zone allocation fs: add an enum for number of life time hints xfs: fix log CRC mismatches between i386 and other architectures xfs: rename the old_crc variable in xlog_recover_process xfs: remove the unused xfs_log_iovec_t typedef ... commit a40eb50a9566318a138b3e222fc4fe04e3932cda Merge: f2c61db29f277b 28c4d9bc070895 Author: Linus Torvalds Date: Mon Sep 29 14:28:50 2025 -0700 Merge tag 'gfs2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Partially revert "gfs2: do_xmote fixes" to ignore dlm_lock() errors during withdraw; passing on those errors doesn't help - Change the LM_FLAG_TRY and LM_FLAG_TRY_1CB logic in add_to_queue() to check if the holder would actually block - Move some more dlm specific code from glock.c to lock_dlm.c - Remove the unused dlm alternate locking mode code - Add proper locking to make sure that dlm lockspaces are never used after being released - Various other cleanups * tag 'gfs2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Fix unlikely race in gdlm_put_lock gfs2: Add proper lockspace locking gfs2: Minor run_queue fixes gfs2: run_queue cleanup gfs2: Simplify do_promote gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote gfs2: Remove duplicate check in do_xmote gfs2: Fix LM_FLAG_TRY* logic in add_to_queue gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code gfs2: Further sanitize lock_dlm.c gfs2: Do not use atomic operations unnecessarily gfs2: Sanitize gfs2_meta_check, gfs2_metatype_check, gfs2_io_error gfs2: Turn gfs2_withdraw into a void function gfs2: Partially revert "gfs2: do_xmote fixes" gfs2: Simplify refcounting in do_xmote gfs2: do_xmote cleanup gfs2: Remove space before newline gfs2: Remove unused sd_withdraw_wait field gfs2: Remove unused GIF_FREE_VFS_INODE flag commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 Author: Duoming Zhou Date: Sat Sep 20 21:42:01 2025 +0800 scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) mvs_pci_remove() | mvs_free() | mvs_work_queue() cancel_delayed_work() | kfree(mvi) | | mvi-> // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated. This bug was found by static analysis. Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes") Signed-off-by: Duoming Zhou Signed-off-by: Martin K. Petersen commit 0ba7a254afd037cfc2b656f379c54b43c6e574e8 Author: Marek Szyprowski Date: Mon Sep 29 13:27:30 2025 +0200 scsi: ufs: core: Fix PM QoS mutex initialization hba->pm_qos_mutex is used very early as a part of ufshcd_init(), so it need to be initialized before that call. This fixes the following warning: ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:577 at __mutex_lock+0x268/0x894, CPU#4: kworker/u32:4/72 Modules linked in: CPU: 4 UID: 0 PID: 72 Comm: kworker/u32:4 Not tainted 6.17.0-rc7-next-20250926+ #11223 PREEMPT Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0x268/0x894 lr : __mutex_lock+0x268/0x894 ... Call trace: __mutex_lock+0x268/0x894 (P) mutex_lock_nested+0x24/0x30 ufshcd_pm_qos_update+0x30/0x78 ufshcd_setup_clocks+0x2d4/0x3c4 ufshcd_init+0x234/0x126c ufshcd_pltfrm_init+0x62c/0x82c ufs_qcom_probe+0x20/0x58 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0x40/0x164 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x80/0xdc __device_attach+0xa8/0x1b0 device_initial_probe+0x14/0x20 bus_probe_device+0xb0/0xb4 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x208/0x60c worker_thread+0x244/0x388 kthread+0x150/0x228 ret_from_fork+0x10/0x20 irq event stamp: 57267 hardirqs last enabled at (57267): [] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (57266): [] clk_enable_lock+0x7c/0xf0 softirqs last enabled at (56270): [] handle_softirqs+0x4c4/0x4dc softirqs last disabled at (56265): [] __do_softirq+0x14/0x20 ---[ end trace 0000000000000000 ]--- Fixes: 79dde5f7dc7c ("scsi: ufs: core: Fix data race in CPU latency PM QoS request handling") Signed-off-by: Marek Szyprowski Reviewed-by: Bart Van Assche Message-Id: <20250929112730.3782765-1-m.szyprowski@samsung.com> Signed-off-by: Martin K. Petersen commit f966e02ae52192928d544262ee7a68611e333031 Author: Peter Wang Date: Fri Sep 26 09:29:26 2025 +0800 scsi: ufs: core: Fix runtime suspend error deadlock Resolve the deadlock issue during runtime suspend when an error triggers the error handler. Prevent the deadlock by checking pm_op_in_progress and performing a quick recovery. This approach ensures that the error handler does not wait indefinitely for runtime PM to resume, allowing runtime suspend to proceed smoothly. Signed-off-by: Peter Wang Suggested-by: Bart Van Assche Reviewed-by: Bart Van Assche Message-Id: <20250926012940.3933367-1-peter.wang@mediatek.com> Signed-off-by: Martin K. Petersen commit f2c61db29f277b9c80de92102fc532cc247495cd Author: Linus Torvalds Date: Mon Sep 29 13:43:52 2025 -0700 Remove bcachefs core code bcachefs was marked 'externally maintained' in 6.17 but the code remained to make the transition smoother. It's now a DKMS module, making the in-kernel code stale, so remove it to avoid any version confusion. Link: https://lore.kernel.org/linux-bcachefs/yokpt2d2g2lluyomtqrdvmkl3amv3kgnipmenobkpgx537kay7@xgcgjviv3n7x/T/ Signed-off-by: Linus Torvalds commit 285654d58a747eb431ee538c803c077d90525674 Author: John Meneghini Date: Thu Sep 25 09:07:29 2025 -0400 Revert "scsi: qla2xxx: Fix memcpy() field-spanning write issue" This reverts commit 6f4b10226b6b1e7d1ff3cdb006cf0f6da6eed71e. We've been testing this patch and it turns out there is a significant bug here. This leaks memory and causes a driver hang. Link: https://lore.kernel.org/linux-scsi/yq1zfajqpec.fsf@ca-mkp.ca.oracle.com/ Signed-off-by: John Meneghini Acked-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen commit ee916dccd4df6e2fd19c3606c4735282b72f1473 Author: Linus Torvalds Date: Mon Sep 29 12:24:20 2025 -0700 Unbreak 'make tools/*' for user-space targets This pattern isn't very documented, and apparently not used much outside of 'make tools/help', but it has existed for over a decade (since commit ea01fa9f63ae: "tools: Connect to the kernel build system"). However, it doesn't work very well for most cases, particularly the useful "tools/all" target, because it overrides the LDFLAGS value with an empty one. And once overridden, 'make' will then not honor the tooling makefiles trying to change it - which then makes any LDFLAGS use in the tooling directory break, typically causing odd link errors. Remove that LDFLAGS override, since it seems to be entirely historical. The core kernel makefiles no longer modify LDFLAGS as part of the build, and use kernel-specific link flags instead (eg 'KBUILD_LDFLAGS' and friends). This allows more of the 'make tools/*' cases to work. I say 'more', because some of the tooling build rules make various other assumptions or have other issues, so it's still a bit hit-or-miss. But those issues tend to show up with the 'make -C tools xyz' pattern too, so now it's no longer an issue of this particular 'tools/*' build rule being special. Acked-by: Nathan Chancellor Cc: Nicolas Schier Cc: Borislav Petkov Signed-off-by: Linus Torvalds commit 29be241d11748dbcd9981587a85afa734942c885 Author: Markus Heidelberg Date: Fri Sep 26 15:15:20 2025 +0200 docs: networking: phy: clarify abbreviation "PAL" It is suddenly used in the text without introduction, so the meaning might have been unclear to readers. Signed-off-by: Markus Heidelberg Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250926131520.222346-1-m.heidelberg@cab.de Signed-off-by: Jakub Kicinski commit 2804359536275d8d5f92eb1949102eca4153ea1e Author: Markus Heidelberg Date: Fri Sep 26 15:13:23 2025 +0200 net: ethtool: remove duplicated mm.o from Makefile Fixes: 2b30f8291a30 ("net: ethtool: add support for MAC Merge layer") Signed-off-by: Markus Heidelberg Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250926131323.222192-1-m.heidelberg@cab.de Signed-off-by: Jakub Kicinski commit 449c2b302c8e200558619821ced46cc13cdb9aa6 Merge: 263e777ee3e00d 4f5ea5aa0dcdd3 Author: Linus Torvalds Date: Mon Sep 29 11:55:15 2025 -0700 Merge tag 'vfs-6.18-rc1.async' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs async directory updates from Christian Brauner: "This contains further preparatory changes for the asynchronous directory locking scheme: - Add lookup_one_positive_killable() which allows overlayfs to perform lookup that won't block on a fatal signal - Unify the mount idmap handling in struct renamedata as a rename can only happen within a single mount - Introduce kern_path_parent() for audit which sets the path to the parent and returns a dentry for the target without holding any locks on return - Rename kern_path_locked() as it is only used to prepare for the removal of an object from the filesystem: kern_path_locked() => start_removing_path() kern_path_create() => start_creating_path() user_path_create() => start_creating_user_path() user_path_locked_at() => start_removing_user_path_at() done_path_create() => end_creating_path() NA => end_removing_path()" * tag 'vfs-6.18-rc1.async' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: debugfs: rename start_creating() to debugfs_start_creating() VFS: rename kern_path_locked() and related functions. VFS/audit: introduce kern_path_parent() for audit VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata VFS: discard err2 in filename_create() VFS/ovl: add lookup_one_positive_killable() commit 263e777ee3e00d628ac2660f68c82aeab14707b3 Merge: 18b19abc3709b1 9426414f0d42f8 Author: Linus Torvalds Date: Mon Sep 29 11:34:40 2025 -0700 Merge tag 'vfs-6.18-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs writeback updates from Christian Brauner: "This contains work adressing lockups reported by users when a systemd unit reading lots of files from a filesystem mounted with the lazytime mount option exits. With the lazytime mount option enabled we can be switching many dirty inodes on cgroup exit to the parent cgroup. The numbers observed in practice when systemd slice of a large cron job exits can easily reach hundreds of thousands or millions. The logic in inode_do_switch_wbs() which sorts the inode into appropriate place in b_dirty list of the target wb however has linear complexity in the number of dirty inodes thus overall time complexity of switching all the inodes is quadratic leading to workers being pegged for hours consuming 100% of the CPU and switching inodes to the parent wb. Simple reproducer of the issue: FILES=10000 # Filesystem mounted with lazytime mount option MNT=/mnt/ echo "Creating files and switching timestamps" for (( j = 0; j < 50; j ++ )); do mkdir $MNT/dir$j for (( i = 0; i < $FILES; i++ )); do echo "foo" >$MNT/dir$j/file$i done touch -a -t 202501010000 $MNT/dir$j/file* done wait echo "Syncing and flushing" sync echo 3 >/proc/sys/vm/drop_caches echo "Reading all files from a cgroup" mkdir /sys/fs/cgroup/unified/mycg1 || exit echo $$ >/sys/fs/cgroup/unified/mycg1/cgroup.procs || exit for (( j = 0; j < 50; j ++ )); do cat /mnt/dir$j/file* >/dev/null & done wait echo "Switching wbs" # Now rmdir the cgroup after the script exits This can be solved by: - Avoiding contention on the wb->list_lock when switching inodes by running a single work item per wb and managing a queue of items switching to the wb - Allowing rescheduling when switching inodes over to a different cgroup to avoid softlockups - Maintaining the b_dirty list ordering instead of sorting it" * tag 'vfs-6.18-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: writeback: Add tracepoint to track pending inode switches writeback: Avoid excessively long inode switching times writeback: Avoid softlockup when switching many inodes writeback: Avoid contention on wb->list_lock when switching inodes commit 18b19abc3709b109676ffd1f48dcd332c2e477d4 Merge: 5484a4ea7a1f20 6e65f4e8fc5b02 Author: Linus Torvalds Date: Mon Sep 29 11:20:29 2025 -0700 Merge tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: "This contains a larger set of changes around the generic namespace infrastructure of the kernel. Each specific namespace type (net, cgroup, mnt, ...) embedds a struct ns_common which carries the reference count of the namespace and so on. We open-coded and cargo-culted so many quirks for each namespace type that it just wasn't scalable anymore. So given there's a bunch of new changes coming in that area I've started cleaning all of this up. The core change is to make it possible to correctly initialize every namespace uniformly and derive the correct initialization settings from the type of the namespace such as namespace operations, namespace type and so on. This leaves the new ns_common_init() function with a single parameter which is the specific namespace type which derives the correct parameters statically. This also means the compiler will yell as soon as someone does something remotely fishy. The ns_common_init() addition also allows us to remove ns_alloc_inum() and drops any special-casing of the initial network namespace in the network namespace initialization code that Linus complained about. Another part is reworking the reference counting. The reference counting was open-coded and copy-pasted for each namespace type even though they all followed the same rules. This also removes all open accesses to the reference count and makes it private and only uses a very small set of dedicated helpers to manipulate them just like we do for e.g., files. In addition this generalizes the mount namespace iteration infrastructure introduced a few cycles ago. As reminder, the vfs makes it possible to iterate sequentially and bidirectionally through all mount namespaces on the system or all mount namespaces that the caller holds privilege over. This allow userspace to iterate over all mounts in all mount namespaces using the listmount() and statmount() system call. Each mount namespace has a unique identifier for the lifetime of the systems that is exposed to userspace. The network namespace also has a unique identifier working exactly the same way. This extends the concept to all other namespace types. The new nstree type makes it possible to lookup namespaces purely by their identifier and to walk the namespace list sequentially and bidirectionally for all namespace types, allowing userspace to iterate through all namespaces. Looking up namespaces in the namespace tree works completely locklessly. This also means we can move the mount namespace onto the generic infrastructure and remove a bunch of code and members from struct mnt_namespace itself. There's a bunch of stuff coming on top of this in the future but for now this uses the generic namespace tree to extend a concept introduced first for pidfs a few cycles ago. For a while now we have supported pidfs file handles for pidfds. This has proven to be very useful. This extends the concept to cover namespaces as well. It is possible to encode and decode namespace file handles using the common name_to_handle_at() and open_by_handle_at() apis. As with pidfs file handles, namespace file handles are exhaustive, meaning it is not required to actually hold a reference to nsfs in able to decode aka open_by_handle_at() a namespace file handle. Instead the FD_NSFS_ROOT constant can be passed which will let the kernel grab a reference to the root of nsfs internally and thus decode the file handle. Namespaces file descriptors can already be derived from pidfds which means they aren't subject to overmount protection bugs. IOW, it's irrelevant if the caller would not have access to an appropriate /proc//ns/ directory as they could always just derive the namespace based on a pidfd already. It has the same advantage as pidfds. It's possible to reliably and for the lifetime of the system refer to a namespace without pinning any resources and to compare them trivially. Permission checking is kept simple. If the caller is located in the namespace the file handle refers to they are able to open it otherwise they must hold privilege over the owning namespace of the relevant namespace. The namespace file handle layout is exposed as uapi and has a stable and extensible format. For now it simply contains the namespace identifier, the namespace type, and the inode number. The stable format means that userspace may construct its own namespace file handles without going through name_to_handle_at() as they are already allowed for pidfs and cgroup file handles" * tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (65 commits) ns: drop assert ns: move ns type into struct ns_common nstree: make struct ns_tree private ns: add ns_debug() ns: simplify ns_common_init() further cgroup: add missing ns_common include ns: use inode initializer for initial namespaces selftests/namespaces: verify initial namespace inode numbers ns: rename to __ns_ref nsfs: port to ns_ref_*() helpers net: port to ns_ref_*() helpers uts: port to ns_ref_*() helpers ipv4: use check_net() net: use check_net() net-sysfs: use check_net() user: port to ns_ref_*() helpers time: port to ns_ref_*() helpers pid: port to ns_ref_*() helpers ipc: port to ns_ref_*() helpers cgroup: port to ns_ref_*() helpers ... commit cfcd6cab2f33c24a68517f9e3131480b4000c2be Author: Alok Tiwari Date: Fri Sep 5 14:14:34 2025 -0700 PCI: j721e: Fix incorrect error message in probe() The probe() function prints "pm_runtime_get_sync failed" when j721e_pcie_ctrl_init() returns an error. This is misleading since the failure is not from pm_runtime, but from the controller init routine. Update the error message to correctly reflect the source. No functional changes. Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver") Signed-off-by: Alok Tiwari Signed-off-by: Manivannan Sadhasivam Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com commit 5484a4ea7a1f208b886b58dd55cc55f418930f8a Merge: 722df25ddf4f13 a19239ba14525c Author: Linus Torvalds Date: Mon Sep 29 10:53:22 2025 -0700 Merge tag 'vfs-6.18-rc1.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull afs updates from Christian Brauner: "This contains the change to enable afs to support RENAME_NOREPLACE and RENAME_EXCHANGE if the server supports it" * tag 'vfs-6.18-rc1.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: afs: Add support for RENAME_NOREPLACE and RENAME_EXCHANGE commit 722df25ddf4f13e303dcc4cd65b3df5b197a79e6 Merge: b7864056850879 76cea30ad52023 Author: Linus Torvalds Date: Mon Sep 29 10:36:50 2025 -0700 Merge tag 'kernel-6.18-rc1.clone3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull copy_process updates from Christian Brauner: "This contains the changes to enable support for clone3() on nios2 which apparently is still a thing. The more exciting part of this is that it cleans up the inconsistency in how the 64-bit flag argument is passed from copy_process() into the various other copy_*() helpers" [ Fixed up rv ltl_monitor 32-bit support as per Sasha Levin in the merge ] * tag 'kernel-6.18-rc1.clone3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nios2: implement architecture-specific portion of sys_clone3 arch: copy_thread: pass clone_flags as u64 copy_process: pass clone_flags as u64 across calltree copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) commit b786405685087912601e24d94c1670523c829137 Merge: df897265c0c6fc 56ce6c8b11a95c Author: Linus Torvalds Date: Mon Sep 29 10:27:17 2025 -0700 Merge tag 'vfs-6.18-rc1.workqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs workqueue updates from Christian Brauner: "This contains various workqueue changes affecting the filesystem layer. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This replaces the use of system_wq and system_unbound_wq. system_wq is a per-CPU workqueue which isn't very obvious from the name and system_unbound_wq is to be used when locality is not required. So this renames system_wq to system_percpu_wq, and system_unbound_wq to system_dfl_wq. This also adds a new WQ_PERCPU flag to allow the fs subsystem users to explicitly request the use of per-CPU behavior. Both WQ_UNBOUND and WQ_PERCPU flags coexist for one release cycle to allow callers to transition their calls. WQ_UNBOUND will be removed in a next release cycle" * tag 'vfs-6.18-rc1.workqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: WQ_PERCPU added to alloc_workqueue users fs: replace use of system_wq with system_percpu_wq fs: replace use of system_unbound_wq with system_dfl_wq commit df897265c0c6fc4b758b07f3a756e96b6f2ab81f Merge: e571372101522f c37adf34a5dc51 Author: Linus Torvalds Date: Mon Sep 29 10:23:02 2025 -0700 Merge tag 'vfs-6.18-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs rust updates from Christian Brauner: "This contains a few minor vfs rust changes: - Add the pid namespace Rust wrappers to the correct MAINTAINERS entry - Use to_result() in the Rust file error handling code - Update imports for fs and pid_namespce Rust wrappers" * tag 'vfs-6.18-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: rust: file: use to_result for error handling pid: add Rust files to MAINTAINERS rust: fs: update ARef and AlwaysRefCounted imports from sync::aref rust: pid_namespace: update AlwaysRefCounted imports from sync::aref commit e571372101522fa91735dac6d30a160b2abe600c Merge: 029a4eb5891294 da664c6db895f7 Author: Linus Torvalds Date: Mon Sep 29 10:02:35 2025 -0700 Merge tag 'vfs-6.18-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: "This just contains a few changes to pid_nr_ns() to make it more robust and cleans up or improves a few users that ab- or misuse it currently" * tag 'vfs-6.18-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: change task_state() to use task_ppid_nr_ns() pid: change bacct_add_tsk() to use task_ppid_nr_ns() pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers pid: Add a judgment for ns null in pid_nr_ns commit 029a4eb589129450f2735df825f784dd7e8c4c63 Merge: 56e7b310717697 c59c965292f75e Author: Linus Torvalds Date: Mon Sep 29 09:52:14 2025 -0700 Merge tag 'vfs-6.18-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs iomap updates from Christian Brauner: "This contains minor fixes and cleanups to the iomap code. Nothing really stands out here" * tag 'vfs-6.18-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: error out on file IO when there is no inline_data buffer iomap: trace iomap_zero_iter zeroing activities commit 56e7b310717697109998966cb3c4d3e490d09200 Merge: 3a2a5b278fb8d4 c3c616c53dbabd Author: Linus Torvalds Date: Mon Sep 29 09:42:30 2025 -0700 Merge tag 'vfs-6.18-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs inode updates from Christian Brauner: "This contains a series I originally wrote and that Eric brought over the finish line. It moves out the i_crypt_info and i_verity_info pointers out of 'struct inode' and into the fs-specific part of the inode. So now the few filesytems that actually make use of this pay the price in their own private inode storage instead of forcing it upon every user of struct inode. The pointer for the crypt and verity info is simply found by storing an offset to its address in struct fsverity_operations and struct fscrypt_operations. This shrinks struct inode by 16 bytes. I hope to move a lot more out of it in the future so that struct inode becomes really just about very core stuff that we need, much like struct dentry and struct file, instead of the dumping ground it has become over the years. On top of this are a various changes associated with the ongoing inode lifetime handling rework that multiple people are pushing forward: - Stop accessing inode->i_count directly in f2fs and gfs2. They simply should use the __iget() and iput() helpers - Make the i_state flags an enum - Rework the iput() logic Currently, if we are the last iput, and we have the I_DIRTY_TIME bit set, we will grab a reference on the inode again and then mark it dirty and then redo the put. This is to make sure we delay the time update for as long as possible We can rework this logic to simply dec i_count if it is not 1, and if it is do the time update while still holding the i_count reference Then we can replace the atomic_dec_and_lock with locking the ->i_lock and doing atomic_dec_and_test, since we did the atomic_add_unless above - Add an icount_read() helper and convert everyone that accesses inode->i_count directly for this purpose to use the helper - Expand dump_inode() to dump more information about an inode helping in debugging - Add some might_sleep() annotations to iput() and associated helpers" * tag 'vfs-6.18-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: add might_sleep() annotation to iput() and more fs: expand dump_inode() inode: fix whitespace issues fs: add an icount_read helper fs: rework iput logic fs: make the i_state flags an enum fs: stop accessing ->i_count directly in f2fs and gfs2 fsverity: check IS_VERITY() in fsverity_cleanup_inode() fs: remove inode::i_verity_info btrfs: move verity info pointer to fs-specific part of inode f2fs: move verity info pointer to fs-specific part of inode ext4: move verity info pointer to fs-specific part of inode fsverity: add support for info in fs-specific part of inode fs: remove inode::i_crypt_info ceph: move crypt info pointer to fs-specific part of inode ubifs: move crypt info pointer to fs-specific part of inode f2fs: move crypt info pointer to fs-specific part of inode ext4: move crypt info pointer to fs-specific part of inode fscrypt: add support for info in fs-specific part of inode fscrypt: replace raw loads of info pointer with helper function commit 3a2a5b278fb8d4cdb3154b8e4a38352b945f96fd Merge: 6c7ca6a02f8f95 1e5f0fb41fccf5 Author: Linus Torvalds Date: Mon Sep 29 09:32:34 2025 -0700 Merge tag 'vfs-6.18-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: "This contains some work around mount api handling: - Output the warning message for mnt_too_revealing() triggered during fsmount() to the fscontext log. This makes it possible for the mount tool to output appropriate warnings on the command line. For example, with the newest fsopen()-based mount(8) from util-linux, the error messages now look like: # mount -t proc proc /tmp mount: /tmp: fsmount() failed: VFS: Mount too revealing. dmesg(1) may have more information after failed mount system call. - Do not consume fscontext log entries when returning -EMSGSIZE Userspace generally expects APIs that return -EMSGSIZE to allow for them to adjust their buffer size and retry the operation. However, the fscontext log would previously clear the message even in the -EMSGSIZE case. Given that it is very cheap for us to check whether the buffer is too small before we remove the message from the ring buffer, let's just do that instead. - Drop an unused argument from do_remount()" * tag 'vfs-6.18-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: fs/namespace.c: remove ms_flags argument from do_remount selftests/filesystems: add basic fscontext log tests fscontext: do not consume log entries when returning -EMSGSIZE vfs: output mount_too_revealing() errors to fscontext docs/vfs: Remove mentions to the old mount API helpers fscontext: add custom-prefix log helpers fs: Remove mount_bdev fs: Remove mount_nodev commit e51d05f523e43ce5d2bad957943a2b14f68078cd Author: Siddharth Vadapalli Date: Fri Sep 12 15:37:58 2025 +0530 PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit Commit under Fixes introduced the IRQ handler for "ks-pcie-error-irq". The interrupt is acquired using "request_irq()" but is never freed if the driver exits due to an error. Although the section in the driver that invokes "request_irq()" has moved around over time, the issue hasn't been addressed until now. Fix this by using "devm_request_irq()" which automatically frees the interrupt if the driver exits. Fixes: 025dd3daeda7 ("PCI: keystone: Add error IRQ handler") Reported-by: Jiri Slaby Closes: https://lore.kernel.org/r/3d3a4b52-e343-42f3-9d69-94c259812143@kernel.org Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250912100802.3136121-2-s-vadapalli@ti.com commit 6c7ca6a02f8f9549a438a08a23c6327580ecf3d6 Author: Christian Brauner Date: Mon Sep 29 11:41:16 2025 +0200 mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. Handle that case gracefully. Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds commit b7ce6fa90fd9554482847b19756a06232c1dc78c Merge: fde0ab43b9a30d 28986dd7e38fb5 Author: Linus Torvalds Date: Mon Sep 29 09:03:07 2025 -0700 Merge tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "This contains the usual selections of misc updates for this cycle. Features: - Add "initramfs_options" parameter to set initramfs mount options. This allows to add specific mount options to the rootfs to e.g., limit the memory size - Add RWF_NOSIGNAL flag for pwritev2() Add RWF_NOSIGNAL flag for pwritev2. This flag prevents the SIGPIPE signal from being raised when writing on disconnected pipes or sockets. The flag is handled directly by the pipe filesystem and converted to the existing MSG_NOSIGNAL flag for sockets - Allow to pass pid namespace as procfs mount option Ever since the introduction of pid namespaces, procfs has had very implicit behaviour surrounding them (the pidns used by a procfs mount is auto-selected based on the mounting process's active pidns, and the pidns itself is basically hidden once the mount has been constructed) This implicit behaviour has historically meant that userspace was required to do some special dances in order to configure the pidns of a procfs mount as desired. Examples include: * In order to bypass the mnt_too_revealing() check, Kubernetes creates a procfs mount from an empty pidns so that user namespaced containers can be nested (without this, the nested containers would fail to mount procfs) But this requires forking off a helper process because you cannot just one-shot this using mount(2) * Container runtimes in general need to fork into a container before configuring its mounts, which can lead to security issues in the case of shared-pidns containers (a privileged process in the pidns can interact with your container runtime process) While SUID_DUMP_DISABLE and user namespaces make this less of an issue, the strict need for this due to a minor uAPI wart is kind of unfortunate Things would be much easier if there was a way for userspace to just specify the pidns they want. So this pull request contains changes to implement a new "pidns" argument which can be set using fsconfig(2): fsconfig(procfd, FSCONFIG_SET_FD, "pidns", NULL, nsfd); fsconfig(procfd, FSCONFIG_SET_STRING, "pidns", "/proc/self/ns/pid", 0); or classic mount(2) / mount(8): // mount -t proc -o pidns=/proc/self/ns/pid proc /tmp/proc mount("proc", "/tmp/proc", "proc", MS_..., "pidns=/proc/self/ns/pid"); Cleanups: - Remove the last references to EXPORT_OP_ASYNC_LOCK - Make file_remove_privs_flags() static - Remove redundant __GFP_NOWARN when GFP_NOWAIT is used - Use try_cmpxchg() in start_dir_add() - Use try_cmpxchg() in sb_init_done_wq() - Replace offsetof() with struct_size() in ioctl_file_dedupe_range() - Remove vfs_ioctl() export - Replace rwlock() with spinlock in epoll code as rwlock causes priority inversion on preempt rt kernels - Make ns_entries in fs/proc/namespaces const - Use a switch() statement() in init_special_inode() just like we do in may_open() - Use struct_size() in dir_add() in the initramfs code - Use str_plural() in rd_load_image() - Replace strcpy() with strscpy() in find_link() - Rename generic_delete_inode() to inode_just_drop() and generic_drop_inode() to inode_generic_drop() - Remove unused arguments from fcntl_{g,s}et_rw_hint() Fixes: - Document @name parameter for name_contains_dotdot() helper - Fix spelling mistake - Always return zero from replace_fd() instead of the file descriptor number - Limit the size for copy_file_range() in compat mode to prevent a signed overflow - Fix debugfs mount options not being applied - Verify the inode mode when loading it from disk in minixfs - Verify the inode mode when loading it from disk in cramfs - Don't trigger automounts with RESOLVE_NO_XDEV If openat2() was called with RESOLVE_NO_XDEV it didn't traverse through automounts, but could still trigger them - Add FL_RECLAIM flag to show_fl_flags() macro so it appears in tracepoints - Fix unused variable warning in rd_load_image() on s390 - Make INITRAMFS_PRESERVE_MTIME depend on BLK_DEV_INITRD - Use ns_capable_noaudit() when determining net sysctl permissions - Don't call path_put() under namespace semaphore in listmount() and statmount()" * tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits) fcntl: trim arguments listmount: don't call path_put() under namespace semaphore statmount: don't call path_put() under namespace semaphore pid: use ns_capable_noaudit() when determining net sysctl permissions fs: rename generic_delete_inode() and generic_drop_inode() init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD initramfs: Replace strcpy() with strscpy() in find_link() initrd: Use str_plural() in rd_load_image() initramfs: Use struct_size() helper to improve dir_add() initrd: Fix unused variable warning in rd_load_image() on s390 fs: use the switch statement in init_special_inode() fs/proc/namespaces: make ns_entries const filelock: add FL_RECLAIM to show_fl_flags() macro eventpoll: Replace rwlock with spinlock selftests/proc: add tests for new pidns APIs procfs: add "pidns" mount option pidns: move is-ancestor logic to helper openat2: don't trigger automounts with RESOLVE_NO_XDEV namei: move cross-device check to __traverse_mounts namei: remove LOOKUP_NO_XDEV check from handle_mounts ... commit 362f84c89e136539b8c3edb47f42fb06ce37bacf Author: Johan Hovold Date: Mon Sep 22 17:31:07 2025 +0200 mtd: rawnand: sunxi: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 2f05c108664056f91e5f9171169c685f517ac568 Author: Johan Hovold Date: Mon Sep 22 17:31:06 2025 +0200 mtd: rawnand: stm32_fmc2: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 61163e7373f678c453a4505865e0f8b27e506de8 Author: Johan Hovold Date: Mon Sep 22 17:31:05 2025 +0200 mtd: rawnand: rockchip: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 1f7005d382f567b25cfb96d9f201f5448cf67f9a Author: Johan Hovold Date: Mon Sep 22 17:31:04 2025 +0200 mtd: rawnand: pl353: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit b1a5c6de97b4c861c1ad1e7ad3818ebd32be190e Author: Johan Hovold Date: Mon Sep 22 17:31:03 2025 +0200 mtd: rawnand: omap2: drop unused module alias The driver only supports OF probing since commit 086c321ec57b ("mtd: nand: omap2: Remove omap_nand_platform_data") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 7a3f3c5bdecfe3cf6cdd35073c2729a46894a34d Author: Johan Hovold Date: Mon Sep 22 17:31:02 2025 +0200 mtd: rawnand: atmel: drop unused module alias The driver only supports OF probing since commit f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit cc74c3f8e4bc01ecf9849a2b22706ba96a29f749 Author: Johan Hovold Date: Mon Sep 22 17:31:01 2025 +0200 mtd: onenand: omap2: drop unused module alias The driver only supports OF probing since commit a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 192f981c14bfad4241446544cf0d27b9fa11a7bd Author: Johan Hovold Date: Mon Sep 22 17:31:00 2025 +0200 mtd: hyperbus: hbmc-am654: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 527668868862e0db65efc88fe82040f1e48d4ab3 Author: Rahul Kumar Date: Mon Sep 22 12:41:37 2025 +0530 mtd: jedec_probe: use struct_size() helper for cfiq allocation Documentation/process/deprecated.rst recommends against performing dynamic size calculations in the arguments of memory allocator functions due to the risk of overflow. Such calculations can wrap around and result in a smaller allocation than expected. Replace the size calculation in cfiq allocation with struct_size() helper to make the code clearer and handle overflows correctly. Signed-off-by: Rahul Kumar Signed-off-by: Miquel Raynal commit d496b6f42eb0455caf5d8cb30cf1f01b7fc2a747 Author: Gopi Krishna Menon Date: Fri Sep 19 00:14:14 2025 +0530 mtd: cfi: use struct_size() helper for cfiq allocation Documentation/process/deprecated.rst recommends against performing dynamic size calculations in the arguments of memory allocator function due to the risk of overflow. Such calculations can wrap around and result in a smaller allocation than what the caller was expecting. Replace the size calculation in cfiq allocation with struct_size() helper to make the code clearer and handle the overflows correctly. Signed-off-by: Gopi Krishna Menon Reviewed-by: Vignesh Raghavendra link: https://lore.kernel.org/linux-kernel-mentees/20250922071137.900508-1-rk0006818@gmail.com/T/#u Signed-off-by: Miquel Raynal commit 1001cc1171248ebb21d371fbe086b5d3f11b410b Author: Maarten Zanders Date: Mon Sep 22 17:39:38 2025 +0200 mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N Commit f04ced6d545e ("mtd: nand: raw: gpmi: improve power management handling") moved all clock handling into PM callbacks. With CONFIG_PM disabled, those callbacks are missing, leaving the driver unusable. Add clock init/teardown for !CONFIG_PM builds to restore basic operation. Keeping the driver working without requiring CONFIG_PM is preferred over adding a Kconfig dependency. Fixes: f04ced6d545e ("mtd: nand: raw: gpmi: improve power management handling") Signed-off-by: Maarten Zanders Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal commit fa1f26b48fe43195aa0ac4badf5651063590326f Author: Johan Hovold Date: Mon Sep 22 17:22:04 2025 +0200 mtd: rawnand: omap2: fix device leak on probe failure Make sure to drop the reference to the elm device taken by of_find_device_by_node() during probe on errors and on driver unload. Fixes: 62116e5171e0 ("mtd: nand: omap2: Support for hardware BCH error correction.") Signed-off-by: Johan Hovold Signed-off-by: Miquel Raynal commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 Author: Erick Karanja Date: Mon Sep 22 14:07:27 2025 +0300 mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands In case of a jump to the err label due to atmel_nand_create() or atmel_nand_controller_add_nand() failure, the reference to nand_np need to be released Use for_each_child_of_node_scoped() to fix the issue. Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Signed-off-by: Erick Karanja Signed-off-by: Miquel Raynal commit 3148d0e5b1c5733d69ec51b70c8280e46488750a Author: Markus Stockhausen Date: Fri Sep 19 03:52:01 2025 -0400 mtd: nand: realtek-ecc: Add Realtek external ECC engine support The Realtek RTl93xx switch SoC series has a built in ECC controller that can provide BCH6 or BCH12 over 512 data and 6 tag bytes. It generates 10 (BCH6) or 20 (BCH12) bytes of parity. This engine will most likely work in conjunction with the Realtek spi-mem based NAND controller but can work on its own. Therefore the initial implementation will be of type external. Remark! The engine can support any data blocks that are multiples of 512 bytes. For now limit it to data+oob layouts that have been analyzed from existing devices. This way it keeps compatibility and pre-existing vendor data can be read. Signed-off-by: Markus Stockhausen Signed-off-by: Miquel Raynal commit 12bfcb84dc0852c97baff9ac1c0292a9db90c367 Author: Markus Stockhausen Date: Fri Sep 19 03:52:00 2025 -0400 dt-bindings: mtd: Add realtek,rtl9301-ecc Add a dtschema for the ECC engine on the Realtek RTL93xx SoCs. The engine supports BCH6 and BCH12 parity for 512 byte blocks. The hardware can make use of interrupts but this is not yet supported by the driver. From the known datasheets it is connected to the LXB (lexra bus) and propably depends on its clock. Provide an optional clock property that can describe the relation. Signed-off-by: Markus Stockhausen Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 Author: Linus Torvalds Date: Mon Sep 29 08:54:12 2025 -0700 Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with a working compiler it will fail on some architectures simply because it uses the mnemonic "jmp" for testing the inline asm. And as reported by Geert, not all architectures use that mnemonic, so the test fails spuriously on such platforms (including arm and riscv, but also several other architectures). This issue avoided any obvious test failures because the build still works thanks to falling back on the old non-asm-goto code, which just generates worse code. Just use an empty asm statement instead. Reported-and-tested-by: Geert Uytterhoeven Suggested-by: Peter Zijlstra Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17") Cc: Nathan Chancellor Cc: Thomas Gleixner Signed-off-by: Linus Torvalds commit 010dc7f2dd6a0078ade3f88f627ed5fbf45ceb94 Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:54:01 2025 +0300 mtd: spinand: repeat reading in regular mode if continuous reading fails Continuous reading may result in multiple flash pages reading in one operation. Unfortunately, not all spinand controllers support such large reading. They will read less data. Unfortunately, the operation can't be continued. In this case: * disable continuous reading on this (not good enough) spi controller * repeat reading in regular mode. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit 004f8ea0d9917398aabff7388b3bf62a84a4088b Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:54:00 2025 +0300 mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails Continuous reading may result in multiple flash pages reading in one operation. Typically only one flash page has read/written (a little bit more than 2-4 Kb), but continuous reading requires the spi controller to read up to 512 Kb in one operation without toggling CS in beetween. Roughly speaking spi controllers can be divided on 2 categories: * spi controllers without dirmap acceleration support * spi controllers with dirmap acceleration support Firt of them will have issues with continuous reading if restriction on the transfer length is implemented in the adjust_op_size() handler. Second group often supports acceleration of single page only reading. Thus enabling of continuous reading can break flash reading. This patch tries to create dirmap for continuous reading first and fallback to regular reading if spi controller refuses to create it. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit e4a0cf9f1d90e6888e5373da3314f761024f6c97 Author: Mikhail Kshevetskiy Date: Thu Sep 18 00:53:59 2025 +0300 mtd: spinand: fix direct mapping creation sizes Continuous mode is only supported for data reads, thus writing requires only single flash page mapping. Signed-off-by: Mikhail Kshevetskiy Signed-off-by: Miquel Raynal commit 99da5bf3dd6a8cb951adcace6153c34c86547811 Author: Lenny Szubowicz Date: Tue Sep 16 15:38:53 2025 -0400 efi/x86: Memory protection on EfiGcdMemoryTypeMoreReliable Check for needed memory protection changes on EFI DXE GCD memory space descriptors with type EfiGcdMemoryTypeMoreReliable in addition to EfiGcdMemoryTypeSystemMemory. This fixes a fault on entry into the decompressed kernel from the EFI stub that occurs when the memory allocated for the decompressed kernel is more reliable memory, has NX/XP set, and the kernel needs to use the EFI DXE protocol to adjust memory protections. The memory descriptors returned by the DXE protocol GetMemorySpaceDescriptor() service use a different GCD memory type to distinguish more reliable memory ranges from their conventional counterparts. This is in contrast to the EFI memory descriptors returned by the EFI GetMemoryMap() service which use the EFI_MEMORY_MORE_RELIABLE memory attributes flag to identify EFI_CONVENTIONAL_MEMORY type regions that have this additional property. Signed-off-by: Lenny Szubowicz Signed-off-by: Ard Biesheuvel commit 5c34f2b6f89ad4f31db15f9c658b597e23bacdf8 Author: Jiapeng Chong Date: Sun Sep 28 09:31:10 2025 +0800 nvdimm: Remove duplicate linux/slab.h header ./drivers/nvdimm/bus.c: linux/slab.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25516 Signed-off-by: Jiapeng Chong Signed-off-by: Ira Weiny commit d5e58ce1fb0f13a9a0845851f267ede3551cd9fe Author: Rafael J. Wysocki Date: Fri Sep 26 18:26:40 2025 +0200 PM: runtime: Drop DEFINE_FREE() for pm_runtime_put() The DEFINE_FREE() for pm_runtime_put has been superseded by recently introduced runtime PM auto-cleanup macros and its only user has been converted to using one of the new macros, so drop it. Signed-off-by: Rafael J. Wysocki Reviewed-by: Dhruva Gole Reviewed-by: Takashi Iwai Reviewed-by: Jonathan Cameron commit 8ff5aaa7b8c9fb3e66df6f440ee109d00f8d7a1b Author: Rafael J. Wysocki Date: Fri Sep 26 18:24:05 2025 +0200 PCI/sysfs: Use runtime PM guard macro for auto-cleanup Use the newly introduced pm_runtime_active_try guard to simplify the code and add the proper error handling for PM runtime resume errors. Based on an earlier patch from Takashi Iwai [1]. Link: https://patch.msgid.link/20250919163147.4743-3-tiwai@suse.de [1] Acked-by: Bjorn Helgaas Signed-off-by: Rafael J. Wysocki Reviewed-by: Takashi Iwai Reviewed-by: Jonathan Cameron commit 9a0abc39450a3123fd52533a662fbd37e0d1508c Author: Rafael J. Wysocki Date: Fri Sep 26 17:47:14 2025 +0200 PM: runtime: Add auto-cleanup macros for "resume and get" operations It is generally useful to be able to automatically drop a device's runtime PM usage counter incremented by runtime PM operations that resume a device and bump up its usage counter [1]. To that end, add guard definition macros allowing pm_runtime_put() and pm_runtime_put_autosuspend() to be used for the auto-cleanup in those cases. Simply put, a piece of code like below: pm_runtime_get_sync(dev); ..... pm_runtime_put(dev); return 0; can be transformed with guard() like: guard(pm_runtime_active)(dev); ..... return 0; (see the pm_runtime_put() call is gone). However, it is better to do proper error handling in the majority of cases, so doing something like this instead of the above is recommended: ACQUIRE(pm_runtime_active_try, pm)(dev); if (ACQUIRE_ERR(pm_runtime_active_try, &pm)) return -ENXIO; ..... return 0; In all of the cases in which runtime PM is known to be enabled for the given device or the device can be regarded as operational (and so it can be accessed) with runtime PM disabled, a piece of code like: ret = pm_runtime_resume_and_get(dev); if (ret < 0) return ret; ..... pm_runtime_put(dev); return 0; can be changed as follows: ACQUIRE(pm_runtime_active_try, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_try, &pm); if (ret < 0) return ret; ..... return 0; (again, see the pm_runtime_put() call is gone). Still, if the device cannot be accessed unless runtime PM has been enabled for it, the pm_runtime_active_try_enabled guard variant needs to be used, that is (in the context of the example above): ACQUIRE(pm_runtime_active_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; When the original code calls pm_runtime_put_autosuspend(), use one of the "auto" guard variants, pm_runtime_active_auto/_try/_enabled, so for example, a piece of code like: ret = pm_runtime_resume_and_get(dev); if (ret < 0) return ret; ..... pm_runtime_put_autosuspend(dev); return 0; will become: ACQUIRE(pm_runtime_active_auto_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_auto_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; Note that the cases in which the return value of pm_runtime_get_sync() is checked can also be handled with the help of the new guard macros. For example, a piece of code like: ret = pm_runtime_get_sync(dev); if (ret < 0) { pm_runtime_put(dev); return ret; } ..... pm_runtime_put(dev); return 0; can be rewritten as: ACQUIRE(pm_runtime_active_auto_try_enabled, pm)(dev); ret = ACQUIRE_ERR(pm_runtime_active_auto_try_enabled, &pm); if (ret < 0) return ret; ..... return 0; or pm_runtime_get_active_try can be used if transparent handling of disabled runtime PM is desirable. Link: https://lore.kernel.org/linux-pm/878qimv24u.wl-tiwai@suse.de/ [1] Link: https://lore.kernel.org/linux-pm/20250926150613.000073a4@huawei.com/ Signed-off-by: Rafael J. Wysocki Acked-by: Dan Williams Reviewed-by: Takashi Iwai Link: https://patch.msgid.link/2238241.irdbgypaU6@rafael.j.wysocki [ rjw: Fixed leftovers from the previous version in the changelog ] Reviewed-by: Jonathan Cameron Reviewed-by: Dhruva Gole Signed-off-by: Rafael J. Wysocki commit c87072064bd482930a021e88c11f438e780d36de Merge: 02e9542558b8ee 7d444f50999709 39c87887606e51 b8db5517fe5265 Author: Rafael J. Wysocki Date: Mon Sep 29 15:28:51 2025 +0200 Merge branches 'acpi-apei', 'acpi-misc' and 'pnp' Merge ACPI APEI updates, a miscellaneous update related to ACPI, and a PNP update for 6.18-rc1: - Remove redundant assignments in erst_dbg_{ioctl|write}() in the ACPI APEI driver (Thorsten Blum) - Allow the ACPI APEI EINJ to handle more types of addresses than just MMIO (Jiaqi Yan) - Use str_low_high() helper in two places in the ACPI code (Chelsy Ratnawat) - Use str_plural() to simplify the PNP code (Xichao Zhao) * acpi-apei: ACPI: APEI: EINJ: Allow more types of addresses except MMIO ACPI: APEI: Remove redundant assignments in erst_dbg_{ioctl|write}() * acpi-misc: ACPI: Use str_low_high() helper in two places * pnp: PNP: isapnp: use str_plural() to simplify the code commit 02e9542558b8ee09994394cb6e06a1e4f0bf6f41 Merge: 6173176cf2fe7c 3f6b537a13c815 7a9490a1c929e0 f144bc21befdcf 4aac453deca0d9 311942ce763e21 Author: Rafael J. Wysocki Date: Mon Sep 29 15:23:52 2025 +0200 Merge branches 'acpi-thermal', 'acpi-fan', 'acpi-video', 'acpi-tad' and 'acpi-prm' Merge an ACPI thermal zone driver update, an ACPI fan driver update, an ACPI backlight (video) driver update, an ACPI TAD (time and alarm device) driver update, and an ACPI PRM (platform runtime mechanism) driver update for 6.18-rc1: - Eliminate a dummy local variable from the ACPI thermal driver (Rafael Wysocki) - Fold two simple functions into their only caller in the ACPI fan driver (Rafael Wysocki) - Force native backlight on Lenovo 82K8 in the ACPI backlight (video) driver (Mario Limonciello) - Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang) - Skip PRM handlers with NULL handler_address or NULL VA in the ACPI PRM driver (Shang song) * acpi-thermal: ACPI: thermal: Get rid of a dummy local variable * acpi-fan: ACPI: fan: Fold two simple functions into their only caller * acpi-video: ACPI: video: force native for Lenovo 82K8 * acpi-tad: ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT * acpi-prm: ACPI: PRM: Skip handlers with NULL handler_address or NULL VA commit 6173176cf2fe7c518e2b112359c98c145acd59d6 Merge: be61a778185f4f 0f83b1d436c980 3a351de0d9c86e 0467ed880a17c2 4d330fe54145ec Author: Rafael J. Wysocki Date: Mon Sep 29 15:14:29 2025 +0200 Merge branches 'acpi-property', 'acpi-resource', 'acpi-pm' and 'acpi-tables' Merge updates of the ACPI device properties management code, ACPI resources management code, ACPI power management, and ACPI data tables parsing code for 6.18-rc1: - Fix ACPI buffer properties extraction for data-only subnodes represented as _DSD-equivalent packages (Rafael Wysocki) - Fix handling of ACPI data-only subnodes represented as _DSD-equivalent packages in the case when they are embedded in larger _DSD-equivalent packages and clean up acpi_nondev_subnode_extract() (Rafael Wysocki) - Skip ACPI IRQ override on ASUS Vivobook Pro N6506CU (Sam van Kampen) - Add power resource init function and use it for introducing an HP EliteBook 855 G7 WWAN modem power resource quirk (Maciej Szmigiero) - Add support for DBG2 RISC-V SBI port subtype and Precise Baud Rate field to the ACPI SPCR table parser (Chen Pei) * acpi-property: ACPI: property: Adjust failure handling in acpi_nondev_subnode_extract() ACPI: property: Do not pass NULL handles to acpi_attach_data() ACPI: property: Add code comments explaining what is going on ACPI: property: Disregard references in data-only subnode lists ACPI: property: Fix buffer properties extraction for subnodes * acpi-resource: ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU * acpi-pm: ACPI: PM: Add HP EliteBook 855 G7 WWAN modem power resource quirk ACPI: PM: Add power resource init function * acpi-tables: ACPI: SPCR: Support Precise Baud Rate field ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype commit be61a778185f4f41e2a94bc35cb438c6fab5d4db Merge: ab80f7707d4d6c 4405a214df1467 559f2eacc8a23c 149139ddcb9958 Author: Rafael J. Wysocki Date: Mon Sep 29 15:12:52 2025 +0200 Merge branches 'acpi-scan', 'acpi-processor' and 'acpi-sysfs' Merge an ACPI device enumeration update, ACPI processor driver updates, and an ACPI sysfs-related code update for 6.18-rc1: - Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] so it is not regarded as real dependency (Hans de Goede) - Use ACPI_FREE() for freeing an ACPI object in description_show() in the ACPI sysfs-related code (Kaushlendra Kumar) - Fix memory leak in the ACPI processor idle driver registration error code path and optimize ACPI idle driver registration (Huisong Li, Rafael Wysocki) - Add module import namespace to the ACPI processor idle driver (Rafael Wysocki) - Eliminate static variable flat_state_cnt from the ACPI processor idle driver (Rafael Wysocki) - Release cpufreq policy references using __free() in the ACPI processor thremal driver (Zihuan Zhang) - Remove unused empty stubs of some functions and rearrange function declarations in a header file in the ACPI processor driver (Huisong Li) - Redefine two functions as void in the ACPI processor driver (Rafael Wysocki) - Do not expose global variable acpi_idle_driver in the ACPI processor driver (Huisong Li) * acpi-scan: ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] * acpi-processor: ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: thermal: Release policy references using __free() ACPI: processor: idle: Fix function defined but not used warning ACPI: processor: idle: Eliminate static variable flat_state_cnt ACPI: processor: idle: Add module import namespace ACPI: processor: idle: Optimize ACPI idle driver registration ACPI: processor: idle: Fix memory leak when register cpuidle device failed * acpi-sysfs: ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object commit ab80f7707d4d6c0ab5103377bde2debdd449fcbf Merge: 496f9372eae147 54ba9071a04b0d Author: Rafael J. Wysocki Date: Mon Sep 29 15:10:54 2025 +0200 Merge branch 'acpica' Merge ACPICA updates (20250807 release material with a few fixes on top) for 6.18-rc1: - Add SoundWire File Table (SWFT) signature to ACPICA (Maciej Strozek) - Rearrange local variable definition involving #ifdef in ACPICA to avoid using uninitialized variables (Zhe Qiao) - Allow ACPICA to skip Global Lock initialization (Huacai Chen) - Apply ACPI_NONSTRING in more places in ACPICA and fix two regressions related to incorrect ACPI_NONSTRING usage (Ahmed Salem) - Fix printing CDAT table header when dissasebling CDAT AML (Ahmed Salem) - Use acpi_ds_clear_operands() in acpi_ds_call_control_method() in ACPICA (Hans de Goede) - Update dsmethod.c in ACPICA to address unused variable warning (Saket Dumbre) - Print error messages in ACPICA for too few or too many control method arguments (Saket Dumbre) - Update ACPICA version to 20250807 (Saket Dumbre) - Fix largest possible resource descriptor index in ACPICA (Dmitry Antipov) - Add Back-Invalidate restriction to CXL Window for CEDT in ACPICA (Davidlohr Bueso). - Add the package type to acceptable Arg3 types for _DSM in ACPICA because ACPI_TYPE_ANY does not cover it (Saket Dumbre) - Fix return values in ap_is_valid_checksum() in the acpidump utility in ACPICA (Kaushlendra Kumar) * acpica: ACPICA: acpidump: fix return values in ap_is_valid_checksum() ACPICA: ACPI_TYPE_ANY does not include the package type ACPICA: CEDT: Add Back-Invalidate restriction to CXL Window ACPICA: Fix largest possible resource descriptor index ACPICA: Update version to 20250807 ACPICA: Print error messages for too few or too many arguments ACPICA: Update dsmethod.c to get rid of unused variable warning ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() ACPICA: Debugger: drop ACPI_NONSTRING attribute from name_seg ACPICA: acpidump: drop ACPI_NONSTRING attribute from file_name ACPICA: iASL: Fix printing CDAT table header ACPICA: Apply ACPI_NONSTRING ACPICA: Allow to skip Global Lock initialization ACPICA: Change the compilation conditions ACPICA: Remove redundant "#ifdef" definitions ACPICA: Modify variable definition position ACPICA: Add SoundWire File Table (SWFT) signature commit 4335edb7138b45abab65f01d2be77a9be9cfd2fe Author: Heiko Carstens Date: Thu Sep 25 10:45:18 2025 +0200 s390: Remove superfluous newlines from inline assemblies Remove superfluous newlines from inline assemblies. Compilers use the number of lines of inline assemblies as heuristic for the complexity and inline decisions. Therefore inline assemblies should only contain as many lines as required. A lot of inline assemblies contain a superfluous newline for the last line. Remove such newlines to improve compiler inlining decisions. Suggested-by: Juergen Christ Signed-off-by: Heiko Carstens Reviewed-by: Alexander Gordeev Reviewed-by: Juergen Christ Signed-off-by: Alexander Gordeev commit f0edc8f113a39d1c9f8cf83e865c32b0668d80e0 Author: Heiko Carstens Date: Thu Sep 25 10:45:17 2025 +0200 s390/cio/ioasm: Fix __xsch() condition code handling For the __xsch() inline assembly the conversion to flag output macros is incomplete. Only the conditional shift of the return value was added, while the required changes to the inline assembly itself are missing. If compiled with GCC versions before 14.2 this leads to a double shift of the cc output operand and therefore the returned value of __xsch() is incorrectly always zero, instead of the expected condition code. Fixes: e200565d434b ("s390/cio/ioasm: Convert to use flag output macros") Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Acked-by: Alexander Gordeev Reviewed-by: Juergen Christ Signed-off-by: Alexander Gordeev commit fa7a0a53eeb7e16402f82c3d5a9ef4bf5efe9357 Author: Heiko Carstens Date: Fri Sep 26 15:39:10 2025 +0200 s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR If the decompressor is compiled with clang this can lead to the following warning: In file included from arch/s390/boot/startup.c:4: ... In file included from ./include/linux/pgtable.h:6: ./arch/s390/include/asm/pgtable.h:2065:48: warning: passing 'unsigned long *' to parameter of type 'long *' converts between pointers to integer types with different sign [-Wpointer-sign] 2065 | value = __atomic64_or_barrier(PGSTE_PCL_BIT, ptr); Add -Wno-pointer-sign to the decompressor compile flags, like it is also done for the kernel. This is similar to what was done for x86 to address the same problem [1]. [1] commit dca5203e3fe2 ("x86/boot: Add -Wno-pointer-sign to KBUILD_CFLAGS") Cc: stable@vger.kernel.org Reported-by: Gerd Bayer Signed-off-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit 27e06650a5eafe832a90fd2604f0c5e920857fae Author: Wang Haoran Date: Sat Sep 20 15:44:41 2025 +0800 scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow. Reported-by: Wang Haoran Reported-by: ziiiro Signed-off-by: Wang Haoran Signed-off-by: Martin K. Petersen commit 40d2cf9c3c1a5a1a9a443389d6b57a87362e4237 Merge: f58f86df6acb51 17eb8812917b10 Author: Rafael J. Wysocki Date: Mon Sep 29 13:10:10 2025 +0200 Merge branch 'pm-tools' Merge power management utilities updates for 6.18-rc1: - Fix and clean up the x86_energy_perf_policy utility and update its documentation (Len Brown, Kaushlendra Kumar) - Fix incorrect sorting of PMT telemetry in turbostat (Kaushlendra Kumar) - Fix incorrect size in cpuidle_state_disable() and the error return value of cpupower_write_sysfs() in cpupower (Kaushlendra Kumar) * pm-tools: tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/cpupower: fix error return value in cpupower_write_sysfs() commit f58f86df6acb51b19edebffa16c439938c9647bc Merge: 101642e43de154 3ce3f569991347 927f3e85015285 1f5bcfe91ffce7 Author: Rafael J. Wysocki Date: Mon Sep 29 12:54:01 2025 +0200 Merge branches 'pm-core', 'pm-runtime' and 'pm-sleep' Merge changes related to system sleep and runtime PM framework for 6.18-rc1: - Annotate loops walking device links in the power management core code as _srcu and add macros for walking device links to reduce the likelihood of coding mistakes related to them (Rafael Wysocki) - Document time units for *_time functions in the runtime PM API (Brian Norris) - Clear power.must_resume in noirq suspend error path to avoid resuming a dependant device under a suspended parent or supplier (Rafael Wysocki) - Fix GFP mask handling during hybrid suspend and make the amdgpu driver handle hybrid suspend correctly (Mario Limonciello, Rafael Wysocki) - Fix GFP mask handling after aborted hibernation in platform mode and combine exit paths in power_down() to avoid code duplication (Rafael Wysocki) - Use vmalloc_array() and vcalloc() in the hibernation core to avoid open-coded size computations (Qianfeng Rong) - Fix typo in hibernation core code comment (Li Jun) - Call pm_wakeup_clear() in the same place where other functions that do bookkeeping prior to suspend_prepare() are called (Samuel Wu) * pm-core: PM: core: Add two macros for walking device links PM: core: Annotate loops walking device links as _srcu * pm-runtime: PM: runtime: Documentation: ABI: Document time units for *_time * pm-sleep: PM: hibernate: Combine return paths in power_down() PM: hibernate: Restrict GFP mask in power_down() PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage drm/amd: Fix hybrid sleep PM: hibernate: Add pm_hibernation_mode_is_suspend() PM: hibernate: Fix hybrid-sleep PM: sleep: core: Clear power.must_resume in noirq suspend error path PM: sleep: Make pm_wakeup_clear() call more clear PM: hibernate: Fix typo in memory bitmaps description comment PM: hibernate: Use vmalloc_array() and vcalloc() to improve code commit 101642e43de15485cce7ac24ccaf6ab0fd0f0563 Merge: d6fd599cd4d8af 7b1b7961170e4f 03cf825911c95f Author: Rafael J. Wysocki Date: Mon Sep 29 12:47:06 2025 +0200 Merge branches 'pm-cpuidle' and 'pm-powercap' Merge cpuidle and power capping changes for 6.18-rc1: - Fail cpuidle device registration if there is one already to avoid sysfs-related issues (Rafael Wysocki) - Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() in cpuidle (Vivek Yadav) - Fix device and OF node leaks at probe in the qcom-spm cpuidle driver and drop unnecessary initialisations from it (Johan Hovold) - Remove unnecessary address-of operators from the intel_idle cpuidle driver (Kaushlendra Kumar) - Rearrange main loop in menu_select() to make the code in that funtion easier to follow (Rafael Wysocki) - Convert values in microseconds to ktime using us_to_ktime() where applicable in the intel_idle power capping driver (Xichao Zhao) * pm-cpuidle: cpuidle: Fail cpuidle device registration if there is one already cpuidle: sysfs: Use sysfs_emit()/sysfs_emit_at() instead of sprintf()/scnprintf() cpuidle: qcom-spm: drop unnecessary initialisations cpuidle: qcom-spm: fix device and OF node leaks at probe intel_idle: Remove unnecessary address-of operators cpuidle: governors: menu: Rearrange main loop in menu_select() * pm-powercap: powercap: idle_inject: use us_to_ktime() where appropriate commit d6fd599cd4d8afb604d5c0b5f5d20a1484942eef Merge: d3f8f8d03061d2 1ebe8f7e782523 8646f111fae02f 531453a36c1391 Author: Rafael J. Wysocki Date: Mon Sep 29 12:30:44 2025 +0200 Merge branches 'pm-em', 'pm-opp' and 'pm-devfreq' Merge energy model management, OPP (operating performance points) and devfreq updates for 6.18-rc1: - Prevent CPU capacity updates after registering a perf domain from failing on a first CPU that is not present (Christian Loehle) - Add support for the cases in which frequency alone is not sufficient to uniquely identify an OPP (Krishna Chaitanya Chundru) - Use to_result() for OPP error handling in Rust (Onur Özkan) - Add support for LPDDR5 on Rockhip RK3588 SoC to rockchip-dfi devfreq driver (Nicolas Frattaroli) - Fix an issue where DDR cycle counts on RK3588/RK3528 with LPDDR4(X) are reported as half by adding a cycle multiplier to the DFI driver in rockchip-dfi devfreq-event driver (Nicolas Frattaroli) - Fix missing error pointer dereference check of regulator instance in the mtk-cci devfreq driver probe and remove a redundant condition from an if () statement in that driver (Dan Carpenter, Liao Yuanhong) * pm-em: PM: EM: Fix late boot with holes in CPU topology * pm-opp: OPP: Add support to find OPP for a set of keys rust: opp: use to_result for error handling * pm-devfreq: PM / devfreq: rockchip-dfi: add support for LPDDR5 PM / devfreq: rockchip-dfi: double count on RK3588 PM / devfreq: mtk-cci: avoid redundant conditions PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() commit ba6018929165fc914c665f071f8e8cdbac844a49 Author: Aaron Kling Date: Thu Aug 28 21:48:13 2025 -0500 cpufreq: tegra186: Initialize all cores to max frequencies During initialization, the EDVD_COREx_VOLT_FREQ registers for some cores are still at reset values and not reflecting the actual frequency. This causes get calls to fail. Set all cores to their respective max frequency during probe to initialize the registers to working values. Suggested-by: Mikko Perttunen Signed-off-by: Aaron Kling Reviewed-by: Mikko Perttunen Signed-off-by: Viresh Kumar commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 Author: Aaron Kling Date: Thu Aug 28 21:48:12 2025 -0500 cpufreq: tegra186: Set target frequency for all cpus in policy The original commit set all cores in a cluster to a shared policy, but did not update set_target to apply a frequency change to all cores for the policy. This caused most cores to remain stuck at their boot frequency. Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster") Signed-off-by: Aaron Kling Reviewed-by: Mikko Perttunen Signed-off-by: Viresh Kumar commit 24287f902095d845c6af9c2c369ba96877f5eb79 Author: Thorsten Blum Date: Mon Sep 15 15:59:54 2025 +0200 rust: cpufreq: streamline find_supply_names Remove local variables from find_supply_names() and use .and_then() with the more concise kernel::kvec![] macro, instead of KVec::with_capacity() followed by .push() and Some(). No functional changes intended. Signed-off-by: Thorsten Blum Signed-off-by: Viresh Kumar commit ebc4ed14a4dbf51307102bb7ffc82ed6c16a37c2 Author: Johan Hovold Date: Tue Sep 9 09:38:19 2025 +0200 cpufreq: mediatek: fix device leak on probe failure Make sure to drop the reference to the cci device taken by of_find_device_by_node() on probe failure (e.g. probe deferral). Fixes: 0daa47325bae ("cpufreq: mediatek: Link CCI device to CPU") Cc: Jia-Wei Chang Cc: Rex-BC Chen Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Signed-off-by: Viresh Kumar commit 17eb8812917b10ce4146b5595f91d8e45bfe68cc Merge: 57610d69f909ea 23199d2aa6dcaf Author: Rafael J. Wysocki Date: Mon Sep 29 10:10:05 2025 +0200 Merge tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge cpupower utility updates for 6.18-rc1 from Shuah Khan: "Fixes incorrect return vale in cpupower_write_sysfs() error path and passing incorrect size to cpuidle_state_write_file() while writing status to disable file in cpuidle_state_disable()." * tag 'linux-cpupower-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: (1125 commits) tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/cpupower: fix error return value in cpupower_write_sysfs() Linux 6.17-rc6 MAINTAINERS: Input: Drop melfas-mip4 section USB: core: remove the move buf action MAINTAINERS: Update the DMA Rust entry erofs: fix long xattr name prefix placement Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" hsr: hold rcu and dev lock for hsr_get_port_ndev hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr hsr: use rtnl lock when iterating over ports wifi: nl80211: completely disable per-link stats for now net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info selftests/bpf: Skip timer cases when bpf_timer is not supported bpf: Reject bpf_timer for PREEMPT_RT libceph: fix invalid accesses to ceph_connection_v1_info PM: hibernate: Restrict GFP mask in hibernation_snapshot() MAINTAINERS: add Phil as netfilter reviewer netfilter: nf_tables: restart set lookup on base_seq change ... commit ca74b8cadaad4b179f77f1f4dc3d288be9a580f1 Merge: b9120619246d73 af92793e52c3a9 Author: Vlastimil Babka Date: Fri Sep 26 15:50:25 2025 +0200 Merge series "slab: Re-entrant kmalloc_nolock()" From the cover letter [1]: This patch set introduces kmalloc_nolock() which is the next logical step towards any context allocation necessary to remove bpf_mem_alloc and get rid of preallocation requirement in BPF infrastructure. In production BPF maps grew to gigabytes in size. Preallocation wastes memory. Alloc from any context addresses this issue for BPF and other subsystems that are forced to preallocate too. This long task started with introduction of alloc_pages_nolock(), then memcg and objcg were converted to operate from any context including NMI, this set completes the task with kmalloc_nolock() that builds on top of alloc_pages_nolock() and memcg changes. After that BPF subsystem will gradually adopt it everywhere. Link: https://lore.kernel.org/all/20250909010007.1660-1-alexei.starovoitov@gmail.com/ [1] commit b9120619246d733a27e5e93c29e86f2e0401cfc5 Merge: f7381b9116407b 719a42e563bb08 Author: Vlastimil Babka Date: Fri Sep 26 14:51:17 2025 +0200 Merge series "SLUB percpu sheaves" This series adds an opt-in percpu array-based caching layer to SLUB. It has evolved to a state where kmem caches with sheaves are compatible with all SLUB features (slub_debug, SLUB_TINY, NUMA locality considerations). The plan is therefore that it will be later enabled for all kmem caches and replace the complicated cpu (partial) slabs code. Note the name "sheaf" was invented by Matthew Wilcox so we don't call the arrays magazines like the original Bonwick paper. The per-NUMA-node cache of sheaves is thus called "barn". This caching may seem similar to the arrays we had in SLAB, but there are some important differences: - deals differently with NUMA locality of freed objects, thus there are no per-node "shared" arrays (with possible lock contention) and no "alien" arrays that would need periodical flushing - instead, freeing remote objects (which is rare) bypasses the sheaves - percpu sheaves thus contain only local objects (modulo rare races and local node exhaustion) - NUMA restricted allocations and strict_numa mode is still honoured - improves kfree_rcu() handling by reusing whole sheaves - there is an API for obtaining a preallocated sheaf that can be used for guaranteed and efficient allocations in a restricted context, when the upper bound for needed objects is known but rarely reached - opt-in, not used for every cache (for now) The motivation comes mainly from the ongoing work related to VMA locking scalability and the related maple tree operations. This is why VMA and maple nodes caches are sheaf-enabled in the patchset. A sheaf-enabled cache has the following expected advantages: - Cheaper fast paths. For allocations, instead of local double cmpxchg, thanks to local_trylock() it becomes a preempt_disable() and no atomic operations. Same for freeing, which is otherwise a local double cmpxchg only for short term allocations (so the same slab is still active on the same cpu when freeing the object) and a more costly locked double cmpxchg otherwise. - kfree_rcu() batching and recycling. kfree_rcu() will put objects to a separate percpu sheaf and only submit the whole sheaf to call_rcu() when full. After the grace period, the sheaf can be used for allocations, which is more efficient than freeing and reallocating individual slab objects (even with the batching done by kfree_rcu() implementation itself). In case only some cpus are allowed to handle rcu callbacks, the sheaf can still be made available to other cpus on the same node via the shared barn. The maple_node cache uses kfree_rcu() and thus can benefit from this. Note: this path is currently limited to !PREEMPT_RT - Preallocation support. A prefilled sheaf can be privately borrowed to perform a short term operation that is not allowed to block in the middle and may need to allocate some objects. If an upper bound (worst case) for the number of allocations is known, but only much fewer allocations actually needed on average, borrowing and returning a sheaf is much more efficient then a bulk allocation for the worst case followed by a bulk free of the many unused objects. Maple tree write operations should benefit from this. - Compatibility with slub_debug. When slub_debug is enabled for a cache, we simply don't create the percpu sheaves so that the debugging hooks (at the node partial list slowpaths) are reached as before. The same thing is done for CONFIG_SLUB_TINY. Sheaf preallocation still works by reusing the (ineffective) paths for requests exceeding the cache's sheaf_capacity. This is in line with the existing approach where debugging bypasses the fast paths and SLUB_TINY preferes memory savings over performance. The above is adapted from the cover letter [1], which contains also in-kernel microbenchmark results showing the lower overhead of sheaves. Results from Suren Baghdasaryan [2] using a mmap/munmap microbenchmark also show improvements. Results from Sudarsan Mahendran [3] using will-it-scale show both benefits and regressions, probably due to overall noisiness of those tests. Link: https://lore.kernel.org/all/20250910-slub-percpu-caches-v8-0-ca3099d8352c@suse.cz/ [1] Link: https://lore.kernel.org/all/CAJuCfpEQ%3DRUgcAvRzE5jRrhhFpkm8E2PpBK9e9GhK26ZaJQt%3DQ@mail.gmail.com/ [2] Link: https://lore.kernel.org/all/20250913000935.1021068-1-sudarsanm@google.com/ [3] commit af92793e52c3a99b828ed4bdd277fd3e11c18d08 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:07 2025 -0700 slab: Introduce kmalloc_nolock() and kfree_nolock(). kmalloc_nolock() relies on ability of local_trylock_t to detect the situation when per-cpu kmem_cache is locked. In !PREEMPT_RT local_(try)lock_irqsave(&s->cpu_slab->lock, flags) disables IRQs and marks s->cpu_slab->lock as acquired. local_lock_is_locked(&s->cpu_slab->lock) returns true when slab is in the middle of manipulating per-cpu cache of that specific kmem_cache. kmalloc_nolock() can be called from any context and can re-enter into ___slab_alloc(): kmalloc() -> ___slab_alloc(cache_A) -> irqsave -> NMI -> bpf -> kmalloc_nolock() -> ___slab_alloc(cache_B) or kmalloc() -> ___slab_alloc(cache_A) -> irqsave -> tracepoint/kprobe -> bpf -> kmalloc_nolock() -> ___slab_alloc(cache_B) Hence the caller of ___slab_alloc() checks if &s->cpu_slab->lock can be acquired without a deadlock before invoking the function. If that specific per-cpu kmem_cache is busy the kmalloc_nolock() retries in a different kmalloc bucket. The second attempt will likely succeed, since this cpu locked different kmem_cache. Similarly, in PREEMPT_RT local_lock_is_locked() returns true when per-cpu rt_spin_lock is locked by current _task_. In this case re-entrance into the same kmalloc bucket is unsafe, and kmalloc_nolock() tries a different bucket that is most likely is not locked by the current task. Though it may be locked by a different task it's safe to rt_spin_lock() and sleep on it. Similar to alloc_pages_nolock() the kmalloc_nolock() returns NULL immediately if called from hard irq or NMI in PREEMPT_RT. kfree_nolock() defers freeing to irq_work when local_lock_is_locked() and (in_nmi() or in PREEMPT_RT). SLUB_TINY config doesn't use local_lock_is_locked() and relies on spin_trylock_irqsave(&n->list_lock) to allocate, while kfree_nolock() always defers to irq_work. Note, kfree_nolock() must be called _only_ for objects allocated with kmalloc_nolock(). Debug checks (like kmemleak and kfence) were skipped on allocation, hence obj = kmalloc(); kfree_nolock(obj); will miss kmemleak/kfence book keeping and will cause false positives. large_kmalloc is not supported by either kmalloc_nolock() or kfree_nolock(). Signed-off-by: Alexei Starovoitov Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 7612833192d56af86061de8ab51989b75daf5b0d Author: Alexei Starovoitov Date: Mon Sep 8 18:00:06 2025 -0700 slab: Reuse first bit for OBJEXTS_ALLOC_FAIL Since the combination of valid upper bits in slab->obj_exts with OBJEXTS_ALLOC_FAIL bit can never happen, use OBJEXTS_ALLOC_FAIL == (1ull << 0) as a magic sentinel instead of (1ull << 2) to free up bit 2. Signed-off-by: Alexei Starovoitov Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 83382af9ddc3cb0ef43f67d049b461720ad785e6 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:05 2025 -0700 slab: Make slub local_(try)lock more precise for LOCKDEP kmalloc_nolock() can be called from any context the ___slab_alloc() can acquire local_trylock_t (which is rt_spin_lock in PREEMPT_RT) and attempt to acquire a different local_trylock_t while in the same task context. The calling sequence might look like: kmalloc() -> tracepoint -> bpf -> kmalloc_nolock() or more precisely: __lock_acquire+0x12ad/0x2590 lock_acquire+0x133/0x2d0 rt_spin_lock+0x6f/0x250 ___slab_alloc+0xb7/0xec0 kmalloc_nolock_noprof+0x15a/0x430 my_debug_callback+0x20e/0x390 [testmod] ___slab_alloc+0x256/0xec0 __kmalloc_cache_noprof+0xd6/0x3b0 Make LOCKDEP understand that local_trylock_t-s protect different kmem_caches. In order to do that add lock_class_key for each kmem_cache and use that key in local_trylock_t. This stack trace is possible on both PREEMPT_RT and !PREEMPT_RT, but teach lockdep about it only for PREEMPT_RT, since in !PREEMPT_RT the ___slab_alloc() code is using local_trylock_irqsave() when lockdep is on. Note, this patch applies this logic to local_lock_t while the next one converts it to local_trylock_t. Both are mapped to rt_spin_lock in PREEMPT_RT. Signed-off-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit d7242af8643409aae32243450341ef25b28d8a8c Author: Alexei Starovoitov Date: Mon Sep 8 18:00:04 2025 -0700 mm: Introduce alloc_frozen_pages_nolock() Split alloc_pages_nolock() and introduce alloc_frozen_pages_nolock() to be used by alloc_slab_page(). Reviewed-by: Vlastimil Babka Signed-off-by: Alexei Starovoitov Reviewed-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 99253de51f80acccc528a9c94e2f4d5f329071f1 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:03 2025 -0700 mm: Allow GFP_ACCOUNT to be used in alloc_pages_nolock(). Change alloc_pages_nolock() to default to __GFP_COMP when allocating pages, since upcoming reentrant alloc_slab_page() needs __GFP_COMP. Also allow __GFP_ACCOUNT flag to be specified, since most of BPF infra needs __GFP_ACCOUNT except BPF streams. Reviewed-by: Vlastimil Babka Signed-off-by: Alexei Starovoitov Reviewed-by: Shakeel Butt Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 4957089a23f41f31f8e7e22802a8ef9f5789c191 Author: Alexei Starovoitov Date: Mon Sep 8 18:00:02 2025 -0700 locking/local_lock: Introduce local_lock_is_locked(). Introduce local_lock_is_locked() that returns true when given local_lock is locked by current cpu (in !PREEMPT_RT) or by current task (in PREEMPT_RT). The goal is to detect a deadlock by the caller. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka commit 719a42e563bb087758500e43e67a57b27f303c4c Author: Liam R. Howlett Date: Wed Sep 3 15:00:03 2025 +0200 maple_tree: Convert forking to use the sheaf interface Use the generic interface which should result in less bulk allocations during a forking. A part of this is to abstract the freeing of the sheaf or maple state allocations into its own function so mas_destroy() and the tree duplication code can use the same functionality to return any unused resources. [andriy.shevchenko@linux.intel.com: remove unused mt_alloc_bulk()] Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 6bf377b06c08049d0f4042493df302285e45165e Author: Liam R. Howlett Date: Wed Sep 3 15:00:02 2025 +0200 maple_tree: Add single node allocation support to maple state The fast path through a write will require replacing a single node in the tree. Using a sheaf (32 nodes) is too heavy for the fast path, so special case the node store operation by just allocating one node in the maple state. Signed-off-by: Liam R. Howlett Signed-off-by: Vlastimil Babka commit 9b05890a25d9197e39fcf5b2298f0b911c323306 Author: Liam R. Howlett Date: Wed Sep 3 15:00:01 2025 +0200 maple_tree: Prefilled sheaf conversion and testing Use prefilled sheaves instead of bulk allocations. This should speed up the allocations and the return path of unused allocations. Remove the push and pop of nodes from the maple state as this is now handled by the slab layer with sheaves. Testing has been removed as necessary since the features of the tree have been reduced. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit fdbebab19f147af6b1459c821bc11162911245fa Author: Liam R. Howlett Date: Wed Sep 3 15:00:00 2025 +0200 tools/testing: Add support for prefilled slab sheafs Add the prefilled sheaf structs to the slab header and the associated functions to the testing/shared/linux.c file. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 025f93101bb4e0a0cdc0fc4ee264f7905271ad75 Author: Pedro Falcato Date: Wed Sep 3 14:59:59 2025 +0200 maple_tree: Replace mt_free_one() with kfree() kfree() is a little shorter and works with kmem_cache_alloc'd pointers too. Also lets us remove one more helper. Signed-off-by: Pedro Falcato Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9b60811cb3b42fe9a8e3f0aa3e007cd9cc814a78 Author: Pedro Falcato Date: Wed Sep 3 14:59:58 2025 +0200 maple_tree: Use kfree_rcu in ma_free_rcu kfree_rcu is an optimized version of call_rcu + kfree. It used to not be possible to call it on non-kmalloc objects, but this restriction was lifted ever since SLOB was dropped from the kernel, and since commit 6c6c47b063b5 ("mm, slab: call kvfree_rcu_barrier() from kmem_cache_destroy()"). Thus, replace call_rcu + mt_free_rcu with kfree_rcu. Signed-off-by: Pedro Falcato Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 551a6e757a95c23cd808533ef96e083d2a858ba0 Author: Liam R. Howlett Date: Wed Sep 3 14:59:57 2025 +0200 testing/radix-tree/maple: Hack around kfree_rcu not existing liburcu doesn't have kfree_rcu (or anything similar). Despite that, we can hack around it in a trivial fashion, by adding a wrapper. The wrapper only works for maple_nodes because we cannot get the kmem_cache pointer any other way in the test code. Link: https://lore.kernel.org/all/20250812162124.59417-1-pfalcato@suse.de/ Suggested-by: Pedro Falcato Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9f910f7d3d84927c388ede3c8053760a5947973b Author: Vlastimil Babka Date: Wed Sep 3 14:59:56 2025 +0200 tools/testing: include maple-shim.c in maple.c There's some duplicated code and we are about to add more functionality in maple-shared.h that we will need in the userspace maple test to be available, so include it via maple-shim.c Co-developed-by: Liam R. Howlett Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 59faa4da7cd4565cbce25358495556b75bb37022 Author: Vlastimil Babka Date: Wed Sep 3 14:59:55 2025 +0200 maple_tree: use percpu sheaves for maple_node_cache Setup the maple_node_cache with percpu sheaves of size 32 to hopefully improve its performance. Note this will not immediately take advantage of sheaf batching of kfree_rcu() operations due to the maple tree using call_rcu with custom callbacks. The followup changes to maple tree will change that and also make use of the prefilled sheaves functionality. Reviewed-by: Sidhartha Kumar Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 3accabda4da1b00ba21dc18573a0a43e032e35f4 Author: Vlastimil Babka Date: Wed Sep 3 14:59:54 2025 +0200 mm, vma: use percpu sheaves for vm_area_struct cache Create the vm_area_struct cache with percpu sheaves of size 32 to improve its performance. Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit c4fb7f0a79771dfd18838bfc5015650a9730e9c0 Author: Liam R. Howlett Date: Wed Sep 3 14:59:53 2025 +0200 tools/testing: Add support for changes to slab for sheaves The slab changes for sheaves requires more effort in the testing code. Unite all the kmem_cache work into the tools/include slab header for both the vma and maple tree testing. The vma test code also requires importing more #defines to allow for seamless use of the shared kmem_cache code. This adds the pthread header to the slab header in the tools directory to allow for the pthread_mutex in linux.c. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 4ec1a08d20315d2d2a6f942ea563e5dadd988e98 Author: Vlastimil Babka Date: Wed Sep 3 14:59:50 2025 +0200 slab: allow NUMA restricted allocations to use percpu sheaves Currently allocations asking for a specific node explicitly or via mempolicy in strict_numa node bypass percpu sheaves. Since sheaves contain mostly local objects, we can try allocating from them if the local node happens to be the requested node or allowed by the mempolicy. If we find the object from percpu sheaves is not from the expected node, we skip the sheaves - this should be rare. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit d09a61a3aa7de53fe055743993d79eaeb945cbad Author: Liam R. Howlett Date: Wed Sep 3 14:59:52 2025 +0200 tools/testing/vma: Implement vm_refcnt reset Add the reset of the ref count in vma_lock_init(). This is needed if the vma memory is not zeroed on allocation. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 989b09b73978a0b3dbee9ef343ab108742b1cc9f Author: Vlastimil Babka Date: Wed Sep 3 14:59:49 2025 +0200 slab: skip percpu sheaves for remote object freeing Since we don't control the NUMA locality of objects in percpu sheaves, allocations with node restrictions bypass them. Allocations without restrictions may however still expect to get local objects with high probability, and the introduction of sheaves can decrease it due to freed object from a remote node ending up in percpu sheaves. The fraction of such remote frees seems low (5% on an 8-node machine) but it can be expected that some cache or workload specific corner cases exist. We can either conclude that this is not a problem due to the low fraction, or we can make remote frees bypass percpu sheaves and go directly to their slabs. This will make the remote frees more expensive, but if it's only a small fraction, most frees will still benefit from the lower overhead of percpu sheaves. This patch thus makes remote object freeing bypass percpu sheaves, including bulk freeing, and kfree_rcu() via the rcu_free sheaf. However it's not intended to be 100% guarantee that percpu sheaves will only contain local objects. The refill from slabs does not provide that guarantee in the first place, and there might be cpu migrations happening when we need to unlock the local_lock. Avoiding all that could be possible but complicated so we can leave it for later investigation whether it would be worth it. It can be expected that the more selective freeing will itself prevent accumulation of remote objects in percpu sheaves so any such violations would have only short-term effects. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit e3852a1213ffc6fbd89c768e7c54a360652648b8 Author: Liam R. Howlett Date: Thu Aug 28 10:53:45 2025 -0400 maple_tree: Drop bulk insert support Bulk insert mode was added to facilitate forking faster, but forking now uses __mt_dup() to duplicate the tree. The addition of sheaves has made the bulk allocations difficult to maintain - since the expected entries would preallocate into the maple state. A big part of the maple state node allocation was the ability to push nodes back onto the state for later use, which was essential to the bulk insert algorithm. Remove mas_expected_entries() and mas_destroy_rebalance() functions as well as the MA_STATE_BULK and MA_STATE_REBALANCE maple state flags since there are no users anymore. Drop the associated testing as well. Signed-off-by: Liam R. Howlett Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 08294229210916c3b179186f3efa3b9c62a04678 Author: Vlastimil Babka Date: Wed Sep 3 14:59:48 2025 +0200 slab: determine barn status racily outside of lock The possibility of many barn operations is determined by the current number of full or empty sheaves. Taking the barn->lock just to find out that e.g. there are no empty sheaves results in unnecessary overhead and lock contention. Thus perform these checks outside of the lock with a data_race() annotated variable read and fail quickly without taking the lock. Checks for sheaf availability that racily succeed have to be obviously repeated under the lock for correctness, but we can skip repeating checks if there are too many sheaves on the given list as the limits don't need to be strict. Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit da577f1fcbdd0317b7c5089c19d5d61ec194f0e0 Author: Lorenzo Stoakes Date: Tue Aug 26 11:28:24 2025 +0100 tools/testing/vma: clean up stubs in vma_internal.h We do not need to references arguments just to avoid compiler warnings, the warning in question does not arise here, so remove all of the instances of '(void)xxx' introduced purely to avoid this warning. As reported by WagYuli in the referenced mail, GCC 8.3 and before will have issues compiling this file if parameter names are not provided, so ensure these are always provided. Finally, perform a trivial fix up of kmem_cache_alloc() which technically has parameters in the incorrect order (as reported by Vlastimil Babka off-list). Link: https://lkml.kernel.org/r/20250826102824.22730-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reported-by: WangYuli Closes: https://lore.kernel.org/linux-mm/EFCEBE7E301589DE+20250729084700.208767-1-wangyuli@uniontech.com/ Reported-by: Vlastimil Babka Acked-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Cc: Jann Horn Cc: WangYuli Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka commit 3c1ea5c5019ff197aca7e886a3a240c38f6c6f0d Author: Vlastimil Babka Date: Wed Sep 3 14:59:47 2025 +0200 slab: sheaf prefilling for guaranteed allocations Add functions for efficient guaranteed allocations e.g. in a critical section that cannot sleep, when the exact number of allocations is not known beforehand, but an upper limit can be calculated. kmem_cache_prefill_sheaf() returns a sheaf containing at least given number of objects. kmem_cache_alloc_from_sheaf() will allocate an object from the sheaf and is guaranteed not to fail until depleted. kmem_cache_return_sheaf() is for giving the sheaf back to the slab allocator after the critical section. This will also attempt to refill it to cache's sheaf capacity for better efficiency of sheaves handling, but it's not stricly necessary to succeed. kmem_cache_refill_sheaf() can be used to refill a previously obtained sheaf to requested size. If the current size is sufficient, it does nothing. If the requested size exceeds cache's sheaf_capacity and the sheaf's current capacity, the sheaf will be replaced with a new one, hence the indirect pointer parameter. kmem_cache_sheaf_size() can be used to query the current size. The implementation supports requesting sizes that exceed cache's sheaf_capacity, but it is not efficient - such "oversize" sheaves are allocated fresh in kmem_cache_prefill_sheaf() and flushed and freed immediately by kmem_cache_return_sheaf(). kmem_cache_refill_sheaf() might be especially ineffective when replacing a sheaf with a new one of a larger capacity. It is therefore better to size cache's sheaf_capacity accordingly to make oversize sheaves exceptional. CONFIG_SLUB_STATS counters are added for sheaf prefill and return operations. A prefill or return is considered _fast when it is able to grab or return a percpu spare sheaf (even if the sheaf needs a refill to satisfy the request, as those should amortize over time), and _slow otherwise (when the barn or even sheaf allocation/freeing has to be involved). sheaf_prefill_oversize is provided to determine how many prefills were oversize (counter for oversize returns is not necessary as all oversize refills result in oversize returns). When slub_debug is enabled for a cache with sheaves, no percpu sheaves exist for it, but the prefill functionality is still provided simply by all prefilled sheaves becoming oversize. If percpu sheaves are not created for a cache due to not passing the sheaf_capacity argument on cache creation, the prefills also work through oversize sheaves, but there's a WARN_ON_ONCE() to indicate the omission. Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit a8541957e7b18921dbf5d887780e8eaeb04916cf Author: Qianfeng Rong Date: Mon Aug 4 20:56:57 2025 +0800 maple_tree: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Link: https://lkml.kernel.org/r/20250804125657.482109-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Reviewed-by: Wei Yang Reviewed-by: Liam R. Howlett Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka commit ec66e0d599520ab414db745544e25d80d0ac5054 Author: Vlastimil Babka Date: Wed Sep 3 14:59:46 2025 +0200 slab: add sheaf support for batching kfree_rcu() operations Extend the sheaf infrastructure for more efficient kfree_rcu() handling. For caches with sheaves, on each cpu maintain a rcu_free sheaf in addition to main and spare sheaves. kfree_rcu() operations will try to put objects on this sheaf. Once full, the sheaf is detached and submitted to call_rcu() with a handler that will try to put it in the barn, or flush to slab pages using bulk free, when the barn is full. Then a new empty sheaf must be obtained to put more objects there. It's possible that no free sheaves are available to use for a new rcu_free sheaf, and the allocation in kfree_rcu() context can only use GFP_NOWAIT and thus may fail. In that case, fall back to the existing kfree_rcu() implementation. Expected advantages: - batching the kfree_rcu() operations, that could eventually replace the existing batching - sheaves can be reused for allocations via barn instead of being flushed to slabs, which is more efficient - this includes cases where only some cpus are allowed to process rcu callbacks (CONFIG_RCU_NOCB_CPU) Possible disadvantage: - objects might be waiting for more than their grace period (it is determined by the last object freed into the sheaf), increasing memory usage - but the existing batching does that too. Only implement this for CONFIG_KVFREE_RCU_BATCHED as the tiny implementation favors smaller memory footprint over performance. Also for now skip the usage of rcu sheaf for CONFIG_PREEMPT_RT as the contexts where kfree_rcu() is called might not be compatible with taking a barn spinlock or a GFP_NOWAIT allocation of a new sheaf taking a spinlock - the current kfree_rcu() implementation avoids doing that. Teach kvfree_rcu_barrier() to flush all rcu_free sheaves from all caches that have them. This is not a cheap operation, but the barrier usage is rare - currently kmem_cache_destroy() or on module unload. Add CONFIG_SLUB_STATS counters free_rcu_sheaf and free_rcu_sheaf_fail to count how many kfree_rcu() used the rcu_free sheaf successfully and how many had to fall back to the existing implementation. Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit db74430a4218f282d16e58a38337275ad3f9f517 Author: Haotian Zhang Date: Sun Sep 28 22:01:10 2025 -0700 Input: psxpad-spi - add a check for the return value of spi_setup() The probe function in the psxpad-spi driver calls spi_setup() but fails to check its return value. If the SPI bus setup fails, the driver will still load successfully, resulting in potential error in later I/O operations. Add a check for the return value of spi_setup() and return an error on failure. Fixes: 8be193c7b1f4 ("Input: add support for PlayStation 1/2 joypads connected via SPI") Signed-off-by: Haotian Zhang Signed-off-by: Dmitry Torokhov commit d3366a04770eea807f2826cbdb96934dd8c9bf79 Author: Zhen Ni Date: Sun Sep 28 14:37:37 2025 +0800 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn Signed-off-by: Dmitry Torokhov commit c8a935a31bc787db52296944890f300ba9479088 Author: Lad Prabhakar Date: Tue Sep 23 10:52:29 2025 +0100 lib/string_choices: Add str_assert_deassert() helper Add str_assert_deassert() helper to return "assert" or "deassert" string literal depending on the boolean argument. Also add the inversed variant str_deassert_assert(). Suggested-by: Philipp Zabel Signed-off-by: Lad Prabhakar Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250923095229.2149740-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Kees Cook commit 129b91fc329604e05f794dc1a18a6da3eb518b4e Author: Rob Herring (Arm) Date: Fri Sep 26 16:47:37 2025 -0500 dt-bindings: arm: altera: Drop socfpga-sdram-edac.txt The contents of arm/altera/socfpga-sdram-edac.txt are already covered by edac/altr,socfpga-ecc-manager.yaml except for the "altr,sdram-edac" compatible string. Add the compatible and drop the old .txt binding doc. Acked-by: Matthew Gerlach Signed-off-by: Rob Herring (Arm) commit 1b53426334c3c942db47e0959a2527a4f815af50 Author: Stefan Metzmacher Date: Mon Sep 8 22:22:35 2025 +0200 smb: server: let smb_direct_flush_send_list() invalidate a remote key first If we want to invalidate a remote key we should do that as soon as possible, so do it in the first send work request. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 942ce74ab9a3f1e18fe00bffa80ecf6294e9e6b5 Author: Stefan Metzmacher Date: Mon Sep 15 08:05:31 2025 +0200 smb: server: make use of ib_alloc_cq_any() instead of ib_alloc_cq() commit 20cf4e026730 ("rdma: Enable ib_alloc_cq to spread work over a device's comp_vectors") happened before ksmbd was upstreamed, but after the out of tree ksmbd (a.k.a. cifsd) was developed. So we still used ib_alloc_cq(). Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8aa23bae607e3bd5ced892afc26bfbe8945f531b Author: Stefan Metzmacher Date: Wed Aug 27 15:54:35 2025 +0200 smb: server: make consitent use of spin_lock_irq{save,restore}() in transport_rdma.c There is a mix of using spin_lock() and spin_lock_irq(), which is confusing as IB_POLL_WORKQUEUE is used and no code would be called from any interrupt. So using spin_lock() or even mutexes would be ok. But we'll soon share common code with the client, which uses IB_POLL_SOFTIRQ. And Documentation/kernel-hacking/locking.rst section "Cheat Sheet For Locking" says: - Otherwise (== data can be touched in an interrupt), use spin_lock_irqsave() and spin_unlock_irqrestore(). So in order to keep it simple and safe we use that version now. It will help merging functions into common code and have consistent locking in all cases. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0491f26f8980d7a4028d3528df09e23f5a64adbe Author: Stefan Metzmacher Date: Tue Sep 2 12:36:50 2025 +0200 smb: server: let {free_transport,smb_direct_disconnect_rdma_{work,connection}}() wake up all wait queues This is important in order to let all waiters notice a broken connection. We also go via smb_direct_disconnect_rdma_{work,connection}() for broken connections. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 7d729df9945a5ff9d4947bbc3c1297040ae3c507 Author: Stefan Metzmacher Date: Thu Aug 28 12:17:23 2025 +0200 smb: server: let smb_direct_disconnect_rdma_connection() disable all work but disconnect_work There's no point run these if we already know the connection is broken. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3d71e7cdbcf056a0b8ca3e9634f161b9a7b1e634 Author: Stefan Metzmacher Date: Thu Aug 28 12:14:07 2025 +0200 smb: server: fill in smbdirect_socket.first_error on error For now we just use -ECONNABORTED, but it will get more detailed later. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b3fd52a0d85c688a381e2ce72912db0a73727ce9 Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smb_direct_disconnect_rdma_connection() should turn the status into an error state instead of leaving it as is until smb_direct_disconnect_rdma_work() is running. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9d0050874767ec5977843d4bfca3aeb9a43a8f74 Author: Stefan Metzmacher Date: Fri Aug 22 16:11:34 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_send_negotiate_response() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5e90c56e0e8b787b3a7ab1ff565c93c918f27f1c Author: Stefan Metzmacher Date: Fri Aug 22 16:08:49 2025 +0200 smb: server: pass struct smbdirect_socket to {enqueue,get_first}_reassembly() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c0cb9823ac52be33a974b3bfe698e62507f456db Author: Stefan Metzmacher Date: Fri Aug 22 16:06:09 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_send_data() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ab83128e65a1f56db292a6db9b96750a39ba074b Author: Stefan Metzmacher Date: Fri Aug 22 16:03:52 2025 +0200 smb: server: pass struct smbdirect_socket to post_sendmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0a715db380444089e2907fa72ed712d2150aae6c Author: Stefan Metzmacher Date: Fri Aug 22 16:02:21 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_create_header() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4d1dffe0a08d87eb4fb1a62e4d76f541849db94a Author: Stefan Metzmacher Date: Fri Aug 22 15:59:35 2025 +0200 smb: server: pass struct smbdirect_socket to manage_keep_alive_before_sending() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 663b3c3c864c906373ef231cbb1755b353cb5f9f Author: Stefan Metzmacher Date: Fri Aug 22 15:57:41 2025 +0200 smb: server: pass struct smbdirect_socket to manage_credits_prior_sending() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b156d2c559b0ac9b410effd081262d96aa9bf00e Author: Stefan Metzmacher Date: Fri Aug 22 15:55:20 2025 +0200 smb: server: pass struct smbdirect_socket to calc_rw_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cae2d9a2298d04c237c6b7c57b9584068a2223df Author: Stefan Metzmacher Date: Fri Aug 22 15:52:47 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_rw_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2dc6c7e8ba3f348b8bcf348c0f736898170225fd Author: Stefan Metzmacher Date: Fri Aug 22 15:51:53 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_send_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7f4805b7db94b75003d08a97f5125617b42c625b Author: Stefan Metzmacher Date: Fri Aug 22 15:49:40 2025 +0200 smb: server: pass struct smbdirect_socket to wait_for_credits() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d14910bbf64404cb74f35419ca2cb427a558a43c Author: Stefan Metzmacher Date: Fri Aug 22 15:48:05 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_flush_send_list() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ecb56dbc93c67a0e03b6c4877ac1ead4cde0e9ca Author: Stefan Metzmacher Date: Fri Aug 22 15:46:53 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_send() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56b442a248b18e20b7a1b17d8bce2a97c62c8063 Author: Stefan Metzmacher Date: Fri Aug 22 15:08:27 2025 +0200 smb: server: remove unused struct struct smb_direct_transport argument from smb_direct_send_ctx_init() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 789cfc2ffa72d75394cee78abf3fd4d57d623399 Author: Stefan Metzmacher Date: Fri Aug 22 15:07:35 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_{alloc,free}_sendmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 100aec545ad170ac9139dd66e3475501f4b5bda4 Author: Stefan Metzmacher Date: Fri Aug 22 14:55:50 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_connect() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7cb0ab73f82f19a7d88d01a2949fc1275f56be39 Author: Stefan Metzmacher Date: Fri Aug 22 14:54:17 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_prepare_negotiation() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56bcc18d24f73f66b4211d4d028a626c0a5c56af Author: Stefan Metzmacher Date: Fri Aug 22 14:53:13 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_accept_client() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9221b12b356729cb9cb2a0e0ca3062b73aafb04c Author: Stefan Metzmacher Date: Fri Aug 22 14:52:04 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_post_recv() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cf789396479593d4929bdfdc775a45c9b7482360 Author: Stefan Metzmacher Date: Fri Aug 22 14:50:32 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_create_qpair() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit f75c226db0d29ee422f9b3ffd0a4730e6c552fbe Author: Stefan Metzmacher Date: Fri Aug 22 14:49:18 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_qpair_handler() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 56227a7aa5c6e159205d79444833c0e2874dcc94 Author: Stefan Metzmacher Date: Fri Aug 22 14:44:16 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_cm_handler() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ece37ea815a70cd170d6922d33b7c9a7e8f2aa9e Author: Stefan Metzmacher Date: Fri Aug 22 14:48:01 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_disconnect_rdma_connection() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a25075f112b4bc02335d4df930409982405987f6 Author: Stefan Metzmacher Date: Fri Aug 22 14:04:34 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_init_params() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 57131bf9e87677dcb64c8ce517c220b1fc403022 Author: Stefan Metzmacher Date: Fri Aug 22 13:55:17 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_get_max_fr_pages() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ce85071d2cd63badaa71651033aa9f702ed36734 Author: Stefan Metzmacher Date: Fri Aug 22 13:50:42 2025 +0200 smb: server: pass struct smbdirect_socket to smb_direct_{create,destroy}_pools() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01721df4e309e76866dd4d28b78e8683581e9e87 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: server: pass struct smbdirect_socket to {get_free,put}_recvmsg() This will make it easier to move function to the common code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit da7d45b9a3858abc89030cf08368e59b2ab2bdd4 Author: Stefan Metzmacher Date: Fri Aug 22 12:32:48 2025 +0200 smb: server: make use of smbdirect_socket.workqueue We still use the single global workqueue, but this will allow us to share common code soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8ad3a97eab240dabbe41b4452d37a5b6b64edf72 Author: Stefan Metzmacher Date: Fri Aug 15 12:36:33 2025 +0200 smb: server: implement correct keepalive and timeout handling for smbdirect Now client and server behave in the same way and we can start to share common functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b8c7776583e72f1fc50f0ed561346954c5d2fe82 Author: Stefan Metzmacher Date: Fri Aug 15 18:00:36 2025 +0200 smb: server: make use of smbdirect_socket.idle.immediate_work With this commit the server only uses struct smbdirect_socket! It doesn't use the idle timer yet, but it will be added soon, from there we'll be ready split common functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d0b9b967b35584379fd0421f408c77647e5d6b12 Author: Stefan Metzmacher Date: Thu Aug 21 12:32:05 2025 +0200 smb: server: make use of smbdirect_socket.rdma.legacy_iwarp Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 49635103e8e68020d80122b9ec408dbbd295d351 Author: Stefan Metzmacher Date: Thu Aug 21 12:30:32 2025 +0200 smb: server: make use of smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code first and then negotiate the value with the peer. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit be3c1d032fad608f48b428854694422633c4b004 Author: Stefan Metzmacher Date: Fri Aug 15 12:31:50 2025 +0200 smb: server: make use of smbdirect_socket_parameters.negotiate_timeout_msec and change to 5s The server negotiations timer is just 5 seconds in Windows, so use the same. See [MS-SMBD] 3.1.7.2 Connection Arrival. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d70e45823961e13af10f44a6a16c5c5a357ccdfb Author: Stefan Metzmacher Date: Fri Aug 15 12:22:09 2025 +0200 smb: server: fill smbdirect_socket_parameters at the beginning and use the values from there This is what we should do and it also simplifies the following changes. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 03a38d846750f06d4fb0aac2213192bdcc2a8435 Author: Stefan Metzmacher Date: Fri Aug 15 12:03:40 2025 +0200 smb: server: pass ksmbd_transport to get_smbd_max_read_write_size() We should use the per connection value. And for TCP return NT_STATUS_INVALID_PARAMETER if any SMB2_CHANNEL_RDMA_V1* is used. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 341b6c69b959a901b167a33b7e62e8b2ff8a1e74 Author: Stefan Metzmacher Date: Fri Aug 15 13:04:31 2025 +0200 smb: server: remove useless casts from KSMBD_TRANS/SMBD_TRANS At best they gain nothing, at worst we procude real bugs. Note container_of() already casts to a pointer of the given type. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4d2e333dabe74349d257ca2f02225e4bc39f23b8 Author: Stefan Metzmacher Date: Fri Aug 15 13:01:30 2025 +0200 smb: server: replace smb_trans_direct_transfort() with SMBD_TRANS() The spelling of smb_trans_direct_transfort was wrong anyway and we don't need the logic twice. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e8bc71986cbd2d2d5991a2fc6afbac0311ff3769 Author: Stefan Metzmacher Date: Thu Aug 14 16:33:30 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.{posted,credits} This will make it possible to introduce common helper functions in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 89b021a72663c4d96d8a8b85272bb42d991a1c6f Author: Stefan Metzmacher Date: Thu Aug 14 16:05:47 2025 +0200 smb: server: manage recv credits by counting posted recv_io and granted credits (At least for me) the logic maintaining the count of posted recv_io messages and the count of granted credits is much easier to understand. From there we can easily calculate the number of new_credits we'll grant to the peer in outgoing send_io messages. This will simplify the move to common logic that can be shared between client and server in the following patches. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 113ed9d56f63d2e4eb3d74002c3d91de1e7a3485 Author: Stefan Metzmacher Date: Thu Aug 14 15:50:05 2025 +0200 smb: server: take the recv_credit_target from the negotiate req and always limit the range The clients sends the initial recv_credit_target in the negotiate req, so we should use that. We also limit the range between 1 and our local defined sp->recv_credit_max. This will simplify further logic changes. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 780ccb0fb624600278ef4a65df30e563fd015a2a Author: Stefan Metzmacher Date: Mon Aug 18 21:07:06 2025 +0200 smb: server: make use of struct smbdirect_rw_io This will allow us to create functions in the common smbdirect code to be used by the server in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 95475d8886bd7e60860f7aa8657683a089f21db5 Author: Stefan Metzmacher Date: Thu Aug 14 12:01:50 2025 +0200 smb: server: make use smbdirect_socket.rw_io.credits This will allow to us to have functions moved into common code in future (even if it's only used by the server). Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 73430a64469c86c027518014e63ca637d9a53b9a Author: Stefan Metzmacher Date: Mon Aug 18 21:16:48 2025 +0200 smb: server: make use of struct smbdirect_send_batch This makes it easier to move functions to the common smbdirect code in future. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2def28338a19f03a15a99d7df46930e6be6944e8 Author: Stefan Metzmacher Date: Mon Aug 11 17:12:58 2025 +0200 smb: server: make use of smbdirect_socket.send_io.credits.{count,wait_queue} This will is used by the client already and will allow to create common helper functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit fd0ad9c521db6acf20fb24699830138481c07f8a Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: server: make use of smbdirect_socket.send_io.pending.{count,zero_wait_queue} This will is used by the client already and will allow to create common helper functions. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bb12617ecb3af1e1c8ba36ef2c3496f95521a605 Author: Stefan Metzmacher Date: Fri Aug 8 19:07:37 2025 +0200 smb: server: make use of smbdirect_socket.disconnect_work Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 16ba90e52bc7c367b62386fa4f61e4dc318c3583 Author: Stefan Metzmacher Date: Fri Aug 8 15:10:52 2025 +0200 smb: server: make use of smbdirect_socket_init() Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b4d56ced9e9dc353484dcb6355c1fd7074609124 Author: Stefan Metzmacher Date: Wed Aug 13 11:39:19 2025 +0200 smb: server: don't wait for info->send_pending == 0 on error Instead we just wake up the waiters and let them return -ENOTCONN. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit b31606097de8393c8adac4161a4d3a6098af10e0 Author: Stefan Metzmacher Date: Tue Aug 12 10:55:31 2025 +0200 smb: server: move smb_direct_disconnect_rdma_work() into free_transport() The logic is also needed when smb_direct_handle_connect_request() calls free_transport(), because rdma_accept() and RDMA_CM_EVENT_ESTABLISHED could already be reached. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e2d5e516c66383bed098b60be4925f9cbe9e3530 Author: Stefan Metzmacher Date: Fri Aug 8 12:46:25 2025 +0200 smb: server: only turn into SMBDIRECT_SOCKET_CONNECTED when negotiation is done From SMBDIRECT_SOCKET_CREATED we now go via the following stages: 1. SMBDIRECT_SOCKET_RDMA_CONNECT_NEEDED This indicated rdma_accept needs to be called 2. SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING This waits for RDMA_CM_EVENT_ESTABLISHED to arrive 3. SMBDIRECT_SOCKET_NEGOTIATE_NEEDED This waits for the negotiate request to arrive 4. SMBDIRECT_SOCKET_NEGOTIATE_RUNNING This indicates the negotiate request arrived and needs to be processed 5. SMBDIRECT_SOCKET_CONNECTED The connection is ready to use This avoids the extra 'bool negotiation_requested' and makes the steps more clear. In future we may want to add trace points when changing the states, which would be useful for debugging. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c82a53211a378e70866aac8ec49f4df64905ccc2 Author: Stefan Metzmacher Date: Thu Aug 7 11:20:55 2025 +0200 smb: server: make use of smbdirect_socket.status_wait This will allow us to have common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit a7eef6144c97bd7031d40ebc6e8fdd038ea3f46f Author: Stefan Metzmacher Date: Mon Aug 11 18:23:03 2025 +0200 smb: server: queue post_recv_credits_work in put_recvmsg() and avoid count_avail_recvmsg This is basically what the client is doing in put_receive_buffer(). It means we don't need complicated work to maintain count_avail_recvmsg. But we keep the logic to queue post_recv_credits_work if the peer raises the requested credit_target and put_receive_buffer() is not called. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d4b86b49093cbe98b68461a1b1af958f1a0ee16d Author: Stefan Metzmacher Date: Fri Aug 8 18:23:59 2025 +0200 smb: server: add a pr_info() when the server starts running We already have a message like: ksmbd: kill command received when the server stops running. This makes it easier for debugging in order to match any possible warnings/errors in dmesg with restarted server. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 27bc4c57f094917c450f1a2d3097bfea728fc1a5 Author: Stefan Metzmacher Date: Thu Aug 14 10:06:50 2025 +0200 smb: server: make only use of wake_up[_all]() in transport_rdma.c wake_up_interruptible(() doesn't wake up tasks waiting with wait_event(). So we better wake_up[_all]() in order to wake up all tasks in order to simplify the logic. As we currently don't use any wait_event_*_exclusive() it doesn't really matter if we use wake_up() or wake_up_all(). But in this patch I try to use wake_up() for expected situations and wake_up_all() for situations of a broken connection. So don't need to adjust things in future when we may use wait_event_*_exclusive() in order to wake up only one process that should make progress. Changing the wait_event_*() code in order to keep wait_event(), wait_event_interruptible() and wait_event_interruptible_timeout() or changing them to wait_event_killable(), wait_event_killable_timeout(), wait_event_killable_exclusive() is something to think about in a future patch. The goal here is to avoid that some tasks are not woken and freeze forever. Also note that this patch only changes the existing wake_up*() calls. Adding more wake_up*() calls for other wait queues is also deferred to a future patch. Link: https://lore.kernel.org/linux-cifs/13851363-0dc9-465c-9ced-3ede4904eef0@samba.org/T/#t Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 98dc77b310644b6716ed2da829697c128b2e5d51 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:04 2025 +0200 smb: server: make use of smbdirect_socket.{send,recv}_io.mem.{cache,pool} This will allow common helper functions to be created later. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 442959002fcce509069025aab2aaab0344709e6f Author: Stefan Metzmacher Date: Wed Aug 6 19:36:03 2025 +0200 smb: server: make use of struct smbdirect_send_io This is already used by the client and will allow us to use common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ea20d02842c8f38ed36045b46d8e95bcfa0514f2 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:02 2025 +0200 smb: server: make use of SMBDIRECT_RECV_IO_MAX_SGE Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit bdb0f1596ae537535a0cebc2911b07ff264c3099 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:01 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.reassembly.* This is also used by the client and will allow us to introduce common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit d9989207b78c2fa3008285c8b1e53e8618544de7 Author: Stefan Metzmacher Date: Wed Aug 6 19:36:00 2025 +0200 smb: server: make use of smbdirect_socket.recv_io.free.{list,lock} This is already used by the client and will allow us to add common helper functions soon. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9883a142f1bba5bdc3a3091608aef8b1600cdd11 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:59 2025 +0200 smb: server: make use of struct smbdirect_recv_io This will allow us to move helper functions into common code soon as the client already uses smbdirect_recv_io. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3e691b1d16dbd30186d71ca707efeb3a98cc542c Author: Stefan Metzmacher Date: Wed Aug 6 19:35:58 2025 +0200 smb: server: make use of smbdirect_socket->recv_io.expected The expected incoming message type can be per connection. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 177368b9924314bde7d2ea6dc93de0d9ba728b61 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:57 2025 +0200 smb: server: make use of common smbdirect_socket_parameters Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4c564f03e23b1ea55b77679192a4cb07f5b3e7f3 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:56 2025 +0200 smb: server: make use of common smbdirect_socket This is the next step in the direction of a common smbdirect layer. Currently only structures are shared, but that will change over time until everything is shared. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit e7de2c4521ce86eb23de133cdf48cb460cff5a91 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:55 2025 +0200 smb: server: make use of common smbdirect.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 575c1af4dc64434a42c4b00e5b7fd298e8c68c3c Author: Stefan Metzmacher Date: Sat Aug 16 10:24:30 2025 +0900 smb: server: make use of common smbdirect_pdu.h Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Hyunchul Lee Cc: Meetakshi Setiya Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit fad988a2158d743da7971884b93482a73735b25e Author: Stefan Metzmacher Date: Wed Aug 20 15:34:58 2025 +0200 smb: server: fix IRD/ORD negotiation with the client Already do real negotiation in smb_direct_handle_connect_request() where we see the requested initiator_depth and responder_resources from the client. We should detect legacy iwarp clients using MPA v1 with the custom IRD/ORD negotiation. We need to send the custom IRD/ORD in big endian, but we need to try to let clients with broken requests using little endian (older cifs.ko) to work. Note the reason why this uses u8 for initiator_depth and responder_resources is that the rdma layer also uses it. Acked-by: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-rdma@vger.kernel.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2dad0b15bbe86ffa6d2f234c40609aa59894e9ec Author: Stefan Metzmacher Date: Mon Sep 15 00:55:31 2025 +0200 smb: client: let smbd_post_send_iter() call ib_dma_map_single() for the header first This will simplify further changes, the important part is that request->num_sge >= 1 is only set if request->sge[0].* is valid. Note that ib_dma_sync_single_for_device() is called in smbd_post_send() for each sge, so the device will still see the packet header even if it's modified after calling ib_dma_map_single(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c4709e61ef253eed4257328b614e7c57fed259ec Author: Stefan Metzmacher Date: Mon Sep 15 23:32:15 2025 +0200 smb: client: defer calling ib_alloc_pd() after we are connected The protection domain is not needed until we're connected. This makes further changes easier to follow... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 17a6bc60f47b344b831da8cf66adef5c2ea3d9c1 Author: Stefan Metzmacher Date: Tue Aug 26 15:54:10 2025 +0200 smb: client: allocate smbdirect workqueue at the beginning of _smbd_get_connection() This will simplify further changes when moving to common code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a437c9cebcc3c4193fe0143e6fbc72c6b7529ad2 Author: Stefan Metzmacher Date: Wed Aug 27 15:34:09 2025 +0200 smb: client: make consitent use of spin_lock_irq{save,restore}() in smbdirect.c There is a mix of using spin_lock(), spin_lock_irq() and spin_lock_irqsave() and it seems at least enqueue_reassembly() was wrong in using just spin_lock() as it's called via recv_done() from a SOFTIRQ as we're using IB_POLL_SOFTIRQ. And Documentation/kernel-hacking/locking.rst section "Cheat Sheet For Locking" says: - Otherwise (== data can be touched in an interrupt), use spin_lock_irqsave() and spin_unlock_irqrestore(). So in order to keep it simple and safe we use that version now. It will help merging functions into common code and have consistent locking in all cases. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1b128ec1c76dcf08b752b5f5268da813fea58a01 Author: Stefan Metzmacher Date: Tue Sep 2 12:17:56 2025 +0200 smb: client: let smbd_{destroy,disconnect_rdma_{work,connection}}() wake up all wait queues This is important in order to let all waiters notice a broken connection. We also go via smbd_disconnect_rdma_{work,connection}() for broken connections. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0cb7ed37af614bbda39dab3d13f0639458d77cae Author: Stefan Metzmacher Date: Thu Aug 28 12:15:11 2025 +0200 smb: client: let smbd_disconnect_rdma_connection() disable all work but disconnect_work There's no point run these if we already know the connection is broken. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 98a1cdca35eac55407c76067cdffd19aade0026c Author: Stefan Metzmacher Date: Thu Aug 28 12:12:09 2025 +0200 smb: client: fill in smbdirect_socket.first_error on error For now we just use -ECONNABORTED, but it will get more detailed later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ffbfc73e84eb829f7e2f901594271557de860827 Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: client: let smbd_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR... smbd_disconnect_rdma_connection() should turn the status into an error state instead of leaving it as is until smbd_disconnect_rdma_work() is running. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 114347dad6e7955b25aa707d62936023e501d8ed Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: remove unused struct smbdirect_socket argument of smbd_iter_to_mr() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4c4b1d1122fb49a207b86318b0940e09898d8e62 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: pass struct smbdirect_socket to get_mr() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2c6b999a90987a86285865569eac8a5a51ce18a1 Author: Stefan Metzmacher Date: Fri Aug 22 11:54:30 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_negotiate() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c612e60de5aa0b1cb60ac6c9e7d96eb3c4528b13 Author: Stefan Metzmacher Date: Fri Aug 22 11:52:24 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_negotiate_req() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0a5dc5fc7c014d88c31aff327a65d610d8006454 Author: Stefan Metzmacher Date: Fri Aug 22 11:34:05 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_ia_open() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2569536b0c69eb3c38deacf2b9ce82cd5f8b4633 Author: Stefan Metzmacher Date: Fri Aug 22 11:10:57 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_create_id() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 94a0e794b77f3300c99fcac65d1a4fc83fd4684f Author: Stefan Metzmacher Date: Fri Aug 22 11:08:13 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_qp_async_error_upcall() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit e3f095cca6563e6aaf9163690e22800f765cd193 Author: Stefan Metzmacher Date: Fri Aug 22 11:07:48 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_conn_upcall() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 05bd1378c821f4cea2818b0bef6b28415ffca56f Author: Stefan Metzmacher Date: Fri Aug 22 11:03:52 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_full_iter() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d76e8c7f546b2d2a49149b4ee59583aad0282c93 Author: Stefan Metzmacher Date: Fri Aug 22 10:47:06 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_empty() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 46b8fe2bd18c487aa4fd5c45e6f9c23a1c4c859a Author: Stefan Metzmacher Date: Fri Aug 22 10:27:01 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send_iter() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8cead970e37c40727d9b93ce49e7c445c2caf7d0 Author: Stefan Metzmacher Date: Fri Aug 22 10:21:16 2025 +0200 smb: client: pass struct smbdirect_socket to manage_keep_alive_before_sending() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8a9919b2bf8199206e5c5e223e2dd3d04b93a4e2 Author: Stefan Metzmacher Date: Fri Aug 22 10:19:28 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_send() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 869bb7284fb2976b59ad29455cddd44bce0976f7 Author: Stefan Metzmacher Date: Fri Aug 22 10:18:12 2025 +0200 smb: client: pass struct smbdirect_socket to manage_credits_prior_sending() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit be8602d47d4116da477cba0e4284295892887b24 Author: Stefan Metzmacher Date: Fri Aug 22 10:14:29 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_post_recv() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c7e4d5facb47698411d144ea1c968ef3e1794be9 Author: Stefan Metzmacher Date: Fri Aug 22 10:12:35 2025 +0200 smb: client: pass struct smbdirect_socket to smbd_disconnect_rdma_connection() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8a45d4c9597ff5357a44e88ce9910ccb52add06 Author: Stefan Metzmacher Date: Fri Aug 22 10:10:10 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_mr_list() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 419fc78fd81ffa6d6da847ba46050db1da64b874 Author: Stefan Metzmacher Date: Fri Aug 22 01:17:35 2025 +0200 smb: client: pass struct smbdirect_socket to {enqueue,_get_first}_reassembly() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b8a5d5d1aa00728a4604cc2c2775c0664e821173 Author: Stefan Metzmacher Date: Fri Aug 22 01:14:38 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_caches_and_workqueue() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 163e0ff8c6e1ba5d436e125291d05951dcc6ba1c Author: Stefan Metzmacher Date: Fri Aug 22 01:11:36 2025 +0200 smb: client: pass struct smbdirect_socket to {allocate,destroy}_receive_buffers() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f6de7482b42941056f2b3cef0e831abce62ebfa7 Author: Stefan Metzmacher Date: Fri Aug 22 01:07:11 2025 +0200 smb: client: pass struct smbdirect_socket to {get,put}_receive_buffer() This will make it easier to move function to the common code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02e6f092c7aa1fa12337978837ad64d1b75bbc82 Author: Stefan Metzmacher Date: Fri Aug 22 00:57:19 2025 +0200 smb: client: make use of smbdirect_socket.mr_io Now struct smbd_connection only contains struct smbdirect_socket, this is an important step towards having common functions as well. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9a52e3b0d63fc5eaefee3707136fa3c5258ae39e Author: Stefan Metzmacher Date: Fri Aug 22 00:32:34 2025 +0200 smb: client: make use of smbdirect_socket_parameters.max_frmr_depth This make it easier to have common code later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f454f36cd0b9ee3b7b6c7181238ef20f1326063a Author: Stefan Metzmacher Date: Thu Aug 21 23:36:33 2025 +0200 smb: client: make use of struct smbdirect_mr_io This will allow us to move to common functions in future too. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5f84b0819a7e678d1004df9aea05d8484ca68ce8 Author: Stefan Metzmacher Date: Fri Aug 22 00:23:53 2025 +0200 smb: client: add and use smbd_get_parameters() In future struct smbdirect_socket_parameters will be the only public structure for the smb layer. This prepares this... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 40212a27c75ff22457d958097a27a3d8815b0a70 Author: Stefan Metzmacher Date: Fri Aug 22 12:29:03 2025 +0200 smb: client: make use of smbdirect_socket.workqueue This will simplify the move to common code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8efb796db30288fab498156ef1fa03a34d88817 Author: Stefan Metzmacher Date: Thu Aug 21 14:50:56 2025 +0200 smb: client: move rdma_readwrite_threshold from smbd_connection to TCP_Server_Info This belongs to the SMB layer not to the transport layer, it just uses the negotiated transport parameters to adjust the value if needed. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ddfcb069c1dd1c909c34605e025e0aeae1b496e3 Author: Stefan Metzmacher Date: Tue Aug 19 13:54:35 2025 +0200 smb: client: make use of smbdirect_socket.statistics This will allow us to use common functions soon. Note this generates the following warnings from scripts/checkpatch.pl --quiet: WARNING: quoted string split across lines #59: FILE: fs/smb/client/cifs_debug.c:481: + seq_printf(m, "\nDebug count_get_receive_buffer: %llu " + "count_put_receive_buffer: %llu count_send_empty: %llu", WARNING: quoted string split across lines #66: FILE: fs/smb/client/cifs_debug.c:486: seq_printf(m, "\nRead Queue " + "count_enqueue_reassembly_queue: %llu " WARNING: quoted string split across lines #67: FILE: fs/smb/client/cifs_debug.c:487: + "count_enqueue_reassembly_queue: %llu " + "count_dequeue_reassembly_queue: %llu " total: 0 errors, 3 warnings, 83 lines checked scripts/checkpatch.pl: FAILED But I left them in there, because it matches the code arround it... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2449c7cc9bc26f8c80560f376f26c6f50b346c0f Author: Stefan Metzmacher Date: Tue Aug 19 12:03:59 2025 +0200 smb: client: remove unused smbd_connection.count_reassembly_queue This basically represents the same information as sc->recv_io.reassembly.queue_length. The only thing that's different is that smbd_connection.count_reassembly_queue was updated in each loop step, while sc->recv_io.reassembly.queue_length is only updated once after the loop in smbd_recv. Also sc->recv_io.reassembly.queue_length is updated under a spinlock. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 87d03d6c829aea8c6cf632ac24ee5227c3b8b00b Author: Stefan Metzmacher Date: Mon Aug 18 10:42:42 2025 +0200 smb: client: remove unused smbd_connection->protocol There is only one protocol version for smbdirect yet and this variable is write only. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4dc536a135e0ef862ccc25f5d68ad5c062dc01a0 Author: Stefan Metzmacher Date: Fri Aug 15 17:57:32 2025 +0200 smb: client: make use of smbdirect_socket.idle.{keepalive,immediate_work,timer_work} This will allow client and server to use the common structures in order to share common functions later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ac31755c7a649786a9e11c6288513f5f4c1d30c9 Author: Stefan Metzmacher Date: Thu Aug 14 19:41:12 2025 +0200 smb: client: fix smbdirect keep alive handling to match the documentation We setup the first timer with the negotiate timeout and set KEEP_ALIVE_PENDING, so that the expired timer disconnects. On every incoming message we need to reset the timer to the keepalive interval (120s). On SMBDIRECT_FLAG_RESPONSE_REQUESTED we need to schedule a response instead of setting KEEP_ALIVE_PENDING. Doing both would mean we would also set SMBDIRECT_FLAG_RESPONSE_REQUESTED in that response. If both ends would do that we'd play ping pong in a busy loop. If we move to KEEP_ALIVE_SENT and send the keepalive request with SMBDIRECT_FLAG_RESPONSE_REQUESTED, we need to setup the timer with keepalive timeout (5s) in order to disconnect if no incoming message reset the timer. The fired timer sets KEEP_ALIVE_PENDING and also setup timer with keepalive timeout (5s) in order to disconnect if no incoming message reset the timer. We do that before queueing the send_immediate_work and have that timer in case we didn't reach the send code that typically sets the timer to keepalive timeout. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1b2c46cdb7c0127711cd72028072d85f6ebd1b53 Author: Stefan Metzmacher Date: Fri Aug 15 12:53:35 2025 +0200 smb: client: send empty packets via send_immediate_work This is what the server already does and it makes refactoring for common structures and functions much easier. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ea5a4e31ab4757273dacaa7e05368892516b53d6 Author: Stefan Metzmacher Date: Thu Aug 21 12:22:46 2025 +0200 smb: client: make use of smbdirect_socket.rdma.legacy_iwarp Currently it's write only for the client, but it will likely be use for debugging later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit dd53b45fc871cd9eb8ce90b215378c683aae783b Author: Stefan Metzmacher Date: Tue Aug 19 23:18:21 2025 +0200 smb: client: make use of smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code first and then negotiate the value with the peer. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1f2ff73a233005cb1f8e7bc02477603e2f9f4c69 Author: Stefan Metzmacher Date: Thu Aug 14 19:39:22 2025 +0200 smb: client: make use of smbdirect_socket_parameters.{resolve_{addr,route},rdma_connect,negotiate}_timeout_msec This will make future changes to these values much saner. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 14b6088dd97b5332c018a2e87c46be1e8cfdabc8 Author: Stefan Metzmacher Date: Fri Aug 15 11:03:04 2025 +0200 smb: client: fill smbdirect_socket_parameters at the beginning and use the values from there This is what we should do and it also simplifies the following changes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d3e743b514c20bfe26e340835cebb1f8301997ab Author: Stefan Metzmacher Date: Thu Aug 14 18:34:02 2025 +0200 smb: client: remove useless smbd_connection.send_immediate We always set it to true before having an if statement that checks it is true... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit c7316ec2d542e27ea717a0d7493902098329f908 Author: Stefan Metzmacher Date: Thu Aug 14 16:32:30 2025 +0200 smb: client: make use of smbdirect_socket.recv_io.{posted,credits} This will make it possible to introduce common helper functions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5fb9b459b3686e366640edd4e62805ef7b4de927 Author: Stefan Metzmacher Date: Thu Aug 14 13:57:37 2025 +0200 smb: client: count the number of posted recv_io messages in order to calculated credits (At least for me) the logic maintaining the count of posted recv_io messages and the count of granted credits is much easier to understand. From there we can easily calculate the number of new_credits we'll grant to the peer in outgoing send_io messages. This will simplify the move to common logic that can be shared between client and server in the following patches. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9219f8cac296769324bbe8a28c289586114244c4 Author: Stefan Metzmacher Date: Thu Aug 14 15:01:35 2025 +0200 smb: client: limit the range of info->receive_credit_target This simplifies further changes... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1a07031fdd56754747a27b48d555152e1daf19cd Author: Stefan Metzmacher Date: Tue Aug 12 09:24:57 2025 +0200 smb: client: remove info->wait_receive_queues handling in smbd_destroy() We already call ib_drain_qp() before, which is an sync operation that only returns in the queues are fully drained. ib_drain_qp() completes pending requests with IB_WC_WR_FLUSH_ERR so we have already called put_receive_buffer(). So all smbdirect_recv_io objects are either in the smbdirect_socket.recv_io.free.list or smbdirect_socket.recv_io.reassembly.list. Then we explicitly iterate smbdirect_socket.recv_io.reassembly.list and call put_receive_buffer(), so every object is in smbdirect_socket.recv_io.free.list. It means info->count_receive_queue == sp->recv_credit_max was already true and calling wait_event(info->wait_receive_queues... is pointless. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a8e970358b31a5abba8b5737a67ba7b8d26f4258 Author: Stefan Metzmacher Date: Tue Aug 12 09:44:07 2025 +0200 smb: client: make use of ib_wc_status_msg() and skip IB_WC_WR_FLUSH_ERR logging There's no need to get log message for every IB_WC_WR_FLUSH_ERR completion, but any other error should be logged at level ERR. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02548c477a90481c1fd0d6e7c84b4504ec2fcc12 Author: Stefan Metzmacher Date: Mon Aug 11 17:53:55 2025 +0200 smb: client: queue post_recv_credits_work also if the peer raises the credit target This is already handled in the server, but currently it done in a very complex way there. So we do it much simpler. Note that put_receive_buffer() will take care of it in case data_length is 0. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b0aa92a229ab9e6de3839e06f3a8494bce5b1cd2 Author: Stefan Metzmacher Date: Tue Aug 12 09:10:07 2025 +0200 smb: client: make sure smbd_disconnect_rdma_work() doesn't run after smbd_destroy() took over If we're already disconnecting we don't need to queue the disconnect_work again. disable_work() turns the next queue_work() into a no-op. Also let smbd_destroy() cancel(and disable) queued disconnect_work and call smbd_disconnect_rdma_work() inline. The makes it more obvious that disconnect_work is never queued again after smbd_destroy() called smbd_disconnect_rdma_work(). It also means we have a single place to call rdma_disconnect(). While there we better also disable all other [delayed_]work. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 9b1a6b7583cb71e101a93e518e2cbc32911a2b89 Author: Stefan Metzmacher Date: Mon Aug 11 17:11:08 2025 +0200 smb: client: make use of smbdirect_socket.send_io.credits.{count,wait_queue} This will be used by the server too and will allow to create common helper functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ca48841de93cbb911d2d85e84a329bbe0fac412d Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: client: make use of smbdirect_socket.send_io.pending.{count,{dec,zero}_wait_queue} This will be used by the server too and will allow to create common helper functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit a51c67db2c9e3f1539f5c441d8db2058ed8644f9 Author: Stefan Metzmacher Date: Fri Aug 8 19:06:49 2025 +0200 smb: client: make use of smbdirect_socket.disconnect_work Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 7360778b6f962bd87472238204b5cf76d98e8122 Author: Stefan Metzmacher Date: Fri Aug 8 15:10:52 2025 +0200 smb: client: make use of smbdirect_socket_init() It's much safer to initialize the whole structure at the beginning than doing it all over the place and then miss to move it if code changes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5a0d5ae65c121decfac03c68a20343e75f636957 Author: Stefan Metzmacher Date: Thu Aug 14 10:06:50 2025 +0200 smb: client: make only use of wake_up[_all]() in smbdirect.c wake_up_interruptible[_all]() doesn't wake up tasks waiting with wait_event(). So we better wake_up[_all]() in order to wake up all tasks in order to simplify the logic. As we currently don't use any wait_event_*_exclusive() it doesn't really matter if we use wake_up() or wake_up_all(). But in this patch I try to use wake_up() for expected situations and wake_up_all() for situations of a broken connection. So don't need to adjust things in future when we may use wait_event_*_exclusive() in order to wake up only one process that should make progress. Changing the wait_event_*() code in order to keep wait_event(), wait_event_interruptible() and wait_event_interruptible_timeout() or changing them to wait_event_killable(), wait_event_killable_timeout(), wait_event_killable_exclusive() is something to think about in a future patch. The goal here is to avoid that some tasks are not woken and freeze forever. Also note that this patch only changes the existing wake_up*() calls. Adding more wake_up*() calls for other wait queues is also deferred to a future patch. Link: https://lore.kernel.org/linux-cifs/13851363-0dc9-465c-9ced-3ede4904eef0@samba.org/T/#t Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d9140ef074239408a1d991819811fadbbe781c79 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:17 2025 +0200 smb: client: make use of smbdirect_socket.status_wait This will allow us to have common helper functions soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 4ff3fa4e4aa78c3aa9083a8d448f8af4f0740df7 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:15 2025 +0200 smb: client: use status_wait and SMBDIRECT_SOCKET_RESOLVE_{ADDR,ROUTE}_RUNNING for completion We can use the state change from SMBDIRECT_SOCKET_RESOLVE_{ADDR,ROUTE}_RUNNING to the next state in order to wake the caller to do the next step. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 00e4c7a87d1fa8d5668e2922578ff4aff6efb8a2 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:14 2025 +0200 smb: client: use status_wait and SMBDIRECT_SOCKET_NEGOTIATE_RUNNING for completion We can use the state change from SMBDIRECT_SOCKET_NEGOTIATE_RUNNING to SMBDIRECT_SOCKET_CONNECTED or SMBDIRECT_SOCKET_NEGOTIATE_FAILED in order to notify the caller if the negotiation is over. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit afff34dc025b5f0476645f44b4d9cbc83dd54e71 Author: Stefan Metzmacher Date: Mon Sep 8 12:14:43 2025 +0200 smb: client: adjust smbdirect related output of cifs_debug_data_proc_show() For the reader it is not obvious that the counter values are displayed in hex as there's no leading '0x' before '%x'. So changed them to %u instead and added '0x' for non-counter values and also a string for the status. Note this generates some checkpatch warnings like this: WARNING: quoted string split across lines #45: FILE: fs/smb/client/cifs_debug.c:460: + seq_printf(m, "\nSMBDirect protocol version: 0x%x " + "transport status: %s (%u)", But I'll leave this is the current style in the related code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit f5b893edde7bcd15246dfeefd25082fe637db647 Author: Stefan Metzmacher Date: Thu Aug 28 12:11:02 2025 +0200 smb: smbdirect: introduce smbdirect_socket.first_error This will be used when a connected conection gets the first error. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit cc678b8a89291ef55c8dfc01391506f1234c6cae Author: Stefan Metzmacher Date: Thu Aug 28 10:39:56 2025 +0200 smb: client/smbdirect: introduce SMBDIRECT_SOCKET_ERROR This will be used to turn SMBDIRECT_SOCKET_CONNECTED into an error within smbd_disconnect_rdma_connection() on the client and smb_direct_disconnect_rdma_connection() on the server. We do this in a single commit with the client as otherwise it won't build because the enum value is not handled in the switch statement. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 58dfba8a2d4eb6defc6e710196b053abdaf6cd79 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:13 2025 +0200 smb: client/smbdirect: replace SMBDIRECT_SOCKET_CONNECTING with more detailed states The process of reaching a functional connection represented by SMBDIRECT_SOCKET_CONNECTED, is more complex than using a single SMBDIRECT_SOCKET_CONNECTING state. This will allow us to remove a lot of special variables and completions in the following commits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ef71f1e046489c77a2f7d012edc762fba0a7aadc Author: Stefan Metzmacher Date: Wed Aug 20 11:25:06 2025 +0200 smb: client: fix sending the iwrap custom IRD/ORD negotiation messages Do a real negotiation and check the servers initiator_depth and responder_resources. This should use big endian in order to be useful. I have captures of windows clients showing this. The fact that we used little endian up to now means that we sent very large numbers and the negotiation with the server truncated them to the server limits. Note the reason why this uses u8 for initiator_depth and responder_resources is that the rdma layer also uses it. The inconsitency regarding the initiator_depth and responder_resources values being reversed for iwarp devices in RDMA_CM_EVENT_ESTABLISHED should also be fixed later, but for now we should fix it. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-rdma@vger.kernel.org Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6920b4ad49fc7ff5b99a0dcff8e9612753a7a876 Author: Stefan Metzmacher Date: Tue Aug 26 16:30:32 2025 +0200 smb: smbdirect: let smbdirect_socket_init() initialize all [delayed_]work_structs as disabled This safer to start with and allows common code not care about if the caller uses these or not. E.g. sc->mr_io.recovery_work is only used on the client... Note disable_[delayed_]work_sync() requires a valid function pointer in INIT_[DELAYED_]WORK(). The non _sync() version don't require it, but as we need to use the _sync() version on cleanup we better use it here too, it won't block anyway here... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ed3350f09d2c0234c59910ef1655cb9cbe17b0ca Author: Stefan Metzmacher Date: Tue Aug 19 09:34:27 2025 +0200 smb: smbdirect: introduce smbdirect_socket.mr_io.* This will be used by the client and will allow us to move to common code... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 41e5086905a3c37c3e5b716192b2dcd719ad8ef5 Author: Stefan Metzmacher Date: Thu Aug 21 23:50:42 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.max_frmr_depth This will be used by the client... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 02c39c0121d209117cb10b76df0b960f546b72e3 Author: Stefan Metzmacher Date: Thu Aug 21 16:16:47 2025 +0200 smb: smbdirect: introduce struct smbdirect_mr_io This will be used by the client in order to maintain memory registrations. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6c5b0f9253d7f15722db22da28cd49ab34252214 Author: Stefan Metzmacher Date: Fri Aug 22 12:22:24 2025 +0200 smb: smbdirect: introduce smbdirect_socket.workqueue The client currently used a per socket workqueue because it can block in a work function waiting for credits. So we use a per socket pointer in order to prepare common code. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 6889d2f5caa69ff4f523ef11a207fcaedaff8c7e Author: Stefan Metzmacher Date: Tue Aug 19 13:52:29 2025 +0200 smb: smbdirect: introduce smbdirect_socket.statistics These will be used by the client and maybe shared code in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 89bae05f9df68f827de0106760de53933083a391 Author: Stefan Metzmacher Date: Fri Aug 15 17:47:58 2025 +0200 smb: smbdirect: introduce smbdirect_socket.idle.{keepalive,immediate_work,timer_work} This will allow client and server to use the common structures in order to share common functions later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2baedb2026a5c01e79e9691540eea14d65f7277a Author: Stefan Metzmacher Date: Thu Aug 21 12:13:16 2025 +0200 smb: smbdirect: introduce smbdirect_socket.rdma.legacy_iwarp This will be used by client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8e34a763870dc48b69049c2a4ec032a21d66feb6 Author: Stefan Metzmacher Date: Tue Aug 19 23:18:21 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.{initiator_depth,responder_resources} This will make it easier to specify these from the outside of the core code later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 932fa15c3726459d0f996893262af33b9f7dc121 Author: Stefan Metzmacher Date: Thu Aug 14 19:12:38 2025 +0200 smb: smbdirect: introduce smbdirect_socket_parameters.{resolve_{addr,route},rdma_connect,negotiate}_timeout_msec These will be used instead of hardcoded values in client and server. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit ec76e3cc6bbcb17815a4bfa6450d4bae1e708c9b Author: Stefan Metzmacher Date: Mon Aug 11 15:57:04 2025 +0200 smb: smbdirect: introduce smbdirect_socket.recv_io.{posted,credits} This will be used by client and server soon in order to maintain the state of posted recv_io messages and granted credits. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b5a4242fb902f3780ef85d4027ba5987b7ce1e2d Author: Stefan Metzmacher Date: Mon Aug 18 21:04:14 2025 +0200 smb: smbdirect: introduce struct smbdirect_rw_io This will be used by the server in order to manage RDMA reads and writes. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 90255ed46774bda93a945a6dbf9228d9ecfcd79f Author: Stefan Metzmacher Date: Thu Aug 14 11:41:59 2025 +0200 smb: smbdirect: introduce smbdirect_socket.rw_io.credits This will be used by the server to manage the state for RDMA read/write requests. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit cce93d2d0ccc88d2486e220e4a802c9edc48849b Author: Stefan Metzmacher Date: Mon Aug 18 21:13:03 2025 +0200 smb: smbdirect: introduce struct smbdirect_send_batch This will replace struct smb_direct_send_ctx in the server and allow us move code to the common smbdirect layer soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2191b3471df53d87a46179b0c302c77c9ccfec11 Author: Stefan Metzmacher Date: Mon Aug 11 16:03:00 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.credits.{count,wait_queue} This will be shared between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3b7be44a0eb18b2e51190fd1d26997dc7bddc32d Author: Stefan Metzmacher Date: Mon Aug 11 15:19:51 2025 +0200 smb: smbdirect: introduce smbdirect_socket.send_io.pending.{count,{dec,zero}_wait_queue} This will be shared between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit de32f33c0365d06962675dc2c2269723dd917d0f Author: Stefan Metzmacher Date: Fri Aug 8 19:05:39 2025 +0200 smb: smbdirect: introduce smbdirect_socket.disconnect_work Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 17e1d07430e4bd6a14e2d194791f545f8548ff58 Author: Stefan Metzmacher Date: Fri Aug 8 15:08:33 2025 +0200 smb: smbdirect: introduce smbdirect_socket_init() This will make it easier to keep the initialization in a single place. For now it's an __always_inline function as we only share the header files. Once move to common functions we'll have a dedicated smbdirect.ko that exports functions... Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 371d3ab51ce44c8a7c0f9b835b74b7340a922059 Author: Stefan Metzmacher Date: Fri Aug 8 18:48:16 2025 +0200 smb: smbdirect: introduce smbdirect_socket.status_wait This will be used by server and client soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 1e2f487584ed426a744b86e04f96662488c7aa0e Author: Stefan Metzmacher Date: Mon Sep 8 12:06:18 2025 +0200 smb: smbdirect: introduce smbdirect_socket_status_string() This will be used for more useful debug messages. Cc: Steve French Cc: Tom Talpey Cc: Long Li Acked-by: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 Author: Arnd Bergmann Date: Wed Sep 24 22:18:33 2025 +0200 i3c: fix big-endian FIFO transfers Short MMIO transfers that are not a multiple of four bytes in size need a special case for the final bytes, however the existing implementation is not endian-safe and introduces an incorrect byteswap on big-endian kernels. This usually does not cause problems because most systems are little-endian and most transfers are multiple of four bytes long, but still needs to be fixed to avoid the extra byteswap. Change the special case for both i3c_writel_fifo() and i3c_readl_fifo() to use non-byteswapping writesl() and readsl() with a single element instead of the byteswapping writel()/readl() that are meant for individual MMIO registers. As data is copied between a FIFO and a memory buffer, the writesl()/readsl() loops are typically based on __raw_readl()/ __raw_writel(), resulting in the order of bytes in the FIFO to match the order in the buffer, regardless of the CPU endianess. The earlier versions in the dw-i3c and i3c-master-cdns had a correct implementation, but the generic version that was recently added broke it. Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()") Cc: Manikanta Guntupalli Signed-off-by: Arnd Bergmann Reviewed-by: Jorge Marques Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org Signed-off-by: Alexandre Belloni commit 8a1f3fd1a89cd1d4acccb0181346ad212a275a69 Author: Alexandre Belloni Date: Wed Sep 24 21:56:00 2025 +0200 i3c: master: adi: fix number of bytes written to fifo adi_i3c_master_wr_to_tx_fifo computes the maximum number of bytes that can be sent to the fifo but never makes use of it, actually limit the number of bytes sent. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509190505.fKGvEJRa-lkp@intel.com/ Reviewed-by: Jorge Marques Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250924195600.122142-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 19692013415486febf71343f5cc539a343a2994b Author: Qinxin Xia Date: Thu Aug 14 21:35:27 2025 +0800 MAINTAINERS: add myself and Barry to dma_map_benchmark maintainers Since Chenxiang has left HiSilicon, Barry and I will jointly maintain this module. Cc: Barry Song Signed-off-by: Qinxin Xia Signed-off-by: Shuah Khan commit edf7e9040fc52c922db947f9c6c36f07377c52ea Author: Chao Yu Date: Sun Sep 28 18:24:22 2025 +0800 f2fs: fix UAF issue in f2fs_merge_page_bio() As JY reported in bugzilla [1], Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace: f2fs_is_cp_guaranteed+0x70/0x98 f2fs_inplace_write_data+0x174/0x2f4 f2fs_do_write_data_page+0x214/0x81c f2fs_write_single_data_page+0x28c/0x764 f2fs_write_data_pages+0x78c/0xce4 do_writepages+0xe8/0x2fc __writeback_single_inode+0x4c/0x4b4 writeback_sb_inodes+0x314/0x540 __writeback_inodes_wb+0xa4/0xf4 wb_writeback+0x160/0x448 wb_workfn+0x2f0/0x5dc process_scheduled_works+0x1c8/0x458 worker_thread+0x334/0x3f0 kthread+0x118/0x1ac ret_from_fork+0x10/0x20 [1] https://bugzilla.kernel.org/show_bug.cgi?id=220575 The panic was caused by UAF issue w/ below race condition: kworker - writepages - f2fs_write_cache_pages - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #1 into bio & cache bio in io->bio_list - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #2 into bio which is linked in io->bio_list write - f2fs_write_begin : write page #1 - f2fs_folio_wait_writeback - f2fs_submit_merged_ipu_write - f2fs_submit_write_bio : submit bio which inclues page #1 and #2 software IRQ - f2fs_write_end_io - fscrypt_free_bounce_page : freed bounced page which belongs to page #2 - inc_page_count( , WB_DATA_TYPE(data_folio), false) : data_folio points to fio->encrypted_page the bounced page can be freed before accessing it in f2fs_is_cp_guarantee() It can reproduce w/ below testcase: Run below script in shell #1: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" Run below script in shell #2: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache. Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") Reported-by: JY Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 72bdca6231a35aaf3fc1f3ac174d5203621d9e7f Author: Yunji Kang Date: Wed Sep 24 16:43:58 2025 +0900 f2fs: readahead node blocks in F2FS_GET_BLOCK_PRECACHE mode In f2fs_precache_extents(), For large files, It requires reading many node blocks. Instead of reading each node block with synchronous I/O, this patch applies readahead so that node blocks can be fetched in advance. It reduces the overhead of repeated sync reads and improves efficiency when precaching extents of large files. I created a file with the same largest extent and executed the test. For this experiment, I set the file's largest extent with an offset of 0 and a size of 1GB. I configured the remaining area with 100MB extents. 5GB test file: dd if=/dev/urandom of=test1 bs=1m count=5120 cp test1 test2 fsync test1 dd if=test1 of=test2 bs=1m skip=1024 seek=1024 count=100 conv=notrunc dd if=test1 of=test2 bs=1m skip=1224 seek=1224 count=100 conv=notrunc ... dd if=test1 of=test2 bs=1m skip=5024 seek=5024 count=100 conv=notrunc reboot I also created 10GB and 20GB files with large extents using the same method. ioctl(F2FS_IOC_PRECACHE_EXTENTS) test results are as follows: +-----------+---------+---------+-----------+ | File size | Before | After | Reduction | +-----------+---------+---------+-----------+ | 5GB | 101.8ms | 37.0ms | 72.1% | | 10GB | 222.9ms | 56.0ms | 74.9% | | 20GB | 446.2ms | 116.4ms | 73.9% | +-----------+---------+---------+-----------+ Tested on a 256GB mobile device with an SM8750 chipset. Reviewed-by: Sungjong Seo Reviewed-by: Sunmin Jeong Signed-off-by: Yunji Kang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 45b70947a425fa121a8b9bcbb77472d9e35def6a Author: Chao Yu Date: Tue Sep 16 16:52:43 2025 +0800 f2fs: add sanity check on ei.len in __update_extent_tree_range() Add a sanity check in __update_extent_tree_range() to detect any zero-sized extent update. Signed-off-by: wangzijie Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1367da7eb875d01102d2ed18654b24d261ff5393 Author: Charan Teja Kalla Date: Wed Sep 24 23:41:38 2025 +0530 mm: swap: check for stable address space before operating on the VMA It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. Link: https://lkml.kernel.org/r/20250924181138.1762750-1-charan.kalla@oss.qualcomm.com Link: https://lore.kernel.org/all/20250815191031.3769540-1-Liam.Howlett@oracle.com/ [1] Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Charan Teja Kalla Suggested-by: David Hildenbrand Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nhat Pham Cc: Peng Zhang Cc: Signed-off-by: Andrew Morton commit 81e78b7ec61e89e8bab9736551839f79b063614c Author: David Hildenbrand Date: Tue Sep 23 16:00:58 2025 +0200 mm: convert folio_page() back to a macro In commit 73b3294b1152 ("mm: simplify folio_page() and folio_page_idx()") we converted folio_page() into a static inline function. However briefly afterwards in commit a847b17009ec ("mm: constify highmem related functions for improved const-correctness") we had to add some nasty const-away casting to make the compiler happy when checking const correctness. So let's just convert it back to a simple macro so the compiler can check const correctness properly. There is the alternative of using a _Generic() similar to page_folio(), but there is not a lot of benefit compared to just using a simple macro. Link: https://lkml.kernel.org/r/20250923140058.2020023-1-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Kiryl Shutsemau Reviewed-by: SeongJae Park Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Dev Jain Reviewed-by: Suren Baghdasaryan Reviewed-by: Lance Yang Reviewed-by: Wei Yang Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Michal Hocko Signed-off-by: Andrew Morton commit 1acc369373008b9eeb930fbb47847c0693055553 Author: Wei Yang Date: Mon Sep 22 14:09:38 2025 +0000 mm/khugepaged: use start_addr/addr for improved readability When collapsing a pmd, there are two address in use: * address points to the start of pmd * address points to each individual page Current naming makes it difficult to distinguish these two and is hence error prone. Considering the plan to collapse mTHP, name the first one `start_addr' and the second `addr' for better readability and consistency. Link: https://lkml.kernel.org/r/20250922140938.27343-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Suggested-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Nico Pache Acked-by: David Hildenbrand Reviewed-by: Dev Jain Cc: Baolin Wang Cc: Barry Song Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit dd83609b88986f4add37c0871c3434310652ebd5 Author: Deepanshu Kartikey Date: Fri Sep 26 09:02:54 2025 +0530 hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization"), if the trylock fails or the VMA has no lock, it should skip that VMA. Any remaining mapped pages are handled by remove_inode_hugepages() which is called after hugetlb_vmdelete_list() and uses proper lock ordering to guarantee unmapping success. Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs without shareable locks, the code proceeds to call unmap_hugepage_range(). This causes assertion failures in huge_pmd_unshare() → hugetlb_vma_assert_locked() because no lock is actually held: WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted Call Trace: hugetlb_vma_assert_locked+0x1dd/0x250 huge_pmd_unshare+0x2c8/0x540 __unmap_hugepage_range+0x6e3/0x1aa0 unmap_hugepage_range+0x32e/0x410 hugetlb_vmdelete_list+0x189/0x1f0 Fix by using goto to ensure locks acquired by trylock are always released, even when skipping VMAs without shareable locks. Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 Suggested-by: Andrew Morton Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit fb552b2425cf8f16c9c72229a972d1744b24d855 Author: Ran Xiaokai Date: Fri Sep 26 08:06:59 2025 +0000 alloc_tag: fix boot failure due to NULL pointer dereference There is a boot failure when both CONFIG_DEBUG_KMEMLEAK and CONFIG_MEM_ALLOC_PROFILING are enabled. BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:__alloc_tagging_slab_alloc_hook+0x181/0x2f0 Call Trace: kmem_cache_alloc_noprof+0x1c8/0x5c0 __alloc_object+0x2f/0x290 __create_object+0x22/0x80 kmemleak_init+0x122/0x190 mm_core_init+0xb6/0x160 start_kernel+0x39f/0x920 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x104/0x120 common_startup_64+0x12c/0x138 In kmemleak, mem_pool_alloc() directly calls kmem_cache_alloc_noprof(), as a result, current->alloc_tag is NULL, leading to a null pointer dereference. Move the checks for SLAB_NO_OBJ_EXT, SLAB_NOLEAKTRACE, and __GFP_NO_OBJ_EXT to the parent function __alloc_tagging_slab_alloc_hook() to fix this. Also this distinguishes the SLAB_NOLEAKTRACE case between the actual memory allocation failures case, make CODETAG_FLAG_INACCURATE more accurate. Link: https://lkml.kernel.org/r/20250926080659.741991-1-ranxiaokai627@163.com Fixes: b9e2f58ffb84 ("alloc_tag: mark inaccurate allocation counters in /proc/allocinfo output") Signed-off-by: Ran Xiaokai Reviewed-by: Harry Yoo Acked-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: Johannes Weiner Cc: Roman Gushchin Cc: Shakeel Butt Cc: Usama Arif Signed-off-by: Andrew Morton commit 989c2f55ca4839121cbf23b5802f8513dbd54e1e Author: Lance Yang Date: Fri Sep 26 17:24:26 2025 +0800 mm: silence data-race in update_hiwater_rss KCSAN reports a data race on mm_cluster.hiwater_rss, which can be accessed concurrently from various paths like page migration and memory unmapping without synchronization. Since hiwater_rss is a statistical field for accounting purposes, this data race is benign. Annotate both the read and write accesses with data_race() to make KCSAN happy. Link: https://lkml.kernel.org/r/20250926092426.43312-1-lance.yang@linux.dev Signed-off-by: Lance Yang Reported-by: syzbot+60192c8877d0bc92a92b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-mm/68d6364e.050a0220.3390a8.000d.GAE@google.com Acked-by: Vlastimil Babka Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Marco Elver Cc: Rik van Riel Signed-off-by: Andrew Morton commit cde31ecdd1aa1cc495bdf6d5cba84adc276d8861 Author: Xie Yuanbin Date: Mon Sep 22 22:36:18 2025 +0800 mm/memory-failure: don't select MEMORY_ISOLATION We added that "select MEMORY_ISOLATION" in commit ee6f509c3274 ("mm: factor out memory isolate functions"). However, in commit add05cecef80 ("mm: soft-offline: don't free target page in successful page migration") we remove the need for it, where we removed the calls to set_migratetype_isolate() etc. What CONFIG_MEMORY_FAILURE soft-offline support wants is migrate_pages() support. But that comes with CONFIG_MIGRATION. And isolate_folio_to_list() has nothing to do with CONFIG_MEMORY_ISOLATION. Therefore, we can remove "select MEMORY_ISOLATION" of MEMORY_FAILURE. Link: https://lkml.kernel.org/r/20250922143618.48640-1-xieyuanbin1@huawei.com Signed-off-by: Xie Yuanbin Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Acked-by: Miaohe Lin Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit b4c9ffb54b3204dc8b4013c6410c897cff8cdd70 Author: Wei Yang Date: Fri Sep 19 07:12:44 2025 +0000 mm/khugepaged: remove definition of struct khugepaged_mm_slot Current code is not correct to get struct khugepaged_mm_slot by mm_slot_entry() without checking mm_slot is !NULL. There is no problem reported since slot is the first element of struct khugepaged_mm_slot. While struct khugepaged_mm_slot is just a wrapper of struct mm_slot, there is no need to define it. Remove the definition of struct khugepaged_mm_slot, so there is not chance to miss use mm_slot_entry(). [richard.weiyang@gmail.com: fix use-after-free crash] Link: https://lkml.kernel.org/r/20250922002834.vz6ntj36e75ehkyp@master Link: https://lkml.kernel.org/r/20250919071244.17020-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Cc: Lance Yang Cc: David Hildenbrand Cc: Dev Jain Cc: Kiryl Shutsemau Cc: xu xin Signed-off-by: Andrew Morton commit 08498be43ee676d8a5eefb22278266322578a3e0 Author: Wei Yang Date: Fri Sep 19 07:12:43 2025 +0000 mm/ksm: get mm_slot by mm_slot_entry() when slot is !NULL Patch series "mm_slot: fix the usage of mm_slot_entry", v2. When using mm_slot in ksm, there is code like: slot = mm_slot_lookup(mm_slots_hash, mm); mm_slot = mm_slot_entry(slot, struct ksm_mm_slot, slot); if (mm_slot && ..) { } The mm_slot_entry() won't return a valid value if slot is NULL generally. But currently it works since slot is the first element of struct ksm_mm_slot. To reduce the ambiguity and make it robust, access mm_slot_entry() when slot is !NULL. Link: https://lkml.kernel.org/r/20250919071244.17020-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20250919071244.17020-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Lance Yang Cc: Kiryl Shutsemau Cc: xu xin Signed-off-by: Andrew Morton commit 3dfd02c900379d209ac9dcac24b4a61d8478842a Author: Li Zhe Date: Fri Sep 19 17:23:53 2025 +0800 hugetlb: increase number of reserving hugepages via cmdline Commit 79359d6d24df ("hugetlb: perform vmemmap optimization on a list of pages") batches the submission of HugeTLB vmemmap optimization (HVO) during hugepage reservation. With HVO enabled, hugepages obtained from the buddy allocator are not submitted for optimization and their struct-page memory is therefore not released—until the entire reservation request has been satisfied. As a result, any struct-page memory freed in the course of the allocation cannot be reused for the ongoing reservation, artificially limiting the number of huge pages that can ultimately be provided. As commit b1222550fbf7 ("mm/hugetlb: do pre-HVO for bootmem allocated pages") already applies early HVO to bootmem-allocated huge pages, this patch extends the same benefit to non-bootmem pages by incrementally submitting them for HVO as they are allocated, thereby returning struct-page memory to the buddy allocator in real time. The change raises the maximum 2 MiB hugepage reservation from just under 376 GB to more than 381 GB on a 384 GB x86 VM. Link: https://lkml.kernel.org/r/20250919092353.41671-1-lizhe.67@bytedance.com Signed-off-by: Li Zhe Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 08ff89b5659d89966fc845ee5040051d318b8d01 Author: Donet Tom Date: Wed Sep 24 00:17:00 2025 +0530 selftests/mm: add fork inheritance test for ksm_merging_pages counter Add a new selftest to verify whether the `ksm_merging_pages` counter in `mm_struct` is not inherited by a child process after fork. This helps ensure correctness of KSM accounting across process creation. Link: https://lkml.kernel.org/r/e7bb17d374133bd31a3e423aa9e46e1122e74971.1758648700.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: David Hildenbrand Cc: Aboorva Devarajan Cc: Chengming Zhou Cc: "Ritesh Harjani (IBM)" Cc: Wei Yang Cc: xu xin Signed-off-by: Andrew Morton commit 4d6fc29f36341d7795db1d1819b4c15fe9be7b23 Author: Donet Tom Date: Wed Sep 24 00:16:59 2025 +0530 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork Patch series "mm/ksm: Fix incorrect accounting of KSM counters during fork", v3. The first patch in this series fixes the incorrect accounting of KSM counters such as ksm_merging_pages, ksm_rmap_items, and the global ksm_zero_pages during fork. The following patch add a selftest to verify the ksm_merging_pages counter was updated correctly during fork. Test Results ============ Without the first patch ----------------------- # [RUN] test_fork_ksm_merging_page_count not ok 10 ksm_merging_page in child: 32 With the first patch -------------------- # [RUN] test_fork_ksm_merging_page_count ok 10 ksm_merging_pages is not inherited after fork This patch (of 2): Currently, the KSM-related counters in `mm_struct`, such as `ksm_merging_pages`, `ksm_rmap_items`, and `ksm_zero_pages`, are inherited by the child process during fork. This results in inconsistent accounting. When a process uses KSM, identical pages are merged and an rmap item is created for each merged page. The `ksm_merging_pages` and `ksm_rmap_items` counters are updated accordingly. However, after a fork, these counters are copied to the child while the corresponding rmap items are not. As a result, when the child later triggers an unmerge, there are no rmap items present in the child, so the counters remain stale, leading to incorrect accounting. A similar issue exists with `ksm_zero_pages`, which maintains both a global counter and a per-process counter. During fork, the per-process counter is inherited by the child, but the global counter is not incremented. Since the child also references zero pages, the global counter should be updated as well. Otherwise, during zero-page unmerge, both the global and per-process counters are decremented, causing the global counter to become inconsistent. To fix this, ksm_merging_pages and ksm_rmap_items are reset to 0 during fork, and the global ksm_zero_pages counter is updated with the per-process ksm_zero_pages value inherited by the child. This ensures that KSM statistics remain accurate and reflect the activity of each process correctly. Link: https://lkml.kernel.org/r/cover.1758648700.git.donettom@linux.ibm.com Link: https://lkml.kernel.org/r/7b9870eb67ccc0d79593940d9dbd4a0b39b5d396.1758648700.git.donettom@linux.ibm.com Fixes: 7609385337a4 ("ksm: count ksm merging pages for each process") Fixes: cb4df4cae4f2 ("ksm: count allocated ksm rmap_items for each process") Fixes: e2942062e01d ("ksm: count all zero pages placed by KSM") Signed-off-by: Donet Tom Reviewed-by: Chengming Zhou Acked-by: David Hildenbrand Cc: Aboorva Devarajan Cc: David Hildenbrand Cc: Donet Tom Cc: "Ritesh Harjani (IBM)" Cc: Wei Yang Cc: xu xin Cc: [6.6+] Signed-off-by: Andrew Morton commit 0efdedfa537eb534c251a5b4794caaf72cc55869 Author: Donet Tom Date: Thu Sep 18 11:11:44 2025 +0530 drivers/base/node: fix double free in register_one_node() When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure. As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free. This patch removes the redundant kfree(node) from register_one_node() to prevent the double free. Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") Signed-off-by: Donet Tom Acked-by: David Hildenbrand Acked-by: Oscar Salvador Cc: Alison Schofield Cc: Chris Mason Cc: Danilo Krummrich Cc: Dave Jiang Cc: Greg Kroah-Hartman Cc: Hiroyouki Kamezawa Cc: Joanthan Cameron Cc: "Ritesh Harjani (IBM)" Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton commit 4afb85f5e359e521ef20c0260af17a4490fc83f7 Author: Dev Jain Date: Thu Sep 18 15:04:53 2025 +0530 mm: remove PMD alignment constraint in execmem_vmalloc() When using vmalloc with VM_ALLOW_HUGE_VMAP flag, it will set the alignment to PMD_SIZE internally, if it deems huge mappings to be eligible. Therefore, setting the alignment in execmem_vmalloc is redundant. Apart from this, it also reduces the probability of allocation in case vmalloc fails to allocate hugepages - in the fallback case, vmalloc tries to use the original alignment and allocate basepages, which unfortunately will again be PMD_SIZE passed over from execmem_vmalloc, thus constraining the search for a free space in vmalloc region. Therefore, remove this constraint. Link: https://lkml.kernel.org/r/20250918093453.75676-1-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Mike Rapoport (Microsoft) Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 51032f26cff7a5ab458d549d88b905ca5bf7a7f5 Author: Manish Kumar Date: Thu Sep 18 23:15:28 2025 +0530 mm/memory_hotplug: fix typo 'esecially' -> 'especially' Link: https://lkml.kernel.org/r/20250918174528.90879-1-manish1588@gmail.com Signed-off-by: Manish Kumar Signed-off-by: Andrew Morton commit ab521b4142aa41fdf74efc20e2b1806f35dbc64b Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:11 2025 +0100 mm/rmap: improve mlock tracking for large folios The kernel currently does not mlock large folios when adding them to rmap, stating that it is difficult to confirm that the folio is fully mapped and safe to mlock it. This leads to a significant undercount of Mlocked in /proc/meminfo, causing problems in production where the stat was used to estimate system utilization and determine if load shedding is required. However, nowadays the caller passes a number of pages of the folio that are getting mapped, making it easy to check if the entire folio is mapped to the VMA. mlock the folio on rmap if it is fully mapped to the VMA. Mlocked in /proc/meminfo can still undercount, but the value is closer the truth and is useful for userspace. Link: https://lkml.kernel.org/r/20250923110711.690639-7-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand Acked-by: Johannes Weiner Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Signed-off-by: Andrew Morton commit 357b92761d942432c90aeeb965f9eb0c94466921 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:10 2025 +0100 mm/filemap: map entire large folio faultaround Currently, kernel only maps part of large folio that fits into start_pgoff/end_pgoff range. Map entire folio where possible. It will match finish_fault() behaviour that user hits on cold page cache. Mapping large folios at once will allow the rmap code to mlock it on add, as it will recognize that it is fully mapped and mlocking is safe. Link: https://lkml.kernel.org/r/20250923110711.690639-6-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 19773df031bcc67d5caa06bf0ddbbff40174be7a Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:09 2025 +0100 mm/fault: try to map the entire file folio in finish_fault() finish_fault() uses per-page fault for file folios. This only occurs for file folios smaller than PMD_SIZE. The comment suggests that this approach prevents RSS inflation. However, it only prevents RSS accounting. The folio is still mapped to the process, and the fact that it is mapped by a single PTE does not affect memory pressure. Additionally, the kernel's ability to map large folios as PMD if they are large enough does not support this argument. When possible, map large folios in one shot. This reduces the number of minor page faults and allows for TLB coalescing. Mapping large folios at once will allow the rmap code to mlock it on add, as it will recognize that it is fully mapped and mlocking is safe. Link: https://lkml.kernel.org/r/20250923110711.690639-5-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Reviewed-by: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 8c49fbafedf15149069cdb9e0d543c4a68a1c683 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:08 2025 +0100 mm/rmap: mlock large folios in try_to_unmap_one() Currently, try_to_unmap_once() only tries to mlock small folios. Use logic similar to folio_referenced_one() to mlock large folios: only do this for fully mapped folios and under page table lock that protects all page table entries. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-4-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit a2880202767daded2898f62265f6cdf4cfb53bc4 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:07 2025 +0100 mm/rmap: fix a mlock race condition in folio_referenced_one() The mlock_vma_folio() function requires the page table lock to be held in order to safely mlock the folio. However, folio_referenced_one() mlocks a large folios outside of the page_vma_mapped_walk() loop where the page table lock has already been dropped. Rework the mlock logic to use the same code path inside the loop for both large and small folios. Use PVMW_PGTABLE_CROSSED to detect when the folio is mapped across a page table boundary. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-3-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 2db579838296239545554443234fafb8f485cca0 Author: Kiryl Shutsemau Date: Tue Sep 23 12:07:06 2025 +0100 mm/page_vma_mapped: track if the page is mapped across page table boundary Patch series "mm: Improve mlock tracking for large folios", v3. The patchset includes several fixes and improvements related to mlock tracking of large folios. The main objective is to reduce the undercount of Mlocked memory in /proc/meminfo and improve the accuracy of the statistics. Patches 1-2: These patches address a minor race condition in folio_referenced_one() related to mlock_vma_folio(). Currently, mlock_vma_folio() is called on large folio without the page table lock, which can result in a race condition with unmap (i.e. MADV_DONTNEED). This can lead to partially mapped folios on the unevictable LRU list. While not a significant issue, I do not believe backporting is necessary. Patch 3: This patch adds mlocking logic similar to folio_referenced_one() to try_to_unmap_one(), allowing for mlocking of large folios where possible. Patch 4-5: These patches modifies finish_fault() and faultaround to map in the entire folio when possible, enabling efficient mlocking upon addition to the rmap. Patch 6: This patch makes rmap mlock large folios if they are fully mapped, addressing the primary source of mlock undercount for large folios. This patch (of 6): Add a PVMW_PGTABLE_CROSSSED flag that page_vma_mapped_walk() will set if the page is mapped across page table boundary. Unlike other PVMW_* flags, this one is result of page_vma_mapped_walk() and not set by the caller. folio_referenced_one() will use it to detect if it safe to mlock the folio. [akpm@linux-foundation.org: s/CROSSSED/CROSSED/] Link: https://lkml.kernel.org/r/20250923110711.690639-1-kirill@shutemov.name Link: https://lkml.kernel.org/r/20250923110711.690639-2-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Reviewed-by: Shakeel Butt Cc: Baolin Wang Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 89e688edcffee7858aa394fd107df98bfd7647a4 Author: Wei Yang Date: Wed Sep 10 09:22:40 2025 +0000 mm/compaction: fix low_pfn advance on isolating hugetlb Commit 56ae0bb349b4 ("mm: compaction: convert to use a folio in isolate_migratepages_block()") converts api from page to folio. But the low_pfn advance for hugetlb page seems wrong when low_pfn doesn't point to head page. Originally, if page is a hugetlb tail page, compound_nr() return 1, which means low_pfn only advance one in next iteration. After the change, low_pfn would advance more than the hugetlb range, since folio_nr_pages() always return total number of the large page. This results in skipping some range to isolate and then to migrate. The worst case for alloc_contig is it does all the isolation and migration, but finally find some range is still not isolated. And then undo all the work and try a new range. Advance low_pfn to the end of hugetlb. Link: https://lkml.kernel.org/r/20250910092240.3981-1-richard.weiyang@gmail.com Fixes: 56ae0bb349b4 ("mm: compaction: convert to use a folio in isolate_migratepages_block()") Signed-off-by: Wei Yang Acked-by: Zi Yan Cc: "Vishal Moola (Oracle)" Cc: Kefeng Wang Cc: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Yang Signed-off-by: Andrew Morton commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b Author: Phillip Lougher Date: Fri Sep 26 22:59:35 2025 +0100 Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [phillip@squashfs.org.uk: only need to check 64 bit quantity] Link: https://lkml.kernel.org/r/20250926222305.110103-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20250926215935.107233-1-phillip@squashfs.org.uk Fixes: 6545b246a2c8 ("Squashfs: inode operations") Signed-off-by: Phillip Lougher Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d580e5.a00a0220.303701.0019.GAE@google.com/ Cc: Amir Goldstein Cc: Signed-off-by: Andrew Morton commit 94b3f02fb33f56c896d855ccbac270766d1aa48b Author: Sahil Chandna Date: Fri Sep 26 13:20:53 2025 +0530 kallsyms: use kmalloc_array() instead of kmalloc() Replace kmalloc(sizeof(*stat) * 2, GFP_KERNEL) with kmalloc_array(2, sizeof(*stat), GFP_KERNEL) to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. Link: https://lkml.kernel.org/r/20250926075053.25615-1-chandna.linuxkernel@gmail.com Signed-off-by: Sahil Chandna Cc: Shuah Khan Cc: David Hunter Signed-off-by: Andrew Morton commit cf1bb6b2d0f24c138ddaf3e8b8ecbf90273ed558 Author: Sibi Sankar Date: Fri Sep 26 15:04:26 2025 +0530 MAINTAINERS: update Sibi Sankar's email address Switch to using oss.qualcomm.com email ID in the MAINTAINERS file. Also update mailmap to ensure proper attribution across historical commits. Link: https://lkml.kernel.org/r/20250926093426.1735334-1-sibi.sankar@oss.qualcomm.com Signed-off-by: Sibi Sankar Cc: Bjorn Andersson Cc: Carlos Bilbao Cc: Jarkko Sakkinen Cc: Shannon Nelson Signed-off-by: Andrew Morton commit dec91e7ab10ec465d59144aabe69c01723ddd1c4 Author: Phillip Lougher Date: Tue Sep 23 23:06:52 2025 +0100 Squashfs: add SEEK_DATA/SEEK_HOLE support Add support for SEEK_DATA and SEEK_HOLE lseek() whence values. These allow much faster searches for holes and data in sparse files, which can significantly speed up file copying, e.g. before (GNU coreutils, Debian 13): cp --sparse=always big-file / took real 11m58s, user 0m5.764s, sys 11m48s after: real 0.047s, user 0.000s, sys 0.027s Where big-file has a 256 GB hole followed by 47 KB of data. Link: https://lkml.kernel.org/r/20250923220652.568416-3-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher Signed-off-by: Andrew Morton commit 9ee94bfbe930a1b39df53fa2d7b31141b780eb5a Author: Phillip Lougher Date: Tue Sep 23 23:06:51 2025 +0100 Squashfs: add additional inode sanity checking Patch series "Squashfs: performance improvement and a sanity check". This patchset adds an additional sanity check when reading regular file inodes, and adds support for SEEK_DATA/SEEK_HOLE lseek() whence values. This patch (of 2): Add an additional sanity check when reading regular file inodes. A regular file if the file size is an exact multiple of the filesystem block size cannot have a fragment. This is because by definition a fragment block stores tailends which are not a whole block in size. Link: https://lkml.kernel.org/r/20250923220652.568416-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20250923220652.568416-2-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher Signed-off-by: Andrew Morton commit 1260cbcffa608219fc9188a6cbe9c45a300ef8b5 Author: Johan Hovold Date: Wed Sep 24 10:02:07 2025 +0200 lib/genalloc: fix device leak in of_gen_pool_get() Make sure to drop the reference taken when looking up the genpool platform device in of_gen_pool_get() before returning the pool. Note that holding a reference to a device does typically not prevent its devres managed resources from being released so there is no point in keeping the reference. Link: https://lkml.kernel.org/r/20250924080207.18006-1-johan@kernel.org Fixes: 9375db07adea ("genalloc: add devres support, allow to find a managed pool by device") Signed-off-by: Johan Hovold Cc: Philipp Zabel Cc: Vladimir Zapolskiy Cc: [3.10+] Signed-off-by: Andrew Morton commit 1daf37592a050da046a03f78b20abb2a91f6d934 Author: Johannes Berg Date: Wed Sep 24 11:43:04 2025 +0200 panic: remove CONFIG_PANIC_ON_OOPS_VALUE There's really no need for this since it's 0 or 1 when CONFIG_PANIC_ON_OOPS is disabled/enabled, so just use IS_ENABLED() instead. The extra symbol goes back to the original code adding it in commit 2a01bb3885c9 ("panic: Make panic_on_oops configurable"). Link: https://lkml.kernel.org/r/20250924094303.18521-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg Signed-off-by: Andrew Morton commit 8f45f089337d924db24397f55697cda0e6960516 Author: Dan Carpenter Date: Tue Sep 23 14:26:07 2025 +0300 ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free. Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace") Signed-off-by: Dan Carpenter Reviewed-by: Joseph Qi Reviewed-by: Goldwyn Rodrigues Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 99b70ece33d87500ef7bee8e32cb99772c45ce14 Author: Suchit Karunakaran Date: Tue Sep 23 22:47:21 2025 +0530 checkpatch: suppress strscpy warnings for userspace tools The checkpatch.pl script currently warns against the use of strcpy, strlcpy, and strncpy, recommending strscpy as a safer alternative. However, these warnings are also triggered for code under tools/ and scripts/, which are userspace utilities where strscpy is not available. This patch suppresses these warnings for files in tools/ and scripts/. Link: https://lkml.kernel.org/r/20250923171722.7798-1-suchitkarunakaran@gmail.com Signed-off-by: Suchit Karunakaran Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Lukas Bulwahn Cc: Shuah Khan Signed-off-by: Andrew Morton commit 20a8e0454d833d80d0c0cae304841a50a2a126bd Author: Alistair Popple Date: Tue Sep 23 10:53:33 2025 +1000 cramfs: fix incorrect physical page address calculation Commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") incorrectly replaced the pfn with the physical address when calling vmf_insert_mixed(). Instead the phys_to_pfn_t() call should have been replaced with PHYS_PFN(). Found by inspection after a similar issue was noted in fuse virtio_fs. Link: https://lkml.kernel.org/r/20250923005333.3165032-1-apopple@nvidia.com Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") Signed-off-by: Alistair Popple Reviewed-by: Dev Jain Reviewed-by: David Hildenbrand Cc: Haiyue Wang Cc: Nicolas Pitre Signed-off-by: Andrew Morton commit 634cdfd6b394cf4a5bfaeacf3b325998c752df45 Author: Demi Marie Obenour Date: Sat Sep 13 18:28:49 2025 -0400 kernel: prevent prctl(PR_SET_PDEATHSIG) from racing with parent process exit If a process calls prctl(PR_SET_PDEATHSIG) at the same time that the parent process exits, the child will write to me->pdeath_sig at the same time the parent is reading it. Since there is no synchronization, this is a data race. Worse, it is possible that a subsequent call to getppid() can continue to return the previous parent process ID without the parent death signal being delivered. This happens in the following scenario: parent child forget_original_parent() prctl(PR_SET_PDEATHSIG, SIGKILL) sys_prctl() me->pdeath_sig = SIGKILL; getppid(); RCU_INIT_POINTER(t->real_parent, reaper); if (t->pdeath_signal) /* reads stale me->pdeath_sig */ group_send_sig_info(t->pdeath_signal, ...); And in the following: parent child forget_original_parent() RCU_INIT_POINTER(t->real_parent, reaper); /* also no barrier */ if (t->pdeath_signal) /* reads stale me->pdeath_sig */ group_send_sig_info(t->pdeath_signal, ...); prctl(PR_SET_PDEATHSIG, SIGKILL) sys_prctl() me->pdeath_sig = SIGKILL; getppid(); /* reads old ppid() */ As a result, the following pattern is racy: pid_t parent_pid = getpid(); pid_t child_pid = fork(); if (child_pid == -1) { /* handle error... */ return; } if (child_pid == 0) { if (prctl(PR_SET_PDEATHSIG, SIGKILL) != 0) { /* handle error */ _exit(126); } if (getppid() != parent_pid) { /* parent died already */ raise(SIGKILL); } /* keep going in child */ } /* keep going in parent */ If the parent is killed at exactly the wrong time, the child process can (wrongly) stay running. I didn't manage to reproduce this in my testing, but I'm pretty sure the race is real. KCSAN is probably the best way to spot the race. Fix the bug by holding tasklist_lock for reading whenever pdeath_signal is being written to. This prevents races on me->pdeath_sig, and the locking and unlocking of the rwlock provide the needed memory barriers. If prctl(PR_SET_PDEATHSIG) happens before the parent exits, the signal will be sent. If it happens afterwards, a subsequent getppid() will return the new value. Link: https://lkml.kernel.org/r/20250913-fix-prctl-pdeathsig-race-v1-1-44e2eb426fe9@gmail.com Signed-off-by: Demi Marie Obenour Cc: Oleg Nesterov Cc: Mateusz Guzik Signed-off-by: Andrew Morton commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf Author: Phillip Lougher Date: Fri Sep 19 00:33:08 2025 +0100 Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0. Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk Fixes: 122601408d20 ("Squashfs: export operations") Signed-off-by: Phillip Lougher Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/ Cc: Signed-off-by: Andrew Morton commit f322a97aeb2a05b6b1ee17629145eb02e1a4c6a0 Author: Pratyush Yadav Date: Thu Sep 18 19:06:15 2025 +0200 kho: only fill kimage if KHO is finalized kho_fill_kimage() only checks for KHO being enabled before filling in the FDT to the image. KHO being enabled does not mean that the kernel has data to hand over. That happens when KHO is finalized. When a kexec is done with KHO enabled but not finalized, the FDT page is allocated but not initialized. FDT initialization happens after finalize. This means the KHO segment is filled in but the FDT contains garbage data. This leads to the below error messages in the next kernel: [ 0.000000] KHO: setup: handover FDT (0x10116b000) is invalid: -9 [ 0.000000] KHO: disabling KHO revival: -22 There is no problem in practice, and the next kernel boots and works fine. But this still leads to misleading error messages and garbage being handed over. Only fill in KHO segment when KHO is finalized. When KHO is not enabled, the debugfs interface is not created and there is no way to finalize it anyway. So the check for kho_enable is not needed, and kho_out.finalize alone is enough. Link: https://lkml.kernel.org/r/20250918170617.91413-1-pratyush@kernel.org Fixes: 3bdecc3c93f9 ("kexec: add KHO support to kexec file loads") Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Jason Gunthorpe Cc: Pasha Tatashin Cc: Signed-off-by: Andrew Morton commit f65dc3b1ab145c9b8b36301256d703c1dd153f71 Author: Roy Vegard Ovesen Date: Sun Sep 28 13:38:27 2025 +0200 ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio On the 1824c output channel 4 left/right is the S/PDIF output, so this needs to be able to be set. I'm guessing that for the 1810c since it has no output channel 4, it does not matter what the gain value of this channel is set to. Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit 0ca29010d426ed5dd08dbd2d03074d1673d963c8 Author: Roy Vegard Ovesen Date: Sun Sep 28 13:38:07 2025 +0200 ALSA: usb-audio: add the initial mix for Presonus Studio 1824c A reasonable initial mix for the 1824c is the one that Presonus Universal Control calls bypass. It mutes all the physical inputs, and connects Daw channel 1 to Line out channel 1 (left) Daw channel 2 to Line out channel 2 (right) Daw channel 3 to Line out channel 3 (left) etc. To get the most out of the 1824c a mixer application like Universal Control is needed. One is available for linux Link: https://github.com/royvegard/baton Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit eb379c3cab44831d7be156612920ae1c67e1f7a4 Merge: 6b9c4a05ae2b53 5c444aa63860f8 Author: Takashi Iwai Date: Sun Sep 28 18:45:34 2025 +0200 Merge branch 'for-linus' into for-next Pull the last minute fixes for 6.17. Signed-off-by: Takashi Iwai commit 6b9c4a05ae2b539bfd4d64a46eb861a57cc08351 Merge: a767d3583d4e80 f8b9c819ea20d1 Author: Takashi Iwai Date: Sun Sep 28 15:41:17 2025 +0200 Merge tag 'asoc-v6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.18 round 2 Some more updates for v6.18, mostly fixes for the earlier pull request with some cleanups and more minor fixes for older code. We do have one new driver, the TI TAS2783A, and some quirks for new platforms. commit 5c444aa63860f81d1f014b2b489c4206a7626c4f Merge: 9f2c0ac1423d5f 733a763dd8b3ac Author: Takashi Iwai Date: Sun Sep 28 15:38:54 2025 +0200 Merge tag 'asoc-fix-v6.17-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 A few final driver specific fixes for v6.17, none super urgent so waiting for v6.18 and backporting is probably fine for htem. commit c64c2a50cdd487e2270c875c1770cd55705d75ff Author: Jerry Hoemann Date: Tue Sep 23 13:03:52 2025 -0600 watchdog/hpwdt New maintianer Update MAINTAINERS file with new contact. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 064a97a29e3ba0e5d75b3b8ad5b762962aaad8ab Author: Michael Walle Date: Fri Sep 12 14:07:43 2025 +0200 dt-bindings: watchdog: add SMARC-sAM67 support The SMARC-sAM67 board has an on-board uC which has the same register interface as the older CPLD implementation on the SMARC-sAL28 board. Although the MCU emulates the same behavior, be prepared for any quirks and add a board specific compatible. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2ea77fca84f07849aa995271271340d262d0c2e9 Author: Hugh Dickins Date: Sat Sep 27 21:28:06 2025 -0700 modpost: Initialize builtin_modname to stop SIGSEGVs Segmentation fault ./scripts/mod/modpost -o vmlinux.symvers vmlinux.o stops the kernel build. It comes when write_vmlinux_export_c_file() tries to buf_printf alias->builtin_modname. malloc'ed memory is not necessarily zeroed. NULL new->builtin_modname before adding to aliases. Fixes: 5ab23c7923a1 ("modpost: Create modalias for builtin modules") Signed-off-by: Hugh Dickins Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/4590a243-0a7e-b7e6-e2d3-cd1b41a12237@google.com Signed-off-by: Nathan Chancellor commit 4ef77dd584cfd915526328f516fec59e3a54d66e Author: Eric Biggers Date: Sat Sep 27 17:38:33 2025 -0700 libbpf: Replace AF_ALG with open coded SHA-256 Reimplement libbpf_sha256() using some basic SHA-256 C code. This eliminates the newly-added dependency on AF_ALG, which is a problematic UAPI that is not supported by all kernels. Make libbpf_sha256() return void, since it can no longer fail. This simplifies some callers. Also drop the unnecessary 'sha_out_sz' parameter. Finally, also fix the typo in "compute_sha_udpate_offsets". Fixes: c297fe3e9f99 ("libbpf: Implement SHA256 internal helper") Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20250928003833.138407-1-ebiggers@kernel.org Signed-off-by: Alexei Starovoitov commit c7bc7e9070d6bd17fad1a3fc6a7de097834beff8 Author: pengdonglin Date: Tue Sep 16 12:47:22 2025 +0800 ACPI: APEI: Remove redundant rcu_read_lock/unlock() under spinlock Since commit a8bb74acd8efe ("rcu: Consolidate RCU-sched update-side function definitions") there is no difference between rcu_read_lock(), rcu_read_lock_bh() and rcu_read_lock_sched() in terms of RCU read section and the relevant grace period. That means that spin_lock(), which implies rcu_read_lock_sched(), also implies rcu_read_lock(). There is no need no explicitly start a RCU read section if one has already been started implicitly by spin_lock(). Simplify the code and remove the inner rcu_read_lock() invocation. Signed-off-by: pengdonglin Signed-off-by: pengdonglin Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250916044735.2316171-2-dolinux.peng@gmail.com [ rjw: Subject adjustment ] Signed-off-by: Rafael J. Wysocki commit 399dbcadc01ebf0035f325eaa8c264f8b5cd0a14 Author: Rafael J. Wysocki Date: Sun Sep 28 12:18:29 2025 +0200 ACPI: battery: Add synchronization between interface updates There is no synchronization between different code paths in the ACPI battery driver that update its sysfs interface or its power supply class device interface. In some cases this results to functional failures due to race conditions. One example of this is when two ACPI notifications: - ACPI_BATTERY_NOTIFY_STATUS (0x80) - ACPI_BATTERY_NOTIFY_INFO (0x81) are triggered (by the platform firmware) in a row with a little delay in between after removing and reinserting a laptop battery. Both notifications cause acpi_battery_update() to be called and if the delay between them is sufficiently small, sysfs_add_battery() can be re-entered before battery->bat is set which leads to a duplicate sysfs entry error: sysfs: cannot create duplicate filename '/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0A:00/power_supply/BAT1' CPU: 1 UID: 0 PID: 185 Comm: kworker/1:4 Kdump: loaded Not tainted 6.12.38+deb13-amd64 #1 Debian 6.12.38-1 Hardware name: Gateway NV44 /SJV40-MV , BIOS V1.3121 04/08/2009 Workqueue: kacpi_notify acpi_os_execute_deferred Call Trace: dump_stack_lvl+0x5d/0x80 sysfs_warn_dup.cold+0x17/0x23 sysfs_create_dir_ns+0xce/0xe0 kobject_add_internal+0xba/0x250 kobject_add+0x96/0xc0 ? get_device_parent+0xde/0x1e0 device_add+0xe2/0x870 __power_supply_register.part.0+0x20f/0x3f0 ? wake_up_q+0x4e/0x90 sysfs_add_battery+0xa4/0x1d0 [battery] acpi_battery_update+0x19e/0x290 [battery] acpi_battery_notify+0x50/0x120 [battery] acpi_ev_notify_dispatch+0x49/0x70 acpi_os_execute_deferred+0x1a/0x30 process_one_work+0x177/0x330 worker_thread+0x251/0x390 ? __pfx_worker_thread+0x10/0x10 kthread+0xd2/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 kobject: kobject_add_internal failed for BAT1 with -EEXIST, don't try to register things with the same name in the same directory. There are also other scenarios in which analogous issues may occur. Address this by using a common lock in all of the code paths leading to updates of driver interfaces: ACPI Notify () handler, system resume callback and post-resume notification, device addition and removal. This new lock replaces sysfs_lock that has been used only in sysfs_remove_battery() which now is going to be always called under the new lock, so it doesn't need any internal locking any more. Fixes: 10666251554c ("ACPI: battery: Install Notify() handler directly") Closes: https://lore.kernel.org/linux-acpi/20250910142653.313360-1-luogf2025@163.com/ Reported-by: GuangFei Luo Tested-by: GuangFei Luo Cc: 6.6+ # 6.6+ Signed-off-by: Rafael J. Wysocki commit 15cf39221e89ad413c3cc2cb8f15a2487db2ba2f Author: Kumar Kartikeya Dwivedi Date: Sat Sep 27 20:53:04 2025 +0000 selftests/bpf: Add stress test for rqspinlock in NMI Introduce a kernel module that will exercise lock acquisition in the NMI path, and bias toward creating contention such that NMI waiters end up being non-head waiters. Prior to the rqspinlock fix made in the commit 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters"), it was possible for the queueing path of non-head waiters to get stuck in NMI, which this stress test reproduces fairly easily with just 3 CPUs. Both AA and ABBA flavors are supported, and it will serve as a test case for future fixes that address this corner case. More information about the problem in question is available in the commit cited above. When the fix is reverted, this stress test will lock up the system. To enable this test automatically through the test_progs infrastructure, add a load_module_params API to exercise both AA and ABBA cases when running the test. Note that the test runs for at most 5 seconds, and becomes a noop after that, in order to allow the system to make forward progress. In addition, CPU 0 is always kept untouched by the created threads and NMIs. The test will automatically scale to the number of available online CPUs. Note that at least 3 CPUs are necessary to run this test, hence skip the selftest in case the environment has less than 3 CPUs available. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250927205304.199760-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 2085f0f4697234a0f59ed718d0e72f38688210e0 Merge: acbba7f0e5ec97 dc67521c20b701 Author: Rafael J. Wysocki Date: Sun Sep 28 12:01:58 2025 +0200 Merge tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge a thermal driver fix for 6.18 from Daniel Lezcano: "- Add missing file when importing conflicting change for the Renesas RZ/G3E thermal driver (Daniel Lezcano)" * tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC commit 137d1a6355131457723b51a34192320d93d15654 Author: Mark Bloch Date: Mon Sep 22 09:06:31 2025 +0300 net/mlx5: IFC add balance ID and LAG per MP group bits Add interface definitions for load balance ID and LAG per multiplane group functionality. This patch introduces the hardware capability bits needed to support balance ID in multiplane LAG configurations. The new fields include: - load_balance_id: 4-bit field for balance identifier. - lag_per_mp_group: capability bit for LAG per multiplane group support. These interface additions are prerequisites for implementing balance ID support in the MLX5 driver. Signed-off-by: Mark Bloch Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758521191-814350-3-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 1ddf1636e0e058adf2231486da0419243eb49539 Author: Tariq Toukan Date: Mon Sep 22 09:06:30 2025 +0300 net/mlx5: Add IFC bit for TIR/SQ order capability Before this cap, firmware requested a certain creation order between TIR objects and SQs of the same transport domain to properly support the self loopback prevention feature. If order is not preserved, explicit modify_tir operations are necessary after the opening of the SQs. When set, this cap bit indicates that this firmware requirement / limitation no longer holds. Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758521191-814350-2-git-send-email-tariqt@nvidia.com Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Leon Romanovsky commit a767d3583d4e800d6a2d0378d7e57513bb4d4bba Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:02 2025 +0800 ALSA: doc: improved docs about quirk_flags in snd-usb-audio Just briefly described about the option's change and its new usage. Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit 98b5427bb64fbc039b7715992e137a572ac14ff1 Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:01 2025 +0800 ALSA: usb-audio: make param quirk_flags change-able in runtime Change its permision from 0644 to 0444, and add runtime processing. Developers now can change it during sysfs, without rebooting, for debugging new buggy devices. Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit ffd586126a82e497e16336a1006430584d0570c4 Author: Cryolitia PukNgae Date: Sun Sep 28 11:08:00 2025 +0800 ALSA: usb-audio: improve module param quirk_flags It accepts strings like `VID:PID:quirk_flag_name1|quirk_flag_name2;...` from now on, so that we can use it to debug USB audio devices more intuitive and flexible. The compatibility of previous form is kept. Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit ce0172627390c3c3885c60093904c79fbe19c543 Author: Cryolitia PukNgae Date: Sun Sep 28 11:07:59 2025 +0800 ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* Define quirk flags enum and its name. Add helper for converting between quirk flags' name and bit. - snd_usb_quirk_flag_find_name() - snd_usb_quirk_flags_from_name() Add helper for printing debug: log snd_usb_apply_flag_dbg() Co-developed-by: Takashi Iwai Signed-off-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai commit 329bdcbbd229731dc5a8b6753aa2409f00869331 Merge: fa7d16734f9606 9f2c0ac1423d5f Author: Takashi Iwai Date: Sun Sep 28 08:34:58 2025 +0200 Merge branch 'for-linus' into for-next Pull 6.17-devel branch for applying further changes cleanly. Signed-off-by: Taksahi Iwai commit 9f2c0ac1423d5f267e7f1d1940780fc764b0fee3 Author: Jeongjun Park Date: Sun Sep 28 02:39:24 2025 +0900 ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory. Cc: Reported-by: syzbot+f02665daa2abeef4a947@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f02665daa2abeef4a947 Fixes: 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") Signed-off-by: Jeongjun Park Signed-off-by: Takashi Iwai commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c Author: Roy Vegard Ovesen Date: Sat Sep 27 17:27:30 2025 +0200 ALSA: usb-audio: add mono main switch to Presonus S1824c The 1824c does not have the A/B switch that the 1810c has, but instead it has a mono main switch that sums the two main output channels to mono. Signed-off-by: Roy Vegard Ovesen Signed-off-by: Takashi Iwai commit fa7d16734f9606c396681648618dd76a5af861e6 Author: Kriish Sharma Date: Sat Sep 27 14:27:08 2025 +0000 ALSA: compress: document 'chan_map' member in snd_dec_opus When building kernel docs, the following warning appeared: WARNING: ./include/uapi/sound/compress_params.h:364 struct member 'chan_map' not described in 'snd_dec_opus' The inline struct 'snd_dec_opus_ch_map' inside 'snd_dec_opus' was not properly documented. This patch documents the 'chan_map' member and its fields (stream_count, coupled_count, channel_map), resolving the warning. Fixes: 5d36370f3431 ("ALSA: compress: add raw opus codec define and opus decoder structs") Suggested-by: Bagas Sanjaya Signed-off-by: Kriish Sharma Signed-off-by: Takashi Iwai commit 33da2d892b6241a3e71f96acdd0e64de5d70b7f3 Author: Richard Fitzgerald Date: Tue Sep 23 14:03:26 2025 +0100 ASoC: cs35l56: Add support for CS35L56 B2 silicon This adds support for changed firmware addresses on the B2 revision of CS35L56 silicon. Signed-off-by: Richard Fitzgerald Signed-off-by: Takashi Iwai commit ab91835e61ab56d3964f51480955c9661678c269 Author: Richard Fitzgerald Date: Tue Sep 23 14:03:25 2025 +0100 ASoC: cs35l56: Set fw_regs table after getting REVID Defer setting the cs35l56_base.fw_regs pointer until after the REVID has been read in cs35l56_hw_init(). Also make the corresponding change to the cs35l56_hda drivers to prevent a build break. This is preparing for firmware registers that change address between revisions of the same device. Signed-off-by: Richard Fitzgerald Signed-off-by: Takashi Iwai commit 52e06d564ce6a5f03177922b2fa5667781d5ff83 Author: Griffin Kroah-Hartman Date: Sat Sep 27 21:14:45 2025 -0700 Input: aw86927 - add driver for Awinic AW86927 Add support for the I2C-connected Awinic AW86927 LRA haptic driver. This driver includes a hardcoded sine waveform to be uploaded to the AW86927's SRAM for haptic playback. This driver does not currently support all the capabilities of the AW86927, such as F0 calibration, RTP mode, and CONT mode. Signed-off-by: Griffin Kroah-Hartman Link: https://lore.kernel.org/r/20250925-aw86927-v3-2-1fc6265b42de@fairphone.com Signed-off-by: Dmitry Torokhov commit 9fbad55d6f9db98ab9f1d48ac5e5f8f72fbac0cc Author: Griffin Kroah-Hartman Date: Sat Sep 27 21:11:55 2025 -0700 dt-bindings: input: Add Awinic AW86927 Add bindings for the Awinic AW86927 haptic chip which can be found in smartphones. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Griffin Kroah-Hartman Link: https://lore.kernel.org/r/20250925-aw86927-v3-1-1fc6265b42de@fairphone.com Signed-off-by: Dmitry Torokhov commit 166c83f7789ed02dc1f25bc7bed4a1beb25343aa Author: Kael D'Alcamo Date: Sun Sep 21 18:11:34 2025 +0200 dt-bindings: rng: hisi-rng: convert to DT schema Convert the Devicetree binding documentation for hisilicon,hip04-rng and hisilicon,hip05-rng from plain text to YAML. Signed-off-by: Kael D'Alcamo Reviewed-by: Rob Herring (Arm) Signed-off-by: Herbert Xu commit 298ced6c3b3c116987554364998e9d8cb94e0126 Author: Bagas Sanjaya Date: Sat Sep 20 07:16:51 2025 +0700 crypto: doc - Add explicit title heading to API docs Documentation for crypto programming interfaces lack explicit title. As such, all its sections become entries in the toctree index. Add the title heading to tidy up toctree. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Herbert Xu commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 Author: Nishanth Menon Date: Fri Sep 19 08:20:02 2025 -0500 hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values. Add clock initialization code before using the clock. Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling") Signed-off-by: Nishanth Menon drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ 1 file changed, 7 insertions(+) Reviewed-by: Alexander Sverdlin Signed-off-by: Herbert Xu commit 5851afffe2ab323a53e184ba5a35fddf268f096b Author: Fan Wu Date: Mon Sep 15 21:15:50 2025 +0000 KEYS: X.509: Fix Basic Constraints CA flag parsing Fix the X.509 Basic Constraints CA flag parsing to correctly handle the ASN.1 DER encoded structure. The parser was incorrectly treating the length field as the boolean value. Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding. According to ITU-T X.690, a DER-encoded BOOLEAN is represented as: Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE) The basicConstraints extension with CA:TRUE is encoded as: SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF) ^-- v[2] ^-- v[3] ^-- v[4] The parser was checking v[3] (the length field, always 0x01) instead of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding). Also handle the case where the extension is an empty SEQUENCE (30 00), which is valid for CA:FALSE when the default value is omitted as required by DER encoding rules (X.690 section 11.5). Per ITU-T X.690-0207: - Section 11.5: Default values must be omitted in DER - Section 11.1: DER requires TRUE to be encoded as 0xFF Link: https://datatracker.ietf.org/doc/html/rfc5280 Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA") Signed-off-by: Fan Wu Reviewed-by: Lukas Wunner Signed-off-by: Herbert Xu commit 40d4c761200b796a44bf2c7675ae09c87b17d4af Author: Takashi Sakamoto Date: Sun Sep 28 10:19:10 2025 +0900 firewire: core: fix undefined reference error in ARM EABI For ARM EABI, GCC generates a reference to __aeabi_uldivmod when compiling a division of 64-bit integer with 32-bit integer. This function is not available in Linux kernel. In such cases, helper macros are defined in include/linux/math64.h. This commit replaces the division with div_u64(). Fixes: 8ec6a8ec23b9 ("firewire: core: suppress overflow warning when computing jiffies from isochronous cycle") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509270428.FZaO2PPq-lkp@intel.com/ Link: https://lore.kernel.org/r/20250928011910.581475-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 2f7d98f10b8f64525b2c74cae7d70ae5278eb654 Author: Al Viro Date: Sun Jul 20 15:32:31 2025 -0400 Have cc(1) catch attempts to modify ->f_path There are very few places that have cause to do that - all in core VFS now, and all done to files that are not yet opened (or visible to anybody else, for that matter). Let's turn f_path into a union of struct path __f_path and const struct path f_path. It's C, not C++ - 6.5.2.3[4] in C99 and later explicitly allows that kind of type-punning. That way any attempts to bypass these checks will be either very easy to catch, or (if the bastards get sufficiently creative to make it hard to spot with grep alone) very clearly malicious - and still catchable with a bit of instrumentation for sparse. Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ae8425014ddc0e9a852f28ce8fcb952644a8520f Merge: cdc59a62bccadf 1b25dea3867abc a79765248649de Author: Al Viro Date: Sat Sep 27 20:18:21 2025 -0400 Merge branches 'work.path' and 'work.mount' into work.f_path commit cdc59a62bccadf104159547690a06d2b9aa88085 Author: Al Viro Date: Sun Jul 6 16:38:13 2025 -0400 kernel/acct.c: saner struct file treatment Instead of switching ->f_path.mnt of an opened file to internal clone, get a struct path with ->mnt set to internal clone of that ->f_path.mnt, then dentry_open() that to get the file with right ->f_path.mnt from the very beginning. The only subtle part here is that on failure exits we need to close the file with __fput_sync() and make sure we do that *before* dropping the original mount. With that done, only fs/{file_table,open,namei}.c ever store anything to file->f_path and only prior to file->f_mode & FMODE_OPENED becoming true. Analysis of mount write count handling also becomes less brittle and convoluted... [AV: folded a fix for a bug spotted by Jan Kara - we do need a full-blown open of the original file, not just user_path_at() or we end up skipping permission checks] Reviewed-by: Jan Kara Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit cb3005d4c490fe2489accd5408592683d705b455 Author: Jarkko Nikula Date: Fri Aug 8 16:09:56 2025 +0300 i2c: i801: Add support for Intel Wildcat Lake-U Add SMBus IDs on Intel Wildcat Lake-U. Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit ec67ef0a501d7dc915d84c0ada4ab3697adfa1d9 Author: AngeloGioacchino Del Regno Date: Wed Jun 11 13:08:00 2025 +0200 dt-bindings: i2c: i2c-mt65xx: Add MediaTek MT8196/6991 compatibles Add support for the MediaTek MT8196 Chromebook SoC and for its close relative, the MediaTek Dimensity 9400 MT6991 SoC. Those chips' multiple I2C controller instances are compatible with the ones found in the MT8188 SoC. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley [wsa: rebased] Signed-off-by: Wolfram Sang commit dc67521c20b701b5237ff486ae078829dc1f8fea Author: John Madieu Date: Sat Sep 27 23:08:24 2025 +0200 thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC When applied the change commit 19d3a401a617, a conflict appeared resulting into a manual fix. However the new file rzg3e_thermal.c was not added but stayed locally in source tree and miss to be merged with the entire change. Fix this by adding the file back. Fixes: 19d3a401a617 ("Add thermal driver for the Renesas RZ/G3E SoC") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509272225.sARVqv2G-lkp@intel.com Signed-off-by: John Madieu Signed-off-by: Daniel Lezcano commit c07b3e60b4d853056f696c449d4d47701dc9f36f Merge: c149841b069ccc 217f92d91c9fae Author: Wolfram Sang Date: Sun Sep 28 00:10:34 2025 +0200 Merge tag 'i2c-host-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.18 - Add support for MediaTek MT6878 I2C - Drop support for S3C2410 commit 720a485d12c590750f40f4ffbe41e36725f43f3d Author: Eric Biggers Date: Sat Aug 9 10:19:41 2025 -0700 KEYS: trusted_tpm1: Move private functionality out of public header Move functionality used only by trusted_tpm1.c out of the public header . Specifically, change the exported functions into static functions, since they are not used outside trusted_tpm1.c, and move various other definitions and inline functions to trusted_tpm1.c. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 366284cfbc8ff4110c00fc23285449f53df739a7 Author: Eric Biggers Date: Sat Aug 9 10:19:40 2025 -0700 KEYS: trusted_tpm1: Use SHA-1 library instead of crypto_shash Use the SHA-1 and HMAC-SHA1 library functions instead of crypto_shash. This is simpler and faster. Replace the selection of CRYPTO, CRYPTO_HMAC, and CRYPTO_SHA1 with CRYPTO_LIB_SHA1 and CRYPTO_LIB_UTILS. The latter is needed for crypto_memneq() which was previously being pulled in via CRYPTO. Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit eed0e3d305530066b4fc5370107cff8ef1a0d229 Author: Eric Biggers Date: Sat Aug 9 10:19:39 2025 -0700 KEYS: trusted_tpm1: Compare HMAC values in constant time To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq(). [For the Fixes commit I used the commit that introduced the memcmp(). It predates the introduction of crypto_memneq(), but it was still a bug at the time even though a helper function didn't exist yet.] Fixes: d00a1c72f7f4 ("keys: add new trusted key-type") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f12b69d8f22824a07f17c1399c99757072de73e0 Author: Sven Eckelmann Date: Sat Sep 27 19:39:08 2025 +0200 batman-adv: Release references to inactive interfaces Trying to dump the originators or the neighbors via netlink for a meshif with an inactive primary interface is not allowed. The dump functions were checking this correctly but they didn't handle non-existing primary interfaces and existing _inactive_ interfaces differently. (Primary) batadv_hard_ifaces hold a references to a net_device. And accessing them is only allowed when either being in a RCU/spinlock protected section or when holding a valid reference to them. The netlink dump functions use the latter. But because the missing specific error handling for inactive primary interfaces, the reference was never dropped. This reference counting error was only detected when the interface should have been removed from the system: unregister_netdevice: waiting for batadv_slave_0 to become free. Usage count = 2 Cc: stable@vger.kernel.org Fixes: 6ecc4fd6c2f4 ("batman-adv: netlink: reduce duplicate code by returning interfaces") Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit e835faaed2f80ee8652f59a54703edceab04f0d9 Author: Akiva Goldberger Date: Thu Sep 25 13:45:30 2025 +0300 net/mlx5: Expose uar access and odp page fault counters Add three counters to vnic health reporter: bar_uar_access, odp_local_triggered_page_fault, and odp_remote_triggered_page_fault. - bar_uar_access number of WRITE or READ access operations to the UAR on the PCIe BAR. - odp_local_triggered_page_fault number of locally-triggered page-faults due to ODP. - odp_remote_triggered_page_fault number of remotly-triggered page-faults due to ODP. Example access: $ devlink health diagnose pci/0000:08:00.0 reporter vnic vNIC env counters: total_error_queues: 0 send_queue_priority_update_flow: 0 comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 invalid_command: 0 quota_exceeded_command: 0 nic_receive_steering_discard: 0 icm_consumption: 1032 bar_uar_access: 1279 odp_local_triggered_page_fault: 20 odp_remote_triggered_page_fault: 34 Signed-off-by: Akiva Goldberger Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758797130-829564-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit be812ace0378a9db86344ad637c5ed2a5d11f216 Author: Gustavo A. R. Silva Date: Tue Sep 9 14:13:35 2025 +0200 Bluetooth: Avoid a couple dozen -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the __struct_group() helper to fix 31 instances of the following type of warnings: 30 net/bluetooth/mgmt_config.c:16:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 1 net/bluetooth/mgmt_config.c:22:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c Author: Luiz Augusto von Dentz Date: Fri Sep 19 12:30:05 2025 -0400 Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements When creating an advertisement for BIG the address shall not be non-resolvable since in case of acting as BASS/Broadcast Assistant the address must be the same as the connection in order to use the PAST method and even when PAST/BASS are not in the picture a Periodic Advertisement can still be synchronized thus the same argument as to connectable advertisements still stand. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Luiz Augusto von Dentz Reviewed-by: Paul Menzel commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac Author: Pauli Virtanen Date: Mon Sep 22 21:11:22 2025 +0300 Bluetooth: ISO: don't leak skb in ISO_CONT RX For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the skb is leaked. Free skb after copying its data. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 6ba85da5804efffe15c89b03742ea868f20b4172 Author: Pauli Virtanen Date: Mon Sep 22 21:11:21 2025 +0300 Bluetooth: ISO: free rx_skb if not consumed If iso_conn is freed when RX is incomplete, free any leftover skb piece. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 Author: Luiz Augusto von Dentz Date: Mon Sep 22 16:27:51 2025 -0400 Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz commit ecb9a843be4d6fd710d7026e359f21015a062572 Author: Luiz Augusto von Dentz Date: Mon Sep 22 13:13:13 2025 -0400 Bluetooth: SCO: Fix UAF on sco_conn_free BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731 __do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: cen zhang Signed-off-by: Luiz Augusto von Dentz commit ca94b2b036c22556c3a66f1b80f490882deef7a6 Author: Ivan Pravdin Date: Sat Aug 30 16:03:40 2025 -0400 Bluetooth: bcsp: receive data only if registered Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin Signed-off-by: Luiz Augusto von Dentz commit 70cd38d22d4659ca8133c7124528c90678215dda Author: Chris Lu Date: Thu Sep 4 19:46:11 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 Add VID 13d3 & PID 3633 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3633 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 576952cf981b7d2b7d3227b246b4326e5548a133 Author: Chris Lu Date: Thu Sep 4 15:58:00 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925 Add VID 13d3 & PID 3627 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=07 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3627 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Signed-off-by: Luiz Augusto von Dentz commit 93f06f8f0daf43d87b4f61a3535a9cda62c61dd7 Author: Calvin Owens Date: Mon Aug 25 21:11:08 2025 -0700 Bluetooth: remove duplicate h4_recv_buf() in header The "h4_recv.h" header contains a duplicate h4_recv_buf() that is nearly but not quite identical to the h4_recv_buf() in hci_h4.c. This duplicated header was added in commit 07eb96a5a7b0 ("Bluetooth: bpa10x: Use separate h4_recv_buf helper"). I wasn't able to find any explanation for duplicating the code in the discussion: https://lore.kernel.org/all/20180320181855.37297-1-marcel@holtmann.org/ https://lore.kernel.org/all/20180324091954.73229-2-marcel@holtmann.org/ Unfortunately, in the years since, several other drivers have come to also rely on this duplicated function, probably by accident. This is, at the very least, *extremely* confusing. It's also caused real issues when it's become out-of-sync, see the following: ef564119ba83 ("Bluetooth: hci_h4: Add support for ISO packets") 61b27cdf025b ("Bluetooth: hci_h4: Add support for ISO packets in h4_recv.h") This is the full diff between the two implementations today: --- orig.c +++ copy.c @@ -1,117 +1,100 @@ { - struct hci_uart *hu = hci_get_drvdata(hdev); - u8 alignment = hu->alignment ? hu->alignment : 1; - /* Check for error from previous call */ if (IS_ERR(skb)) skb = NULL; while (count) { int i, len; - /* remove padding bytes from buffer */ - for (; hu->padding && count > 0; hu->padding--) { - count--; - buffer++; - } - if (!count) - break; - if (!skb) { for (i = 0; i < pkts_count; i++) { if (buffer[0] != (&pkts[i])->type) continue; skb = bt_skb_alloc((&pkts[i])->maxlen, GFP_ATOMIC); if (!skb) return ERR_PTR(-ENOMEM); hci_skb_pkt_type(skb) = (&pkts[i])->type; hci_skb_expect(skb) = (&pkts[i])->hlen; break; } /* Check for invalid packet type */ if (!skb) return ERR_PTR(-EILSEQ); count -= 1; buffer += 1; } len = min_t(uint, hci_skb_expect(skb) - skb->len, count); skb_put_data(skb, buffer, len); count -= len; buffer += len; /* Check for partial packet */ if (skb->len < hci_skb_expect(skb)) continue; for (i = 0; i < pkts_count; i++) { if (hci_skb_pkt_type(skb) == (&pkts[i])->type) break; } if (i >= pkts_count) { kfree_skb(skb); return ERR_PTR(-EILSEQ); } if (skb->len == (&pkts[i])->hlen) { u16 dlen; switch ((&pkts[i])->lsize) { case 0: /* No variable data length */ dlen = 0; break; case 1: /* Single octet variable length */ dlen = skb->data[(&pkts[i])->loff]; hci_skb_expect(skb) += dlen; if (skb_tailroom(skb) < dlen) { kfree_skb(skb); return ERR_PTR(-EMSGSIZE); } break; case 2: /* Double octet variable length */ dlen = get_unaligned_le16(skb->data + (&pkts[i])->loff); hci_skb_expect(skb) += dlen; if (skb_tailroom(skb) < dlen) { kfree_skb(skb); return ERR_PTR(-EMSGSIZE); } break; default: /* Unsupported variable length */ kfree_skb(skb); return ERR_PTR(-EILSEQ); } if (!dlen) { - hu->padding = (skb->len + 1) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - /* No more data, complete frame */ (&pkts[i])->recv(hdev, skb); skb = NULL; } } else { - hu->padding = (skb->len + 1) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - /* Complete frame */ (&pkts[i])->recv(hdev, skb); skb = NULL; } } return skb; } -EXPORT_SYMBOL_GPL(h4_recv_buf) As I read this: If alignment is one, and padding is zero, padding remains zero throughout the loop. So it seems to me that the two functions behave strictly identically in that case. All the duplicated defines are also identical, as is the duplicated h4_recv_pkt structure declaration. All four drivers which use the duplicated function use the default alignment of one, and the default padding of zero. I therefore conclude the duplicate function may be safely replaced with the core one. I raised this in an RFC a few months ago, and didn't get much interest: https://lore.kernel.org/all/CABBYNZ+ONkYtq2fR-8PtL3X-vetvJ0BdP4MTw9cNpjLDzG3HUQ@mail.gmail.com/ ...but I'm still wary I've missed something, and I'd really appreciate more eyeballs on it. I tested this successfully on btnxpuart a few months ago, but unfortunately I no longer have access to that hardware. Cc: Marcel Holtmann Signed-off-by: Calvin Owens Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c Author: Arkadiusz Bokowy Date: Wed Aug 27 18:40:16 2025 +0200 Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames Some Barrot based USB Bluetooth dongles erroneously send one extra random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The consequence of that is that the next HCI transfer is misaligned by one byte causing undefined behavior. In most cases the response event for the next command fails with random error code. Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI controller initialization, the initialization fails rendering the USB dongle not usable. > [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd > [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 > [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0 > [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter > [61.720116] Bluetooth: hci1: command 0x1005 tx timeout > [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110 This patch was tested with the 33fa:0012 device. The info from the /sys/kernel/debug/usb/devices is shown below: T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=33fa ProdID=0012 Rev=88.91 S: Product=UGREEN BT6.0 Adapter C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Now the device is initialized properly: > [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg > [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91 > [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0 > [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter > [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes > [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes > [43.750141] Bluetooth: MGMT ver 1.23 Link: https://github.com/bluez/bluez/issues/1326 Signed-off-by: Arkadiusz Bokowy Tested-by: Arkadiusz Bokowy Signed-off-by: Luiz Augusto von Dentz commit 48a258b198c12685747beaf6392f2b68e6c542c2 Author: Luiz Augusto von Dentz Date: Wed Aug 20 12:21:09 2025 -0400 Bluetooth: hci_core: Print information of hcon on hci_low_sent This prints the information about the hcon on hci_low_sent to confirm all connection are being processed. Signed-off-by: Luiz Augusto von Dentz commit 3c34d6428740e47b29ae3afd85d6f9eb656a3ea3 Author: Luiz Augusto von Dentz Date: Tue Aug 19 15:31:28 2025 -0400 Bluetooth: hci_core: Print number of packets in conn->data_q This attempts to print the number of packets pending to be transmitted in the conn->data_q. Signed-off-by: Luiz Augusto von Dentz commit 9eb14331885b09adfa7fe69a5a4603e24909c88f Author: Luiz Augusto von Dentz Date: Mon Aug 18 16:43:53 2025 -0400 Bluetooth: Add function and line information to bt_dbg When enabling debug via CONFIG_BT_FEATURE_DEBUG include function and line information by default otherwise it is hard to make any sense of which function the logs comes from. Signed-off-by: Luiz Augusto von Dentz commit 79e562a52adea4afa0601a15964498fae66c823c Author: Luiz Augusto von Dentz Date: Wed Aug 20 08:50:12 2025 -0400 Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO was not called with a specific index which breaks the likes of bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an adapter is plugged, so instead of depending hdev not to be set just enable the UUID on any index like it was done with iso_sock_uuid. Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled") Signed-off-by: Luiz Augusto von Dentz commit c9beb36c14660713b948e289b1e352cc3d386d44 Author: Luiz Augusto von Dentz Date: Wed Aug 13 15:57:39 2025 -0400 Bluetooth: hci_core: Detect if an ISO link has stalled This attempts to detect if an ISO link has been waiting for an ISO buffer for longer than the maximum allowed transport latency then proceed to use hci_link_tx_to which prints an error and disconnects. Signed-off-by: Luiz Augusto von Dentz commit 339a87883a14d6a818ca436fed41aa5d10e0f4bd Author: Luiz Augusto von Dentz Date: Wed Aug 13 15:21:19 2025 -0400 Bluetooth: ISO: Use sk_sndtimeo as conn_timeout This aligns the usage of socket sk_sndtimeo as conn_timeout when initiating a connection and then use it when scheduling the resulting HCI command, similar to what has been done in bf98feea5b65 ("Bluetooth: hci_conn: Always use sk_timeo as conn_timeout"). Signed-off-by: Luiz Augusto von Dentz commit 69a86cc17811c411fe336eb484a23bc0b425a814 Author: Luiz Augusto von Dentz Date: Fri Jun 27 11:18:30 2025 -0400 Bluetooth: HCI: Fix using LE/ACL buffers for ISO packets ISO packets shall not use LE/ACL buffer pool, that feature seem to be exclusive to LE-ACL only. Signed-off-by: Luiz Augusto von Dentz commit d79c7d01f1c8bcf9a48337c8960d618fbe31fc0c Author: Luiz Augusto von Dentz Date: Fri Jun 27 11:18:29 2025 -0400 Bluetooth: ISO: Don't initiate CIS connections if there are no buffers If the controller has no buffers left return -ENOBUFF to indicate that iso_cnt might be out of sync. Signed-off-by: Luiz Augusto von Dentz commit 8183c8ea8762b1de6d2e32f36531d6ea81878f11 Author: Bartosz Golaszewski Date: Mon Aug 11 17:04:00 2025 +0200 MAINTAINERS: add a sub-entry for the Qualcomm bluetooth driver Patches modifying drivers/bluetooth/hci_qca.c should be Cc'ed to the linux-arm-msm mailing list so that Qualcomm maintainers and reviewers can get notified about proposed changes to it. Add a sub-entry that adds the mailing list to the list of addresses returned by get_maintainer.pl. Acked-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 58fddb364dd5c4e9bf223a2113a42538d9c040de Author: Kiran K Date: Wed Aug 6 12:18:49 2025 +0530 Bluetooth: btintel_pcie: Refactor Device Coredump As device coredumps are not HCI traces, maintain the device coredump at the driver level and eliminate the dependency on hdev_devcd*() Signed-off-by: Kiran K Fixes: 07e6bddb54b4 ("Bluetooth: btintel_pcie: Add support for device coredump") Signed-off-by: Luiz Augusto von Dentz commit 5967c08545e9d591e06c205b74fd25f8a702029c Author: Thorsten Blum Date: Mon Aug 11 11:19:06 2025 +0200 Bluetooth: btintel_pcie: Use strscpy() instead of strscpy_pad() kzalloc() already zero-initializes the destination buffer 'data', making strscpy() sufficient for safely copying 'name'. The additional NUL-padding performed by strscpy_pad() is unnecessary. Add a new local variable to store the length of 'name' and reuse it instead of recalculating the same length. Signed-off-by: Thorsten Blum Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit d4e99db3d942c8099006f3b7536bc52f766b475a Author: Thorsten Blum Date: Sun Aug 10 23:53:20 2025 +0200 Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le() Add the __counted_by_le() compiler attribute to the flexible array member 'supported_commands' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Signed-off-by: Luiz Augusto von Dentz commit 3e94262921990e2884ff7a49064c12fb6d3a0733 Author: Chandrashekar Devegowda Date: Thu Jul 31 16:47:11 2025 +0530 Bluetooth: btintel_pcie: Define hdev->wakeup() callback Implement hdev->wakeup() callback to support Wake On BT feature. Test steps: 1. echo enabled > /sys/bus/pci/devices/0000:00:14.7/power/wakeup 2. connect bluetooth hid device 3. put the system to suspend - rtcwake -m mem -s 300 4. press any key on hid to wake up the system Signed-off-by: Kiran K Signed-off-by: Chandrashekar Devegowda Signed-off-by: Luiz Augusto von Dentz commit 34ecb8760190606472f71ebf4ca2817928ce5d40 Author: Zenm Chen Date: Sat Jul 26 00:14:32 2025 +0800 Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 Add USB ID 2001:332a for D-Link AX9U rev. A1 which is based on a Realtek RTL8851BU chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2001 ProdID=332a Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00e04c000001 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu_git E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org # 6.12.x Signed-off-by: Zenm Chen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit ee333727de222345e8c0a1ddcb8141e176fc147a Author: Luiz Augusto von Dentz Date: Mon Jul 28 14:05:14 2025 -0400 Bluetooth: btintel_pcie: Move model comment before its definition This prevents the comments going over 80 columns which is still required for Bluetooth code. Signed-off-by: Luiz Augusto von Dentz commit 04efaba1d7615a000195762e9f1dac69bd3b089a Author: Kiran K Date: Mon Jul 28 21:19:09 2025 +0530 Bluetooth: btintel_pcie: Add id of Scorpious, Panther Lake-H484 sudo lspci -v -k -d 8086:e376 00:14.7 Bluetooth: Intel Corporation Device e376 Subsystem: Intel Corporation Device 0011 Flags: bus master, fast devsel, latency 0, IRQ 16, IOMMU group 14 Memory at 14815368000 (64-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [80] MSI-X: Enable+ Count=32 Masked- Capabilities: [100] Latency Tolerance Reporting Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie Reviewed-by: Paul Menzel Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 2bae7d46149339905a4b89543c5c5b98c1771b30 Author: Kiran K Date: Mon Jul 28 21:19:08 2025 +0530 Bluetooth: btintel_pcie: Add Bluetooth core/platform as comments Add Bluetooth CNVi core and platform names to the PCI device table for each device ID as a comment. Reviewed-by: Paul Menzel Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit e57362f4911b025c31e032c7e1c67389b7eb8dd1 Author: Chandrashekar Devegowda Date: Fri Jul 25 14:31:33 2025 +0530 Bluetooth: btintel_pcie: Add support for _suspend() / _resume() This patch implements _suspend() and _resume() functions for the Bluetooth controller. When the system enters a suspended state, the driver notifies the controller to perform necessary housekeeping tasks by writing to the sleep control register and waits for an alive interrupt. The firmware raises the alive interrupt when it has transitioned to the D3 state. The same flow occurs when the system resumes. Command to test host initiated wakeup after 60 seconds sudo rtcwake -m mem -s 60 dmesg log (tested on Whale Peak2 on Panther Lake platform) On system suspend: [Fri Jul 25 11:05:37 2025] Bluetooth: hci0: device entered into d3 state from d0 in 80 us On system resume: [Fri Jul 25 11:06:36 2025] Bluetooth: hci0: device entered into d0 state from d3 in 7117 us Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Signed-off-by: Arnd Bergmann Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 926e8bfaaa11471b3df25befc284da62b11a1e92 Author: Kiran K Date: Thu Jul 24 17:58:24 2025 +0530 Bluetooth: btintel: Add support for BlazarIW core Add support for the BlazarIW Bluetooth core used in the Wildcat Lake platform. HCI traces: < HCI Command: Intel Read Version (0x3f|0x0005) plen 1 Requested Type: All Supported Types(0xff) > HCI Event: Command Complete (0x0e) plen 122 Intel Read Version (0x3f|0x0005) ncmd 1 Status: Success (0x00) ..... CNVi BT(18): 0x00223700 - BlazarIW(0x22) ..... ..... Signed-off-by: Vijay Satija Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 0e8e60e86cf3292e747a0fa7cc13127f290323ad Author: Daniel Borkmann Date: Fri Sep 26 19:12:01 2025 +0200 selftests/bpf: Add test case for different expected_attach_type Add a small test case which adds two programs - one calling the other through a tailcall - and check that BPF rejects them in case of different expected_attach_type values: # ./vmtest.sh -- ./test_progs -t xdp_devmap [...] #641/1 xdp_devmap_attach/DEVMAP with programs in entries:OK #641/2 xdp_devmap_attach/DEVMAP with frags programs in entries:OK #641/3 xdp_devmap_attach/Verifier check of DEVMAP programs:OK #641/4 xdp_devmap_attach/DEVMAP with programs in entries on veth:OK #641 xdp_devmap_attach:OK Summary: 2/4 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250926171201.188490-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 4540aed51b12bc13364149bf95f6ecef013197c0 Author: Daniel Borkmann Date: Fri Sep 26 19:12:00 2025 +0200 bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue. Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reviewed-by: Dongliang Mu Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 528f218b31aac4bbfc58914d43766a22ab545d48 Author: Randall P. Embry Date: Fri Sep 26 18:27:31 2025 +0900 9p: sysfs_init: don't hardcode error to ENOMEM v9fs_sysfs_init() always returned -ENOMEM on failure; return the actual sysfs_create_group() error instead. Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 Author: Randall P. Embry Date: Fri Sep 26 18:27:30 2025 +0900 9p: fix /sys/fs/9p/caches overwriting itself caches_show() overwrote its buffer on each iteration, so only the last cache tag was visible in sysfs output. Properly append with snprintf(buf + count, …). Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 623fa18f6c94e589b29c4e6277943364f1bb71d6 Author: Randall P. Embry Date: Fri Sep 26 18:27:29 2025 +0900 9p: clean up comment typos Fix a few minor typos in comments (e.g. "trasnport" → "transport"). Signed-off-by: Randall P. Embry Message-ID: <20250926-v9fs_misc-v1-1-a8b3907fc04d@codewreck.org> Signed-off-by: Dominique Martinet commit 632d31067be2f414c57955efcf29c79290cc749b Author: Pin-yen Lin Date: Fri Sep 26 18:23:18 2025 +0800 PM: sleep: Do not wait on SYNC_STATE_ONLY device links Device links with DL_FLAG_SYNC_STATE_ONLY should not affect system suspend and resume, and functions like device_reorder_to_tail() and device_link_add() don't try to reorder the consumers with that flag. However, dpm_wait_for_consumers() and dpm_wait_for_suppliers() don't check thas flag before triggering dpm_wait(), leading to potential hang during suspend/resume. This can be reproduced on MT8186 Corsola Chromebook with devicetree like: usb-a-connector { compatible = "usb-a-connector"; port { usb_a_con: endpoint { remote-endpoint = <&usb_hs>; }; }; }; usb_host { compatible = "mediatek,mt8186-xhci", "mediatek,mtk-xhci"; port { usb_hs: endpoint { remote-endpoint = <&usb_a_con>; }; }; }; In this case, the two nodes form a cycle and a SYNC_STATE_ONLY devlink between usb_host (supplier) and usb-a-connector (consumer) is created. Address this by exporting device_link_flag_is_sync_state_only() and making dpm_wait_for_consumers() and dpm_wait_for_suppliers() use it when deciding if dpm_wait() should be called. Fixes: 05ef983e0d65a ("driver core: Add device link support for SYNC_STATE_ONLY flag") Signed-off-by: Pin-yen Lin Link: https://patch.msgid.link/20250926102320.4053167-1-treapking@chromium.org [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 50a098e3e9b1bb30cefc43cdfba3c7b9b32e14a7 Author: Takashi Iwai Date: Sat Sep 27 11:47:23 2025 +0200 ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 HP-Spectre 14t-ea100 model has no speaker output unless booting previously from Windows on dual boot, a reboot while on Linux will stop the speakers working. Applying the existing quirk for HP Spectre X360 EU0xxx seems fixing this speaker problem. Reported-by: Kaden Berger Cc: Link: https://lore.kernel.org/aMxdGAmfOQ6VPNU8@archlinux Signed-off-by: Takashi Iwai commit fed7eaa4f037361fe4f3d4170649d6849a25998d Author: Brian Norris Date: Thu Sep 25 12:42:16 2025 -0700 PM: runtime: Update kerneldoc return codes APIs based on __pm_runtime_idle() (pm_runtime_idle(), pm_request_idle()) do not return 1 when already suspended. They return -EAGAIN. This is already covered in the docs, so the entry for "1" is redundant and conflicting. (pm_runtime_put() and pm_runtime_put_sync() were previously incorrect, but that's fixed in "PM: runtime: pm_runtime_put{,_sync}() returns 1 when already suspended", to ensure consistency with APIs like pm_runtime_put_autosuspend().) RPM_GET_PUT APIs based on __pm_runtime_suspend() do return 1 when already suspended, but the language is a little unclear -- it's not really an "error", so it seems better to list as a clarification before the 0/success case. Additionally, they only actually return 1 when the refcount makes it to 0; if the usage counter is still non-zero, we return 0. pm_runtime_put(), etc., also don't appear at first like they can ever see "-EAGAIN: Runtime PM usage_count non-zero", because in non-racy conditions, pm_runtime_put() would drop its reference count, see it's non-zero, and return early (in __pm_runtime_idle()). However, it's possible to race with another actor that increments the usage_count afterward, since rpm_idle() is protected by a separate lock; in such a case, we may see -EAGAIN. Because this case is only seen in the presence of concurrent actors, it makes sense to clarify that this is when "usage_count **became** non-zero", by way of some racing actor. Lastly, pm_runtime_put_sync_suspend() duplicated some -EAGAIN language. Fix that. Fixes: 271ff96d6066 ("PM: runtime: Document return values of suspend-related API functions") Link: https://lore.kernel.org/linux-pm/aJ5pkEJuixTaybV4@google.com/ Signed-off-by: Brian Norris Reviewed-by: Sakari Ailus Cc: 6.17+ # 6.17+ Signed-off-by: Rafael J. Wysocki commit d0b8651a026125d58b50b464aeb78f2c5956179f Author: Brian Norris Date: Thu Sep 25 12:42:15 2025 -0700 PM: runtime: Make put{,_sync}() return 1 when already suspended The pm_runtime.h docs say pm_runtime_put() and pm_runtime_put_sync() return 1 when already suspended, but this is not true -- they return -EAGAIN. On the other hand, pm_runtime_put_sync_suspend() and pm_runtime_put_sync_autosuspend() *do* return 1. This is an artifact of the fact that the former are built on rpm_idle(), whereas the latter are built on rpm_suspend(). There are precious few pm_runtime_put()/pm_runtime_put_sync() callers that check the return code at all, but most of them only log errors, and usually only for negative error codes. None of them should be treating this as an error, so: * at best, this may fix some case where a driver treats this condition as an error, when it shouldn't; * at worst, this should make no effect; and * somewhere in between, we could potentially clear up non-fatal log messages. Fix the pm_runtime_already_suspended_test() while tweaking the behavior. The test makes a lot more sense when these all return 1 when the device is already suspended: pm_runtime_put_sync(dev); pm_runtime_suspend(dev); pm_runtime_autosuspend(dev); pm_request_autosuspend(dev); pm_runtime_put_sync_autosuspend(dev); Notably, I've avoided testing the return codes for these, since they really should be ignored by callers, and we may make them 'void' altogether: pm_runtime_put(dev); pm_runtime_put_autosuspend(dev); Signed-off-by: Brian Norris Reviewed-by: Dhruva Gole Reviewed-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki commit 7f7acd193ba8aaa8ed07cfadc335bb17a991fd42 Author: Brian Norris Date: Thu Sep 25 12:42:14 2025 -0700 PM: runtime: Add basic kunit tests for API contracts In exploring the various return codes and failure modes of runtime PM APIs, I found it helpful to verify and codify many of them in unit tests, especially given that even the kerneldoc can be rather complex to reason through, and it also has had subtle errors of its own. Notably, I avoid testing the return codes for pm_runtime_put() and pm_runtime_put_autosuspend(), since code that checks them is probably wrong, and we're considering making them return 'void' altogether. I still test the sync() variants, since those have a bit more meaning to them. Signed-off-by: Brian Norris Signed-off-by: Rafael J. Wysocki commit 4b2113413e76213cb36e30e6d5299208254d9369 Author: Jiapeng Chong Date: Fri Sep 26 17:52:40 2025 +0800 bpftool: Remove duplicate string.h header ./tools/bpf/bpftool/sign.c: string.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25502 Signed-off-by: Jiapeng Chong Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250926095240.3397539-2-jiapeng.chong@linux.alibaba.com Signed-off-by: Alexei Starovoitov commit 87608c2a7718dcac5deef801fb3c18cf36fb0233 Author: Jiapeng Chong Date: Fri Sep 26 17:52:39 2025 +0800 bpf: Remove duplicate crypto/sha2.h header ./include/linux/bpf.h: crypto/sha2.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=25501 Signed-off-by: Jiapeng Chong Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20250926095240.3397539-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Alexei Starovoitov commit 05b7e10687c69e0c28e62b9a74ce78b3e7463806 Author: Crystal Wood Date: Sat Sep 6 21:23:25 2025 -0500 tools/rtla: Add remaining support for osnoise actions The basic functionality came with the consolidation; now hook up the command line options, and add documentation and tests. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-8-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 3cd6b18d1025f2fca991c5d9543396892df3a8dd Author: Crystal Wood Date: Sat Sep 6 21:23:24 2025 -0500 tools/rtla: Add test engine support for unexpected output Add a check() parameter to indicate which text must not appear in the output. Simplify the code so that we can print failures as they happen rather than trying to figure out what went wrong after printing "not ok". This also means that "not ok" gets printed after the info rather than before, which seems more intuitive anyway. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-7-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit c4e30c22baa745173997c831011a95e03771e466 Author: Crystal Wood Date: Sat Sep 6 21:23:23 2025 -0500 tools/rtla: Fix -A option name in test comment This was changed to --on-threshold when the patches were applied. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-6-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 2f3172f9dd58cca0f188bc0766b619d24f8116ad Author: Crystal Wood Date: Sat Sep 6 21:23:22 2025 -0500 tools/rtla: Consolidate code between osnoise/timerlat and hist/top Currently a lot of code is duplicated between the different rtla tools, making maintenance more difficult, and encouraging divergence such as features that are only implemented for certain tools even though they could be more broadly applicable. Merge the various main() functions into a common run_tool() with an ops struct for tool-specific details. Implement enough support for actions on osnoise to not need to keep the old params->trace_output path. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-5-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 263d7eacf8d17d66078700ff6b4b540d66f56278 Author: Crystal Wood Date: Sat Sep 6 21:23:21 2025 -0500 tools/rtla: Create common_apply_config() Merge the common bits of osnoise_apply_config() and timerlat_apply_config(). Put the result in a new common.c, and move enough things to common.h so that common.c does not need to include osnoise.h. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-4-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 5742bf62e6d3070f04a2ea688758431537076129 Author: Crystal Wood Date: Sat Sep 6 21:23:20 2025 -0500 tools/rtla: Move top/hist params into common struct The hist members were very similar between timerlat and top, so just use one common hist struct. output_divisor, quiet, and pretty printing are pretty generic concepts that can go in the main struct even if not every specific tool (currently) uses them. Cc: John Kacur Cc: Costa Shulyupin Link: https://lore.kernel.org/20250907022325.243930-3-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 344823886eafe5fe17ed788b00e463666c2183b4 Author: Costa Shulyupin Date: Sat Sep 6 21:23:19 2025 -0500 tools/rtla: Consolidate common parameters into shared structure timerlat_params and osnoise_params structures contain 15 identical fields. Introduce a new header common.h and define a common_params structure to consolidate shared fields, reduce code duplication, and enhance maintainability. Cc: John Kacur Link: https://lore.kernel.org/20250907022325.243930-2-crwood@redhat.com Reviewed-by: Tomas Glozar Signed-off-by: Costa Shulyupin Signed-off-by: Crystal Wood Signed-off-by: Steven Rostedt (Google) commit 012ea489aedab1a4c08efbd936bb7be91a06d236 Merge: 439263376c2c4e 70a5ce8bc94545 Author: Jakub Kicinski Date: Fri Sep 26 17:54:55 2025 -0700 Merge branch 'net-macb-various-fixes' Théo Lebrun says: ==================== net: macb: various fixes Fix a few disparate topics in MACB: [PATCH net v6 1/5] dt-bindings: net: cdns,macb: allow tsu_clk without tx_clk [PATCH net v6 2/5] net: macb: remove illusion about TBQPH/RBQPH being per-queue [PATCH net v6 3/5] net: macb: move ring size computation to functions [PATCH net v6 4/5] net: macb: single dma_alloc_coherent() for DMA descriptors [PATCH net v6 5/5] net: macb: avoid dealing with endianness in macb_set_hwaddr() Patch 3/5 is a rework that simplifies patch 4/5. It is the only non-fix. Pending series on MACB are: (1) many cleanup patches, (2) patches for EyeQ5 support and (3) XDP work. Those will be sent targeting net-next/main once this series lands there, aiming to minimise merge conflicts. Old version of(1) and (2) are visible in the V2 revision [0]. [0]: https://lore.kernel.org/lkml/20250627-macb-v2-0-ff8207d0bb77@bootlin.com/ ==================== Link: https://patch.msgid.link/20250923-macb-fixes-v6-0-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d Author: Théo Lebrun Date: Tue Sep 23 18:00:27 2025 +0200 net: macb: avoid dealing with endianness in macb_set_hwaddr() bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32 pointer and dereferencing implies dealing manually with endianness, which is error-prone. Replace by calls to get_unaligned_le32|le16() helpers. This was found using sparse: ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o warning: incorrect type in assignment (different base types) expected unsigned int [usertype] bottom got restricted __le32 [usertype] warning: incorrect type in assignment (different base types) expected unsigned short [usertype] top got restricted __le16 [usertype] ... Reviewed-by: Sean Anderson Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 78d901897b3cae06b38f54e48a2378cf9da21175 Author: Théo Lebrun Date: Tue Sep 23 18:00:26 2025 +0200 net: macb: single dma_alloc_coherent() for DMA descriptors Move from 2*NUM_QUEUES dma_alloc_coherent() for DMA descriptor rings to 2 calls overall. Issue is with how all queues share the same register for configuring the upper 32-bits of Tx/Rx descriptor rings. Taking Tx, notice how TBQPH does *not* depend on the queue index: #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2)) #define GEM_TBQPH(hw_q) (0x04C8) queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma)); #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (bp->hw_dma_cap & HW_DMA_CAP_64B) queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma)); #endif To maximise our chances of getting valid DMA addresses, we do a single dma_alloc_coherent() across queues. This improves the odds because alloc_pages() guarantees natural alignment. Other codepaths (IOMMU or dev/arch dma_map_ops) don't give high enough guarantees (even page-aligned isn't enough). Two consideration: - dma_alloc_coherent() gives us page alignment. Here we remove this constraint meaning each queue's ring won't be page-aligned anymore. - This can save some tiny amounts of memory. Fewer allocations means (1) less overhead (constant cost per alloc) and (2) less wasted bytes due to alignment constraints. Example for (2): 4 queues, default ring size (512), 64-bit DMA descriptors, 16K pages: - Before: 8 allocs of 8K, each rounded to 16K => 64K wasted. - After: 2 allocs of 32K => 0K wasted. Fixes: 02c958dd3446 ("net/macb: add TX multiqueue support for gem") Reviewed-by: Sean Anderson Acked-by: Nicolas Ferre Tested-by: Nicolas Ferre # on sam9x75 Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-4-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 92d4256fafd8d0a14d3aaa10452ac771bf9b597c Author: Théo Lebrun Date: Tue Sep 23 18:00:25 2025 +0200 net: macb: move ring size computation to functions The tx/rx ring size calculation is somewhat complex and partially hidden behind a macro. Move that out of the {RX,TX}_RING_BYTES() macros and macb_{alloc,free}_consistent() functions into neat separate functions. In macb_free_consistent(), we drop the size variable and directly call the size helpers in the arguments list. In macb_alloc_consistent(), we keep the size variable that is used by netdev_dbg() calls. Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-3-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit fca3dc859b200ca4dcdd2124beaf3bb2ab80b0f7 Author: Théo Lebrun Date: Tue Sep 23 18:00:24 2025 +0200 net: macb: remove illusion about TBQPH/RBQPH being per-queue The MACB driver acts as if TBQPH/RBQPH are configurable on a per queue basis; this is a lie. A single register configures the upper 32 bits of each DMA descriptor buffers for all queues. Concrete actions: - Drop GEM_TBQPH/GEM_RBQPH macros which have a queue index argument. Only use MACB_TBQPH/MACB_RBQPH constants. - Drop struct macb_queue->TBQPH/RBQPH fields. - In macb_init_buffers(): do a single write to TBQPH and RBQPH for all queues instead of a write per queue. - In macb_tx_error_task(): drop the write to TBQPH. - In macb_alloc_consistent(): if allocations give different upper 32-bits, fail. Previously, it would have lead to silent memory corruption as queues would have used the upper 32 bits of the alloc from queue 0 and their own low 32 bits. - In macb_suspend(): if we use the tie off descriptor for suspend, do the write once for all queues instead of once per queue. Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM") Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues") Reviewed-by: Sean Anderson Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250923-macb-fixes-v6-2-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 9665aa15ef8bdf1fa596f9ff8162e9c5e00ac036 Author: Théo Lebrun Date: Tue Sep 23 18:00:23 2025 +0200 dt-bindings: net: cdns,macb: allow tsu_clk without tx_clk Allow providing tsu_clk without a tx_clk as both are optional. This is about relaxing unneeded constraints. It so happened that in the past HW that needed a tsu_clk always needed a tx_clk. Fixes: 4e5b6de1f46d ("dt-bindings: net: cdns,macb: Convert to json-schema") Reviewed-by: Krzysztof Kozlowski Acked-by: Nicolas Ferre Signed-off-by: Théo Lebrun Link: https://patch.msgid.link/20250923-macb-fixes-v6-1-772d655cdeb6@bootlin.com Signed-off-by: Jakub Kicinski commit 1493c18fe8696bfc758a97130a485fc4e08387f5 Merge: 9ccec266234a96 fca6ff9191bd60 Author: Jakub Kicinski Date: Fri Sep 26 17:54:36 2025 -0700 Merge branch 'selftests-mark-auto-deferring-functions-clearly' Petr Machata says: ==================== selftests: Mark auto-deferring functions clearly selftests/net/lib.sh contains a suite of iproute2 wrappers that automatically schedule the corresponding cleanup through defer. The fact they do so is however not immediately obvious, one needs to know which functions are handling the deferral behind the scenes, and which expect the caller to handle cleanups themselves. A convention for these auto-deferring functions would help both writing and patch review. This patchset does so by marking these functions with an adf_ prefix. We already have a few such functions: forwarding/lib.sh has adf_mcd_start() and a few selftests add private helpers that conform to this convention. Patches #1 to #8 gradually convert individual functions, one per patch. Patch #9 renames an auto-deferring private helpers named dfr_* to adf_*. The plan is not to retro-rename all private helpers, but I happened to know about this one. Patches #10 to #12 introduce several autodefer helpers for commonly used forwarding/lib.sh functions, and opportunistically convert straightforward instances of 'action; defer counteraction' to the new helpers. Patch #13 adds some README verbiage to pitch defer and the adf_* convention. ==================== Link: https://patch.msgid.link/cover.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit fca6ff9191bd60167d5fe1d1fea89bf988d9e355 Author: Petr Machata Date: Thu Sep 25 19:31:56 2025 +0200 selftests: forwarding: README: Mention defer, adf_ Mention how it would be nice if new code used defer. Also if it does that in dirtying helpers, how it would be nice if these were named adf_*. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/0764bdb9266cd516da23ddeec110e01118cf981e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 040a6cbead5d6be72eec0444af48241693241f8d Author: Petr Machata Date: Thu Sep 25 19:31:55 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of forwarding_enable() Most forwarding tests invoke forwarding_enable() to enable the router and forwarding_restore() to restore the original configuration. Add a helper, adf_forwarding_enable(), which is like forwarding_enable(), but takes care of scheduling the cleanup automatically. Convert the tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/78b752c40069cde21c44dcf4c7b966a76a0eef2c.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f53748d56d1092657d30a094df92b11a24eadd12 Author: Petr Machata Date: Thu Sep 25 19:31:54 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of simple_if_init() Most forwarding tests invoke simple_if_init() to set up a VRF-based "host" and simple_if_fini() to tear it down again. Add a helper, adf_simple_if_init(), which is like simple_if_fini(), but takes care of scheduling the cleanup automatically. Convert the tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/6b9ee1a7946a36fd32a47fdb1aa9325198ffc695.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 02aabe00b2e1cc61e7a60616d6044592f12a748c Author: Petr Machata Date: Thu Sep 25 19:31:53 2025 +0200 selftests: forwarding: lib: Add an autodefer variant of vrf_prepare() Most forwarding tests invoke vrf_prepare() to set up VRF forwarding and vrf_cleanup() to restore the original configuration. Add a helper, adf_vrf_prepare(), which is like vrf_prepare(), but takes care of scheduling the cleanup automatically. Convert a number of tests that currently use defer to schedule the cleanup. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/2f2000e54ae700d560a8d6128322dade3bd2207e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 14b72996ae8052b2174fc36f151791f7604d3b1b Author: Petr Machata Date: Thu Sep 25 19:31:52 2025 +0200 selftests: net: vlan_bridge_binding: Rename dfr_set_binding_*() to adf_* This test contains two autodefer-like helpers, but namespaces them as dfr_* instead of adf_* like this patchset. Rename them. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/5f0c81b39e9e1f56f706cc4b53f82238a1d1e2f9.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit b628dfcd54cb78718cfe0392ca1946df43c49ac8 Author: Petr Machata Date: Thu Sep 25 19:31:51 2025 +0200 selftests: net: lib: Rename bridge_vlan_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/93526ce79e635a3ec34753c796edf0c96711547d.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit d85bcf6505d2383847637d90ecd4fa94f507cbc8 Author: Petr Machata Date: Thu Sep 25 19:31:50 2025 +0200 selftests: net: lib: Rename ip_route_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/403143183373419e4a31df4665d6bfaa273eb761.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 773603d6db3079a0bf828f149224abf2bdde56b3 Author: Petr Machata Date: Thu Sep 25 19:31:49 2025 +0200 selftests: net: lib: Rename ip_addr_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/706327a5db660c7f18ba9fbfba7ce913da065e3e.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a55f9fb3432e2eddacfad65294223bde2394c125 Author: Petr Machata Date: Thu Sep 25 19:31:48 2025 +0200 selftests: net: lib: Rename ip_link_set_down() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/e5bf4cb3405fb50fe6e217a04268952e97410dc2.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 34d3f8b75e2bb54f22c40868b6dcff2fab1f997d Author: Petr Machata Date: Thu Sep 25 19:31:47 2025 +0200 selftests: net: lib: Rename ip_link_set_up() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/475716ef792f5bd42e5c8ef1c3e287b1294f1630.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit beb98a3477622ccdb15d8a3dcdc53805f36ed8e7 Author: Petr Machata Date: Thu Sep 25 19:31:46 2025 +0200 selftests: net: lib: Rename ip_link_set_addr() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/5318e90f7f491f9f397ac221a8b47fdbedd0d3b2.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit c3cbd21fe18ed03f6926bbe5a7d3b62db0733896 Author: Petr Machata Date: Thu Sep 25 19:31:45 2025 +0200 selftests: net: lib: Rename ip_link_set_master() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/53ce64231faa1396a968b2869af5f1c0aebec2c9.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 191c4912f9c3aff76c4e46c92f6031714607e10b Author: Petr Machata Date: Thu Sep 25 19:31:44 2025 +0200 selftests: net: lib: Rename ip_link_add() to adf_* Rename this function to mark it as autodefer. For details, see the discussion in the cover letter. Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/0b163cca1bf2ec44270e0fc89108f488d99d9c9d.1758821127.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 9ccec266234a960c63d56fa078ec2873d05a3c16 Merge: 1d312d54159153 539f6b9de39ec5 Author: Jakub Kicinski Date: Fri Sep 26 17:44:14 2025 -0700 Merge branch 'mptcp-pm-special-case-for-c-flag-luminar-endp' Matthieu Baerts says: ==================== mptcp: pm: special case for c-flag + luminar endp Here are some patches for the MPTCP PM, including some refactoring that I thought it would be best to send at the end of a cycle to avoid conflicts between net and net-next that could last a few weeks. The most interesting changes are in the first and last patch, the rest are patches refactoring the code & tests to validate the modifications. - Patches 1 & 2: When servers set the C-flag in their MP_CAPABLE to tell clients not to create subflows to the initial address and port -- e.g. a deployment behind a L4 load balancer like a typical CDN deployment -- clients will not use their other endpoints when default settings are used. That's because the in-kernel path-manager uses the 'subflow' endpoints to create subflows only to the initial address and port. The first patch fixes that (for >=v5.14), and the second one validates it. - Patches 3-14: various patches refactoring the code around the in-kernel PM (mainly): split too long functions, rename variables and functions to avoid confusions, reduce structure size, and compare IDs instead of IP addresses. Note that one patch modifies one internal variable used in one BPF selftest. - Patch 15: ability to control endpoints that are used in reaction to a new address announced by the other peer. With that, endpoints can be used only once. ==================== Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-0-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 539f6b9de39ec5d827b16f6f5c8f3cfd58669e93 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:50 2025 +0200 mptcp: pm: in-kernel: add laminar endpoints Currently, upon the reception of an ADD_ADDR (and when the fullmesh flag is not used), the in-kernel PM will create new subflows using the local address the routing configuration will pick. It would be easier to pick local addresses from a selected list of endpoints, and use it only once, than relying on routing rules. Use case: both the client (C) and the server (S) have two addresses (a and b). The client establishes the connection between C(a) and S(a). Once established, the server announces its additional address S(b). Once received, the client connects to it using its second address C(b). Compared to a situation without the 'laminar' endpoint for C(b), the client didn't use this address C(b) to establish a subflow to the server's primary address S(a). So at the end, we have: C S C(a) --- S(a) C(b) --- S(b) In case of a 3rd address on each side (C(c) and S(c)), upon the reception of an ADD_ADDR with S(c), the client should not pick C(b) because it has already been used. C(c) should then be used. Note that this situation is currently possible if C doesn't add any endpoint, but configure the routing in order to pick C(b) for the route to S(b), and pick C(c) for the route to S(c). That doesn't sound very practical because it means knowing in advance the IP addresses that will be used and announced by the server. 'laminar', like the idea of laminar flows: the different subflows don't mix with each other on an endpoint, unlike the "turbulent" way traffic is mixed by 'fullmesh'. In the code, the new endpoint type is added. Similar to the other subflow types, an MPTCP_INFO counter is added. While at it, hole are now commented in struct mptcp_info, to remember next time that these holes can no longer be used. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/503 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-15-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit f596293314b25fc494acb42f40ec256e4662d04f Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:49 2025 +0200 mptcp: pm: in-kernel: compare IDs instead of addresses When receiving an ADD_ADDR right after the 3WHS, the connection will switch to 'fully established'. It means the MPTCP worker will be called to treat two events, in this order: ADD_ADDR_RECEIVED, PM_ESTABLISHED. The MPTCP endpoints cannot have the ID 0, because it is reserved to the address and port used by the initial subflow. To be able to deal with this case in different places, msk->mpc_endpoint_id contains the endpoint ID linked to the initial subflow. This variable was only set when treating the first PM_ESTABLISHED event, after ADD_ADDR_RECEIVED. That's why in fill_local_addresses_vec(), the endpoint addresses were compared with the one of the initial subflow, instead of only comparing the IDs. Instead, msk->mpc_endpoint_id is now set when treating ADD_ADDR_RECEIVED as well, if needed, then the IDs can be compared. To be able to do so, the code doing that is now in a dedicated helper, and called from the functions linked to the two actions. While at it, mptcp_endp_get_local_id() has also been moved up, next to this new helper, because they are linked, and to be able to use it in fill_local_addresses_vec() in the next commit. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-14-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 4984fe6254f8d469c98e639856b7ce21fe8da86f Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:48 2025 +0200 mptcp: pm: in-kernel: reduce pernet struct size All the 'unsigned int' variables from the 'pm_nl_pernet' structure are bounded to MPTCP_PM_ADDR_MAX, currently set to 8. The endpoint ID is also bounded by the protocol to 8-bit. MPTCP_PM_ADDR_MAX, if extended later, will never over 8-bit. So no need to use 'unsigned int' variables, 'u8' is enough. Note that the exposed counters in MPTCP_INFO are already limited to 8-bit, same for pm->extra_subflows, and others. So it seems even better to limit them to 8-bit. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-13-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit db9a0e3858ba8acbe4f78edcb8c2061aee53dfa4 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:47 2025 +0200 mptcp: pm: in-kernel: remove stale_loss_cnt It is currently not used. It was in fact never used since its introduction in commit ff5a0b421cb2 ("mptcp: faster active backup recovery"). It was probably initially added to struct pm_nl_pernet during the development of this commit, before being added to struct mptcp_pernet in ctrl.c, but not removed from the first place. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-12-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit e9aa044f4a1f7c7a858b96ea1fc7c642095ef4b8 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:46 2025 +0200 mptcp: pm: in-kernel: rename 'addrs' to 'endpoints' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'addrs', which in fact represents the number of declared endpoints, and not only the 'signal' endpoints. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-11-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 35e71e43a56d40e68ea0ebab3ac85038624cb8b5 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:45 2025 +0200 mptcp: pm: in-kernel: rename 'local_addr_list' to 'endp_list' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'local_addr_list', which in fact represents the list of endpoints, and not only the 'subflow' endpoints. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-10-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit e7757b6d3a623671705388be24851af7360b54ba Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:44 2025 +0200 mptcp: pm: in-kernel: rename 'local_addr_max' to 'endp_subflow_max' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'local_addr_max', which in fact represents the maximum number of 'subflow' endpoints that can be used to create new subflows, and not the number of local addresses that have been used to create subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_endp_subflow_max. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. Also move the variable and function next to the other 'endp_X_max' ones. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-9-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 37712d84dfc2e80d4d218ff9be490c86e604aa69 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:43 2025 +0200 mptcp: pm: in-kernel: rename 'add_addr_accept_max' to 'limit_add_addr_accepted' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'add_addr_accept_max', which in fact represents the limit of ADD_ADDR that can be accepted: the limit set via 'ip mptcp limit add_addr_accepted X' for example. It is not linked to the maximum number of accepted ADD_ADDR. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_limit_add_addr_accepted. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-8-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 45cae570664d58c562e21a3c7409fc02147bba46 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:42 2025 +0200 mptcp: pm: in-kernel: rename 'add_addr_signal_max' to 'endp_signal_max' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'add_addr_signal_max', which in fact represents the maximum number of 'signal' endpoints that can be used to announced addresses, and not the number of ADD_ADDR that can be signalled. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_endp_signal_max. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-7-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 3eb3c9a9596a53880f7d7eff28ac5622f3e0ba37 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:41 2025 +0200 mptcp: pm: in-kernel: rename 'subflows_max' to 'limit_extra_subflows' A few variables linked to the in-kernel Path-Manager are confusing, and it would help current and future developers, to clarify them. One of them is 'subflows_max', which in fact represents the limit of extra subflows: the limit set via 'ip mptcp limit subflows X' for example. It is not linked to the maximum number of created / possible subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_limit_extra_subflows. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-6-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit c5273f6ca166c4edfaa6a87570e111453a0576ad Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:40 2025 +0200 mptcp: pm: rename 'subflows' to 'extra_subflows' A few variables linked to the Path-Managers are confusing, and it would help current and future developers, to clarify them. One of them is 'subflows', which in fact represents the number of extra subflows: all the additional subflows created after the initial one, and not the total number of subflows. While at it, add an additional name for the corresponding variable in MPTCP INFO: mptcpi_extra_subflows. Not to break the current uAPI, the new name is added as a 'define' pointing to the former name. This will then also help userspace devs. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-5-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit a845b2bbf26ed73e545a3573df264c3a1cb302a1 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:39 2025 +0200 mptcp: pm: in-kernel: refactor fill_remote_addresses_vec Before this modification, this function was quite long with many levels of indentations. Each case can be split in a dedicated function: fullmesh, non-fullmesh. To remove one level of indentation, msk->pm.subflows >= subflows_max is now checked after having added one subflow, and stops the loop if it is no longer possible to add new subflows. This is fine to do this because this function should only be called if msk->pm.subflows < subflows_max. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-4-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 8dc63ade451d28211511b657fecf5e0822580986 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:38 2025 +0200 mptcp: pm: in-kernel: refactor fill_local_addresses_vec Before this modification, this function was quite long with many levels of indentations. Each case can be split in a dedicated function: fullmesh, C flag, any. No functional changes intended. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-3-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 008385efd05e04d8dff299382df2e8be0f91d8a0 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:37 2025 +0200 selftests: mptcp: join: validate C-flag + def limit The previous commit adds an exception for the C-flag case. The 'mptcp_join.sh' selftest is extended to validate this case. In this subtest, there is a typical CDN deployment with a client where MPTCP endpoints have been 'automatically' configured: - the server set net.mptcp.allow_join_initial_addr_port=0 - the client has multiple 'subflow' endpoints, and the default limits: not accepting ADD_ADDRs. Without the parent patch, the client is not able to establish new subflows using its 'subflow' endpoints. The parent commit fixes that. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: df377be38725 ("mptcp: add deny_join_id0 in mptcp_options_received") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-2-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 4b1ff850e0c1aacc23e923ed22989b827b9808f9 Author: Matthieu Baerts (NGI0) Date: Thu Sep 25 12:32:36 2025 +0200 mptcp: pm: in-kernel: usable client side with C-flag When servers set the C-flag in their MP_CAPABLE to tell clients not to create subflows to the initial address and port, clients will likely not use their other endpoints. That's because the in-kernel path-manager uses the 'subflow' endpoints to create subflows only to the initial address and port. If the limits have not been modified to accept ADD_ADDR, the client doesn't try to establish new subflows. If the limits accept ADD_ADDR, the routing routes will be used to select the source IP. The C-flag is typically set when the server is operating behind a legacy Layer 4 load balancer, or using anycast IP address. Clients having their different 'subflow' endpoints setup, don't end up creating multiple subflows as expected, and causing some deployment issues. A special case is then added here: when servers set the C-flag in the MPC and directly sends an ADD_ADDR, this single ADD_ADDR is accepted. The 'subflows' endpoints will then be used with this new remote IP and port. This exception is only allowed when the ADD_ADDR is sent immediately after the 3WHS, and makes the client switching to the 'fully established' mode. After that, 'select_local_address()' will not be able to find any subflows, because 'id_avail_bitmap' will be filled in mptcp_pm_create_subflow_or_signal_addr(), when switching to 'fully established' mode. Fixes: df377be38725 ("mptcp: add deny_join_id0 in mptcp_options_received") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/536 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250925-net-next-mptcp-c-flag-laminar-v1-1-ad126cc47c6b@kernel.org Signed-off-by: Jakub Kicinski commit 1d312d541591530bf1b2301220c0517ad5b43757 Merge: bf91f4bc9c1dfb 6294bcd423ae20 Author: Jakub Kicinski Date: Fri Sep 26 17:43:25 2025 -0700 Merge branch 'add-support-to-retrieve-hardware-channel-information' Sathesh B Edara says: ==================== Add support to retrieve hardware channel information This patch series introduces support for retrieving hardware channel configuration through the ethtool interface for both PF and VF. ==================== Link: https://patch.msgid.link/20250925125134.22421-1-sedara@marvell.com Signed-off-by: Jakub Kicinski commit 6294bcd423ae20e6843c5a05d26372879d25475d Author: Sathesh B Edara Date: Thu Sep 25 05:51:34 2025 -0700 octeon_ep_vf: Add support to retrieve hardware channel information This patch introduces support for retrieving hardware channel configuration through the ethtool interface. Signed-off-by: Sathesh B Edara Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925125134.22421-3-sedara@marvell.com Signed-off-by: Jakub Kicinski commit 24d15b6a17e265bd78b73e532a67fb074aa323c1 Author: Sathesh B Edara Date: Thu Sep 25 05:51:33 2025 -0700 octeon_ep: Add support to retrieve hardware channel information This patch introduces support for retrieving hardware channel configuration through the ethtool interface. Signed-off-by: Sathesh B Edara Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925125134.22421-2-sedara@marvell.com Signed-off-by: Jakub Kicinski commit bf91f4bc9c1dfba75e457e6a5f11e3cda658729a Author: Horatiu Vultur Date: Thu Sep 25 08:47:02 2025 +0200 net: phy: micrel: Fix lan8814_config_init The blamed commit introduced the function lanphy_modify_page_reg which as name suggests it, it modifies the registers. In the same commit we have started to use this function inside the drivers. The problem is that in the function lan8814_config_init we passed the wrong page number when disabling the aneg towards host side. We passed extended page number 4(LAN8814_PAGE_COMMON_REGS) instead of extended page 5(LAN8814_PAGE_PORT_REGS) Fixes: a0de636ed7a264 ("net: phy: micrel: Introduce lanphy_modify_page_reg") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925064702.3906950-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 439263376c2c4e126cac0d07e4987568de4eaba5 Author: Michael S. Tsirkin Date: Thu Sep 25 02:04:08 2025 -0400 vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values. Cc: zhang jiao Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations") Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit 105ce7ad57e492b75ab40f2dc591db645fadbaa2 Author: Lorenzo Bianconi Date: Wed Sep 24 23:14:53 2025 +0200 net: airoha: npu: Add a NPU callback to initialize flow stats Introduce a NPU callback to initialize flow stats and remove NPU stats initialization from airoha_npu_get routine. Add num_stats_entries to airoha_npu_ppe_stats_setup routine. This patch makes the code more readable since NPU statistic are now initialized on demand by the NPU consumer (at the moment NPU statistic are configured just by the airoha_eth driver). Moreover this patch allows the NPU consumer (PPE module) to explicitly enable/disable NPU flow stats. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924-airoha-npu-init-stats-callback-v1-1-88bdf3c941b2@kernel.org Signed-off-by: Jakub Kicinski commit 20a2e46f9e4c3c9a8a17708f81db672a26738adc Author: Mohsin Bashir Date: Wed Sep 24 11:44:45 2025 -0700 eth: fbnic: Add support to read lane count We are reporting the lane count in the link settings but the flag is not set to indicate that the driver supports lanes. Set the flag to report lane count. ~]# ethtool eth0 | grep Lanes Lanes: 2 Signed-off-by: Mohsin Bashir Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924184445.2293325-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit e556f011e2df317b23ee44542189ed52c8117eea Author: Mengyuan Lou Date: Wed Sep 24 16:21:40 2025 +0800 Wangxun: vf: Implement some ethtool apis for get_xxx Implement some ethtool interfaces for obtaining the status of Wangxun Virtual Function Ethernet. Just like connection status, version information, queue depth and so on. Signed-off-by: Mengyuan Lou Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924082140.41612-1-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 55f5a5a7c1770c3c79715e5236d7055f3cca8742 Merge: fbb8bc408027a9 ed3d74a754113e Author: Jakub Kicinski Date: Fri Sep 26 16:48:02 2025 -0700 Merge branch 'add-fec-bins-histogram-report-via-ethtool' Vadim Fedorenko says: ==================== add FEC bins histogram report via ethtool IEEE 802.3ck-2022 defines counters for FEC bins and 802.3df-2024 clarifies it a bit further. Implement reporting interface through as addition to FEC stats available in ethtool. NetDevSim driver has simple implementation as an example while mlx5 has much more complex solution. The example query is the same as usual FEC statistics while the answer is a bit more verbose: $ ynl --family ethtool --do fec-get \ --json '{"header":{"dev-index": 10, "flags": 4}}' {'auto': 0, 'header': {'dev-index': 10, 'dev-name': 'eni10np1'}, 'modes': {'bits': {}, 'nomask': True, 'size': 121}, 'stats': {'corr-bits': [], 'corrected': [123], 'hist': [{'bin-high': 0, 'bin-low': 0, 'bin-val': 445, 'bin-val-per-lane': [125, 120, 100, 100]}, {'bin-high': 3, 'bin-low': 1, 'bin-val': 12}, {'bin-high': 7, 'bin-low': 4, 'bin-val': 2, 'bin-val-per-lane': [2, 0, 0, 0]}], 'uncorr': [4]}} ==================== Link: https://patch.msgid.link/20250924124037.1508846-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ed3d74a754113eb84299a0a4ddc215199a6dd89c Author: Vadim Fedorenko Date: Wed Sep 24 12:40:37 2025 +0000 selftests: net-drv: stats: sanity check FEC histogram Simple tests to validate kernel's output. FEC bin range should be valid means high boundary should be not less than low boundary. Bin boundaries have to be provided as well as error counter value. Per-plane value should match bin's value. Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-6-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ca80036839eb9556b08f62d4c655885c6670c2cc Author: Carolina Jubran Date: Wed Sep 24 12:40:36 2025 +0000 net/mlx5e: Report RS-FEC histogram statistics via ethtool Add support for reporting RS-FEC histogram counters by reading them from the RS_FEC_HISTOGRAM_GROUP in the PPCNT register. Co-developed-by: Yael Chemla Signed-off-by: Yael Chemla Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Link: https://patch.msgid.link/20250924124037.1508846-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 44907e7c8fd0dec2d17ba8011bb7da443a9e4585 Author: Carolina Jubran Date: Wed Sep 24 12:40:35 2025 +0000 net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR Introduce support for querying the Ports Phy Histogram Configuration Register (PPHCR) to retrieve RS-FEC histogram bin ranges. The ranges are stored in a static array and will be used to map histogram counters to error levels. The actual RS-FEC histogram statistics are not yet reported in this commit and will be handled in a downstream patch. Co-developed-by: Yael Chemla Signed-off-by: Yael Chemla Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 6b81b8a0b1978284e007566d7a1607b47f92209f Author: Carolina Jubran Date: Wed Sep 24 12:40:34 2025 +0000 net/mlx5e: Don't query FEC statistics when FEC is disabled Update mlx5e_stats_fec_get() to check the active FEC mode and skip statistics collection when FEC is disabled. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit cc2f08129925b437bf28f7f7822f20dac083a87c Author: Vadim Fedorenko Date: Wed Sep 24 12:40:33 2025 +0000 ethtool: add FEC bins histogram report IEEE 802.3ck-2022 defines counters for FEC bins and 802.3df-2024 clarifies it a bit further. Implement reporting interface through as addition to FEC stats available in ethtool. Drivers can leave bin counter uninitialized if per-lane values are provided. In this case the core will recalculate summ for the bin. Signed-off-by: Vadim Fedorenko Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250924124037.1508846-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit fbb8bc408027a94b0b513410df15003e6ba6a77c Author: Zhen Ni Date: Wed Sep 24 11:02:19 2025 +0800 net: qed: Remove redundant NULL checks after list_first_entry() list_first_entry() never returns NULL — if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. The calls to list_first_entry() are always guarded by !list_empty(), which guarantees a valid entry is returned. Therefore, the additional `if (!p_buffer) break;` checks in qed_ooo_release_connection_isles(), qed_ooo_release_all_isles(), and qed_ooo_free() are redundant and unreachable. Remove the dead code for clarity and consistency with common list handling patterns in the kernel. No functional change intended. Signed-off-by: Zhen Ni Link: https://patch.msgid.link/20250924030219.1252773-1-zhen.ni@easystack.cn Signed-off-by: Jakub Kicinski commit e9f35294e18da82162004a2f35976e7031aaf7f9 Author: I Viswanath Date: Thu Sep 25 21:29:08 2025 +0530 ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: I Viswanath Acked-by: Richard Cochran Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 347afa39042728267550fa7a5ab5e9af52671add Author: Dan Carpenter Date: Thu Sep 25 16:28:13 2025 +0300 dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free() and the caller, zl3073x_devlink_flash_update(), also calls that same free function so it leads to a double free. Delete the extra free. Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Ivan Vecera Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/aNVDbcIQq4RmU_fl@stanley.mountain Signed-off-by: Jakub Kicinski commit 81dcfdd21dbd7067068c7c341ee448c3f0d6f115 Author: Alessandro Zanni Date: Thu Sep 25 15:28:23 2025 +0200 selftest: net: Fix error message if empty variable Fix to avoid cases where the `res` shell variable is empty in script comparisons. The comparison has been modified into string comparison to handle other possible values the variable could assume. The issue can be reproduced with the command: make kselftest TARGETS=net It solves the error: ./tfo_passive.sh: line 98: [: -eq: unary operator expected Signed-off-by: Alessandro Zanni Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250925132832.9828-1-alessandro.zanni87@gmail.com Signed-off-by: Jakub Kicinski commit 793adf57e2cfa85792989f6d89cb1bba5bcc6df2 Merge: 4e9510f1621880 ffa8f0791955de Author: Jakub Kicinski Date: Fri Sep 26 15:21:40 2025 -0700 Merge branch 'dns_resolver-docs-formatting-cleanup' Bagas Sanjaya says: ==================== dns_resolver docs formatting cleanup Here are reST cleanups for DNS Resolver Module documentation. ==================== Link: https://patch.msgid.link/20250924020626.17073-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit ffa8f0791955dec12af2a09a1655a41e3fff783a Author: Bagas Sanjaya Date: Wed Sep 24 09:06:25 2025 +0700 net: dns_resolver: Fix request-key cross-reference Link to "Key Request Service" docs uses file:// scheme instead due to angled brackets markup. Fix it to proper cross-reference. Reviewed-by: Simon Horman Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20250924020626.17073-4-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 1b1fe672337bb7549f637853c1c9536872d3d19c Author: Bagas Sanjaya Date: Wed Sep 24 09:06:24 2025 +0700 net: dns_resolver: Move dns_query() explanation out of code block Documentation for dns_query() is placed in the function's literal code block snippet instead. Move it out of there. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924020626.17073-3-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 84a27b5a4cedd0b19381e27e8026614ddf3e900f Author: Bagas Sanjaya Date: Wed Sep 24 09:06:23 2025 +0700 net: dns_resolver: Use reST bullet list for features list Features overview list uses an asterisk in parentheses (``(*)``) as bullet list marker, which isn't supported by Sphinx as proper bullet. Replace it with just asterisk. Reviewed-by: Simon Horman Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20250924020626.17073-2-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit 4e9510f16218802b5fc0d593d8707d4e7ebf9774 Author: Michael S. Tsirkin Date: Wed Sep 24 01:27:07 2025 -0400 ptr_ring: drop duplicated tail zeroing code We have some rather subtle code around zeroing tail entries, minimizing cache bouncing. Let's put it all in one place. Doing this also reduces the text size slightly, e.g. for drivers/vhost/net.o Before: text: 15,114 bytes After: text: 15,082 bytes Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Link: https://patch.msgid.link/adb9d941de4a2b619ddb2be271a9939849e70687.1758690291.git.mst@redhat.com Signed-off-by: Jakub Kicinski commit 8d5868f8c1b27e99b35d200b5ed2dfe12586e936 Author: Jonas Rebmann Date: Wed Sep 24 10:34:12 2025 +0200 dt-bindings: net: dsa: nxp,sja1105: Add reset-gpios property Both the nxp,sja1105 and the nxp,sja1110 series feature an active-low reset pin, rendering reset-gpios a valid property for all of the nxp,sja1105 family. Acked-by: Vladimir Oltean Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Signed-off-by: Jonas Rebmann Link: https://patch.msgid.link/20250924-imx8mp-prt8ml-v3-1-f498d7f71a94@pengutronix.de Signed-off-by: Jakub Kicinski commit 0a8fe9161164d84b8ed904ca39ddd21a0afac938 Merge: 0e41b0af474376 96da9d67da780c Author: Jakub Kicinski Date: Fri Sep 26 15:18:14 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== idpf: add XSk support Alexander Lobakin says: Add support for XSk xmit and receive using libeth_xdp. This includes adding interfaces to reconfigure/enable/disable only a particular set of queues and support for checksum offload XSk Tx metadata. libeth_xdp's implementation mostly matches the one of ice: batched allocations and sending, unrolled descriptor writes etc. But unlike other Intel drivers, XSk wakeup is implemented using CSD/IPI instead of HW "software interrupt". In lots of different tests, this yielded way better perf than SW interrupts, but also, this gives better control over which CPU will handle the NAPI loop (SW interrupts are a subject to irqbalance and stuff, while CSDs are strictly pinned 1:1 to the core of the same index). Note that the header split is always disabled for XSk queues, as for now we see no reasons to have it there. XSk xmit perf is up to 3x comparing to ice. XSk XDP_PASS is also faster a bunch as it uses system percpu page_pools, so that the only overhead left is memcpy(). The rest is at least comparable. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: idpf: enable XSk features and ndo_xsk_wakeup idpf: implement Rx path for AF_XDP idpf: implement XSk xmit idpf: add XSk pool initialization idpf: add virtchnl functions to manage selected queues ==================== Link: https://patch.msgid.link/20250924175230.1290529-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 0e41b0af4743761a5994b9a538146ea2adea72e6 Author: Christophe Leroy Date: Wed Sep 24 17:06:47 2025 +0200 net: wan: framer: Add version sysfs attribute for the Lantiq PEF2256 framer Lantiq PEF2256 framer has some little differences in behaviour depending on its version. Add a sysfs attribute to allow user applications to know the version. Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/77a27941d6924b1009df0162ed9f0fa07ed6e431.1758726302.git.christophe.leroy@csgroup.eu Signed-off-by: Jakub Kicinski commit 958baf5eaee394e5fd976979b0791a875f14a179 Author: I Viswanath Date: Wed Sep 24 19:13:50 2025 +0530 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio Signed-off-by: I Viswanath Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski commit 231889d9b62650a2242b8b752565892a6cd18372 Author: Dan Carpenter Date: Wed Sep 24 17:21:17 2025 +0300 dibs: Check correct variable in dibs_init() There is a typo in this code. It should check "dibs_class" instead of "&dibs_class". Remove the &. Fixes: 804737349813 ("dibs: Create class dibs") Signed-off-by: Dan Carpenter Reviewed-by: Alexandra Winter Link: https://patch.msgid.link/aNP-XcrjSUjZAu4a@stanley.mountain Signed-off-by: Jakub Kicinski commit 72bc38077e804b26188bdffe875874186bca8300 Author: Geert Uytterhoeven Date: Wed Sep 24 15:19:30 2025 +0200 net: renesas: rswitch: Remove unneeded semicolons Semicolons after end of function braces are not needed, remove them. Signed-off-by: Geert Uytterhoeven Reviewed-by: Nikita Yushchenko Link: https://patch.msgid.link/e6b57123f319c03b3f078981cb452be49e86253b.1758719832.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f Author: Claudiu Manoil Date: Wed Sep 24 16:27:55 2025 +0800 net: enetc: Fix probing error message typo for the ENETCv4 PF driver Blamed commit wrongly indicates VF error in case of PF probing error. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil Signed-off-by: Wei Fang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit bb9a242ce58e00da802d9ae49643f7271be9c99e Merge: ed6cfe861cc803 896d52af944107 Author: Jakub Kicinski Date: Fri Sep 26 14:46:58 2025 -0700 Merge tag 'linux-can-next-for-6.18-20250924' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-09-25 this is a pull request of 48 patches for net-next/main, which supersedes tags/linux-can-next-for-6.18-20250923. The 1st patch is by Xichao Zhao and converts ns_to_ktime() to us_to_ktime() in the m_can driver. Vincent Mailhol contributes 2 patches: Updating the MAINTAINERS and mailmap files to Vincent's new email address and sorting the includes in the CAN helper library alphabeticaly. Stéphane Grosjean's patch modifies all peak CAN drivers and the mailmap to reflect Stéphane's new email address. 4 patches by Biju Das update the CAN-FD handling in the rcar_canfd driver. Followed by 11 patches by Geert Uytterhoeven updating and improving the rcar_can driver. Stefan Mätje contributes 2 patches for the esd_usb driver updating the error messages. The next 3 patch series are all by Vincent Mailhol: 3 patches to optimize the size of struct raw_sock and struct uniqframe. 4 patches which rework the CAN MTU logic as preparation for CAN-XL interfaces. And finally 20 patches that prepare and refactor the CAN netlink code for the upcoming CAN-XL support. * tag 'linux-can-next-for-6.18-20250924' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (48 commits) can: netlink: add userland error messages can: dev: add can_get_ctrlmode_str() can: calc_bittiming: make can_calc_tdco() FD agnostic can: netlink: make can_tdc_fill_info() FD agnostic can: netlink: add can_bitrate_const_fill_info() can: netlink: add can_bittiming_const_fill_info() can: netlink: add can_bittiming_fill_info() can: netlink: add can_data_bittiming_get_size() can: netlink: make can_tdc_get_size() FD agnostic can: netlink: add can_ctrlmode_changelink() can: netlink: add can_dtb_changelink() can: netlink: make can_tdc_changelink() FD agnostic can: netlink: remove useless check in can_tdc_changelink() can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic can: netlink: add can_validate_databittiming() can: netlink: add can_validate_tdc() can: netlink: refactor can_validate_bittiming() can: netlink: document which symbols are FD specific can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h can: dev: move struct data_bittiming_params to linux/can/bittiming.h ... ==================== Link: https://patch.msgid.link/20250925121332.848157-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit ed6cfe861cc80387a0f71af14ca9d5d2242fcae2 Merge: 94aced6ed9e263 9f4f591cd5a410 Author: Jakub Kicinski Date: Fri Sep 26 14:44:50 2025 -0700 Merge tag 'ipsec-next-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2025-09-26 1) Fix field-spanning memcpy warning in AH output. From Charalampos Mitrodimas. 2) Replace the strcpy() calls for alg_name by strscpy(). From Miguel García. * tag 'ipsec-next-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: xfrm_user: use strscpy() for alg_name net: ipv6: fix field-spanning memcpy warning in AH output ==================== Link: https://patch.msgid.link/20250926053025.2242061-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit d1a7be736ca9b89c32023185fa95c0df02f6db27 Author: Rob Herring (Arm) Date: Wed Sep 24 17:35:49 2025 -0500 dt-bindings: gpu: Convert nvidia,gk20a to DT schema Convert the NVIDIA GPU binding to DT schema format. Add undocumented "interconnects" and "interconnect-names" properties for gp10b and gv11b. Drop all but one example. Signed-off-by: Rob Herring (Arm) commit 94aced6ed9e2630bae0b5631e384a5302c4b6783 Merge: 47f78a67d35e48 56d9de46715245 Author: Jakub Kicinski Date: Fri Sep 26 14:27:28 2025 -0700 Merge tag 'wireless-next-2025-09-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bit more things, including pull requests from drivers: - mt76: MLO support, HW restart improvements - rtw88/89: small features, prep for RTL8922DE support - ath10k: GTK rekey fixes - cfg80211/mac80211: - additions for more NAN support - S1G channel representation cleanup * tag 'wireless-next-2025-09-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (167 commits) wifi: libertas: add WQ_UNBOUND to alloc_workqueue users Revert "wifi: libertas: WQ_PERCPU added to alloc_workqueue users" wifi: libertas: WQ_PERCPU added to alloc_workqueue users wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again wifi: ath12k: enforce CPU endian format for all QMI data wifi: ath12k: Use 1KB Cache Flush Command for QoS TID Descriptors wifi: ath12k: Fix flush cache failure during RX queue update wifi: ath12k: Add Retry Mechanism for REO RX Queue Update Failures wifi: ath12k: Refactor REO command to use ath12k_dp_rx_tid_rxq wifi: ath12k: Refactor RX TID buffer cleanup into helper function wifi: ath12k: Refactor RX TID deletion handling into helper function wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 wifi: cfg80211: remove IEEE80211_CHAN_{1,2,4,8,16}MHZ flags wifi: rtw89: avoid circular locking dependency in ser_state_run() wifi: rtw89: fix leak in rtw89_core_send_nullfunc() wifi: rtw89: avoid possible TX wait initialization race wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() wifi: mac80211: fix Rx packet handling when pubsta information is not available ... ==================== Link: https://patch.msgid.link/20250925232341.4544-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 47f78a67d35e48a56add528c9aa681782cf1b8e1 Author: Stanislav Fomichev Date: Wed Sep 24 15:25:18 2025 -0700 selftests: drv-net: Enable BTF Commit fec2e55bdef ("selftests: drv-net: Pull data before parsing headers") added __ksym external symbol to xdp_native.bpf.c which now requires a kernel with BTF. Enable BTF for driver selftests. Before: # TAP version 13 # 1..10 # # Exception| Traceback (most recent call last): # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 244, in ksft_run # # Exception| case(*args) # # Exception| ~~~~^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 231, in test_xdp_native_pass_sb # # Exception| _test_pass(cfg, bpf_info, 256) # # Exception| ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 209, in _test_pass # # Exception| prog_info = _load_xdp_prog(cfg, bpf_info) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 114, in _load_xdp_prog # # Exception| cmd( # # Exception| ~~~^ # # Exception| f"ip link set dev {cfg.ifname} mtu {bpf_info.mtu} xdpdrv obj {abs_path} sec {bpf_info.xdp_sec}", # # Exception| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| shell=True # # Exception| ^^^^^^^^^^ # # Exception| ) # # Exception| ^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 75, in __init__ # # Exception| self.process(terminate=False, fail=fail, timeout=timeout) # # Exception| ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 95, in process # # Exception| raise CmdExitFailure("Command failed: %s\nSTDOUT: %s\nSTDERR: %s" % # # Exception| (self.proc.args, stdout, stderr), self) # # Exception| net.lib.py.utils.CmdExitFailure: Command failed: ip link set dev eni30773np1 mtu 1500 xdpdrv obj /home/sdf/src/linux/tools/testing/selftests/net/lib/xdp_native.bpf.o sec xdp # # Exception| STDOUT: b'' # # Exception| STDERR: b"libbpf: kernel BTF is missing at '/sys/kernel/btf/vmlinux', was CONFIG_DEBUG_INFO_BTF enabled?\nlibbpf: failed to find '.BTF' ELF section in /lib/modules/6.17.0-rc6-virtme/build/vmlinux\nlibbpf: failed to find valid kernel BTF\nlib bpf: Error loading vmlinux BTF: -3\nlibbpf: failed to load object '/home/sdf/src/linux/tools/testing/selftests/net/lib/xdp_native.bpf.o'\n" # not ok 1 xdp.test_xdp_native_pass_sb ... After: # TAP version 13 # 1..10 # ok 1 xdp.test_xdp_native_pass_sb # ok 2 xdp.test_xdp_native_pass_mb # ok 3 xdp.test_xdp_native_drop_sb # ok 4 xdp.test_xdp_native_drop_mb # ok 5 xdp.test_xdp_native_tx_sb # ok 6 xdp.test_xdp_native_tx_mb # # Ignoring SIGTERM (cnt: 2), already exiting... # # Ignoring SIGTERM (cnt: 3), already exiting... # # Exception| Traceback (most recent call last): # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 244, in ksft_run # # Exception| case(*args) # # Exception| ~~~~^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 506, in test_xdp_native_adjst_taa # # Exception| res = _test_xdp_native_tail_adjst( # # Exception| cfg, # # Exception| pkt_sz_lst, # # Exception| offset_lst, # # Exception| ) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 467, in _test_xdp_native_tail_adt # # Exception| recvd_str = _exchg_udp(cfg, port, test_str) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/drivers/net/./xdp.py", line 72, in _exchg_udp # # Exception| with bkg(rx_udp_cmd, exit_wait=True) as nc: # # Exception| ~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 137, in __exit__ # # Exception| return self.process(terminate=terminate, fail=self.check_fail) # # Exception| ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/utils.py", line 85, in process # # Exception| stdout, stderr = self.proc.communicate(timeout) # # Exception| ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^ # # Exception| File "/usr/lib/python3.13/subprocess.py", line 1222, in communicate # # Exception| stdout, stderr = self._communicate(input, endtime, timeout) # # Exception| ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^ # # Exception| File "/usr/lib/python3.13/subprocess.py", line 2128, in _communicate # # Exception| ready = selector.select(timeout) # # Exception| File "/usr/lib/python3.13/selectors.py", line 398, in select # # Exception| fd_event_list = self._selector.poll(timeout) # # Exception| File "/home/sdf/src/linux/tools/testing/selftests/net/lib/py/ksft.py", line 208, in _ksft_intr # # Exception| raise KsftTerminate() # # Exception| net.lib.py.ksft.KsftTerminate # # Stopping tests due to KsftTerminate. # not ok 7 xdp.test_xdp_native_adjst_tail_grow_data # # Totals: pass:6 fail:1 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250924222518.1826863-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 96a17ed17b369109b662b40345df961b412c1cd3 Author: Qiang Yu Date: Fri Sep 19 19:53:25 2025 +0530 dt-bindings: PCI: qcom,pcie-x1e80100: Set clocks minItems for the fifth Glymur PCIe Controller On the Qualcomm Glymur platform, the fifth PCIe host is compatible with the DWC controller present on the X1E80100 platform, but does not have cnoc_sf_axi clock. Hence, set minItems of clocks and clock-names to six. Signed-off-by: Qiang Yu Signed-off-by: Pankaj Patil Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250919142325.1090059-1-pankaj.patil@oss.qualcomm.com commit cef730075cfe2b2091e3c94471cc0a78405401d5 Author: Konrad Dybcio Date: Fri Sep 26 14:22:45 2025 +0200 PCI: dwc: Support 16-lane operation Some hosts support 16 lanes of PCIe. Make num-lanes accept that number. Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250926-topic-pcie_16ln-v1-1-c249acc18790@oss.qualcomm.com commit 60e7b5aa85712f7f2fc75b2e9d28444de88ab47f Author: Niklas Schnelle Date: Tue Aug 26 10:52:09 2025 +0200 PCI: Add lockdep assertion in pci_stop_and_remove_bus_device() Removing a PCI devices requires holding pci_rescan_remove_lock. Prompted by this being missed in sriov_disable() and going unnoticed since its inception, add a lockdep assert so this doesn't get missed again in the future. Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Reviewed-by: Julian Ruess Link: https://patch.msgid.link/20250826-pci_fix_sriov_disable-v1-2-2d0bc938f2a3@linux.ibm.com commit 6c85fb5486c5a8ae646438877d7dc5050992a173 Author: Geert Uytterhoeven Date: Thu Sep 25 09:09:50 2025 +0200 psp: Expand PSP acronym in INET_PSP help description People not very intimate with PSP may not know the meaning of this recursive acronym. Hence replace the half-explanatory "PSP protocol" in the help description by the full expansion, like is done in the linked PSP Architecture Specification document. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman Link: https://patch.msgid.link/ae13c3ed7f80e604b8ae1561437a67b73549e599.1758784164.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 267bca002c504b6c656c23dc973a34ddaededbce Author: Robert Marko Date: Thu Sep 25 15:19:49 2025 +0200 dt-bindings: net: sparx5: correct LAN969x register space windows LAN969x needs only 2 register space windows as GCB is already covered by the "devices" register space window, so expect only 2 "reg" and "reg-names" properties. Fixes: 41c6439fdc2b ("dt-bindings: net: add compatible strings for lan969x targets") Signed-off-by: Robert Marko Acked-by: Conor Dooley Link: https://patch.msgid.link/20250925132109.583984-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 Author: Niklas Schnelle Date: Tue Aug 26 10:52:08 2025 +0200 PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs. Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls. On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed: PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56) GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001 00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8 #0 [3800313fb20] device_del at c9158ad5c #1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390 #9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2. This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy. Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper. Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking. Fixes: 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") Signed-off-by: Niklas Schnelle Signed-off-by: Bjorn Helgaas Reviewed-by: Benjamin Block Reviewed-by: Farhan Ali Reviewed-by: Julian Ruess Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250826-pci_fix_sriov_disable-v1-1-2d0bc938f2a3@linux.ibm.com commit 11ae737efea10a8cc1c48b6288bde93180946b8c Author: Amery Hung Date: Thu Sep 25 09:14:52 2025 -0700 selftests: drv-net: Reload pkt pointer after calling filter_udphdr Fix a verification failure. filter_udphdr() calls bpf_xdp_pull_data(), which will invalidate all pkt pointers. Therefore, all ctx->data loaded before filter_udphdr() cannot be used. Reload it to prevent verification errors. The error may not appear on some compiler versions if they decide to load ctx->data after filter_udphdr() when it is first used. Fixes: efec2e55bdef ("selftests: drv-net: Pull data before parsing headers") Signed-off-by: Amery Hung Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925161452.1290694-1-ameryhung@gmail.com Signed-off-by: Jakub Kicinski commit 532a94352fca6b51f49d1cd9f0e4250ade49b8b2 Author: Kael D'Alcamo Date: Wed Sep 24 16:09:20 2025 +0200 dt-bindings: rng: sparc_sun_oracle_rng: convert to DT schema Convert the Devicetree binding documentation for: * SUNW,n2-rng * SUNW,vf-rng * SUNW,kt-rng * ORCL,m4-rng * ORCL,m7-rng from plain text to YAML. Signed-off-by: Kael D'Alcamo Signed-off-by: Rob Herring (Arm) commit 33b6c8ed1ddd6118fbc150269cd2201462fbd7e6 Author: Kael D'Alcamo Date: Wed Sep 24 16:09:22 2025 +0200 dt-bindings: vendor-prefixes: update regex for properties without a prefix Update vendor-prefixes.yaml to allow property names without a prefix to contain '#' character in all positions Signed-off-by: Kael D'Alcamo Signed-off-by: Rob Herring (Arm) commit 74459b0dacced28542b631abf89bc24456c7f789 Author: Frank Li Date: Tue Sep 23 16:55:48 2025 -0400 dt-bindings: display: bridge: convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml Convert megachips-stdpxxxx-ge-b850v3-fw.txt to yaml format. Additional changes: - Only keep one example. Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit 77e46093e83a2788e2cf80ba8c8731375e587ad2 Author: Markus Heidelberg Date: Fri Sep 26 12:57:49 2025 +0200 scripts: dt_to_config: fix grammar and a typo in --help text - grammar: singular/plural inconsistency - typo: "of" -> "or" Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit d6f57d8c5a5aede34c72382cdbd5b35616e171e6 Author: Markus Heidelberg Date: Fri Sep 26 12:57:48 2025 +0200 dt-bindings: fix spelling, typos, grammar, duplicated words Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit 86eedc669a56e5607c253253d7b466a5b8d70fc8 Author: Markus Heidelberg Date: Fri Sep 26 12:57:47 2025 +0200 docs: dt: fix grammar and spelling Signed-off-by: Markus Heidelberg Signed-off-by: Rob Herring (Arm) commit dd5629a67c5f3b4d9783dcdf06c844f8b7c88fae Merge: 6f540af89e1cfd 30c3055f9c0d84 Author: Jakub Kicinski Date: Fri Sep 26 13:51:47 2025 -0700 Merge branch 'xsk-refactors-around-generic-xmit-side' Maciej Fijalkowski says: ==================== xsk: refactors around generic xmit side this small patchset is about refactoring code around xsk_build_skb() as it became pretty heavy. Generic xmit is a bit hard to follow so here are three clean ups to start with making this code more friendly. v1: https://lore.kernel.org/20250922152600.2455136-1-maciej.fijalkowski@intel.com ==================== Link: https://patch.msgid.link/20250925160009.2474816-1-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 30c3055f9c0d84a67b8fd723bdec9b1b52b3c695 Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:09 2025 +0200 xsk: wrap generic metadata handling onto separate function xsk_build_skb() has gone wild with its size and one of the things we can do about it is to pull out a branch that takes care of metadata handling and make it a separate function. While at it, let us add metadata SW support for devices supporting IFF_TX_SKB_NO_LINEAR flag, that happen to have separate logic for building skb in xsk's generic xmit path. Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Signed-off-by: Maciej Fijalkowski Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-4-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 6b9c129c2f93df545248e26434720928f249ff2e Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:08 2025 +0200 xsk: remove @first_frag from xsk_build_skb() Instead of using auxiliary boolean that tracks if we are at first frag when gathering all elements of skb, same functionality can be achieved with checking if skb_shared_info::nr_frags is 0. Remove @first_frag but be careful around xsk_build_skb_zerocopy() and NULL the skb pointer when it failed so that common error path does not incorrectly interpret it during decision whether to call kfree_skb(). Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-3-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit c30d084960cf316c95fbf145d39974ce1ff7889c Author: Maciej Fijalkowski Date: Thu Sep 25 18:00:07 2025 +0200 xsk: avoid overwriting skb fields for multi-buffer traffic We are unnecessarily setting a bunch of skb fields per each processed descriptor, which is redundant for fragmented frames. Let us set these respective members for first fragment only. To address both paths that we have within xsk_build_skb(), move assignments onto xsk_set_destructor_arg() and rename it to xsk_skb_init_misc(). Signed-off-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Reviewed-by: Jason Xing Acked-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925160009.2474816-2-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 Author: D. Wythe Date: Fri Sep 26 15:17:51 2025 +0800 libbpf: Fix error when st-prefix_ops and ops from differ btf When a module registers a struct_ops, the struct_ops type and its corresponding map_value type ("bpf_struct_ops_") may reside in different btf objects, here are four possible case: +--------+---------------+-------------+---------------------------------+ | |bpf_struct_ops_| xxx_ops | | +--------+---------------+-------------+---------------------------------+ | case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux | +--------+---------------+-------------+---------------------------------+ | case 1 | btf_vmlinux | mod_btf | INVALID | +--------+---------------+-------------+---------------------------------+ | case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in | | | | | vmlinux and mod. | +--------+---------------+-------------+---------------------------------+ | case 3 | mod_btf | mod_btf | be used and reg only in mod | +--------+---------------+-------------+---------------------------------+ Currently we figure out the mod_btf by searching with the struct_ops type, which makes it impossible to figure out the mod_btf when the struct_ops type is in btf_vmlinux while it's corresponding map_value type is in mod_btf (case 2). The fix is to use the corresponding map_value type ("bpf_struct_ops_") as the lookup anchor instead of the struct_ops type to figure out the `btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate the kern_type_id via btf__find_by_name_kind() with the `btf` we just obtained from find_ksym_btf_id(). With this change the lookup obtains the correct btf and mod_btf for case 2, preserves correct behavior for other valid cases, and still fails as expected for the invalid scenario (case 1). Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support") Signed-off-by: D. Wythe Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Acked-by: Martin KaFai Lau Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com commit acbba7f0e5ec9736813dee221cc20f77a7d11d7b Merge: b1793cd1fefaa3 79428e60897916 Author: Rafael J. Wysocki Date: Fri Sep 26 22:01:13 2025 +0200 Merge tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge updates of thermal drivers for 6.18-rc1 from Daniel Lezcano: "- Add the QCS615 compatible DT bindings for QCom platforms (Gaurav Kohli) - Support fallback trimming values when the fuse is empty in the R-Car driver (Marek Vasut) - Remove unneeded semicolon in the Mediatek LVTS driver (Jiapeng Chong) - Fix the LMH Kconfig option by selecting QCOM_SCM and take the opportunity to add the COMPILE_TEST option for the QCom's LMH feature (Dmitry Baryshkov) - Fix the missing includes and incorrect error message in the Qcom's LMH driver (Dmitry Baryshkov) - Fix comment typo and add the documentation in the Kconfig for the R-Car Gen3 and Gen4 (Marek Vasut) - Add Tegra114 SOCTHERM support (Svyatoslav Ryhel) - Rename the functions name in the driver to be consistent and generic with the different R-Car platform variants (Wolfram Sang) - Register the TI K3 J72xx bandgap sensor as a hwmon sensor too (Michael Walle) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3S SoC (Claudiu Beznea) - Support the GRF in the Rockchip driver (Sebastian Reichel) - Add a temperature IIO sensor channel in the generic thermal ADC driver (Svyatoslav Ryhel) - Document the temperature sensor on the QCOM's Glymur platform (Manaf Meethalavalappu) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3E SoC (John Madieu)" * tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (24 commits) dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit thermal/drivers/thermal-generic-adc: Add temperature sensor channel dt-bindings: thermal: rockchip: Tighten grf requirements thermal/drivers/rockchip: Shut up GRF warning thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver dt-bindings: thermal: add Tegra114 soctherm header thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry thermal/drivers/rcar_gen3: Fix comment typo drivers/thermal/qcom/lmh: Fix incorrect error message thermal/drivers/qcom/lmh: Add missing IRQ includes thermal/drivers/qcom: Make LMH select QCOM_SCM ... commit a036bb0e60ad2828c3498bff7465bcbb247b7436 Author: Bjorn Helgaas Date: Thu Sep 25 14:56:30 2025 -0500 of: base: Add of_get_next_child_with_prefix() stub 1fcc67e3a354 ("of: base: Add for_each_child_of_node_with_prefix()") added of_get_next_child_with_prefix() but did not add a stub for the !CONFIG_OF case. Add a of_get_next_child_with_prefix() stub so users of for_each_child_of_node_with_prefix() can be built for compile testing even when !CONFIG_OF. Fixes: 1fcc67e3a354 ("of: base: Add for_each_child_of_node_with_prefix()") Signed-off-by: Bjorn Helgaas Signed-off-by: Rob Herring (Arm) commit 4fea3336ef57295b989a6b2db4a6946a06e4c787 Author: Frank Li Date: Tue Sep 23 16:41:18 2025 -0400 dt-bindings: trivial-devices: Add compatible string synaptics,synaptics_i2c Add compatible string synaptics,synaptics_i2c for synaptics touch pad. It match existed driver drivers/input/mouse/synaptics_i2c.c. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit 18b26b15178386eb82bca4b23b03e96ca9317d36 Author: Ariel D'Alessandro Date: Thu Sep 11 12:10:00 2025 -0300 dt-bindings: soc: mediatek: pwrap: Add power-domains property Currently, the DT bindings for Mediatek PMIC Wrapper is missing the power-domains property, which is used in the MT8173 E1 evaluation board as it needs USB power domain. Signed-off-by: Ariel D'Alessandro Acked-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Rob Herring (Arm) commit d0b5a39acd079bccaebbb0d94bfd4649359951c2 Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:57 2025 -0300 dt-bindings: pinctrl: mt65xx: Allow gpio-line-names Current, the DT bindings for MediaTek's MT65xx Pin controller is missing the gpio-line-names property, add it to the associated schema. Signed-off-by: Ariel D'Alessandro Acked-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Linus Walleij Signed-off-by: Rob Herring (Arm) commit 49ceb031b6c139e17e069b25506a4c283fd22595 Author: Ariel D'Alessandro Date: Thu Sep 11 12:09:51 2025 -0300 dt-bindings: media: Convert MediaTek mt8173-vpu bindings to DT schema Convert the existing text-based DT bindings for Mediatek MT8173 Video Processor Unit to a DT schema. Signed-off-by: Ariel D'Alessandro Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski [robh: update MAINTAINERS and mediatek-mdp.txt references] Signed-off-by: Rob Herring (Arm) commit 37020f865aa3c4049266cb34cf83ef299184ae80 Author: Julien Massot Date: Tue Aug 26 09:39:36 2025 +0200 dt-bindings: arm: mediatek: Support mt8183-audiosys variant Update the mediatek,audsys binding to support the mt8183-audiosys compatible, which uses a different audio controller (mediatek,mt8183-audio.yaml) compared to the legacy mt2701-audio controller. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Signed-off-by: Rob Herring (Arm) commit a31c2f8e2b6af2e45d5e8016e5055b2b00b4d6c5 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:39 2025 +0200 dt-bindings: mailbox: mediatek,gce-mailbox: Make clock-names optional The GCE Mailbox needs only one clock and the clock-names can be used only by the driver (which, for instance, does not use it), and this is true for all of the currently supported MediaTek SoCs. Stop requiring to specify clock-names on all non-MT8195 GCEs. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Acked-by: Rob Herring (Arm) Reviewed-by: Chen-Yu Tsai Signed-off-by: Rob Herring (Arm) commit 1a8493e06b854b05263071a5db77488cb9c07972 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:48 2025 +0200 dt-bindings: regulator: mediatek,mt6331: Add missing compatible This binding had no compatible and for this reason would not be applied to anything: add the missing "mediatek,mt6331-regulator" comaptible. Fixes: 6385e21692bb ("regulator: Add bindings for MT6331 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit e29e64fb9c58ce92cb8316cd6a939bd3e49b7f63 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:47 2025 +0200 dt-bindings: regulator: mediatek,mt6331: Fix various regulator names This binding was never applied to anything because it misses the compatible, hence any mistake in it got unnoticed. Before adding the compatible to let it apply, fix the names and the node names of various regulators. Fixes: 6385e21692bb ("regulator: Add bindings for MT6331 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 41663b33cda3a70c719f82f4f62c2f54b16fad5b Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:46 2025 +0200 dt-bindings: regulator: mediatek,mt6332-regulator: Add missing compatible This binding had no compatible and for this reason would not be applied to anything: add the missing "mediatek,mt6332-regulator" compatible. Fixes: e22943e32e1f regulator: ("Add bindings for MT6332 regulator") Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 8e0118a79bda64aad3ae72dd80c814c1978460ea Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:44 2025 +0200 dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing base reg The pin controller for both MT7622 and MT7629 need both a "base" and an "eint" MMIO like the ones found on other MediaTek SoCs: while devicetrees have always been correct, the binding is not, as it only allows an "eint" reg. Add "base" to reg-names and increment maxItems for reg to two. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Rob Herring (Arm) commit 8d200dff1e8e0cb521dd48ba1d5424be400cd9bc Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:43 2025 +0200 dt-bindings: pinctrl: mediatek,mt7622-pinctrl: Add missing pwm_ch7_2 The MT7622 SoC has a PWM channel 7-2 group for the pwm7 IP: add the missing pwm_ch7_2 group. Signed-off-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit c1f7800c9c70c67d5feea2d9acaac004086d41d2 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:42 2025 +0200 dt-bindings: timer: mediatek: Add compatible for MT6795 GP Timer Add a compatible for the General Purpose Timer (GPT) found on the MediaTek Helio X10 MT6795 SoC which is fully compatible with the one found in MT6577. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Acked-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) commit 069862313db33a2b68ebf9e92ac13b73ef12f2af Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:37 2025 +0200 dt-bindings: display: mediatek: dpi: Allow specifying resets Even though the DPI IP has a reset bit on all MediaTek SoCs, it is optional, and has always been unused until MT8195; specifically: on older SoCs, like MT8173, the reset bit is located in MMSYS, and on newer SoCs, like MT8195, it is located in VDOSYS. For this reason, allow specifying the resets and reset-names on all MediaTek SoCs. Those properties are optional because there are multiple ways to reset this IP and the reset lines in MM/VDO are used only if the IP cannot perform warm-reset. Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Rob Herring (Arm) commit 4379fbb9b06c8c17dac63652cfc2a7ada96c5074 Author: Pankaj Patil Date: Thu Sep 18 19:32:49 2025 +0530 dt-bindings: interrupt-controller: qcom,pdc: Document Glymur PDC Document compatible for the Power Domain Controller(PDC) block on Glymur.PDC acts as interrupt controller in SoC states where GIC is non-operational. Signed-off-by: Pankaj Patil Signed-off-by: Rob Herring (Arm) commit c502ca1ea1b9a7ed4b9665bed48bc1d8887639b3 Author: sheetal Date: Thu Sep 18 15:50:08 2025 +0530 dt-bindings: interrupt-controller: arm,gic: Add tegra264-agic Add nvidia,tegra264-agic to the arm,gic binding for tegra264 audio interrupt controller support. Signed-off-by: sheetal Signed-off-by: Rob Herring (Arm) commit 60042a6ff2348fd2edca2f31e79fe80548d1a75d Author: Frank Li Date: Mon Sep 15 11:51:23 2025 -0400 dt-bindings: display: simple: Add innolux,n133hse-ea1 and nlt,nl12880bc20-spwg-24 Add innolux,n133hse-ea1 13.3" TFT LCD panel and nlt,nl12880bc20-spwg-24 12.1" WXGA (1280 x 800) LVDS TFT LCD panel. Fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6q-novena.dtb: /panel: failed to match any schema with compatible: ['innolux,n133hse-ea1'] arch/arm/boot/dts/nxp/imx/imx6dl-tx6u-811x.dtb: /lvds0-panel: failed to match any schema with compatible: ['nlt,nl12880bc20-spwg-24'] Signed-off-by: Frank Li Signed-off-by: Rob Herring (Arm) commit b518ec73cc62fe3f921ea6c009628a40c927d92c Author: Ivaylo Ivanov Date: Sun Sep 14 16:14:52 2025 +0300 dt-bindings: gpu: arm,mali-midgard: add exynos8890-mali compatible The exynos8890 uses the ARM Mali T880 GPU, document its compatible string with the appropriate fallback. Signed-off-by: Ivaylo Ivanov Signed-off-by: Rob Herring (Arm) commit ad9a8291b13b985852ad617827a4c5265a8836f5 Author: Rob Herring (Arm) Date: Wed Apr 30 13:27:35 2025 -0500 dt-bindings: edac: Convert aspeed,ast2400-sdram-edac to DT schema Convert the ASpeed SDRAM EDAC binding to DT schema. It's a straight-forward conversion. Reviewed-by: Andrew Jeffery Reviewed-by: Stefan Schaeckeler Signed-off-by: Rob Herring (Arm) commit b1793cd1fefaa372f838aa43cf6c404ad49e2968 Merge: e3e661253e82b2 5cf952c54f3546 Author: Rafael J. Wysocki Date: Fri Sep 26 21:49:58 2025 +0200 Merge branch 'thermal-intel' Merge an adjustment of the new Power Slider interface in the int340x thermal driver. * thermal-intel: thermal: intel: int340x: Power Slider: Validate slider_balance range commit 20b1d75fb840cc27490028a5b13914e22375f273 Author: Jonathan Curley Date: Wed Sep 24 16:20:50 2025 +0000 NFSv4/flexfiles: Add support for striped layouts Updates lseg creation path to parse and add striped layouts. Enable support for striped layouts. Limitations: 1. All mirrors must have the same number of stripes. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 8a8e0f5566edc074a006246917fd78b358e39afa Author: Jonathan Curley Date: Wed Sep 24 16:20:49 2025 +0000 NFSv4/flexfiles: Update layout stats & error paths for striped layouts Updates the layout stats logic to be stripe aware. Read and write stats are accumulated on a per DS stripe basis. Also updates error paths to use dss_id where appropraite. Limitations: 1. The layout stats structure is still statically sized to 4 and there is no deduplication logic for deviceids that may appear more than once in a striped layout. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 06d157d6fc40615d199d0b2786dc469a05c9d254 Author: Jonathan Curley Date: Wed Sep 24 16:20:48 2025 +0000 NFSv4/flexfiles: Write path updates for striped layouts Updates write path to calculate and use dss_id to direct IO to the appropriate stripe DS. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 8a8729db676379e148ce56ac9a7bc1f90e3bd95a Author: Jonathan Curley Date: Wed Sep 24 16:20:47 2025 +0000 NFSv4/flexfiles: Commit path updates for striped layouts Updates the commit path to be stripe aware. This required updating the ds_commit_idx to be stripe aware. ds_commit_idx == mirror_idx * dss_count + dss_id. Updates code paths to utilize the new ds_commit_idx and derive dss_id & mirror_idx where appropriate to contact the correct DS using the corresponding parameters. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 4934ccbeaed39659474fa18b8a399e2887cef8a9 Author: Jonathan Curley Date: Wed Sep 24 16:20:46 2025 +0000 NFSv4/flexfiles: Read path updates for striped layouts Updates read path to calculate and use dss_id to direct IO to the appropriate stripe DS. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit a1491919c8805b3874f76fd273ae224ec9768aec Author: Jonathan Curley Date: Wed Sep 24 16:20:45 2025 +0000 NFSv4/flexfiles: Update low level helper functions to be DS stripe aware. Updates common helper functions to be dss_id aware. Most cases simply add a dss_id parameter. The has_available functions have been updated with a loop. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit d442670c0f63c46b7f348f68fb2002af597708f2 Author: Jonathan Curley Date: Wed Sep 24 16:20:44 2025 +0000 NFSv4/flexfiles: Add data structure support for striped layouts Adds a new struct nfs4_ff_layout_ds_stripe that represents a data server stripe within a layout. A new dynamically allocated array of this type has been added to nfs4_ff_layout_mirror and per stripe configuration information has been moved from the mirror type to the stripe based on the RFC. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit eb71428e1a7fb51b8d43762db1c2ec1d8a7a95b6 Author: Jonathan Curley Date: Wed Sep 24 16:20:43 2025 +0000 NFSv4/flexfiles: Use ds_commit_idx when marking a write commit Correct this path to use ds_commit_idx. Another noop preparation change. In current code commit_idx == mirror_idx but when striping is enabled that will not be true. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit fec80afc41afa3016421115427df8d00dc491ee5 Author: Jonathan Curley Date: Wed Sep 24 16:20:42 2025 +0000 NFSv4/flexfiles: Remove cred local variable dependency No-op preparation change to remove dependency on cred local variable. Subsequent striping diff has a cred per stripe so this local variable can't be trusted to be the same. Signed-off-by: Jonathan Curley Signed-off-by: Anna Schumaker commit 6f540af89e1cfd1a33f63989c50010629b169cc5 Merge: 203e3beb73e535 b89cd87b77d48f Author: Jakub Kicinski Date: Fri Sep 26 12:26:43 2025 -0700 Merge branch 'scripts-coccinelle-symbolic-error-names-script' Tariq Toukan says: ==================== scripts/coccinelle: Symbolic error names script This small series by Gal adds a new coccinelle script that spots potential transitions to symbolic error names in print functions, and then uses it in mlx5 driver. ==================== Link: https://patch.msgid.link/1758192227-701925-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b89cd87b77d48ff14aea743cdba4193e76feb588 Author: Gal Pressman Date: Thu Sep 18 13:43:47 2025 +0300 net/mlx5: Use %pe format specifier for error pointers Using the coccinelle test introduced in previous commit (scripts/coccinelle/misc/ptr_err_to_pe.cocci), convert error logging throughout the mlx5 driver to use the %pe format specifier instead of PTR_ERR() with integer format specifiers. Signed-off-by: Gal Pressman Reviewed-by: Alexei Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758192227-701925-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 57c49d2355729c12475554b4c51dbf830b02d08d Author: Gal Pressman Date: Thu Sep 18 13:43:46 2025 +0300 scripts/coccinelle: Find PTR_ERR() to %pe candidates Add a new Coccinelle script to identify places where PTR_ERR() is used in print functions and suggest using the %pe format specifier instead. For printing error pointers (i.e., a pointer for which IS_ERR() is true) %pe will print a symbolic error name (e.g,. -EINVAL), opposed to the raw errno (e.g,. -22) produced by PTR_ERR(). It also makes the code cleaner by saving a redundant call to PTR_ERR(). The script supports context, report, and org modes. Example transformation: printk("Error: %ld\n", PTR_ERR(ptr)); // Before printk("Error: %pe\n", ptr); // After Signed-off-by: Gal Pressman Reviewed-by: Alexei Lazar Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1758192227-701925-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 1f5bcfe91ffce71bdd1022648b9d501d46d20c09 Author: Rafael J. Wysocki Date: Fri Sep 26 18:41:21 2025 +0200 PM: hibernate: Combine return paths in power_down() To avoid code duplication and improve clarity, combine the code paths in power_down() leading to a return from that function. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/3571055.QJadu78ljV@rafael.j.wysocki [ rjw: Changed the new label name to "exit" ] Signed-off-by: Rafael J. Wysocki commit 991e555efffde314e94be9c28fc0ea5504195df8 Author: Amery Hung Date: Fri Sep 26 09:41:42 2025 -0700 selftests/bpf: Test changing packet data from kfunc bpf_xdp_pull_data() is the first kfunc that changes packet data. Make sure the verifier clear all packet pointers after calling packet data changing kfunc. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250926164142.1850176-1-ameryhung@gmail.com commit 6f4c6f9ed4ce65303f6bb153e2afc71bc33c8ded Author: Rafael J. Wysocki Date: Fri Sep 26 18:40:25 2025 +0200 PM: hibernate: Restrict GFP mask in power_down() Commit 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") caused hibernation_platform_enter() to call pm_restore_gfp_mask() via dpm_resume_end(), so when power_down() returns after aborting hibernation_platform_enter(), it needs to match the pm_restore_gfp_mask() call in hibernate() that will occur subsequently. Address this by adding a pm_restrict_gfp_mask() call to the relevant error path in power_down(). Fixes: 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit bbfe987c5a2854705393ad79813074e5eadcbde6 Author: Rafael J. Wysocki Date: Fri Sep 26 13:10:22 2025 +0200 PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage Commit 495c8d35035e ("PM: hibernate: Add pm_hibernation_mode_is_suspend()") that introduced pm_hibernation_mode_is_suspend() did not define it in the case when CONFIG_HIBERNATION is unset, but CONFIG_SUSPEND is set. Subsequent commit 0a6e9e098fcc ("drm/amd: Fix hybrid sleep") made the amdgpu driver use that function which led to kernel build breakage in the case mentioned above [1]. Address this by using appropriate #ifdeffery around the definition of pm_hibernation_mode_is_suspend(). Fixes: 0a6e9e098fcc ("drm/amd: Fix hybrid sleep") Reported-by: KernelCI bot Closes: https://groups.io/g/kernelci-results/topic/regression_pm_testing/115439919 [1] Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit 927f3e85015285ff68789bd00aa66b071016b27f Author: Brian Norris Date: Tue Sep 23 15:06:26 2025 -0700 PM: runtime: Documentation: ABI: Document time units for *_time Many .../power/... time-related attributes have an "_ms" suffix and also include language in their ABI description to make clear that their time is measured in milliseconds. However, 'runtime_suspended_time' and 'runtime_active_time' have neither, and it takes me a nontrivial amount of time to poke through the source to confirm that they are also measured in milliseconds. Update the doc with "millisecond" units. Signed-off-by: Brian Norris Reviewed-by: Dhruva Gole Link: https://patch.msgid.link/20250923150625.1.If11a14e33d578369db48d678395d0323bdb01915@changeid [ rjw: Subject edits, changelog tweak ] Signed-off-by: Rafael J. Wysocki commit e6d736bd08902ba53460df1b62ee4218bbd17d9b Author: Abhijit Gangurde Date: Wed Sep 24 19:51:23 2025 +0530 RDMA/ionic: Fix memory leak of admin q_wr The admin queue work request buffer, aq->q_wr, is allocated via kcalloc in __ionic_create_rdma_adminq. However, it was not being freed in the corresponding teardown function __ionic_destroy_rdma_adminq. This results in a memory leak. Fix this leak by adding the missing kfree(aq->q_wr) in the destruction path. Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Link: https://patch.msgid.link/r/20250924142123.18344-1-abhijit.gangurde@amd.com Signed-off-by: Abhijit Gangurde Signed-off-by: Jason Gunthorpe commit fdd0fe94d68649322e391c5c27dd9f436b4e955e Author: Bernard Metzler Date: Tue Sep 23 16:45:36 2025 +0200 RDMA/siw: Always report immediate post SQ errors In siw_post_send(), any immediate error encountered during processing of the work request list must be reported to the caller, even if previous work requests in that list were just accepted and added to the send queue. Not reporting those errors confuses the caller, which would wait indefinitely for the failing and potentially subsequently aborted work requests completion. This fixes a case where immediate errors were overwritten by subsequent code in siw_post_send(). Fixes: 303ae1cdfdf7 ("rdma/siw: application interface") Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev Suggested-by: Stefan Metzmacher Signed-off-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit fe0126702a40b2f3d315bc943ef10dc2f707e29d Author: Thorsten Blum Date: Mon Sep 22 23:03:57 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in handle_nextprop_quirks() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 79f76dfb4ee299eaba9be8c17d59e146a54e6752 Author: Thorsten Blum Date: Mon Sep 22 23:03:56 2025 +0200 sparc64: Replace deprecated strcpy() with strscpy() in build_path_component() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit b7b2c2f7e8848299c5cc8c596c49e90b0a39a3db Author: Thorsten Blum Date: Mon Sep 22 23:03:55 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in prom_32.c strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit dcdba5966c1ef9a6890e03fdaaf1bd1a5b66ee75 Author: Thorsten Blum Date: Mon Sep 22 23:03:54 2025 +0200 sparc: Replace deprecated strcpy() with strscpy() in domain services driver strcpy() is deprecated; use strscpy() instead. In ldom_set_var(), use pr_err() instead of printk(KERN_ERR) to silence a checkpatch warning. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 9040d7c77e4d920c190ee2154d76e9daf4406de6 Author: Thorsten Blum Date: Mon Sep 22 23:03:53 2025 +0200 sparc64: Replace deprecated strcpy() with strscpy() in prom_nextprop() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit c7ae5d73b7af5723e7590015a570cd3cd397290b Author: Thorsten Blum Date: Mon Sep 22 23:03:52 2025 +0200 sparc: floppy: Replace deprecated strcpy() with strscpy() in sun_floppy_init() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 8ebfe29b710ba0c40531089ce649d0e4a776125a Author: Thorsten Blum Date: Mon Sep 22 23:03:51 2025 +0200 sparc: parport: Replace deprecated strcpy() with strscpy() in ecpp_probe() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 59d94ea8901cdab47dc65cabc790597eef99944f Author: Thorsten Blum Date: Mon Sep 22 23:03:50 2025 +0200 sparc: PCI: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 3b1307e1cd1224a063a1791d213dfdd35b05a38a Author: Thomas Huth Date: Fri Mar 14 08:10:05 2025 +0100 sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: David S. Miller Cc: Andreas Larsson Cc: sparclinux@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit d6fb6511de74bd0d4cb4cabddae9b31d533af1c1 Author: Thomas Huth Date: Fri Mar 14 08:10:04 2025 +0100 sparc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: David S. Miller Cc: Andreas Larsson Cc: sparclinux@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: Andreas Larsson Signed-off-by: Andreas Larsson commit dc356bf3c173a69d4b6f6ee6221cd21c6500fc65 Author: Thomas Huth Date: Tue Aug 5 11:25:40 2025 +0200 sparc: Drop the "-ansi" from the asflags In the very early kernel 1.x days, assembler files were pre-processed with the "-traditional" flag. With kernel 1.1.85, the sparc subsystem was changed to use "-ansi" instead while the other parts of the kernel continued to use "-traditional". That "-traditional" got removed from the other architectures in the course of time, but the sparc part kept the "-ansi" until today. This is bad since it comes with some disadvantages nowadays: You have to make sure to not include any header that contains a "//" C++ comment by accident (there are now some in the tree that use these for SPDX identifiers for example), and with "-ansi" we also do not get the pre-defined __ASSEMBLER__ macro which we'd like to use instead of the kernel-only __ASSEMBLY__ macro in the future. Since there does not seem to be any compelling reason anymore to use "-ansi" nowadays, let's simply drop the "-ansi" flag from the sparc subsystem now to get rid of those disadvantages. Signed-off-by: Thomas Huth Reviewed-by: Arnd Bergmann Reviewed-by: Andreas Larsson Tested-by: Andreas Larsson Signed-off-by: Andreas Larsson commit 407aa63018d15c35a34938633868e61174d2ef6e Author: Tushar Dave Date: Thu Sep 25 12:09:35 2025 -0500 vfio/nvgrace-gpu: Add GB300 SKU to the devid table GB300 is NVIDIA's Grace Blackwell Ultra Superchip. Add the GB300 SKU device-id to nvgrace_gpu_vfio_pci_table. Signed-off-by: Tushar Dave Reviewed-by: Ankit Agrawal Link: https://lore.kernel.org/r/20250925170935.121587-1-tdave@nvidia.com Signed-off-by: Alex Williamson commit 8b9f128947dd72e0fcf256088a673abac9b720bf Author: Timothy Pearson Date: Tue Sep 23 12:04:33 2025 -0500 vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices PCI devices prior to PCI 2.3 both use level interrupts and do not support interrupt masking, leading to a failure when passed through to a KVM guest on at least the ppc64 platform. This failure manifests as receiving and acknowledging a single interrupt in the guest, while the device continues to assert the level interrupt indicating a need for further servicing. When lazy IRQ masking is used on DisINTx- (non-PCI 2.3) hardware, the following sequence occurs: * Level IRQ assertion on device * IRQ marked disabled in kernel * Host interrupt handler exits without clearing the interrupt on the device * Eventfd is delivered to userspace * Guest processes IRQ and clears device interrupt * Device de-asserts INTx, then re-asserts INTx while the interrupt is masked * Newly asserted interrupt acknowledged by kernel VMM without being handled * Software mask removed by VFIO driver * Device INTx still asserted, host controller does not see new edge after EOI The behavior is now platform-dependent. Some platforms (amd64) will continue to spew IRQs for as long as the INTX line remains asserted, therefore the IRQ will be handled by the host as soon as the mask is dropped. Others (ppc64) will only send the one request, and if it is not handled no further interrupts will be sent. The former behavior theoretically leaves the system vulnerable to interrupt storm, and the latter will result in the device stalling after receiving exactly one interrupt in the guest. Work around this by disabling lazy IRQ masking for DisINTx- INTx devices. Signed-off-by: Timothy Pearson Link: https://lore.kernel.org/r/333803015.1744464.1758647073336.JavaMail.zimbra@raptorengineeringinc.com Signed-off-by: Alex Williamson commit 4d164e08cd8457ebcd5346f612ac2c04e80b6bea Author: John Ogness Date: Fri Sep 26 00:55:59 2025 +0206 printk: ringbuffer: Fix data block max size check Currently data_check_size() limits data blocks to a maximum size of the full buffer minus an ID (long integer): max_size <= DATA_SIZE(data_ring) - sizeof(long) However, this is not an appropriate limit due to the nature of wrapping data blocks. For example, if a data block is larger than half the buffer: size = (DATA_SIZE(data_ring) / 2) + 8 and begins exactly in the middle of the buffer, then: - the data block will wrap - the ID will be stored at exactly half of the buffer - the record data begins at the beginning of the buffer - the record data ends 8 bytes _past_ exactly half of the buffer The record overwrites itself, i.e. needs more space than the full buffer! Luckily printk() is not vulnerable to this problem because truncate_msg() limits printk-messages to 1/4 of the ringbuffer. Indeed, by adjusting the printk_ringbuffer KUnit test, which does not use printk() and its truncate_msg() check, it is easy to see that the ringbuffer becomes corrupted for records larger than half the buffer size. The corruption occurs because data_push_tail() expects it will never be requested to push the tail beyond the head. Avoid this problem by adjusting data_check_size() to limit record sizes to half the buffer size. Also add WARN_ON_ONCE() before relevant data_push_tail() calls to validate that there are no such illegal requests. WARN_ON_ONCE() is used, rather than just adding extra checks to data_push_tail() because it is considered a bug to attempt such illegal actions. Link: https://lore.kernel.org/lkml/aMLrGCQSyC8odlFZ@pathway.suse.cz Signed-off-by: John Ogness Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek commit cb0c5a60a6f7dd7f35fa5b46fd04dfb66b37fc1e Author: Gopi Krishna Menon Date: Fri Sep 26 10:06:12 2025 +0530 docs: perf: Fujitsu: Fix htmldocs build warnings and errors Running "make htmldocs" generates the following build errors and warnings for fujitsu_uncore_pmu.rst: Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:20: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:23: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:28: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:29: WARNING: Block quote ends without a blank line; unexpected unindent. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:81: ERROR: Unexpected indentation. Documentation/admin-guide/perf/fujitsu_uncore_pmu.rst:82: WARNING: Block quote ends without a blank line; unexpected unindent. Add blank line before bullet lists, block quotes to fix build errors, resolve warnings and properly render perf commands as code blocks. Signed-off-by: Gopi Krishna Menon Reviewed-by: Koichi Okuno Fixes: bad11557eed2 ("perf: Fujitsu: Add the Uncore PMU driver") Reviewed-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Will Deacon commit 57610d69f909ea2ea072775c6ad64ba9fad590bb Merge: 2bc1adb05e360f 66f430522452fe Author: Rafael J. Wysocki Date: Fri Sep 26 15:02:37 2025 +0200 Merge tag 'power-utilities-for-v6.18-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Merge turbostat and x86_energy_perf_policy bug fixes for v6.18 merge window from Len Brown. * tag 'power-utilities-for-v6.18-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces tools/power x86_energy_perf_policy: Add make snapshot target tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: EPB access is only via sysfs tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Enhance HWP enabled check tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage tools/power turbostat: Fix incorrect sorting of PMT telemetry commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc Author: Alessandro Zanni Date: Wed Sep 24 19:16:28 2025 +0200 iommu/selftest: prevent use of uninitialized variable Fix to avoid the usage of the `res` variable uninitialized in the following macro expansions. It solves the following warning: In function ‘iommufd_viommu_vdevice_alloc’, inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1: ../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized] 760 | if (!(__exp _t __seen)) { \ | ^ ../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’ 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1) | ^~~~~~~~ iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’ 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents)) | ^~~~~~~~~ iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’ 2924 | test_cmd_trigger_vevents(dev_id, 3); | ^~~~~~~~~~~~~~~~~~~~~~~~ The issue can be reproduced, building the tests, with the command: make -C tools/testing/selftests TARGETS=iommu Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage") Signed-off-by: Alessandro Zanni Signed-off-by: Jason Gunthorpe commit bbc3110823eca23b066e75a920bdc8118adda0d2 Author: Dan Carpenter Date: Fri Sep 26 07:03:29 2025 +0300 pmdomain: thead: Fix error pointer vs NULL bug in th1520_pd_reboot_init() The devm_auxiliary_device_create() returns NULL on error. It never returns error pointers. Using PTR_ERR_OR_ZERO() here means the function always returns success. Replace the PTR_ERR_OR_ZERO() call check with a NULL check. Fixes: 64581f41f4c4 ("pmdomain: thead: create auxiliary device for rebooting") Signed-off-by: Dan Carpenter Acked-by: Icenowy Zheng Signed-off-by: Ulf Hansson commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e Author: Jan Kara Date: Thu Sep 25 14:30:39 2025 +0200 ext4: fix checks for orphan inodes When orphan file feature is enabled, inode can be tracked as orphan either in the standard orphan list or in the orphan file. The first can be tested by checking ei->i_orphan list head, the second is recorded by EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where we want to check whether inode is tracked as orphan and only some of them properly check for both possibilities. Luckily the consequences are mostly minor, the worst that can happen is that we track an inode as orphan although we don't need to and e2fsck then complains (resulting in occasional ext4/307 xfstest failures). Fix the problem by introducing a helper for checking whether an inode is tracked as orphan and use it in appropriate places. Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling") Cc: stable@kernel.org Signed-off-by: Jan Kara Reviewed-by: Zhang Yi Message-ID: <20250925123038.20264-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 44d2a72f4d64655f906ba47a5e108733f59e6f28 Author: Deepanshu Kartikey Date: Tue Sep 23 19:02:45 2025 +0530 ext4: validate ea_ino and size in check_xattrs During xattr block validation, check_xattrs() processes xattr entries without validating that entries claiming to use EA inodes have non-zero sizes. Corrupted filesystems may contain xattr entries where e_value_size is zero but e_value_inum is non-zero, indicating invalid xattr data. Add validation in check_xattrs() to detect this corruption pattern early and return -EFSCORRUPTED, preventing invalid xattr entries from causing issues throughout the ext4 codebase. Cc: stable@kernel.org Suggested-by: Theodore Ts'o Reported-by: syzbot+4c9d23743a2409b80293@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=4c9d23743a2409b80293 Signed-off-by: Deepanshu Kartikey Signed-off-by: Theodore Ts'o Message-ID: <20250923133245.1091761-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o commit 57295e835408d8d425bef58da5253465db3d6888 Author: Ahmet Eray Karadag Date: Sat Sep 20 05:13:43 2025 +0300 ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn. Reported-by: syzbot+0be4f339a8218d2a5bb1@syzkaller.appspotmail.com Fixes: https://syzbot.org/bug?extid=0be4f339a8218d2a5bb1 Cc: stable@kernel.org Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Message-ID: <20250920021342.45575-1-eraykrdg1@gmail.com> Signed-off-by: Theodore Ts'o commit 04a91570ac67760301e5458d65eaf1342ecca314 Author: Theodore Ts'o Date: Tue Sep 16 23:22:49 2025 -0400 ext4: implemet new ioctls to set and get superblock parameters Implement the EXT4_IOC_GET_TUNE_SB_PARAM and EXT4_IOC_SET_TUNE_SB_PARAM ioctls, which allow certains superblock parameters to be set while the file system is mounted, without needing write access to the block device. Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-3-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 12c84dd4d308551568d85203fd6ed2685e861fda Author: Theodore Ts'o Date: Tue Sep 16 23:22:48 2025 -0400 ext4: add support for 32-bit default reserved uid and gid values Support for specifying the default user id and group id that is allowed to use the reserved block space was added way back when Linux only supported 16-bit uid's and gid's. (Yeah, that long ago.) It's not a commonly used feature, but let's add support for 32-bit user and group id's. Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-2-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8 Author: Theodore Ts'o Date: Tue Sep 16 23:22:47 2025 -0400 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring. Cc: stable@vger.kernel.org Fixes: 8b67f04ab9de ("ext4: Add mount options in superblock") Reviewed-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Theodore Ts'o Message-ID: <20250916-tune2fs-v2-1-d594dc7486f0@mit.edu> Signed-off-by: Theodore Ts'o commit 12e803c8827d049ae8f2c743ef66ab87ae898375 Author: Zhang Yi Date: Fri Sep 12 18:58:41 2025 +0800 ext4: fix an off-by-one issue during moving extents During the movement of a written extent, mext_page_mkuptodate() is called to read data in the range [from, to) into the page cache and to update the corresponding buffers. Therefore, we should not wait on any buffer whose start offset is >= 'to'. Otherwise, it will return -EIO and fail the extents movement. $ for i in `seq 3 -1 0`; \ do xfs_io -fs -c "pwrite -b 1024 $((i * 1024)) 1024" /mnt/foo; \ done $ umount /mnt && mount /dev/pmem1s /mnt # drop cache $ e4defrag /mnt/foo e4defrag 1.47.0 (5-Feb-2023) ext4 defragmentation for /mnt/foo [1/1]/mnt/foo: 0% [ NG ] Success: [0/1] Cc: stable@kernel.org Fixes: a40759fb16ae ("ext4: remove array of buffer_heads from mext_page_mkuptodate()") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250912105841.1886799-1-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 9d80eaa1a1d37539224982b76c9ceeee736510b9 Author: Yongjian Sun Date: Thu Sep 11 21:30:24 2025 +0800 ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() After running a stress test combined with fault injection, we performed fsck -a followed by fsck -fn on the filesystem image. During the second pass, fsck -fn reported: Inode 131512, end of extent exceeds allowed value (logical block 405, physical block 1180540, len 2) This inode was not in the orphan list. Analysis revealed the following call chain that leads to the inconsistency: ext4_da_write_end() //does not update i_disksize ext4_punch_hole() //truncate folio, keep size ext4_page_mkwrite() ext4_block_page_mkwrite() ext4_block_write_begin() ext4_get_block() //insert written extent without update i_disksize journal commit echo 1 > /sys/block/xxx/device/delete da-write path updates i_size but does not update i_disksize. Then ext4_punch_hole truncates the da-folio yet still leaves i_disksize unchanged(in the ext4_update_disksize_before_punch function, the condition offset + len < size is met). Then ext4_page_mkwrite sees ext4_nonda_switch return 1 and takes the nodioread_nolock path, the folio about to be written has just been punched out, and it’s offset sits beyond the current i_disksize. This may result in a written extent being inserted, but again does not update i_disksize. If the journal gets committed and then the block device is yanked, we might run into this. It should be noted that replacing ext4_punch_hole with ext4_zero_range in the call sequence may also trigger this issue, as neither will update i_disksize under these circumstances. To fix this, we can modify ext4_update_disksize_before_punch to increase i_disksize to min(i_size, offset + len) when both i_size and (offset + len) are greater than i_disksize. Cc: stable@kernel.org Signed-off-by: Yongjian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Message-ID: <20250911133024.1841027-1-sunyongjian@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 0a6ce20c156442a4ce2a404747bb0fb05d54eeb3 Author: Jan Kara Date: Tue Sep 9 13:22:07 2025 +0200 ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files. Reported-by: syzbot+0b92850d68d9b12934f5@syzkaller.appspotmail.com Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling") Cc: stable@kernel.org Signed-off-by: Jan Kara Message-ID: <20250909112206.10459-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit 963845748fe67125006859229487b45485564db7 Author: Jan Kara Date: Mon Sep 1 13:27:40 2025 +0200 ext4: fail unaligned direct IO write with EINVAL Commit bc264fea0f6f ("iomap: support incremental iomap_iter advances") changed the error handling logic in iomap_iter(). Previously any error from iomap_dio_bio_iter() got propagated to userspace, after this commit if ->iomap_end returns error, it gets propagated to userspace instead of an error from iomap_dio_bio_iter(). This results in unaligned writes to ext4 to silently fallback to buffered IO instead of erroring out. Now returning ENOTBLK for DIO writes from ext4_iomap_end() seems unnecessary these days. It is enough to return ENOTBLK from ext4_iomap_begin() when we don't support DIO write for that particular file offset (due to hole). Fixes: bc264fea0f6f ("iomap: support incremental iomap_iter advances") Cc: stable@kernel.org Signed-off-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Message-ID: <20250901112739.32484-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit f8b9c819ea20d1101656a91ced843d9e47ba0630 Author: Dan Carpenter Date: Fri Sep 26 07:03:11 2025 +0300 ASoc: tas2783A: Fix an error code in probe() This code returns the wrong variable "tas_dev->regmap" instead of "regmap" so it returns success instead of a negative error code. Return the correct variable. Fixes: 4cc9bd8d7b32 ("ASoc: tas2783A: Add soundwire based codec driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aNYQf4cyavnku5Nt@stanley.mountain Signed-off-by: Mark Brown commit 79428e60897916401c9ed326f6ada4d7c7c997a3 Author: Manaf Meethalavalappu Pallikunhi Date: Sat Sep 20 18:06:31 2025 +0530 dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor Document the Temperature Sensor (TSENS) on Glymur Platform. Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Pankaj Patil Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250920123631.281153-1-pankaj.patil@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit b8754092dfed4fc2fcdb0de32a029ba8f9b464b6 Author: Dmitry Torokhov Date: Mon Aug 11 15:50:05 2025 -0700 platform/x86: pcengines-apuv2: Use static device properties Convert the PC Engines APUv2/v3 board driver to use software nodes and static device properties for its on-board LEDs and front button. This change replaces the legacy gpiod_lookup_table and platform_data with a modern software node implementation, which allows the leds-gpio and gpio-keys drivers to use the standard device properties API. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/yaaegm5z2vtkl6ci5jpfnv42aywfjtoqw3bjgtli43ypask2r6@a7gg37rwkpx2 Signed-off-by: Ilpo Järvinen commit a2a815233c3068e3d41e15ee4dc4c19f256840df Author: Dmitry Torokhov Date: Mon Aug 11 15:47:09 2025 -0700 platform/x86: meraki-mx100: Use static device properties Convert the Meraki MX100 board driver to use software nodes and static device properties to describe the on-board LEDs and reset button. This moves away from the legacy gpiod_lookup_table and platform_data mechanisms, allowing consumer drivers like leds-gpio and gpio-keys to rely on the unified device properties interface instead of board-specific data. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/dzecghqrsrbe74akboqih7xculdm53rbhxa7dimt2ysdevyskd@hxhd2j3vnlt5 Signed-off-by: Ilpo Järvinen commit 4e0bcbd270e88800c4432715edd47964a080e52e Author: Dmitry Torokhov Date: Sun Aug 10 21:31:37 2025 -0700 platform/x86: barco-p50-gpio: use software nodes for gpio-leds/keys In preparation of dropping support for legacy GPIO API from gpio-keys switch the driver to use software nodes/properties to describe GPIO-connected LED and button. Signed-off-by: Dmitry Torokhov Link: https://patch.msgid.link/2meuzip4qnxvle4bwk4hbow4j34ii3cwb46xd5inq5btif5mjg@iiygy6ir7vtr Signed-off-by: Ilpo Järvinen commit 01fd7cf3534aa107797d130f461ba7bcad30414d Author: Hans de Goede Date: Sat Sep 20 22:07:13 2025 +0200 platform/x86: x86-android-tablets: Stop using EPROBE_DEFER Since the x86-android-tablets code uses platform_create_bundle() it cannot use EPROBE_DEFER and the driver-core will translate EPROBE_DEFER to ENXIO. Stop using EPROBE_DEFER instead log an error and return ENODEV, or for non-fatal cases log a warning and return 0. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-21-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 83fdf93f4bf45bda99c292c550ff299e2c249b1f Author: Hans de Goede Date: Sat Sep 20 22:07:12 2025 +0200 platform/x86: x86-android-tablets: Fix modules lists for Lenovo devices 2 fixes for Lenovo tablets: - The bq24190 charger on the Lenovo Yoga Tab2 830/1050 devices does not use the crystal-cove PMIC charger IRQ, so these shouldn't use bq24190_modules as that includes "intel_crystal_cove_charger" - Both the Tab2 and the Tab3 devices have a SPI audio-codec which init() attaches properties to, resp. the whole SPI device gets instantiated by the x86-android-tablets code. This requires the "spi_pxa2xx_platform" module to be loaded before init() runs Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-20-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6b4bc1451c23f9e41c544c0f6aa8fea048492611 Author: Hans de Goede Date: Sat Sep 20 22:07:11 2025 +0200 platform/x86: x86-android-tablets: Simplify lenovo_yoga_tab2_830_1050_exit() lenovo_yoga_tab2_830_1050_exit() only gets called after a successful lenovo_yoga_tab2_830_1050_init() call so there is no need to check if lenovo_yoga_tab2_830_1050_codec_[dev|pinctrl] are set. Also change the exit() order to be the exact reverse of init(). Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-19-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6564d3e1a46b12990a02dafa948b311a45bc4991 Author: Hans de Goede Date: Sat Sep 20 22:07:10 2025 +0200 platform/x86: x86-android-tablets: Add support for Acer A1-840 tablet Add support for the Acer Iconia One 8 A1-840 (non FHD version) tablet. This tablet has the usual issues for tablets shipped with Android as factory OS. The DSDT is broken in various ways, so i2c_clients for various devices as well as the INT3496 platform-device for OTG extcon handling need to be instantiated manually by x86-android-tablets. This tablet is special in that it is the first time a Bay Trail device has been found to use the Dollar Cove TI PMIC and the first time that the PMIC's Coulomb Counter is used as fuel-gauge. So far this PMIC has only been used together with Cherry Trail SoCs and always in combination with a separate full-featured fuel-gauge IC. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-18-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit d4bc149653d33d373c90b6dcdcc51fb55b296c7f Author: Hans de Goede Date: Sat Sep 20 22:07:09 2025 +0200 platform/x86: x86-android-tablets: Move Acer info to its own file Acer has several x86 based Android tablets which need x86-android-tablets support to work around their broken ACPI tables. At the moment x86-android-tablets only support one model, move this to its own file before adding support for more models to avoid needing to move more code around later. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-17-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e5e12fab129458b32f76ac6019132661f1f1737c Author: Hans de Goede Date: Sat Sep 20 22:07:08 2025 +0200 platform/x86: x86-android-tablets: Update my email address hdegoede@redhat.com will stop working soon, replace it with my kernel.org address. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-16-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit 2bb596a7d2375d2a2218b0cc5b028f0f86e9fed9 Author: Hans de Goede Date: Sat Sep 20 22:07:07 2025 +0200 platform/x86: x86-android-tablets: Simplify node-group [un]registration software_node_register_node_group() / software_node_unregister_node_group() both accept a NULL node-group as argument. So there is no need to check for the node-group being NULL before calling these functions, remove the checks to simplify the code. Note the "if (gpio_button_swnodes)" check for registering is kept because that also guards the creation of a gpio-button platform-device. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250920200713.20193-15-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 936ddb5398909d9e1255627386bc090ec8943558 Author: Hans de Goede Date: Sat Sep 20 22:07:06 2025 +0200 platform/x86: x86-android-tablets: use swnode_group instead of manual registering Replace manually calling software_node_register_node_group() from init() with the new swnode_group registration mechanism. Note this also fixes a missing software_node_unregister_node_group() for lenovo_yt3_swnodes. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-14-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a0133db5cdc02a8b6588558ebd4ca423c2f8c8bc Author: Hans de Goede Date: Sat Sep 20 22:07:05 2025 +0200 platform/x86: x86-android-tablets: replace bat_swnode with swnode_group Now that we are using software-nodes are used in more places it is useful to have a more generic mechanism to have the core code register software-nodes. Replace the bat_swnode registration mechanism with a more generic swnode_group registration mechanism. Reviewed-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-13-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6564e5d2ea06b262d3e87785693fd3e8903bef03 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:04 2025 +0200 platform/x86: x86-android-tablets: convert gpio_keys devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for gpio_keys devices to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-12-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit 74ff0b6f3ac245287dbff0bab9ff55db4323acc5 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:03 2025 +0200 platform/x86: x86-android-tablets: remove support for GPIO lookup tables Now that everything that used the lookup tables has been switched to using property entries to describe GPIOs, we can remove support for registering and unregistering the lookup tables. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-11-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 27d3e7351eea6fe2e967ea6028143e04f5914f0d Author: Dmitry Torokhov Date: Sat Sep 20 22:07:02 2025 +0200 platform/x86: x86-android-tablets: convert Yoga Tab2 fast charger to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for the fast charger device to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-10-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0a2f13e2747b14ee4c30d9c479dbe0a5a1d11c89 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:01 2025 +0200 platform/x86: x86-android-tablets: convert HID-I2C devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for HID-I2C touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-9-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0536b0372927e2ab4073ee84c9d0bd9c2105c7b2 Author: Dmitry Torokhov Date: Sat Sep 20 22:07:00 2025 +0200 platform/x86: x86-android-tablets: convert wm1502 devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for wm1502 devices to using PROPERTY_ENTRY_GPIO(). Adding a swnode to the yt3 spi device changes the name of the SPI/codec device and the sound/soc/intel/boards/bytcr_wm5102.c machine driver looks up the code by name, update the machine driver to use the new name. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-8-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit ef64ca079345046c306153cacb63a58354819eb0 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:59 2025 +0200 platform/x86: x86-android-tablets: convert int3496 devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for int3496 devices to using PROPERTY_ENTRY_GPIO(). Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-7-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e4a7488717688a9821c44f3b6023c94b95f6979a Author: Dmitry Torokhov Date: Sat Sep 20 22:06:58 2025 +0200 platform/x86: x86-android-tablets: convert EDT devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for EDT touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-6-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f6fd6e7bdbb89cfcbc6c889d9571d8efa7373ac7 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:57 2025 +0200 platform/x86: x86-android-tablets: convert Novatek devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Novatek touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-5-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 40949a3f0ed50bd50aa83629de73b88d13956ce7 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:56 2025 +0200 platform/x86: x86-android-tablets: convert HiDeep devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for HiDeep touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-4-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c5f7d46d52e24e500cfb036f0cfc2e1e596bdf8d Author: Dmitry Torokhov Date: Sat Sep 20 22:06:55 2025 +0200 platform/x86: x86-android-tablets: convert Wacom devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Wacom touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-3-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b40088bfdb8bcac165f55bb16b2ea24caa351234 Author: Dmitry Torokhov Date: Sat Sep 20 22:06:54 2025 +0200 platform/x86: x86-android-tablets: convert Goodix devices to GPIO references Now that gpiolib supports software nodes to describe GPIOs, switch the driver away from using GPIO lookup tables for Goodix touchscreens to using PROPERTY_ENTRY_GPIO() to keep all touchscreen properties together. Since the tablets are using either Baytrail or Cherryview GPIO controllers x86_dev_info structure has been extended to carry gpiochip type information so that the code can instantiate correct set of software nodes representing the GPIO chip. Because this adds a new point of failure in x86_android_tablet_probe(), x86_android_tablet_remove() is rearranged to handle cases where battery swnode has not been registered yet, and registering of GPIO lookup tables is moved earlier as it can not fail. Signed-off-by: Dmitry Torokhov Tested-by: Hans de Goede Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20250920200713.20193-2-hansg@kernel.org Signed-off-by: Ilpo Järvinen commit e3b1320be6fed2ceabce08ba8cea0b3067ef40a9 Author: Xi Pardee Date: Tue Sep 16 12:13:32 2025 -0700 platform/x86:intel/pmc: Replace dev_warn() with dev_dbg() Replace dev_warn() with dev_dbg() to reduce unnecessary warning messages. When the low power mode priority register contains invalid data, the Intel PMC Core driver can still utilize the default priority list. This scenario is more suited for debug information rather than warning. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20250916191339.1748512-1-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a90a8ea288ef823621ccb9f786bd9d9ac1913ad9 Author: Sebastian Reichel Date: Thu Sep 18 23:20:28 2025 +0200 arm64: dts: qcom: x1e80100-t14s: add EC Describe ThinkPad Embedded Controller in the T14s device tree, which adds LED and special key support. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-3-ac0bc6382c5c@collabora.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 60b7ab6ce030939d86c26f591967fbe7938b05da Author: Sebastian Reichel Date: Thu Sep 18 23:20:27 2025 +0200 platform: arm64: thinkpad-t14s-ec: new driver Introduce EC driver for the ThinkPad T14s Gen6 Snapdragon, which is in theory compatible with ThinkPad ACPI. On Linux the system is booted with device tree, which is not supported by the ThinkPad ACPI driver (drivers/platform/x86/lenovo/thinkpad_acpi.c). Also most of the hardware compatibility is handled via ACPI tables, which are obviously not used when booting via device tree. Thus adding DT compatibility to the existing driver is not worth it as there is almost no code sharing. The driver currently exposes features, which are not available via other means: * Extra Keys * System LEDs * Keyboard Backlight Control The driver has been developed by reading the ACPI DSDT. There are some more features around thermal control, which are not yet supported by the driver. The speaker mute and mic mute LEDs need some additional changes in the ALSA UCM to be set automatically. Tested-by: Neil Armstrong # on Thinkpad T14S OLED Reviewed-by: Bryan O'Donoghue Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20250918-thinkpad-t14s-ec-v5-2-ac0bc6382c5c@collabora.com [ij: folded in patch from Chen Ni ] Link: https://patch.msgid.link/20250926091302.817919-1-nichen@iscas.ac.cn [ij: folded in patch from Lukas Bulwahn ] Link: https://patch.msgid.link/20250926071859.138396-1-lukas.bulwahn@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2d517aa09bbc4203f10cdee7e1d42f3bbdc1b1cd Author: Vlastimil Babka Date: Wed Sep 3 14:59:45 2025 +0200 slab: add opt-in caching layer of percpu sheaves Specifying a non-zero value for a new struct kmem_cache_args field sheaf_capacity will setup a caching layer of percpu arrays called sheaves of given capacity for the created cache. Allocations from the cache will allocate via the percpu sheaves (main or spare) as long as they have no NUMA node preference. Frees will also put the object back into one of the sheaves. When both percpu sheaves are found empty during an allocation, an empty sheaf may be replaced with a full one from the per-node barn. If none are available and the allocation is allowed to block, an empty sheaf is refilled from slab(s) by an internal bulk alloc operation. When both percpu sheaves are full during freeing, the barn can replace a full one with an empty one, unless over a full sheaves limit. In that case a sheaf is flushed to slab(s) by an internal bulk free operation. Flushing sheaves and barns is also wired to the existing cpu flushing and cache shrinking operations. The sheaves do not distinguish NUMA locality of the cached objects. If an allocation is requested with kmem_cache_alloc_node() (or a mempolicy with strict_numa mode enabled) with a specific node (not NUMA_NO_NODE), the sheaves are bypassed. The bulk operations exposed to slab users also try to utilize the sheaves as long as the necessary (full or empty) sheaves are available on the cpu or in the barn. Once depleted, they will fallback to bulk alloc/free to slabs directly to avoid double copying. The sheaf_capacity value is exported in sysfs for observability. Sysfs CONFIG_SLUB_STATS counters alloc_cpu_sheaf and free_cpu_sheaf count objects allocated or freed using the sheaves (and thus not counting towards the other alloc/free path counters). Counters sheaf_refill and sheaf_flush count objects filled or flushed from or to slab pages, and can be used to assess how effective the caching is. The refill and flush operations will also count towards the usual alloc_fastpath/slowpath, free_fastpath/slowpath and other counters for the backing slabs. For barn operations, barn_get and barn_put count how many full sheaves were get from or put to the barn, the _fail variants count how many such requests could not be satisfied mainly because the barn was either empty or full. While the barn also holds empty sheaves to make some operations easier, these are not as critical to mandate own counters. Finally, there are sheaf_alloc/sheaf_free counters. Access to the percpu sheaves is protected by local_trylock() when potential callers include irq context, and local_lock() otherwise (such as when we already know the gfp flags allow blocking). The trylock failures should be rare and we can easily fallback. Each per-NUMA-node barn has a spin_lock. When slub_debug is enabled for a cache with sheaf_capacity also specified, the latter is ignored so that allocations and frees reach the slow path where debugging hooks are processed. Similarly, we ignore it with CONFIG_SLUB_TINY which prefers low memory usage to performance. [boot failure: https://lore.kernel.org/all/583eacf5-c971-451a-9f76-fed0e341b815@linux.ibm.com/ ] Reported-and-tested-by: Venkat Rao Bagalkote Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 9d4e6ab865c48c70e684b176d3ee1574d092626f Author: Vlastimil Babka Date: Wed Sep 3 14:59:44 2025 +0200 slab: simplify init_kmem_cache_nodes() error handling We don't need to call free_kmem_cache_nodes() immediately when failing to allocate a kmem_cache_node, because when we return 0, do_kmem_cache_create() calls __kmem_cache_release() which also performs free_kmem_cache_nodes(). Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit bc061143637532c08d9fc657eec93fdc2588068e Author: Conor Dooley Date: Thu Sep 25 16:39:18 2025 +0100 gpio: mpfs: fix setting gpio direction to output mpfs_gpio_direction_output() actually sets the line to input mode. Use the correct register settings for output mode so that this function actually works as intended. This was a copy-paste mistake made when converting to regmap during the driver submission process. It went unnoticed because my test for output mode is toggling LEDs on an Icicle kit which functions with the incorrect code. The internal reporter has yet to test the patch, but on their system the incorrect setting may be the reason for failures to drive the GPIO lines on the BeagleV-fire board. CC: stable@vger.kernel.org Fixes: a987b78f3615e ("gpio: mpfs: add polarfire soc gpio support") Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20250925-boogieman-carrot-82989ff75d10@spud Signed-off-by: Bartosz Golaszewski commit 212b0f07cf021575ec25e0b2336df77c7a4d2e68 Author: Alexei Starovoitov Date: Wed Sep 3 14:59:43 2025 +0200 locking/local_lock: Expose dep_map in local_trylock_t. lockdep_is_held() macro assumes that "struct lockdep_map dep_map;" is a top level field of any lock that participates in LOCKDEP. Make it so for local_trylock_t. Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Alexei Starovoitov Reviewed-by: Harry Yoo Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka commit 69ed025aeb4c8faa3019e5997b850a554b47498c Merge: c2fcb2e79d6f41 71965cae7db394 Author: Borislav Petkov (AMD) Date: Fri Sep 26 11:44:35 2025 +0200 Merge branches 'edac-drivers' and 'edac-misc' into edac-updates * edac-drivers: EDAC/versalnet: Return the correct error in mc_probe() EDAC/mc_sysfs: Increase legacy channel support to 16 EDAC/amd64: Add support for AMD family 1Ah-based newer models EDAC: Add a driver for the AMD Versal NET DDR controller dt-bindings: memory-controllers: Add support for Versal NET EDAC RAS: Export log_non_standard_event() to drivers cdx: Export Symbols for MCDI RPC and Initialization cdx: Split mcdi.h and reorganize headers EDAC/skx_common: Use topology_physical_package_id() instead of open coding EDAC/altera: Use dev_fwnode() EDAC/skx_common: Remove unused *NUM*_IMC macros EDAC/i10nm: Reallocate skx_dev list if preconfigured cnt != runtime cnt EDAC/skx_common: Remove redundant upper bound check for res->imc EDAC/skx_common: Make skx_dev->imc[] a flexible array EDAC/skx_common: Swap memory controller index mapping EDAC/skx_common: Move mc_mapping to be a field inside struct skx_imc EDAC/{skx_common,skx}: Use configuration data, not global macros EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller EDAC/ie31200: Add two more Intel Alder Lake-S SoCs for EDAC support dt-bindings: arm: cpus: Add edac-enabled property EDAC: Add EDAC driver for ARM Cortex A72 cores * edac-misc: EDAC: Fix wrong executable file modes for C source files MAINTAINERS: EDAC: Drop inactive reviewers Signed-off-by: Borislav Petkov (AMD) commit 28986dd7e38fb5ba2f180f9eb3ff330798719369 Author: Kanchan Joshi Date: Mon Sep 22 17:00:46 2025 +0530 fcntl: trim arguments Remove superfluous argument from fcntl_{get/set}_rw_hint. No functional change. Signed-off-by: Kanchan Joshi Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 Author: Christian Brauner Date: Fri Sep 19 17:33:47 2025 +0200 listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked. Fixes: b4c2bea8ceaa ("add listmount(2) syscall") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Christian Brauner commit e8c84e2082e69335f66c8ade4895e80ec270d7c4 Author: Christian Brauner Date: Fri Sep 19 17:03:51 2025 +0200 statmount: don't call path_put() under namespace semaphore Massage statmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked. Fixes: 46eae99ef733 ("add statmount(2) syscall") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Christian Brauner commit 5f4b8c03f41782f37d278946296d9443a7194153 Merge: 07e27ad16399af a2d2e6ea1865d3 e520b2520c81c5 4f901b3dce57d2 57f55048e564de 9be15fbfc6c5c8 Author: Joerg Roedel Date: Fri Sep 26 10:03:33 2025 +0200 Merge branches 'apple/dart', 'ti/omap', 'riscv', 'intel/vt-d' and 'amd/amd-vi' into next commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e Author: Lu Baolu Date: Fri Sep 26 10:41:30 2025 +0800 iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must be coherent between the IOMMU and the CPU. In another word, if the iommu page walk is incoherent, dirty page tracking doesn't work. The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: "Remapping hardware encountering the need to atomically update A/EA/D bits in a paging-structure entry that is not snooped will result in a non- recoverable fault." To prevent an IOMMU from being incorrectly configured for dirty page tracking when it is operating in an incoherent mode, mark SSADS as supported only when both ecap_slads and ecap_smpwc are supported. Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains") Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit c149841b069ccc6e480b00e11f35a57b5d88c7bb Author: Kunihiko Hayashi Date: Thu Jul 24 13:22:11 2025 +0900 i2c: designware: Add disabling clocks when probe fails After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is called. However, this function doesn't disable clocks and the clock-enable count keeps increasing. Should disable these clocks explicitly. Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") Co-developed-by: Kohei Ito Signed-off-by: Kohei Ito Signed-off-by: Kunihiko Hayashi Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f Author: Kunihiko Hayashi Date: Thu Jul 24 13:22:10 2025 +0900 i2c: designware: Fix clock issue when PM is disabled When the driver is removed, the clocks are first enabled by calling pm_runtime_get_sync(), and then disabled with pm_runtime_put_sync(). If CONFIG_PM=y, clocks for this controller are disabled when it's in the idle state. So the clocks are properly disabled when the driver exits. Othewise, the clocks are always enabled and the PM functions have no effect. Therefore, the driver exits without disabling the clocks. # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 18 # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 20 # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count 20 To ensure that the clocks can be disabled correctly even without CONFIG_PM=y, should add the following fixes: - Replace with pm_runtime_put_noidle(), which only decrements the runtime PM usage count. - Call i2c_dw_prepare_clk(false) to explicitly disable the clocks. Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM") Co-developed-by: Kohei Ito Signed-off-by: Kohei Ito Signed-off-by: Kunihiko Hayashi Tested-by: Jarkko Nikula Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit dff4f9ff5d7f289e4545cc936362e01ed3252742 Author: Anderson Nascimento Date: Mon Sep 8 09:49:02 2025 -0300 btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes). However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes). If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned. This results in an 8-byte out-of-bounds write at fid->parent_root_objectid = parent_root_id. A previous attempt to fix this issue was made but was lost. https://lore.kernel.org/all/4CADAEEC020000780001B32C@vpn.id2.novell.com/ Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data. Fixes: be6e8dc0ba84 ("NFS support for btrfs - v3") CC: stable@vger.kernel.org # 3.0+ Signed-off-by: Anderson Nascimento Reviewed-by: David Sterba Signed-off-by: David Sterba commit 22d693e45d4a4513bd99489a4e50b81cc0175b21 Author: Danilo Krummrich Date: Thu Sep 25 20:59:27 2025 +0200 rust: usb: keep usb::Device private for now The USB abstractions target to support USB interface drivers. While internally the abstraction has to deal with the interface's parent USB device, there shouldn't be a need for users to deal with the parent USB device directly. Functions, such as for preparing and sending USB URBs, can be implemented for the usb::Interface structure directly. Whether this internal implementation has to deal with the parent USB device can remain transparent to USB interface drivers. Hence, keep the usb::Device structure private for now, in order to avoid confusion for users and to make it less likely to accidentally expose APIs with unnecessary indirections. Should we start supporting USB device drivers, or need it for any other reason we do not foresee yet, it should be trivial to make it public again. Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250925190400.144699-2-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman commit f12140f21acba1499e55cc0220d7c1fe518de369 Author: Danilo Krummrich Date: Thu Sep 25 20:59:26 2025 +0200 rust: usb: don't retain device context for the interface parent When deriving the parent USB device (struct usb_device) from a USB interface (struct usb_interface), do not retain the device context. For the Bound context, as pointed out by Alan in [1], it is not guaranteed that the parent USB device is always bound when the interface is bound. The bigger problem, however, is that we can't infer the Core context, since eventually it indicates that the device lock is held. However, there is no guarantee that if the device lock of the interface is held, also the device lock of the parent USB device is held. Hence, fix this by not inferring any device context information; while at it, fix up the (affected) safety comments. Link: https://lore.kernel.org/all/0ff2a825-1115-426a-a6f9-df544cd0c5fc@rowland.harvard.edu/ [1] Fixes: e7e2296b0ecf ("rust: usb: add basic USB abstractions") Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250925190400.144699-1-dakr@kernel.org Signed-off-by: Greg Kroah-Hartman commit 62bea0e1d5c71a3d9c953d4bbbae79428d0ba05c Merge: a2caae58f8e8f2 6ca282c3e635cd Author: Dave Airlie Date: Fri Sep 26 13:25:42 2025 +1000 Merge tag 'drm-habanalabs-next-2025-09-25' of https://github.com/HabanaAI/drivers.accel.habanalabs.kernel into drm-next This tag contains habanalabs driver changes for v6.18. It continues the previous upstream work from tags/drm-habanalabs-next-2024-06-23, Including improvements in debug and visibility, alongside general code cleanups, and new features such as vmalloc-backed coherent mmap, HLDIO infrastructure, etc. Signed-off-by: Dave Airlie From: "Elbaz, Koby" Link: https://lore.kernel.org/r/da02d370-9967-49d2-9eef-7aeaa40c987c@intel.com commit 66f430522452fe1a8a0fd2198cf9f335125acbfc Author: Len Brown Date: Wed Sep 24 11:50:29 2025 -0400 tools/power x86_energy_perf_policy.8: Emphasize preference for SW interfaces This tool was originally written when Linux had no standard interface for EPB, or HWP support. Retain the capability to manage a system w/o any kernel PM support, but prefer the standard kernel interfaces, when avaialble. (not doing so led to a confusing conflict between a p-state limit request made via cpufreq and modified by the intel-pstate driver, versus the raw MSR write made by this utility) Signed-off-by: Len Brown commit a648e0892ccd8c2168c2deae7e12e18a8d596730 Author: Len Brown Date: Fri Sep 19 22:30:18 2025 -0400 tools/power x86_energy_perf_policy: Add make snapshot target $ make snapshot creates x86_energy_perf_policy-$(DATE).tar.gz Which can be transported to a target machine without needing a kernel tree to build on the target. Useful for creating debug versions. Signed-off-by: Len Brown commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 Author: Len Brown Date: Fri Sep 19 15:56:46 2025 -0400 tools/power x86_energy_perf_policy: Prefer driver HWP limits When we are successful in using cpufreq min/max limits, skip setting the raw MSR limits entirely. This is necessary to avoid undoing any modification that the cpufreq driver makes to our sysfs request. eg. intel_pstate may take our request for a limit that is valid according to HWP.CAP.MIN/MAX and clip it to be within the range available in PLATFORM_INFO. Signed-off-by: Len Brown commit f8241f5426eb9feb46a007341edd221ceaf73073 Author: Len Brown Date: Fri Sep 19 15:35:07 2025 -0400 tools/power x86_energy_perf_policy: EPB access is only via sysfs Comprehend that EPB writes are now only via sysfs by moving it out of the _msr specific path. No functional change. Signed-off-by: Len Brown commit 8ef8fa829f8ad313f18d694c15874f85d693215d Author: Len Brown Date: Fri Sep 19 15:05:48 2025 -0400 tools/power x86_energy_perf_policy: Prepare for MSR/sysfs refactoring Rename routines to make "_msr" and "_sysfs" access methods clear No functional change Signed-off-by: Len Brown commit c97c057d357c4b39b153e9e430bbf8976e05bd4e Author: Len Brown Date: Fri Sep 19 14:07:02 2025 -0400 tools/power x86_energy_perf_policy: Enhance HWP enable On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE. Also, skip writing the MSR_PM_ENABLE if HWP is already enabled. Signed-off-by: Len Brown commit b6b42a6051b203bb1d78bf6518007e5dc8b62fc4 Author: Len Brown Date: Fri Sep 19 13:46:55 2025 -0400 tools/power x86_energy_perf_policy: Enhance HWP enabled check Verify that all CPUs have HWP enabled, not just cpu0. Signed-off-by: Len Brown commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c Author: Kaushlendra Kumar Date: Wed Aug 13 12:32:08 2025 +0530 tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage The fopen_or_die() function was previously hardcoded to open files in read-only mode ("r"), ignoring the mode parameter passed to it. This patch corrects fopen_or_die() to use the provided mode argument, allowing for flexible file access as intended. Additionally, the call to fopen_or_die() in err_on_hypervisor() incorrectly used the mode "ro", which is not a valid fopen mode. This is fixed to use the correct "r" mode. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit cafb47be3f38ad81306bf894e743bebc2ccf66ab Author: Kaushlendra Kumar Date: Sat Aug 9 10:35:15 2025 +0530 tools/power turbostat: Fix incorrect sorting of PMT telemetry The pmt_telemdir_sort() comparison function was returning a boolean value (0 or 1) instead of the required negative, zero, or positive value for proper sorting. This caused unpredictable and incorrect ordering of telemetry directories named telem0, telem1, ..., telemN. Update the comparison logic to return -1, 0, or 1 based on the numerical value extracted from the directory name, ensuring correct numerical ordering when using scandir. This change improves stability and correctness when iterating PMT telemetry directories. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit a2caae58f8e8f24f085515d270b5983b83d2c6e3 Merge: 342f141ba9f4c9 0c4932f6ddf815 Author: Dave Airlie Date: Fri Sep 26 13:06:21 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Short summary of fixes pull: bridge: - waveshare-dsi: Fix error handling in probe function pixpaper: - select GEM SHMEM helpers Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250925064257.GA9107@linux.fritz.box commit 46c22a8bb4cb03211da1100d7ee4a2005bf77c70 Author: Ojaswin Mujoo Date: Fri Sep 5 13:44:46 2025 +0530 ext4: correctly handle queries for metadata mappings Currently, our handling of metadata is _ambiguous_ in some scenarios, that is, we end up returning unknown if the range only covers the mapping partially. For example, in the following case: $ xfs_io -c fsmap -d 0: 254:16 [0..7]: static fs metadata 8 1: 254:16 [8..15]: special 102:1 8 2: 254:16 [16..5127]: special 102:2 5112 3: 254:16 [5128..5255]: special 102:3 128 4: 254:16 [5256..5383]: special 102:4 128 5: 254:16 [5384..70919]: inodes 65536 6: 254:16 [70920..70967]: unknown 48 ... $ xfs_io -c fsmap -d 24 33 0: 254:16 [24..39]: unknown 16 <--- incomplete reporting $ xfs_io -c fsmap -d 24 33 (With patch) 0: 254:16 [16..5127]: special 102:2 5112 This is because earlier in ext4_getfsmap_meta_helper, we end up ignoring any extent that starts before our queried range, but overlaps it. While the man page [1] is a bit ambiguous on this, this fix makes the output make more sense since we are anyways returning an "unknown" extent. This is also consistent to how XFS does it: $ xfs_io -c fsmap -d ... 6: 254:16 [104..127]: free space 24 7: 254:16 [128..191]: inodes 64 ... $ xfs_io -c fsmap -d 137 150 0: 254:16 [128..191]: inodes 64 <-- full extent returned [1] https://man7.org/linux/man-pages/man2/ioctl_getfsmap.2.html Reported-by: Ritesh Harjani (IBM) Cc: stable@kernel.org Signed-off-by: Ojaswin Mujoo Message-ID: <023f37e35ee280cd9baac0296cbadcbe10995cab.1757058211.git.ojaswin@linux.ibm.com> Signed-off-by: Theodore Ts'o commit 21c3896b471aafe906f35e8d5a2dbf713754079e Author: Heinrich Schuchardt Date: Tue Jul 29 15:15:35 2025 +0200 ACPI: support BGRT table on RISC-V The BGRT table is used to display a vendor logo in the boot process. There is no good reason why RISC-V should not support it. Remove the architecture constraint. Signed-off-by: Heinrich Schuchardt Acked-by: Rafael J. Wysocki Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20250729131535.522205-3-heinrich.schuchardt@canonical.com Signed-off-by: Paul Walmsley commit 67b876663ecee3a74be3bb1ad358d309fcaec6b1 Author: Anup Patel Date: Mon Aug 18 09:39:20 2025 +0530 MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers Add Rahul and myself as maintainers for RISC-V RPMI and MPXY drivers. Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-25-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit f30d7ccd13f01aa6224a2de62562f63c7a298a7e Author: Anup Patel Date: Mon Aug 18 09:39:19 2025 +0530 RISC-V: Enable GPIO keyboard and event device in RV64 defconfig The GPIO keyboard and event device can be used to receive graceful shutdown or reboot input keys so let us enable it by default for RV64 (just like ARM64). Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-24-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4752b0cfbc37a4e62e583bd8723b1fc2fe8df319 Author: Sunil V L Date: Mon Aug 18 09:39:18 2025 +0530 irqchip/riscv-rpmi-sysmsi: Add ACPI support Add ACPI support for the RISC-V RPMI system MSI based irqchip driver. Reviewed-by: Thomas Gleixner Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-23-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 7e64042fdbacc04adce0caf4a0718bf2c4b2045f Author: Sunil V L Date: Mon Aug 18 09:39:17 2025 +0530 mailbox/riscv-sbi-mpxy: Add ACPI support Add ACPI support for the RISC-V SBI message proxy (MPXY) based mailbox driver. Acked-by: Jassi Brar Signed-off-by: Sunil V L Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-22-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 3f5d7a5c05b4d5ac011223359f15fb140125894b Author: Sunil V L Date: Mon Aug 18 09:39:16 2025 +0530 irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode() ACPI based loadable drivers which need MSIs will also need imsic_acpi_get_fwnode() to update the device MSI domain so export this function. Reviewed-by: Thomas Gleixner Signed-off-by: Sunil V L Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-21-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit bb96fb5a799a128bb478e1ea3dab25a484aadf63 Author: Sunil V L Date: Mon Aug 18 09:39:15 2025 +0530 ACPI: RISC-V: Add RPMI System MSI to GSI mapping The RPMI System MSI device will provide GSIs to downstream devices (such as GED) so add it to the RISC-V GSI to fwnode mapping. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-20-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4d185fdeef67d0c2c5d4a142392cf1ade3786dd2 Author: Sunil V L Date: Mon Aug 18 09:39:14 2025 +0530 ACPI: RISC-V: Add support to update gsi range Some RISC-V interrupt controllers like RPMI based system MSI interrupt controllers do not have MADT entry defined. These interrupt controllers exist only in the namespace. ACPI spec defines _GSB method to get the GSI base of the interrupt controller, However, there is no such standard method to get the GSI range. To support such interrupt controllers, set the GSI range of such interrupt controllers to non-overlapping range and provide API for interrupt controller driver to update it with proper value. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-19-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 694b2ef1e73c5eea6d7bd112894f465a9c4e42d5 Author: Sunil V L Date: Mon Aug 18 09:39:13 2025 +0530 ACPI: RISC-V: Create interrupt controller list in sorted order Currently, the interrupt controller list is created without any order. Create the list sorted with the GSI base of the interrupt controllers. Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-18-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 4215d1cf59e4b272755f4277a05cd5967935a704 Author: Sunil V L Date: Mon Aug 18 09:39:12 2025 +0530 ACPI: scan: Update honor list for RPMI System MSI The RPMI System MSI interrupt controller (just like PLIC and APLIC) needs to probed prior to devices like GED which use interrupts provided by it. Also, it has dependency on the SBI MPXY mailbox device. Add HIDs of RPMI System MSI and SBI MPXY mailbox devices to the honor list so that those dependencies are handled. Reviewed-by: Atish Patra Reviewed-by: Andy Shevchenko Acked-by: Rafael J. Wysocki Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-17-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 159c86f306ea20c019b36fc998e2677008183c04 Author: Sunil V L Date: Mon Aug 18 09:39:11 2025 +0530 ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() Currently, ACPI does not support the use of a nargs_prop (e.g., associated with a reference in fwnode_property_get_reference_args(). Instead, ACPI expects the number of arguments (nargs) to be explicitly passed or known. This behavior diverges from Open Firmware (OF), which allows the use of a #*-cells property in the referenced node to determine the number of arguments. Since fwnode_property_get_reference_args() is a common interface used across both OF and ACPI firmware paradigms, it is desirable to have a unified calling convention that works seamlessly for both. Add the support for ACPI to parse a nargs_prop from the referenced fwnode, aligning its behavior with the OF backend. This allows drivers and subsystems using fwnode_property_get_reference_args() to work in a firmware-agnostic way without having to hardcode or special-case argument counts for ACPI. Acked-by: Rafael J. Wysocki Reviewed-by: Andy Shevchenko Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-16-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 76bb6969a8cfc5e00ca142fdad86ffd0a6ed9ecd Author: Frank Li Date: Thu Sep 25 15:22:19 2025 -0400 dt-bindings: hwmon: (lm75) allow interrupt for ti,tmp75 Allow interrupt for ti,tmp75 because chip has open drain ALERT signal. Signed-off-by: Frank Li Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250925192219.303825-1-Frank.Li@nxp.com Signed-off-by: Guenter Roeck commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e Author: Primoz Fiser Date: Thu Sep 25 10:59:29 2025 +0200 ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 The problem of having class-D initialization sequence in probe using regmap_register_patch() is that it will do hardware register writes immediately after being called as it bypasses regcache. Afterwards, in aic3x_init() we also perform codec soft reset, rendering class-D init sequence pointless. This issue is even more apparent when using reset GPIO line, since in that case class-D amplifier initialization fails with "Failed to init class D: -5" message as codec is already held in reset state after requesting the reset GPIO and hence hardware I/O fails with -EIO errno. Thus move class-D amplifier initialization sequence from probe function to aic3x_set_power() just before the usual regcache sync. Use bypassed regmap_multi_reg_write_bypassed() function to make sure, class-D init sequence is performed in proper order as described in the datasheet. Signed-off-by: Primoz Fiser Link: https://patch.msgid.link/20250925085929.2581749-1-primoz.fiser@norik.com Signed-off-by: Mark Brown commit ba0c67d3c4b0ce5ec5e6de35e6433b22eecb1f6a Author: Dmitry Baryshkov Date: Wed Sep 24 22:34:02 2025 +0300 ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075 All firmware for the Lemans platform aka QCS9100 aka QCS9075 is for historical reasons located in the qcom/sa8775p/ subdir inside linux-firmware. The only exceptions to this rule are audio topology files. While it's not too late, change the subdir to point to the sa8775p/ subdir, so that all firmware for that platform is present at the same location. Fixes: 5b5bf5922f4c ("ASoC: qcom: sc8280xp: Add sound card support for QCS9100 and QCS9075") Signed-off-by: Dmitry Baryshkov Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250924-lemans-evk-topo-v2-1-7d44909a5758@oss.qualcomm.com Signed-off-by: Mark Brown commit b6b5bbad571f1204622881b30e6ca3e6d7324102 Merge: 27fa1a8b2803df e26387e950ee44 Author: Mark Brown Date: Fri Sep 26 01:21:48 2025 +0100 ASoC: renesas: msiof: tidyup to remove each errors Merge series from Kuninori Morimoto : Current Renesas MSIOF driver might get some errors. This patch-set try to reduce/remove them. commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 Author: Olivier Moysan Date: Tue Sep 16 14:31:18 2025 +0200 ASoC: stm32: sai: manage context in set_sysclk callback The mclk direction now needs to be specified in endpoint node with "system-clock-direction-out" property. However some calls to the set_sysclk callback, related to CPU DAI clock, result in unbalanced calls to clock API. The set_sysclk callback in STM32 SAI driver is intended only for mclk management. So it is relevant to ensure that calls to set_sysclk are related to mclk only. Since the master clock is handled only at runtime, skip the calls to set_sysclk in the initialization phase. Signed-off-by: Olivier Moysan Link: https://patch.msgid.link/20250916123118.84175-1-olivier.moysan@foss.st.com Signed-off-by: Mark Brown commit d43029ff7d1b7183dc0cf11b6cc2c12a0b810ad8 Author: Tao Chen Date: Fri Sep 26 01:50:30 2025 +0800 selftests/bpf: Add stacktrace map lookup_and_delete_elem test case Add tests for stacktrace map lookup and delete: 1. use bpf_map_lookup_and_delete_elem to lookup and delete the target stack_id, 2. lookup the deleted stack_id again to double check. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-3-chen.dylane@linux.dev commit 363b17e273f0929ba7791231a0bbb5424204d93a Author: Tao Chen Date: Fri Sep 26 01:50:29 2025 +0800 selftests/bpf: Refactor stacktrace_map case with skeleton The loading method of the stacktrace_map test case looks too outdated, refactor it with skeleton, and we can use global variable feature in the next patch. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-2-chen.dylane@linux.dev commit 17f0d1f6321caa95699b8f96baf12e654d7b8d60 Author: Tao Chen Date: Fri Sep 26 01:50:28 2025 +0800 bpf: Add lookup_and_delete_elem for BPF_MAP_STACK_TRACE The stacktrace map can be easily full, which will lead to failure in obtaining the stack. In addition to increasing the size of the map, another solution is to delete the stack_id after looking it up from the user, so extend the existing bpf_map_lookup_and_delete_elem() functionality to stacktrace map types. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925175030.1615837-1-chen.dylane@linux.dev commit 5ed35b4d490d8735021cce9b715b62a418310864 Author: Marek Vasut Date: Tue Sep 9 18:26:25 2025 +0200 PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock The rcar_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls rcar_msi_irq_unmask(). Since the &desc->lock descriptor lock is a raw spinlock, and the rcar_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y. Use scoped_guard() to simplify the locking. Fixes: 83ed8d4fa656 ("PCI: rcar: Convert to MSI domains") Reported-by: Duy Nguyen Reported-by: Thuan Nguyen Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Acked-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250909162707.13927-2-marek.vasut+renesas@mailbox.org commit e1bd928479fb1fa60e9034b0fdb1ab9f3fa92f33 Author: Manivannan Sadhasivam Date: Mon Sep 22 13:40:57 2025 +0530 PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() In tegra_pcie_downstream_dev_to_D0(), PCI devices are transitioned to D0 state. For iterating over the devices, first the downstream bus of the Root Port is searched from the root bus. But the name of the variable that holds the Root Port downstream bus is named as 'root_bus', which is wrong. Rename the variable to 'root_port_bus'. Also, move the comment on 'bringing the devices to D0' to where the state is set exactly. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922081057.15209-1-mani@kernel.org commit 26fda92d3b56bf44a02bcb4001c5a5548e0ae8ee Author: Marek Vasut Date: Mon Sep 22 17:07:48 2025 +0200 PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock The tegra_msi_irq_unmask() function may be called from a PCI driver request_threaded_irq() function. This triggers kernel/irq/manage.c __setup_irq() which locks raw spinlock &desc->lock descriptor lock and with that descriptor lock held, calls tegra_msi_irq_unmask(). Since the &desc->lock descriptor lock is a raw spinlock, and the tegra_msi .mask_lock is not a raw spinlock, this setup triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y. Use scoped_guard() to simplify the locking. Fixes: 2c99e55f7955 ("PCI: tegra: Convert to MSI domains") Reported-by: Geert Uytterhoeven Closes: https://patchwork.kernel.org/project/linux-pci/patch/20250909162707.13927-2-marek.vasut+renesas@mailbox.org/#26574451 Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922150811.88450-1-marek.vasut+renesas@mailbox.org commit 105eb5dc74109a9f53c2f26c9a918d9347a73595 Author: Mykyta Yatsenko Date: Thu Sep 25 22:52:30 2025 +0100 selftests/bpf: Fix flaky bpf_cookie selftest bpf_cookie can fail on perf_event_open(), when it runs after the task_work selftest. The task_work test causes perf to lower sysctl_perf_event_sample_rate, and bpf_cookie uses sample_freq, which is validated against that sysctl. As a result, perf_event_open() rejects the attr if the (now tighter) limit is exceeded. >From perf_event_open(): if (attr.freq) { if (attr.sample_freq > sysctl_perf_event_sample_rate) return -EINVAL; } else { if (attr.sample_period & (1ULL << 63)) return -EINVAL; } Switch bpf_cookie to use sample_period, which is not checked against sysctl_perf_event_sample_rate. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250925215230.265501-1-mykyta.yatsenko5@gmail.com commit 2bdf1d428f48e1077791bb7f88fd00262118256d Author: Marek Vasut Date: Tue Sep 16 01:58:40 2025 +0200 PCI: rcar-gen4: Fix inverted break condition in PHY initialization R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581 Figure 104.3b Initial Setting of PCIEC(example), third quarter of the figure indicates that register 0xf8 should be polled until bit 18 becomes set to 1. Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is set to 1 in less than 1 ms afterward. The current readl_poll_timeout() break condition is inverted and returns when register 0xf8, bit 18 is set to 0, which in most cases means immediately. In case CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and afterward never read register 0xf8, bit 18 as 0, which leads to timeout and failure to start the PCIe controller. Fix this by inverting the poll condition to match the reference manual initialization sequence. Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H") Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 Author: Marek Vasut Date: Wed Sep 24 02:55:45 2025 +0200 PCI: rcar-gen4: Assure reset occurs before DBI access Assure the reset is latched and the core is ready for DBI access. On R-Car V4H, the PCIe reset is asynchronous and does not take effect immediately, but needs a short time to complete. In case DBI access happens in that short time, that access generates an SError. Make sure that condition can never happen, read back the state of the reset, which should turn the asynchronous reset into a synchronous one, and wait a little over 1ms to add additional safety margin. Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org commit 8795b70581770657cd5ead3c965348f05242580f Author: Marek Vasut Date: Fri Sep 19 15:45:58 2025 +0200 PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC domain, after reset has been asserted by writing a matching reset bit into register SRCR, it is mandatory to wait 1ms. Because it is the controller driver which can determine whether or not the controller is in HSC domain based on its compatible string, add the missing delay in the controller driver. This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear whether S4 is affected as well. This patch does apply the extra delay on R-Car S4 as well. Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode") Suggested-by: Geert Uytterhoeven Signed-off-by: Marek Vasut [mani: added the missing r-b tag from Krzysztof] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Wilczyński Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org commit 1193c46c1745cf809dead55ece4f3baa728f316c Author: Amery Hung Date: Thu Sep 25 10:00:13 2025 -0700 selftests/bpf: Test changing packet data from global functions with a kfunc The verifier should invalidate all packet pointers after a packet data changing kfunc is called. So, similar to commit 3f23ee5590d9 ("selftests/bpf: test for changing packet data from global functions"), test changing packet data from global functions to make sure packet pointers are indeed invalidated. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925170013.1752561-2-ameryhung@gmail.com commit 12aad2960e9d6a32d7371e43cabcb02531ae3704 Author: Xichao Zhao Date: Wed Aug 27 17:43:44 2025 +0800 i2c: busses: Fix some spelling errors Fix spelling errors in some comments. Signed-off-by: Xichao Zhao Signed-off-by: Wolfram Sang commit 59ccb8176bd7e826d47962e891b460284f6978f0 Author: I Viswanath Date: Mon Aug 25 08:44:30 2025 +0530 i2c: mux: Simplify boolean assignment in i2c_mux_alloc Refactor boolean field assignments of the form `if (a) b = true` to `b = !!(a)` in i2c_mux_alloc. Signed-off-by: I Viswanath Signed-off-by: Wolfram Sang commit 2b7a2003ba01cde9a4958a50c55207f820766816 Author: Benoît Monin Date: Thu Sep 4 16:31:07 2025 +0200 i2c: designware: use dev_err_probe() when probing platform device Add calls to dev_err_probe() on error paths that can return -EPROBE_DEFER when probing platform device. Namely when requesting the reset controller, when probing for lock support and when requesting the clocks. PCI device probing already use dev_err_probe(). Signed-off-by: Benoît Monin Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 437e6c3e3175e40c07987be87eea1cf9d7b8f30f Author: Benoît Monin Date: Thu Sep 4 16:31:06 2025 +0200 i2c: designware: convert to dev_err_probe() on request IRQ error Simplify the error handling of devm_request_irq() in i2c_dw_probe_master() and i2c_dw_probe_slave() by converting to: return dev_err_probe(); instead of calling: dev_err(); return ret; This also handle deferred probe error without spamming the log. Signed-off-by: Benoît Monin Reviewed-by: Andy Shevchenko Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 0de61943244dec418d396633a587adca1c350b55 Author: Troy Mitchell Date: Thu Sep 25 10:02:29 2025 +0800 i2c: spacemit: ensure SDA is released after bus reset After performing a conditional bus reset, the controller must ensure that the SDA line is actually released. Previously, the reset routine only performed a single check, which could leave the bus in a locked state in some situations. This patch introduces a loop that toggles the reset cycle and issues a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking SDA after each attempt. If SDA is released before the maximum count, the function returns early. Otherwise, a warning is emitted. This change improves bus recovery reliability. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Troy Mitchell Reviewed-by: Aurelien Jarno Signed-off-by: Wolfram Sang commit db7720ef50e0103be70a3887bc66e9c909933ad9 Author: Troy Mitchell Date: Thu Sep 25 10:02:28 2025 +0800 i2c: spacemit: check SDA instead of SCL after bus reset After calling spacemit_i2c_conditionally_reset_bus(), the controller should ensure that the SDA line is release before proceeding. Previously, the driver checked the SCL line instead, which does not guarantee that the bus is truly idle. This patch changes the check to verify SDA. This ensures proper bus recovery and avoids potential communication errors after a conditional reset. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d Author: Troy Mitchell Date: Thu Sep 25 10:02:27 2025 +0800 i2c: spacemit: disable SDA glitch fix to avoid restart delay The K1 I2C controller has an SDA glitch fix that introduces a small delay on restart signals. While this feature can suppress glitches on SDA when SCL = 0, it also delays the restart signal, which may cause unexpected behavior in some transfers. The glitch itself does not affect normal I2C operation, because the I2C specification allows SDA to change while SCL is low. To ensure correct transmission for every message, we disable the SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during initialization. This guarantees that restarts are issued promptly without unintended delays. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit bc8712f2b5250825968e6b0c3d2709a4b9d5d570 Author: Amery Hung Date: Thu Sep 25 10:00:12 2025 -0700 bpf: Emit struct bpf_xdp_sock type in vmlinux BTF Similar to other BPF UAPI struct, force emit BTF of struct bpf_xdp_sock so that it is defined in vmlinux.h. In a later patch, a selftest will use vmlinux.h to get the definition of struct bpf_xdp_sock instead of bpf.h. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250925170013.1752561-1-ameryhung@gmail.com commit e121be784d35e2950652b46258a87381e00270ab Author: Sunil V L Date: Mon Aug 18 09:39:10 2025 +0530 ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop Currently, acpi_fwnode_get_reference_args() delegates to the internal function __acpi_node_get_property_reference() to retrieve property references. However, this function does not handle the nargs_prop (cells property) parameter, and instead expects the number of arguments (nargs) to be known or hardcoded. As a result, when fwnode_property_get_reference_args() is used with a valid nargs_prop, the ACPI backend ignores it, whereas the Device Tree (DT) backend uses the #*-cells property from the reference node to determine the number of arguments dynamically. To support the nargs_prop in ACPI, refactor the code as follows: - Move the implementation from __acpi_node_get_property_reference() into acpi_fwnode_get_reference_args(). - Update __acpi_node_get_property_reference() to call the (now updated) acpi_fwnode_get_reference_args() passing NULL as nargs_prop to keep the behavior of __acpi_node_get_property_reference() intact. Acked-by: Rafael J. Wysocki Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Sunil V L Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-15-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit a43ac325c7cbbfe72bdf9178059b3ee9f5a2c7dd Author: Ilpo Järvinen Date: Wed Sep 24 16:42:27 2025 +0300 PCI: Set up bridge resources earlier Bridge windows are read twice from PCI Config Space, the first time from pci_read_bridge_windows(), which does not set up the device's resources. This causes problems down the road as child resources of the bridge cannot check whether they reside within the bridge window or not. Set up the bridge windows already in pci_read_bridge_windows(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250924134228.1663-2-ilpo.jarvinen@linux.intel.com commit 445522fe7aad6131b2747ae8c76f77266054cd84 Author: Troy Mitchell Date: Thu Sep 25 10:02:26 2025 +0800 i2c: spacemit: remove stop function to avoid bus error Previously, STOP handling was split into two separate steps: 1) clear TB/STOP/START/ACK bits 2) issue STOP by calling spacemit_i2c_stop() This left a small window where the control register was updated twice, which can confuse the controller. While this race has not been observed with interrupt-driven transfers, it reliably causes bus errors in PIO mode. Inline the STOP sequence into the IRQ handler and ensure that control register bits are updated atomically in a single writel(). Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Troy Mitchell Reviewed-by: Aurelien Jarno Signed-off-by: Wolfram Sang commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b Author: Troy Mitchell Date: Thu Sep 25 10:02:25 2025 +0800 i2c: spacemit: ensure bus release check runs when wait_bus_idle() fails spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative error code on failure. Since 'ret' can never be positive, the final 'else' branch was unreachable, and spacemit_i2c_check_bus_release() was never called. This commit guarantees we attempt to release the bus whenever waiting for an idle bus fails. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Reviewed-by: Aurelien Jarno Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit b492183652808e0f389272bf63dc836241b287ff Author: Leilk.Liu Date: Sat Sep 6 16:24:06 2025 +0800 i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD The old IC does not support the I2C_MASTER_WRRD (write-then-read) function, but the current code’s handling of i2c->auto_restart may potentially lead to entering the I2C_MASTER_WRRD software flow, resulting in unexpected bugs. Instead of repurposing the auto_restart flag, add a separate flag to signal I2C_MASTER_WRRD operations. Also fix handling of msgs. If the operation (i2c->op) is I2C_MASTER_WRRD, then the msgs pointer is incremented by 2. For all other operations, msgs is simply incremented by 1. Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller") Signed-off-by: Leilk.Liu Suggested-by: Chen-Yu Tsai Reviewed-by: Chen-Yu Tsai Signed-off-by: Wolfram Sang commit 1a2b423be6a89dd07d5fc27ea042be68697a6a49 Author: Heiner Kallweit Date: Sun Sep 14 22:24:13 2025 +0200 i2c: boardinfo: Annotate code used in init phase only Annotate two places in boardinfo code: - __i2c_first_dynamic_bus_num is set in init phase. Annotate it as __ro_after_init to prevent later changes. - i2c_register_board_info() is used in init phase only, so annotate it as __init, allowing to free the memory after init phase. This is safe, see comment: "done in board-specific init code near arch_initcall() time" Signed-off-by: Heiner Kallweit Signed-off-by: Wolfram Sang commit 749b61c2d6a91c81732860f22925ae9884de95fe Merge: 8f5ae30d69d754 45d78cd0bf2c40 Author: Thomas Gleixner Date: Thu Sep 25 23:14:04 2025 +0200 Merge tag 'timers-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource Pull clocksource/events driver updates from Daniel Lezcano: - Add the module owner to all the drivers which can be converted into modules in order to have the core time framework to take the refcount and prevent wild module removal. In addition export the symbols for the sched_clock_register() function to allow the drivers to be converted into modules (Daniel Lezcano) - Convert the faraday,fttmr010 DT bindings to yaml schema (Rob Herring) - Add the DT bindings compatible string for the MT6572 (Max Shevchenko) - Fix the fsl,ftm-timer bindings by using the items to describe a register (Frank Li) - Add the DT binding documentation for Andes machine timer (Ben Zong-You Xie) - Avoid 64-bit divide operation which fails on xtensa and simplify the timeleft computation with 32 bits operations on Tegra186 (Guenter Roeck) - Add the fsl,timrot.yaml DT bindings for i.MX23/i.MX28 timer (Frank Li) - Replace comma by semicolon which were introduced when moving the static structure initialization (Chen Ni) - Add a new compatible for the MediaTek MT8196 SoC, fully compatible with MT6765 (AngeloGioacchino Del Regno) - Add the support for the s32g2 and s32g3 platforms in the PIT timer after cleaning up the code to support multiple instances (Daniel Lezcano) - Generate platform devices for MMIO timers with ACPI and integrate it with the arch ARM timer (Marc Zyngier) - Fix RTL OTTO timer by working around dying timers (Markus Stockhausen) - Remove extra error message in the tegra186 timer (Wolfram Sang) - Convert from round_rate() to determine_rate() in the Ingenic sysost driver (Brian Masney) - Add PWM capture functionality in the OMAP DM driver (Gokul Praveen) - Autodetect the clock rate to initialize a prescaler value compatible with the frequency changes on the ARM global timer (Markus Schneider-Pargmann) - Fix rollbacks missing resource deallocation in case of error on the clps711x (Zhen Ni) - Reorganize the code to split the start and the stop routine on the sh_cmt driver (Niklas Söderlund) - Add the compatible definition for ARTPEC-9 on exynos MCT (SungMin Park) commit 54d6a978bb2bb78a781bc849608c5b4f0748985b Merge: 958e55f90a0145 d32bb69523b86c Author: Wolfram Sang Date: Thu Sep 25 22:42:24 2025 +0200 Merge branch 'i2c/immutable/scoped_fwnode_child' into i2c/for-mergewindow commit aa43953e862c031ff66e44353c88beb7a449e80d Author: Anup Patel Date: Mon Aug 18 09:39:09 2025 +0530 irqchip: Add driver for the RPMI system MSI service group The RPMI specification defines a system MSI service group which allows application processors to receive MSIs upon system events such as graceful shutdown/reboot request, CPU hotplug event, memory hotplug event, etc. Add an irqchip driver for the RISC-V RPMI system MSI service group to directly receive system MSIs in Linux kernel. Reviewed-by: Thomas Gleixner Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-14-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 3e6cf38486005831e063fd0d943a46bc8434e732 Author: Anup Patel Date: Mon Aug 18 09:39:08 2025 +0530 dt-bindings: Add RPMI system MSI interrupt controller bindings Add device tree bindings for the RPMI system MSI service group based interrupt controller for the supervisor software. The RPMI system MSI service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Atish Patra Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-13-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit a72ab2514b7c8e8203c551310166f4c72262ff43 Author: Anup Patel Date: Mon Aug 18 09:39:07 2025 +0530 dt-bindings: Add RPMI system MSI message proxy bindings Add device tree bindings for the RPMI system MSI service group based message proxy implemented by the SBI implementation (machine mode firmware or hypervisor). The RPMI system MSI service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Atish Patra Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-12-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 19d3a401a617c68e9487f55b9f2efe213f8f949d Author: John Madieu Date: Wed Sep 17 19:01:56 2025 +0200 thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC The RZ/G3E SoC integrates a Temperature Sensor Unit (TSU) block designed to monitor the chip's junction temperature. This sensor is connected to channel 1 of the APB port clock/reset and provides temperature measurements. It also requires calibration values stored in the system controller registers for accurate temperature measurement. Add a driver for the Renesas RZ/G3E TSU. [ dlezcano: Fixed conflict with "renesas: Add support for RZ/G3S" ] Signed-off-by: John Madieu Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20250917170202.197929-3-john.madieu.xa@bp.renesas.com Signed-off-by: Daniel Lezcano commit caf41eb4575ddac61dd0f6d4a6108bb7ab9fc408 Author: John Madieu Date: Wed Sep 17 19:01:55 2025 +0200 dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit The Renesas RZ/G3E SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The device provides real-time temperature measurements for thermal management, utilizing a single dedicated channel (channel 1) for temperature sensing. Reviewed-by: Rob Herring (Arm) Signed-off-by: John Madieu Link: https://lore.kernel.org/r/20250917170202.197929-2-john.madieu.xa@bp.renesas.com Signed-off-by: Daniel Lezcano commit 3762f5851ac5a65dcccadf73dbe853b1b346f561 Author: Svyatoslav Ryhel Date: Wed Sep 3 19:27:49 2025 +0300 thermal/drivers/thermal-generic-adc: Add temperature sensor channel To avoid duplicating sensor functionality and conversion tables, this design allows converting an ADC IIO channel's output directly into a temperature IIO channel. This is particularly useful for devices where hwmon isn't suitable or where temperature data must be accessible through IIO. One such device is, for example, the MAX17040 fuel gauge. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20250903162749.109910-2-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit e881662aa06af65021c2fa255dd7530235a3d195 Author: Sebastian Reichel Date: Wed Aug 20 19:40:49 2025 +0200 dt-bindings: thermal: rockchip: Tighten grf requirements Instead of having an optional rockchip,grf property, forbid using it on platforms without registers in a GRF being needed for thermal monitoring and make it mandatory on the platforms actually needing it. Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-3-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit c268a9d8c18d594418dcf16762bfe9caf6e1bbb6 Author: Sebastian Reichel Date: Wed Aug 20 19:40:48 2025 +0200 thermal/drivers/rockchip: Shut up GRF warning Most of the recent Rockchip devices do not have a GRF associated with the tsadc IP. Let's avoid printing a warning on those devices. Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Tested-by: Diederik de Haas Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-2-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit 6f769708d53ab029f09f78660680b4ad161092f2 Author: Sebastian Reichel Date: Wed Aug 20 19:40:47 2025 +0200 thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format Unify all chip descriptions to the version without any empty lines. Suggested-by: Heiko Stuebner Signed-off-by: Sebastian Reichel Reviewed-by: Dragan Simic Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250820-thermal-rockchip-grf-warning-v2-1-c7e2d35017b8@kernel.org Signed-off-by: Daniel Lezcano commit dc095b37b09e1abbdb6daf5e69dbd0cd5265087e Author: Claudiu Beznea Date: Sun Aug 10 15:21:23 2025 +0300 thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC The Renesas RZ/G3S SoC features a Thermal Sensor Unit (TSU) that reports the junction temperature. The temperature is reported through a dedicated ADC channel. Add a driver for the Renesas RZ/G3S TSU. Signed-off-by: Claudiu Beznea Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250810122125.792966-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Daniel Lezcano commit a3152e5c742ca2557c5cd0e5a9e6ca6b9a92df93 Author: Claudiu Beznea Date: Sun Aug 10 15:21:22 2025 +0300 dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit The Renesas RZ/G3S SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The temperature is measured using the RZ/G3S ADC, with a dedicated ADC channel directly connected to the TSU. Add documentation for it. Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250810122125.792966-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Daniel Lezcano commit 55173287e7a2dbab8c920f7d5db8ac515ab82b4e Author: Michael Walle Date: Thu Aug 28 14:40:42 2025 +0200 thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon Make the sensors available in the hwmon subsystem (if CONFIG_THERMAL_HWMON is enabled). Signed-off-by: Michael Walle Reviewed-by: Lukasz Luba Link: https://lore.kernel.org/r/20250828124042.1680853-1-mwalle@kernel.org Signed-off-by: Daniel Lezcano commit 117bdda24d68be7a61d460e1ee372458c41e787e Author: Wolfram Sang Date: Thu Sep 11 09:00:13 2025 +0200 thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry S4 was added first so it was assumed to be the blueprint for R-Car Gen4. It turned out now, that S4 is a special mix between Gen3 and Gen4. V4H and V4M are the similar ones as confirmed by HW engineers. So, rename the S4 entry to be specific instead of generic. Rename the V4H entry to be the new generic one, so V4M will use it as well now. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250911070254.2214-2-wsa+renesas@sang-engineering.com Signed-off-by: Daniel Lezcano commit 9d522a877b6f1a8a2675826d14d2edaa9712db9a Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:03 2025 +0300 thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver Add Tegra114 specific SOCTHERM driver. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-6-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit 10e1dcb62a7e874af43e7dfbef13ef8e3a2ad4a9 Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:02 2025 +0300 dt-bindings: thermal: add Tegra114 soctherm header This adds header for the Tegra114 SOCTHERM device tree node. Signed-off-by: Svyatoslav Ryhel Acked-by: Conor Dooley Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-5-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit 48fc33b95159badfca03d0c48aced60bf9f9325a Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:01 2025 +0300 thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support The Tegra114 has a different fuse calibration register layout and address compared to other Tegra SoCs, requiring SOCTHERM shift, mask, register address, and nominal tf calibration value to be configurable. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250828055104.8073-4-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit aa0025154855b10b68ada4e60fd99623d51252cc Author: Svyatoslav Ryhel Date: Thu Aug 28 08:51:00 2025 +0300 dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System Document SOCTHERM Thermal Management System found in the Tegra 4 SoC. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250828055104.8073-3-clamor95@gmail.com Signed-off-by: Daniel Lezcano commit ec4be3165e4c6af3f03c8a603af5ea118c95dfb4 Author: Marek Vasut Date: Fri Sep 5 21:32:56 2025 +0200 thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry The R-Car Gen3 thermal driver supports both R-Car Gen3 and Gen4 SoCs. Update the Kconfig entry. Signed-off-by: Marek Vasut Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250905193322.148115-1-marek.vasut+renesas@mailbox.org Signed-off-by: Daniel Lezcano commit 13eac80a2db125c56a13938216c23202cf7f59ac Author: Marek Vasut Date: Sun Sep 7 17:41:38 2025 +0200 thermal/drivers/rcar_gen3: Fix comment typo Fix typo to millidegree Celsius. This aligns the comment with another comment later on the same function. No functional change. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250907154148.171496-1-marek.vasut+renesas@mailbox.org Signed-off-by: Daniel Lezcano commit 14b7ea27bd0fcbaf06f3df1544dcbced43e9fb1b Author: Sumeet Pawnikar Date: Thu Jul 10 23:24:25 2025 +0530 drivers/thermal/qcom/lmh: Fix incorrect error message It was showing wrong error message as ARM threshold thremal trip for setting LOW threshold thermal trip. Fix this incorrect error message for setting LOW threshold thermal trip. Reviewed-by: Konrad Dybcio Signed-off-by: Sumeet Pawnikar Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250710175426.5789-1-sumeet4linux@gmail.com commit b50b2c53f98fcdb6957e184eb488c16502db9575 Author: Dmitry Baryshkov Date: Mon Jul 28 15:18:24 2025 +0300 thermal/drivers/qcom/lmh: Add missing IRQ includes As reported by LKP, the Qualcomm LMH driver needs to include several IRQ-related headers, which decrlare necessary IRQ functionality. Currently driver builds on ARM64 platforms, where the headers are pulled in implicitly by other headers, but fails to build on other platforms. Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/ Signed-off-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com commit 57eda47bd14b0c2876f2db42e757c57b7a671965 Author: Dmitry Baryshkov Date: Mon Jul 28 15:18:23 2025 +0300 thermal/drivers/qcom: Make LMH select QCOM_SCM The QCOM_SCM symbol is not user-visible, so it makes little sense to depend on it. Make LMH driver select QCOM_SCM as all other drivers do and, as the dependecy is now correctly handled, enable || COMPILE_TEST in order to include the driver into broader set of build tests. Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM") Signed-off-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com commit 5ea75f3479ee7c97a54c8660ce2cd980c9e9afb6 Author: Jiapeng Chong Date: Fri Aug 1 14:35:40 2025 +0800 thermal/drivers/mediatek/lvts_thermal: Remove unneeded semicolon ./drivers/thermal/mediatek/lvts_thermal.c:642:2-3: Unneeded semicolon. A semicolon is present after the closing bracket of the loop, let's remove it. No functional change intended. [ dlezcano : Reworded the description and reordered the tags order ] Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=23244 Signed-off-by: Jiapeng Chong Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250801063540.2959610-1-jiapeng.chong@linux.alibaba.com commit 48bc3b3317b9e67103b82cebbc1475b57abde38b Author: Marek Vasut Date: Wed Jun 25 20:16:58 2025 +0200 thermal/drivers/rcar_gen3: Add support for R-Car V4H default trim values Add default trimming values for the four temperature sensors located in Renesas R-Car V4H Working Sample SoC. The trimming values are identical for all four THS temperature sensors. Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250625181739.28391-2-marek.vasut+renesas@mailbox.org commit 84fd9e4a6b996ca1ac00eb46fcb4ef3246b6f6a3 Author: Marek Vasut Date: Wed Jun 25 20:16:57 2025 +0200 thermal/drivers/rcar_gen3: Add support for per-SoC default trim values The Working Sample R-Car SoCs may not yet have thermal sensor trimming values programmed into fuses, those fuses are blank instead. For such SoCs, the driver includes fallback trimming values. Those values are currently applied to all SoCs which use this driver. Introduce support for per-SoC fallback trimming values in preparation for SoCs which do not use these current trimming values. No functional change is intended here. Signed-off-by: Marek Vasut Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/20250625181739.28391-1-marek.vasut+renesas@mailbox.org commit 4ae50c82a5ab9071b928648da8723153004170bb Author: Gaurav Kohli Date: Tue Jun 24 12:19:44 2025 +0530 dt-bindings: thermal: tsens: Add QCS615 compatible Add compatibility string for the thermal sensors on QCS615 platform. Acked-by: Rob Herring (Arm) Signed-off-by: Gaurav Kohli Link: https://lore.kernel.org/r/20250624064945.764245-2-quic_gkohli@quicinc.com Signed-off-by: Daniel Lezcano commit df2ba5709416ac6ce8dab1d141fc246b79549e78 Author: Mario Limonciello Date: Wed Sep 24 11:16:24 2025 -0500 drm/amd: Add name to modes from amdgpu_connector_add_common_modes() [Why] When DC adds common modes it adds modes with a string to match what they are. Non-DC doesn't. This can be inconsistent when turning on/off DC support. [How] Add a name member to common_modes[] and copy it into the drm display mode. Cc: Timur Kristóf Reviewed-by: Alex Deucher Reviewed-by: Timur Kristóf Link: https://lore.kernel.org/r/20250924161624.1975819-6-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 6d622755bc9774a1edcb85325951f4c4a8ba9a55 Author: Mario Limonciello Date: Wed Sep 24 11:16:23 2025 -0500 drm/amd: Drop some common modes from amdgpu_connector_add_common_modes() [Why] DC and non-DC codepaths have different sets of common modes that are added for eDP and LVDS cases. This can cause different behaviors for turning on DC on hardware that can support both. [How] Drop extra modes from amdgpu_connector_add_common_modes() not present in amdgpu_dm_connector_add_common_modes(). Cc: Timur Kristóf Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-5-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit dbf2341569dfbc61ff34c32de988bc058d0644d9 Author: Alex Deucher Date: Fri Nov 15 08:56:33 2024 -0500 drm/amdgpu: update MODULE_PARM_DESC for freesync_video To better describe what it does. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3756 Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 123a1750c5e0dcbfec953647045947be9620a7d8 Author: Mario Limonciello Date: Wed Sep 24 11:16:22 2025 -0500 drm/amd: Use dynamic array size declaration for amdgpu_connector_add_common_modes() [Why] Adding or removing a mode from common_modes[] can be fragile if a user forgot to update the for loop boundaries. [How] Use ARRAY_SIZE() to detect size of the array and use that instead. Cc: Timur Kristóf Reviewed-by: Alex Deucher Reviewed-by: Timur Kristóf Link: https://lore.kernel.org/r/20250924161624.1975819-4-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 1f721ebcf312df88c6da6457e0ff21c33613f73c Author: Timur Kristóf Date: Wed Sep 24 13:38:36 2025 +0200 drm/amd/display: Share dce100_validate_global with DCE6-8 The dce100_validate_global function was verbatim exactly the same as dce60_validate_global and dce80_validate_global. Share dce100_validate_global between DCE6-10 to save code size. Signed-off-by: Timur Kristóf Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit ee352f6c56e1775b192f2d39ad45362148e1fd16 Author: Timur Kristóf Date: Wed Sep 24 13:38:35 2025 +0200 drm/amd/display: Share dce100_validate_bandwidth with DCE6-8 DCE6-8 have very similar capabilities to DCE10, they support the same DP and HDMI versions and work similarly. Share dce100_validate_bandwidth between DCE6-10 to reduce code duplication in the DC driver. Signed-off-by: Timur Kristóf Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit b8ae2640f9acd4f411c9227d2493755d03fe440a Author: Jesse.Zhang Date: Wed Sep 24 16:00:06 2025 +0800 drm/amdgpu: Fix fence signaling race condition in userqueue This commit fixes a potential race condition in the userqueue fence signaling mechanism by replacing dma_fence_is_signaled_locked() with dma_fence_is_signaled(). The issue occurred because: 1. dma_fence_is_signaled_locked() should only be used when holding the fence's individual lock, not just the fence list lock 2. Using the locked variant without the proper fence lock could lead to double-signaling scenarios: - Hardware completion signals the fence - Software path also tries to signal the same fence By using dma_fence_is_signaled() instead, we properly handle the locking hierarchy and avoid the race condition while still maintaining the necessary synchronization through the fence_list_lock. v2: drop the comment (Christian) Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 45da20e00d5da842e17dfc633072b127504f0d0e Author: Yifan Zhang Date: Wed Sep 24 23:19:14 2025 +0800 amd/amdkfd: enhance kfd process check in switch partition current switch partition only check if kfd_processes_table is empty. kfd_prcesses_table entry is deleted in kfd_process_notifier_release, but kfd_process tear down is in kfd_process_wq_release. consider two processes: Process A (workqueue) -> kfd_process_wq_release -> Access kfd_node member Process B switch partition -> amdgpu_xcp_pre_partition_switch -> amdgpu_amdkfd_device_fini_sw -> kfd_node tear down. Process A and B may trigger a race as shown in dmesg log. This patch is to resolve the race by adding an atomic kfd_process counter kfd_processes_count, it increment as create kfd process, decrement as finish kfd_process_wq_release. v2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds and bug fix. (Philip Yang) [3966658.307702] divide error: 0000 [#1] SMP NOPTI [3966658.350818] i10nm_edac [3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted [3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu] [3966658.362839] nfit [3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu] [3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00 [3966658.380967] x86_pkg_temp_thermal [3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246 [3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000 [3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00 [3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4 [3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000 [3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800 [3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000 [3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0 [3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [3966658.391536] PKRU: 55555554 [3966658.391536] Call Trace: [3966658.391674] deallocate_sdma_queue+0x38/0xa0 [amdgpu] [3966658.391762] process_termination_cpsch+0x1ed/0x480 [amdgpu] [3966658.399754] intel_powerclamp [3966658.402831] kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu] [3966658.402908] kfd_process_wq_release+0x1a/0x1a0 [amdgpu] [3966658.410516] coretemp [3966658.434016] process_one_work+0x1ad/0x380 [3966658.434021] worker_thread+0x49/0x310 [3966658.438963] kvm_intel [3966658.446041] ? process_one_work+0x380/0x380 [3966658.446045] kthread+0x118/0x140 [3966658.446047] ? __kthread_bind_mask+0x60/0x60 [3966658.446050] ret_from_fork+0x1f/0x30 [3966658.446053] Modules linked in: kpatch_20765354(OEK) [3966658.455310] kvm [3966658.464534] mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK) [3966658.473462] idxd_mdev [3966658.482306] kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqos_hotfixes(OE) rfkill uio_pci_generic uio cuse fuse nf_tables nfnetlink intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm idxd_mdev [3966658.491237] vfio_pci [3966658.501196] vfio_pci vfio_virqfd mdev vfio_iommu_type1 vfio iax_crypto intel_pmt_telemetry iTCO_wdt intel_pmt_class iTCO_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq [3966658.508537] vfio_virqfd [3966658.517569] snd_seq_device ipmi_ssif isst_if_mbox_pci isst_if_mmio pcspkr snd_pcm idxd intel_uncore ses isst_if_common intel_vsec idxd_bus enclosure snd_timer mei_me snd i2c_i801 i2c_smbus mei i2c_ismt soundcore joydev acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad vfat fat [3966658.526851] mdev [3966658.536096] nfsd auth_rpcgss nfs_acl lockd grace slb_vtoa(OE) sunrpc dm_mod hookers mlx5_ib(OE) ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helper ttm mlx5_core(OE) mlxfw(OE) [3966658.540381] vfio_iommu_type1 [3966658.544341] nvme mpt3sas tls drm nvme_core pci_hyperv_intf raid_class psample libcrc32c crc32c_intel mlxdevm(OE) i2c_core [3966658.551254] vfio [3966658.558742] scsi_transport_sas wmi pinctrl_emmitsburg sd_mod t10_pi sg ahci libahci libata rdma_ucm(OE) ib_uverbs(OE) rdma_cm(OE) iw_cm(OE) ib_cm(OE) ib_umad(OE) ib_core(OE) ib_ucm(OE) mlx_compat(OE) [3966658.563004] iax_crypto [3966658.570988] [last unloaded: diagnose] [3966658.571027] ---[ end trace cc9dbb180f9ae537 ]--- Signed-off-by: Yifan Zhang Reviewed-by: Philip.Yang Signed-off-by: Alex Deucher commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 Author: Yifan Zhang Date: Tue Sep 16 21:21:15 2025 +0800 amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw There is race in amdgpu_amdkfd_device_fini_sw and interrupt. if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and kfree(kfd), and KGD interrupt generated. kernel panic log: BUG: kernel NULL pointer dereference, address: 0000000000000098 amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP PGD d78c68067 P4D d78c68067 kfd kfd: amdgpu: Allocated 3969056 bytes on gart PUD 1465b8067 PMD @ Oops: @002 [#1] SMP NOPTI kfd kfd: amdgpu: Total number of KFD nodes to be created: 4 CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40 Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 OF b1 17 75 Ba 4c 89 e@ 41 Sc 89 c6 e8 07 38 5d RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018 0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098 ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020 0000000000000000 R11: 0000000000000000 R12: 0900000000000002 ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00 CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033 CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400 PKRU: 55555554 Call Trace: kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu] ? amdgpu_fence_process+0xa4/0x150 [amdgpu] kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace amdgpu_irq_dispatch+0x165/0x210 [amdgpu] amdgpu_ih_process+0x80/0x100 [amdgpu] amdgpu: Virtual CRAT table created for GPU amdgpu_irq_handler+0x1f/@x60 [amdgpu] __handle_irq_event_percpu+0x3d/0x170 amdgpu: Topology: Add dGPU node [0x74a2:0x1002] handle_irq_event+0x5a/@xcO handle_edge_irq+0x93/0x240 kfd kfd: amdgpu: KFD node 1 partition @ size 49148M asm_call_irq_on_stack+0xf/@x20 common_interrupt+0xb3/0x130 asm_common_interrupt+0x1le/0x40 5.10.134-010.a1i5000.a18.x86_64 #1 Signed-off-by: Yifan Zhang Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 118800b0797a046adaa2a8e9dee9b971b78802a7 Author: Timur Kristóf Date: Wed Sep 24 13:38:34 2025 +0200 drm/amd/display: Reject modes with too high pixel clock on DCE6-10 Reject modes with a pixel clock higher than the maximum display clock. Use 400 MHz as a fallback value when the maximum display clock is not known. Pixel clocks that are higher than the display clock just won't work and are not supported. With the addition of the YUV422 fallback, DC can now accidentally select a mode requiring higher pixel clock than actually supported when the DP version supports the required bandwidth but the clock is otherwise too high for the display engine. DCE 6-10 don't support these modes but they don't have a bandwidth calculation to reject them properly. Fixes: db291ed1732e ("drm/amd/display: Add fallback path for YCBCR422") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 210844d2c075e12927507097b7ac9ae7a4ae1c15 Author: Mario Limonciello Date: Wed Sep 24 11:16:21 2025 -0500 drm/amd: Drop unnecessary check in amdgpu_connector_add_common_modes() [Why] amdgpu_connector_add_common_modes() has a check for the width and height of common modes being too small, but the array of common_modes[] has fixed values. The check is dead code. [How] Drop unnecessary check. Cc: Timur Kristóf Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-3-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 0fb915d64d99b2cd6164fd0c5304457aa417ea3c Author: Mario Limonciello Date: Wed Sep 24 11:16:20 2025 -0500 drm/amd/display: Only enable common modes for eDP and LVDS [Why] The main reason common modes are added is for compatibility with clone mode when a laptop is connected to a projector or external monitor. Since commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") when non-native modes are picked for eDP the GPU scalar will be used. This is because it is inconsistent whether eDP panels have the capability to actually drive non-native resolutions. With panels connected to other connectors this limitation generally doesn't exist as we the EDID will advertise support for a number of resolutions and monitors will use built in scaling hardware. Comparing DC and non-DC code paths the non-DC code path only adds common modes for LVDS and eDP whereas the DC codepath does it for all connector types. In the past there was an experiment done to disable common mode adding for eDP and LVDS from commit 6d396e7ac1ce3 ("drm/amd/display: Disable common modes for LVDS") and commit 7948afb46af92 ("drm/amd/display: Disable common modes for eDP") but this was reverted in commit a8b79b09185de ("drm/amd: Re-enable common modes for eDP and LVDS") because it caused problems with Xorg. [How] Only add common modes for eDP and LVDS for DC, matching the behavior of non-DC. Suggested-by: Timur Kristóf Reviewed-by: Harry Wentland Reviewed-by: Timur Kristóf Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250924161624.1975819-2-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 4e3b45d7b6c36d7d1b9a30b13d2dfa890e7a0763 Author: Sunil Khatri Date: Wed Sep 24 18:03:07 2025 +0530 drm/amdgpu: remove the redeclaration of variable i Variable "i" has been redeclared as integer later in the function which is wrong and not serving any purpose. Fixes: 899fbde14646 ("drm/amdgpu: replace get_user_pages with HMM mirror helpers") Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 21bbcdf669554c2fe535592be639ba2f2e899399 Author: Dylan Yudaken Date: Fri Sep 19 10:01:39 2025 -0700 selftests/kexec: Ignore selftest binary Add a .gitignore for the test case build object. Signed-off-by: Dylan Yudaken Signed-off-by: Sohil Mehta Reviewed-by: Simon Horman Signed-off-by: Shuah Khan commit 883bd89d00085c2c5f1efcd25861745cb039f9e3 Author: Prike Liang Date: Fri Sep 19 14:31:50 2025 +0800 drm/amdgpu/userq: assign an error code for invalid userq va It should return an error code if userq VA validation fails. Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size") Signed-off-by: Prike Liang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 90e09ea4cfd4aaaf07ababa6d8c880035587e7e9 Author: Christian König Date: Fri Sep 19 09:27:03 2025 +0200 drm/amdgpu: revert "rework reserved VMID handling" v2 This reverts commit e44a0fe630c58b0a87d8281f5c1077a3479e5fce. Initially we used VMID reservation to enforce isolation between processes. That has now been replaced by proper fence handling. Both OpenGL, RADV and ROCm developers requested a way to reserve a VMID for SPM, so restore that approach by reverting back to only allowing a single process to use the reserved VMID. Only compile tested for now. v2: use -ENOENT instead of -EINVAL if VMID is not available Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 66f3883dbc9245ca96abf97c2a4dd2a1e898b32f Author: Christian König Date: Tue Sep 16 16:07:35 2025 +0200 drm/amdgpu: remove leftover from enforcing isolation by VMID Initially we enforced isolation by reserving a VMID, but that practice was now removed. Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 7469567d882374dcac3fdb8b300e0f28cf875a75 Author: Jesse.Zhang Date: Tue Sep 16 13:11:06 2025 +0800 drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails Add a fallback mechanism to attempt pipe reset when KCQ reset fails to recover the ring. After performing the KCQ reset and queue remapping, test the ring functionality. If the ring test fails, initiate a pipe reset as an additional recovery step. v2: fix the typo (Lijo) v3: try pipeline reset when kiq mapping fails (Lijo) Reviewed-by: Alex Deucher Signed-off-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 0a6e9e098fcc318fec0f45a05a5c4743a81a60d9 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:08 2025 -0500 drm/amd: Fix hybrid sleep [Why] commit 530694f54dd5e ("drm/amdgpu: do not resume device in thaw for normal hibernation") optimized the flow for systems that are going into S4 where the power would be turned off. Basically the thaw() callback wouldn't resume the device if the hibernation image was successfully created since the system would be powered off. This however isn't the correct flow for a system entering into s0i3 after the hibernation image is created. Some of the amdgpu callbacks have different behavior depending upon the intended state of the suspend. [How] Use pm_hibernation_mode_is_suspend() as an input to decide whether to run resume during thaw() callback. Reported-by: Ionut Nechita Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4573 Tested-by: Ionut Nechita Fixes: 530694f54dd5e ("drm/amdgpu: do not resume device in thaw for normal hibernation") Acked-by: Alex Deucher Tested-by: Kenneth Crudup Signed-off-by: Mario Limonciello (AMD) Cc: 6.17+ # 6.17+: 495c8d35035e: PM: hibernate: Add pm_hibernation_mode_is_suspend() Signed-off-by: Rafael J. Wysocki commit 495c8d35035edb66e3284113bef01f3b1b843832 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:07 2025 -0500 PM: hibernate: Add pm_hibernation_mode_is_suspend() Some drivers have different flows for hibernation and suspend. If the driver opportunistically will skip thaw() then it needs a hint to know what is happening after the hibernate. Introduce a new symbol pm_hibernation_mode_is_suspend() that drivers can call to determine if suspending the system for this purpose. Tested-by: Ionut Nechita Tested-by: Kenneth Crudup Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Rafael J. Wysocki commit 469d80a3712c66a00b5bb888e62e809db8887ba7 Author: Mario Limonciello (AMD) Date: Thu Sep 25 13:51:06 2025 -0500 PM: hibernate: Fix hybrid-sleep Hybrid sleep will hibernate the system followed by running through the suspend routine. Since both the hibernate and the suspend routine will call pm_restrict_gfp_mask(), pm_restore_gfp_mask() must be called before starting the suspend sequence. Add an explicit call to pm_restore_gfp_mask() to power_down() before the suspend sequence starts. Add an extra call for pm_restrict_gfp_mask() when exiting suspend so that the pm_restore_gfp_mask() call in hibernate() is balanced. Reported-by: Ionut Nechita Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4573 Tested-by: Ionut Nechita Fixes: 12ffc3b1513eb ("PM: Restrict swap use to later in the suspend sequence") Tested-by: Kenneth Crudup Acked-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250925185108.2968494-2-superm1@kernel.org [ rjw: Add comment explainig the new pm_restrict_gfp_mask() call purpose ] Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit 5ba9f520f41a33c99fd5d1eb81b5650ed3517b88 Author: Rahul Pathak Date: Mon Aug 18 09:39:06 2025 +0530 clk: Add clock driver for the RISC-V RPMI clock service group The RPMI specification defines a clock service group which can be accessed via SBI MPXY extension or dedicated S-mode RPMI transport. Add mailbox client based clock driver for the RISC-V RPMI clock service group. Reviewed-by: Stephen Boyd Reviewed-by: Andy Shevchenko Co-developed-by: Anup Patel Signed-off-by: Anup Patel Signed-off-by: Rahul Pathak Link: https://lore.kernel.org/r/20250818040920.272664-11-apatel@ventanamicro.com [pjw@kernel.org: converted rpmi_clkrate_u64 macro to a function; replaced bare constant with a macro] Signed-off-by: Paul Walmsley commit b385830290b417c7708e2db7c0e34a0b3e7297bf Author: Anup Patel Date: Mon Aug 18 09:39:05 2025 +0530 dt-bindings: clock: Add RPMI clock service controller bindings Add device tree bindings for the RPMI clock service group based controller for the supervisor software. The RPMI clock service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Conor Dooley Reviewed-by: Stephen Boyd Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-10-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 54e184f0f5f34b0cd18623117150b52444ab6433 Author: Anup Patel Date: Mon Aug 18 09:39:04 2025 +0530 dt-bindings: clock: Add RPMI clock service message proxy bindings Add device tree bindings for the RPMI clock service group based message proxy implemented by the SBI implementation (machine mode firmware or hypervisor). The RPMI clock service group is defined by the RISC-V platform management interface (RPMI) specification. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/20250818040920.272664-9-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 46e75c56dfeafb6756773b71cabe187a6886859a Author: Julian Sun Date: Wed Aug 27 20:18:12 2025 +0800 ext4: increase IO priority of fastcommit The following code paths may result in high latency or even task hangs: 1. fastcommit io is throttled by wbt. 2. jbd2_fc_wait_bufs() might wait for a long time while JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then jbd2_journal_commit_transaction() waits for the JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write lock of j_state_lock. 3. start_this_handle() waits for read lock of j_state_lock which results in high latency or task hang. Given the fact that ext4_fc_commit() already modifies the current process' IO priority to match that of the jbd2 thread, it should be reasonable to match jbd2's IO submission flags as well. Suggested-by: Ritesh Harjani (IBM) Signed-off-by: Julian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com> Signed-off-by: Theodore Ts'o commit d6ace46c82fd2d3bdb58c35e3dd5cb9e83e136bf Author: Lukas Bulwahn Date: Wed Aug 27 11:08:08 2025 +0200 ext4: remove obsolete EXT3 config options In June 2015, commit c290ea01abb7 ("fs: Remove ext3 filesystem driver") removed the historic ext3 filesystem support as ext3 partitions are fully supported with the ext4 filesystem support. To simplify updating the kernel build configuration, which had only EXT3 support but not EXT4 support enabled, the three config options EXT3_{FS,FS_POSIX_ACL,FS_SECURITY} were kept, instead of immediately removing them. The three options just enable the corresponding EXT4 counterparts when configs from older kernel versions are used to build on later kernel versions. This ensures that the kernels from those kernel build configurations would then continue to have EXT4 enabled for supporting booting from ext3 and ext4 file systems, to avoid potential unexpected surprises. Given that the kernel build configuration has no backwards-compatibility guarantee and this transition phase for such build configurations has been in place for a decade, we can reasonably expect all such users to have transitioned to use the EXT4 config options in their config files at this point in time. With that in mind, the three EXT3 config options are obsolete by now. Remove the obsolete EXT3 config options. Signed-off-by: Lukas Bulwahn Signed-off-by: Theodore Ts'o commit 0f3b05c12158ec7545fb336469ccce38c31c7f9f Author: Julian Sun Date: Mon Aug 25 20:53:39 2025 +0800 jbd2: increase IO priority of checkpoint In commit 6a3afb6ac6df ("jbd2: increase the journal IO's priority"), the priority of IOs initiated by jbd2 has been raised, exempting them from WBT throttling. Checkpoint is also a crucial operation of jbd2. While no serious issues have been observed so far, it should still be reasonable to exempt checkpoint from WBT throttling. Signed-off-by: Julian Sun Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o commit 3c3fac6bc0a9c00dbe65d8dc0d3a282afe4d3188 Author: Baokun Li Date: Mon Aug 25 11:38:30 2025 +0800 ext4: fix potential null deref in ext4_mb_init() In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy() lacks null pointer checking, this leads to a null pointer dereference. ================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40 Call Trace: xa_destroy+0x61/0x130 ext4_mb_init+0x483/0x540 __ext4_fill_super+0x116d/0x17b0 ext4_fill_super+0xd3/0x280 get_tree_bdev_flags+0x132/0x1d0 vfs_get_tree+0x29/0xd0 do_new_mount+0x197/0x300 __x64_sys_mount+0x116/0x150 do_syscall_64+0x50/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ================================================================== Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy() to prevent this issue. The same fix is also applied to ext4_mb_largest_free_orders_destroy(). Reported-by: syzbot+1713b1aa266195b916c2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1713b1aa266195b916c2 Cc: stable@kernel.org Fixes: f7eaacbb4e54 ("ext4: convert free groups order lists to xarrays") Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Theodore Ts'o commit d8b90e6387a74bcb1714c8d1e6a782ff709de9a9 Author: Baokun Li Date: Thu Aug 21 21:38:57 2025 +0800 ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() The implicit __GFP_NOFAIL flag in ext4_sb_bread() was removed in commit 8a83ac54940d ("ext4: call bdev_getblk() from sb_getblk_gfp()"), meaning the function can now fail under memory pressure. Most callers of ext4_sb_bread() propagate the error to userspace and do not remount the filesystem read-only. However, ext4_free_branches() handles ext4_sb_bread() failure by remounting the filesystem read-only. This implies that an ext3 filesystem (mounted via the ext4 driver) could be forcibly remounted read-only due to a transient page allocation failure, which is unacceptable. To mitigate this, introduce a new helper function, ext4_sb_bread_nofail(), which explicitly uses __GFP_NOFAIL, and use it in ext4_free_branches(). Fixes: 8a83ac54940d ("ext4: call bdev_getblk() from sb_getblk_gfp()") Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o commit 2728e71ad67810fea8346fb800c647b66a25162d Author: Dario Binacchi Date: Thu Sep 25 17:31:35 2025 +0200 dt-bindings: touchscreen: remove touchscreen.txt With commit 1d6204e2f51f ("dt-bindings: touchscreen: Add touchscreen schema") touchscreen.txt is no longer needed, and since no other file refers to it, it can be safely removed. Signed-off-by: Dario Binacchi Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-3-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 6b4896e404c7053cf09a6f58fd09684262fab6dd Author: Dario Binacchi Date: Thu Sep 25 17:31:34 2025 +0200 dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node Convert Raspberry Pi firmware 7" touchscreen controller device tree binding to json-schema. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-2-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit b0b255d6b86dd1f2618a1402d6cbdcec1be0c589 Author: Dario Binacchi Date: Thu Sep 25 17:31:33 2025 +0200 dt-bindings: touchscreen: convert eeti bindings to json schema Convert EETI touchscreen controller device tree binding to json-schema. Signed-off-by: Dario Binacchi Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250925153144.4082786-1-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 981b696faf2d59a58d1dc8e258bba00b12e5de93 Author: Xichao Zhao Date: Mon Aug 18 15:28:59 2025 +0800 ext4: replace min/max nesting with clamp() The clamp() macro explicitly expresses the intent of constraining a value within bounds.Therefore, replacing max(min(a,b),c) with clamp(val, lo, hi) can improve code readability. Signed-off-by: Xichao Zhao Signed-off-by: Theodore Ts'o commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a Author: chuguangqing Date: Wed Aug 6 10:28:49 2025 +0800 fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag. Signed-off-by: chuguangqing Signed-off-by: Theodore Ts'o commit 203e3beb73e53584ca90bc2a6d8240b9b12b9bcf Merge: 12de5f0f6c2d7a 4ff71af020ae59 Author: Jakub Kicinski Date: Thu Sep 11 17:37:09 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.17-rc8). Conflicts: drivers/net/can/spi/hi311x.c 6b6968084721 ("can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled") 27ce71e1ce81 ("net: WQ_PERCPU added to alloc_workqueue users") https://lore.kernel.org/72ce7599-1b5b-464a-a5de-228ff9724701@kernel.org net/smc/smc_loopback.c drivers/dibs/dibs_loopback.c a35c04de2565 ("net/smc: fix warning in smc_rx_splice() when calling get_page()") cc21191b584c ("dibs: Move data path to dibs layer") https://lore.kernel.org/74368a5c-48ac-4f8e-a198-40ec1ed3cf5f@kernel.org Adjacent changes: drivers/net/dsa/lantiq/lantiq_gswip.c c0054b25e2f1 ("net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()") 7a1eaef0a791 ("net: dsa: lantiq_gswip: support model-specific mac_select_pcs()") Signed-off-by: Jakub Kicinski commit 5730dacb3f172858ca47b8b1aeab083b5713f24b Author: Mykyta Yatsenko Date: Wed Sep 24 15:29:54 2025 +0100 selftests/bpf: Task_work selftest cleanup fixes task_work selftest does not properly handle cleanup during failures: * destroy bpf_link * perf event fd is passed to bpf_link, no need to close it if link was created successfully * goto cleanup if fork() failed, close pipe. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250924142954.129519-2-mykyta.yatsenko5@gmail.com commit a9e6aa994917ee602798bbb03180a194b37865bb Author: Guangshuo Li Date: Thu Sep 25 14:44:48 2025 +0800 nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() devm_kcalloc() may fail. ndtest_probe() allocates three DMA address arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses them in ndtest_nvdimm_init(), which can lead to a NULL pointer dereference under low-memory conditions. Check all three allocations and return -ENOMEM if any allocation fails, jumping to the common error path. Do not emit an extra error message since the allocator already warns on allocation failure. Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Alison Schofield Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Signed-off-by: Ira Weiny commit 88506435d9d4148e31341a2be9492004df9f7611 Author: Dave Jiang Date: Tue Sep 23 10:40:13 2025 -0700 nvdimm: Clean up __nd_ioctl() and remove gotos Utilize scoped based resource management to clean up the code and and remove gotos for the __nd_ioctl() function. Change allocation of 'buf' to use kvzalloc() in order to use vmalloc() memory when needed and also zero out the allocated memory. Signed-off-by: Dave Jiang Reviewed-by: Dan Williams Signed-off-by: Ira Weiny commit 0020839be034cf1c57ebdf8af8c9e4f697055db6 Author: Dave Jiang Date: Tue Sep 23 10:40:12 2025 -0700 nvdimm: Introduce guard() for nvdimm_bus_lock Converting nvdimm_bus_lock/unlock to guard() to clean up usage of gotos for error handling and avoid future mistakes of missed unlock on error paths. Link: https://lore.kernel.org/linux-cxl/20250917163623.00004a3c@huawei.com/ Suggested-by: Jonathan Cameron Signed-off-by: Dave Jiang Acked-by: Dan Williams Signed-off-by: Ira Weiny commit 99510c324e531addd9f7b80a72dab7435ca66215 Author: Lukas Bulwahn Date: Thu Sep 25 09:36:34 2025 +0200 Documentation/features: Update feature lists for 6.17-rc7 It seems that ./Documentation/features/scripts/features-refresh.sh was most recently used in December 2022, with the latest kernel release v6.1-rc7 at that time (see commit 7f2e60ff51ca ("Documentation/features: Update feature lists for 6.1") to update the feature lists in this subdirectory. All further changes to Documentation/features/ since then have probably been done manually, without checking for changes in other architectures and features, that missed to update this part of the documentation. Running ./Documentation/features/scripts/features-refresh.sh now showed seven changes of supported features in various architectures (one in arc, two in parisc, one in riscv, one in openrisc, and two in um), which were not reflected yet in the current documentation. To confirm the sanity of this script's suggested changes, I checked if the commit messages confirm that the features have in fact been added in the following commits: - commit f122668ddcce ("ARC: Add eBPF JIT support") - commit 4800a6215e33 ("parisc: Wire up eBPF JIT compiler") - commit a869b8c29f86 ("riscv: enable mseal sysmap for RV64") - commit 2f681ba4b352 ("um: move thread info into task") - commit 3f17fed21491 ("um: switch to regset API and depend on XSTATE") - commit 7ce8716e2769 ("openrisc: Add HAVE_REGS_AND_STACK_ACCESS_API support") - commit b5ff52be8913 ("parisc: Convert to generic clockevents") So, update all documents to the current state with features-refresh.sh. Signed-off-by: Lukas Bulwahn Signed-off-by: Jonathan Corbet Message-ID: <20250925073634.112142-1-lukas.bulwahn@redhat.com> commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 Author: Cristian Ciocaltea Date: Tue Sep 2 15:15:46 2025 +0300 usb: vhci-hcd: Prevent suspending virtually attached devices The VHCI platform driver aims to forbid entering system suspend when at least one of the virtual USB ports are bound to an active USB/IP connection. However, in some cases, the detection logic doesn't work reliably, i.e. when all devices attached to the virtual root hub have been already suspended, leading to a broken suspend state, with unrecoverable resume. Ensure the virtually attached devices do not enter suspend by setting the syscore PM flag. Note this is currently limited to the client side only, since the server side doesn't implement system suspend prevention. Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") Signed-off-by: Cristian Ciocaltea Acked-by: Shuah Khan Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com Signed-off-by: Greg Kroah-Hartman commit 2d965c1ae4135ed6f505661458f6dabd39488dac Author: André Almeida Date: Thu Sep 25 11:14:23 2025 -0300 tools/nolibc: add stdbool.h to nolibc includes Otherwise tests compiled with only "-include nolibc.h" will fail with "error: unknown type name 'bool'", even though a stdbool.h is available from nolibc. Fixes: ae1f550efc11 ("tools/nolibc: add stdbool.h header") Fixes: f2662ec26b26 ("selftests: kselftest: Create ksft_print_dbg_msg()") Reported-by: Mark Brown Closes: https://lore.kernel.org/lkml/833f5ae5-190e-47ec-9ad9-127ad166c80c@sirena.org.uk/ Signed-off-by: André Almeida [Thomas: add Fixes tags and massage commit message a bit] Signed-off-by: Thomas Weißschuh commit e26387e950ee4486b4ed5728b5d3c1430c33ba67 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:47 2025 +0000 ASoC: renesas: msiof: ignore 1st FSERR Renesas have tried to minimize the occurrence of FSERR errors as much as possible, but unfortunately we cannot remove them completely, because MSIOF might setup its register during CLK/SYNC are inputed. It can be happen because MSIOF is working as Clock/Frame Consumer. Ignore 1st FSERR which we can do nothing Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/874isryutg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8c363f61e5bcb92d5e88ca1b47be74be2683b212 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:41 2025 +0000 ASoC: renesas: msiof: Add note for The possibility of R/L opposite Capture This driver is assuming MSIOF is used as Clock/Frame Consumer Mode, and there is a case that some Codec (= Clock/Frame Provider) might output Clock/Frame before setup MSIOF. And, MSIOF will capture data without checking SYNC signal Hi/Low (= R/L). This means, if MSIOF RXE bit was set as 1 in case of SYNC signal was Hi (= R) timing, it will start capture data since next SYNC low signal (= L). Because Linux assumes sound data is lined up as R->L->R->L->..., the data R/L might be opposite. The only solution in this case is start CLK/SYNC *after* MSIOF settings, but it depends when and how Codec driver start it. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/875xd7yutm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit dc7473e6372ee36ff232af10c910ee3a8bad6447 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:34 2025 +0000 ASoC: renesas: msiof: setup both (Playback/Capture) in the same time SITMDRn / SIRMDRn and some other registers should not be updated during working even though it was not related the target direction (for example, do TX settings during RX is working), otherwise it cause a FSERR. Setup both direction (Playback/Capture) in the same time. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/877bxnyutt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 25aa058b5c83a3c455a2a288bb3295c0b234f093 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:27 2025 +0000 ASoC: renesas: msiof: tidyup DMAC stop timing Current DMAC is stopped before HW stop, but it might be cause of sync error. Stop HW first. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/878qi3yuu0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ab77fa5533e4d1dcfdd2711b9b1e166e4ed57dab Author: Kuninori Morimoto Date: Thu Sep 25 05:17:21 2025 +0000 ASoC: renesas: msiof: add .symmetric_xxx on snd_soc_dai_driver MSIOF TX/RX are sharing same clock. Adds .symmetric_xxx flags. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87a52jyuu6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 130947b4681c515a5e5a7961244b502de2de85ca Author: Kuninori Morimoto Date: Thu Sep 25 05:17:17 2025 +0000 ASoC: renesas: msiof: set SIFCTR register Because it uses DMAC, we would like to transfer data if there is any data. Set SIFCTR for it. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87bjmzyuub.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 25226abc1affd4bf4f6dd415d475b76e7a273fa8 Author: Kuninori Morimoto Date: Thu Sep 25 05:17:11 2025 +0000 ASoC: renesas: msiof: use reset controller MSIOF has TXRST/RXRST to reset FIFO, but it shouldn't be used during SYNC signal was asserted, because it will be cause of HW issue. When MSIOF is used as Sound driver, this driver is assuming it is used as clock consumer mode (= Codec is clock provider). This means, it can't control SYNC signal by itself. We need to use SW reset (= reset_control_xxx()) instead of TXRST/RXRST. Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Link: https://patch.msgid.link/87cy7fyuug.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 030c59df83b448fc873d1caabb9ea077ae25268e Author: Kuninori Morimoto Date: Thu Sep 25 05:17:04 2025 +0000 ASoC: renesas: msiof: add unique NOTE name MSIOF will have many NOTE on top of driver, give it a unique NOTE name. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ecrvyuuo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 264a58e60c5c93b358818f523eb4911190c8b8d7 Merge: ef351f8e39375a 0e0ba0ecec3d6e Author: Greg Kroah-Hartman Date: Thu Sep 25 18:38:53 2025 +0200 Merge tag 'usb-serial-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 6.18-rc1 Here are the USB serial updates for 6.18-rc1 consisting of some new modem device ids and a trivial cleanup. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add SIMCom 8230C compositions USB: serial: oti6858: remove extranenous ; after comment commit ef351f8e39375a12b64364e5cda7c62fb96a8566 Merge: a4e143636d5def 67600ccfc4f38e Author: Greg Kroah-Hartman Date: Thu Sep 25 18:36:54 2025 +0200 Merge tag 'thunderbolt-for-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.18 merge window This includes following USB4/Thunderbolt changes for the v6.18 merge window: - HMAC hashing improvements - Switch to use Linux Foundation IDs for XDomain discovery - Use is_pciehp instead of is_hotplug_bridge - Fixes for various kernel-doc issues - Fix use-after-free in DP tunneling error path. I'm sending the UAF fix with this pull request because it came quite late and I would like to give it some exposure before it lands the mainline. All these except the UAF fix have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (33 commits) thunderbolt: Fix use-after-free in tb_dp_dprx_work thunderbolt: Update thunderbolt.h header file thunderbolt: Update xdomain.c function documentation thunderbolt: Update usb4_port.c function documentation thunderbolt: Update usb4.c function documentation thunderbolt: Update tunnel.h function documentation thunderbolt: Update tunnel.c function documentation thunderbolt: Update tmu.c function documentation thunderbolt: Add missing documentation in tb.h thunderbolt: Update tb.h function documentation thunderbolt: Update tb.c function documentation thunderbolt: Update switch.c function documentation thunderbolt: Update retimer.c function documentation thunderbolt: Update property.c function documentation thunderbolt: Update path.c function documentation thunderbolt: Update nvm.c function documentation thunderbolt: Add missing documentation in nhi_regs.h ring_desc structure thunderbolt: Update nhi.c function documentation thunderbolt: Update lc.c function documentation thunderbolt: Update eeprom.c function documentation ... commit 130e6de62107116eba124647116276266be0f84c Author: Jaehoon Kim Date: Thu Sep 25 17:47:08 2025 +0200 s390/dasd: enforce dma_alignment to ensure proper buffer validation The block layer validates buffer alignment using the device's dma_alignment value. If dma_alignment is smaller than logical_block_size(bp_block) -1, misaligned buffer incorrectly pass validation and propagate to the lower-level driver. This patch adjusts dma_alignment to be at least logical_block_size -1, ensuring that misalignment buffers are properly rejected at the block layer and do not reach the DASD driver unnecessarily. Fixes: 2a07bb64d801 ("s390/dasd: Remove DMA alignment") Reviewed-by: Stefan Haberland Cc: stable@vger.kernel.org #6.11+ Signed-off-by: Jaehoon Kim Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 8f4ed0ce4857ceb444174503fc9058720d4faaa1 Author: Jaehoon Kim Date: Thu Sep 25 17:47:07 2025 +0200 s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request Currently, if CCW request creation fails with -EINVAL, the DASD driver returns BLK_STS_IOERR to the block layer. This can happen, for example, when a user-space application such as QEMU passes a misaligned buffer, but the original cause of the error is masked as a generic I/O error. This patch changes the behavior so that -EINVAL is returned as BLK_STS_INVAL, allowing user space to properly detect alignment issues instead of interpreting them as I/O errors. Reviewed-by: Stefan Haberland Cc: stable@vger.kernel.org #6.11+ Signed-off-by: Jaehoon Kim Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 1e11552ee54d10c0b602c76b94db602e2581ce57 Author: Vadim Pasternak Date: Mon Jan 13 10:48:59 2025 +0200 hwmon: (mlxreg-fan) Add support for new flavour of capability register FAN platform data is common across the various systems, while fan driver should be able to apply only the fan instances relevant to specific system. For example, platform data might contain descriptions for fan1, fan2, ..., fan{n}, while some systems equipped with all 'n' fans, others with less. Also, on some systems fan drawer can be equipped with several tachometers and on others only with one. For detection of the real number of equipped drawers and tachometers special capability registers are used. These registers used to indicate presence of drawers and tachometers through the bitmap. For some new big modular systems this register will provide presence data by counter. Use slot parameter to distinct whether capability register contains bitmask or counter. Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250113084859.27064-3-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 Author: Vadim Pasternak Date: Mon Jan 13 10:48:58 2025 +0200 hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems Distinct between fan speed setting request coming for hwmon and thermal subsystems. There are fields 'last_hwmon_state' and 'last_thermal_state' in the structure 'mlxreg_fan_pwm', which respectively store the cooling state set by the 'hwmon' and 'thermal' subsystem. The purpose is to make arbitration of fan speed setting. For example, if fan speed required to be not lower than some limit, such setting is to be performed through 'hwmon' subsystem, thus 'thermal' subsystem will not set fan below this limit. Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing cooling state to never be set to a lower value. Eliminate update of 'last_thermal_state', when request is coming from 'hwmon' subsystem. Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit") Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit 5798b62867b47b6ace287d31172ce748ad70d869 Author: Sung-Chi Li Date: Thu Sep 11 06:56:36 2025 +0000 hwmon: (cros_ec) register fans into thermal framework cooling devices Register fans connected under EC as thermal cooling devices as well, so these fans can then work with the thermal framework. During the driver probing phase, we will also try to register each fan as a thermal cooling device based on previous probe result (whether the there are fans connected on that channel, and whether EC supports fan control). The basic get max state, get current state, and set current state methods are then implemented as well. Signed-off-by: Sung-Chi Li Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-3-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit fb8e659309f72e54ed011c6bfe98597b9236805d Author: Sung-Chi Li Date: Thu Sep 11 06:56:35 2025 +0000 hwmon: (cros_ec) add PWM control over fans Newer EC firmware supports controlling fans through host commands, so adding corresponding implementations for controlling these fans in the driver for other kernel services and userspace to control them. The driver will first probe the supported host command versions (get and set of fan PWM values, get and set of fan control mode) to see if the connected EC fulfills the requirements of controlling the fan, then exposes corresponding sysfs nodes for userspace to control the fan with corresponding read and write implementations. As EC will automatically change the fan mode to auto when the device is suspended, the power management hooks are added as well to keep the fan control mode and fan PWM value consistent during suspend and resume. As we need to access the hwmon device in the power management hook, update the driver by storing the hwmon device in the driver data as well. Signed-off-by: Sung-Chi Li Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-2-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit 60ac65a31041b0e5dfd736a79027314b9d533ef5 Author: Sung-Chi Li Date: Thu Sep 11 06:56:34 2025 +0000 platform/chrome: update pwm fan control host commands Update cros_ec_commands.h to include definitions for getting PWM fan duty, getting and setting the fan control mode. Signed-off-by: Sung-Chi Li Acked-by: Tzung-Bi Shih Reviewed-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250911-cros_ec_fan-v6-1-a1446cc098af@google.com Signed-off-by: Guenter Roeck commit 443b39c82c322c9f3c38bea0389fe927ba00b3b4 Author: Michael Walle Date: Fri Sep 12 14:07:44 2025 +0200 hwmon: add SMARC-sAM67 support Add a new driver for the Kontron SMARC-sAM67 board management controller. It has two voltage sensors and one temperature sensor. Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250912120745.2295115-7-mwalle@kernel.org [groeck: Added sa67 to index.rst] Signed-off-by: Guenter Roeck commit 0f6eae86e626e0561d2f545a3183be2e12108410 Author: Michael Walle Date: Fri Sep 12 14:07:42 2025 +0200 dt-bindings: hwmon: sl28cpld: add sa67mcu compatible The Kontron SMARC-sAM67 module features an on-board house keeping uC. It is designed to be compatible with the older sl28cpld implementation, but has different sensors, like voltage and temperature monitoring. Add a new compatible for that board. Signed-off-by: Michael Walle Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250912120745.2295115-5-mwalle@kernel.org Signed-off-by: Guenter Roeck commit 31c092baea5a1c5473d2183c2f2a36c76d083c59 Author: Mohamad Kamal Date: Sun Sep 14 10:40:10 2025 +0200 hwmon: (asus-ec-sensors) add TUF GAMING X670E PLUS WIFI Add support for TUF GAMING X670E PLUS WIFI Signed-off-by: Mohamad Kamal Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250914084019.1108941-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit cb403594701cd36f7f3f868258655d56f9afaf8e Author: Darrick J. Wong Date: Mon Sep 15 17:27:58 2025 -0700 fuse: move CREATE_TRACE_POINTS to a separate file Before we start adding new tracepoints for fuse+iomap, move the tracepoint creation itself to a separate source file so that we don't have to start pulling iomap dependencies into dev.c just for the iomap structures. Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit c4331e19a6b0f9b8de5921cc2f3253e572945564 Author: Darrick J. Wong Date: Mon Sep 15 17:27:11 2025 -0700 fuse: move the backing file idr and code into a new source file iomap support for fuse is also going to want the ability to attach backing files to a fuse filesystem. Move the fuse_backing code into a separate file so that both can use it. Signed-off-by: Darrick J. Wong Reviewed-by: Amir Goldstein Signed-off-by: Miklos Szeredi commit db155b7c7c85b5f14edec21e164001a168581ffb Author: Sergey Bashirov Date: Mon Aug 25 16:11:02 2025 +0300 NFSD: Disallow layoutget during grace period When the server is recovering from a reboot and is in a grace period, any operation that may result in deletion or reallocation of block extents should not be allowed. See RFC 8881, section 18.43.3. If multiple clients write data to the same file, rebooting the server during writing may result in file corruption. In the worst case, the exported XFS may also become corrupted. Observed this behavior while testing pNFS block volume setup. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Signed-off-by: Chuck Lever commit 6d97171ac6585de698df019b0bfea3f123fd8385 Author: John Hubbard Date: Wed Sep 24 18:33:59 2025 -0700 rust: pci: display symbolic PCI vendor names The Display implementation for Vendor was forwarding directly to Debug printing, resulting in raw hex values instead of PCI Vendor strings. Improve things by doing a stringify!() call for each PCI Vendor item. This now prints symbolic names such as "NVIDIA", instead of "Vendor(0x10de)". It still falls back to Debug formatting for unknown class values. Suggested-by: Danilo Krummrich Signed-off-by: John Hubbard Reviewed-by: Alexandre Courbot [ Remove #[inline] for Vendor::fmt(). - Danilo ] Signed-off-by: Danilo Krummrich commit 0a8f173d9dad13930d5888505dc4c4fd6a1d4262 Author: Marek Vasut Date: Tue Sep 9 18:26:24 2025 +0200 PCI: rcar-host: Drop PMSR spinlock The pmsr_lock spinlock used to be necessary to synchronize access to the PMSR register, because that access could have been triggered from either config space access in rcar_pcie_config_access() or an exception handler rcar_pcie_aarch32_abort_handler(). The rcar_pcie_aarch32_abort_handler() case is no longer applicable since commit 6e36203bc14c ("PCI: rcar: Use PCI_SET_ERROR_RESPONSE after read which triggered an exception"), which performs more accurate, controlled invocation of the exception, and a fixup. This leaves rcar_pcie_config_access() as the only call site from which rcar_pcie_wakeup() is called. The rcar_pcie_config_access() can only be called from the controller struct pci_ops .read and .write callbacks, and those are serialized in drivers/pci/access.c using raw spinlock 'pci_lock' . It should be noted that CONFIG_PCI_LOCKLESS_CONFIG is never set on this platform. Since the 'pci_lock' is a raw spinlock , and the 'pmsr_lock' is not a raw spinlock, this constellation triggers 'BUG: Invalid wait context' with CONFIG_PROVE_RAW_LOCK_NESTING=y . Remove the pmsr_lock to fix the locking. Fixes: a115b1bd3af0 ("PCI: rcar: Add L1 link state fix into data abort hook") Reported-by: Duy Nguyen Reported-by: Thuan Nguyen Signed-off-by: Marek Vasut Signed-off-by: Manivannan Sadhasivam Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250909162707.13927-1-marek.vasut+renesas@mailbox.org commit d53ea977adf913a6e5024323e6b7e02326d4453c Author: John Hubbard Date: Wed Sep 24 18:33:58 2025 -0700 rust: pci: display symbolic PCI class names The Display implementation for Class was forwarding directly to Debug printing, resulting in raw hex values instead of PCI Class strings. Improve things by doing a stringify!() call for each PCI Class item. This now prints symbolic names such as "DISPLAY_VGA", instead of "Class(0x030000)". It still falls back to Debug formatting for unknown class values. Suggested-by: Danilo Krummrich Signed-off-by: John Hubbard Reviewed-by: Alexandre Courbot Signed-off-by: Danilo Krummrich commit 200b0d25084d6e99f9f08229283b14b60a84c657 Author: Kevin Brodsky Date: Fri Sep 12 08:39:08 2025 +0100 arm64: mm: Move KPTI helpers to mmu.c create_kpti_ng_temp_pgd() is currently defined (as an alias) in mmu.c without matching declaration in a header; instead cpufeature.c makes its own declaration. This is clearly not pretty, and as commit ceca927c86e6 ("arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature") showed, it also makes it very easy for the prototypes to go out of sync. All this would be much simpler if kpti_install_ng_mappings() and associated functions lived in mmu.c, where they logically belong. This is what this patch does: - Move kpti_install_ng_mappings() and associated functions from cpufeature.c to mmu.c, add a declaration to - Remove create_kpti_ng_temp_pgd() and just call __create_pgd_mapping_locked() directly instead - Mark all these functions __init - Move __initdata after kpti_ng_temp_alloc (as suggested by checkpatch) Reviewed-by: Ryan Roberts Reviewed-by: Ard Biesheuvel Reviewed-by: Anshuman Khandual Signed-off-by: Kevin Brodsky Reviewed-by: Yeoreum Yun [will: Fix conflicts with init_idmap_kpti_bbml2_flag()] Signed-off-by: Will Deacon commit 0da48c5b2fa731b21bc523c82d927399a1e508b0 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:54 2025 +0530 PCI: dwc: Support ECAM mechanism by enabling iATU 'CFG Shift Feature' Designware databook r5.20a, sec 3.10.10.3 documents the 'CFG Shift Feature' of the internal Address Translation Unit (iATU). When this feature is enabled, it shifts/maps the BDF contained in the bits [27:12] of the target address in MEM TLP to become BDF of the CFG TLP. This essentially implements the Enhanced Configuration Address Mapping (ECAM) mechanism as defined in PCIe r6.0, sec 7.2.2. Currently, the driver is not making use of this CFG shift feature, thereby creating the iATU outbound map for each config access to the devices, causing latency and wasting CPU cycles. So to avoid this, configure the controller to enable CFG shift feature by enabling the 'CFG Shift' bit of the 'iATU Control 2 Register'. As a result of enabling CFG shift (ECAM), there is no longer a need to map the DBI register space separately as the DBI region falls under the 'config' space used for ECAM (as DBI is used to access the Root Port). For enabling ECAM using CFG shift, the platform has to satisfy following requirements: 1. Size of the 'config' memory space to be used as ECAM memory should be able to accommodate the number of buses defined in the 'bus-range' property of the host bridge DT node. 2. The 'config' memory space should be 256 MiB aligned. This requirement comes from PCIe r6.0, sec 7.2.2, which says the base address of ECAM memory should be aligned to a 2^(n+20) byte address boundary. For the DWC cores, n is 8, so this results in 2^28 byte alignment requirement. It should be noted that some DWC vendor glue drivers like pcie-al may use their own ECAM mechanism. For those controllers, set 'dw_pcie_rp::native_ecam' flag and skip enabling the CFG Shift feature in the DWC core. Signed-off-by: Krishna Chaitanya Chundru [mani: code split, reworded subject/description, comment, native_ecam flag] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-4-e84390ba75fa@kernel.org commit 4660e50cf81800f82eeecf743ad1e3e97ab72190 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:53 2025 +0530 PCI: qcom: Prepare for the DWC ECAM enablement To support the DWC ECAM mechanism, prepare the driver by performing below configurations: 1. Since the ELBI region will be covered by the ECAM 'config' space, override the 'elbi_base' with the address derived from 'dbi_base' and the offset from PARF_SLV_DBI_ELBI register. 2. Block the transactions from the host bridge to devices other than Root Port on the root bus to return all F's. This is required when the 'CFG Shift Feature' of iATU is enabled. Signed-off-by: Krishna Chaitanya Chundru [mani: code split, reworded subject/description and comments] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-3-e84390ba75fa@kernel.org commit f6fd357f7afbeb34a633e5688a23b9d7eb49d558 Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:52 2025 +0530 PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature' In order to enable PCIe ECAM mechanism in DWC driver as per the 'CFG Shift Feature' documented in Designware databook r5.20a, sec 3.10.10.3, prepare the driver to handle the one time iATU setup and creating ECAM window. Signed-off-by: Krishna Chaitanya Chundru [mani: splitted the preparatory code into a separate commit for bisectability] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-2-e84390ba75fa@kernel.org commit c96992a24beca0768c1c42ad25d6a466e17ec70f Author: Krishna Chaitanya Chundru Date: Tue Sep 23 16:56:51 2025 +0530 PCI: dwc: Add support for ELBI resource mapping External Local Bus Interface (ELBI) is an optional register space for all DWC IPs containing the vendor specific registers. There is no need for the vendor glue drivers to fetch and map the ELBI region separately. Hence, optionally fetch and map the resource from DT in the DWC core. This also warrants dropping the corresponding code from glue drivers. Hence, drop the ELBI resource fetch and map logic from glue drivers and convert them to use 'dw_pci::elbi_base'. Note that the pcie-qcom-ep driver used devm_pci_remap_cfg_resource() to map the ELBI resource previously. But it was a mistake since devm_pci_remap_cfg_resource() should only be used for mapping the PCIe config space region as it maps the region as Non-Posted. As ELBI is used to hold vendor specific registers, there is no need to map the region as Non-Posted. With this conversion, the region will get mapped as normal MMIO memory. Suggested-by: Manivannan Sadhasivam Signed-off-by: Krishna Chaitanya Chundru [mani: removed elbi override, converted glue drivers and reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250923-controller-dwc-ecam-v10-1-e84390ba75fa@kernel.org commit fd2f74f8f3d3c1a524637caf5bead9757fae4332 Author: Feng Yang Date: Thu Sep 25 10:08:22 2025 +0800 tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 When using bpf_program__attach_kprobe_multi_opts on ARM64 to hook a BPF program that contains the bpf_get_stackid function, the BPF program fails to obtain the stack trace and returns -EFAULT. This is because ftrace_partial_regs omits the configuration of the pstate register, leaving pstate at the default value of 0. When get_perf_callchain executes, it uses user_mode(regs) to determine whether it is in kernel mode. This leads to a misjudgment that the code is in user mode, so perf_callchain_kernel is not executed and the function returns directly. As a result, trace->nr becomes 0, and finally -EFAULT is returned. Therefore, the assignment of the pstate register is added here. Fixes: b9b55c8912ce ("tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs") Closes: https://lore.kernel.org/bpf/20250919071902.554223-1-yangfeng59949@163.com/ Signed-off-by: Feng Yang Tested-by: Jiri Olsa Acked-by: Masami Hiramatsu (Google) Signed-off-by: Will Deacon commit 195a1b7d8388c0ec2969a39324feb8bebf9bb907 Author: Yang Shi Date: Thu Sep 18 09:23:49 2025 -0700 arm64: kprobes: call set_memory_rox() for kprobe page The kprobe page is allocated by execmem allocator with ROX permission. It needs to call set_memory_rox() to set proper permission for the direct map too. It was missed. Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page") Cc: Signed-off-by: Yang Shi Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon commit c584a1c7c8a192c13637bc51c7b63a9f15fe6474 Author: Greg Kroah-Hartman Date: Thu Sep 25 14:42:40 2025 +0200 USB: disable rust bindings from the build for now The rust USB bindings as submitted are a good start, but they don't really seem to be correct in a number of minor places, so just disable them from the build entirely at this point in time. When they are ready to be re-enabled, this commit can be reverted. Acked-by: Daniel Almeida Signed-off-by: Greg Kroah-Hartman commit a084c3c4a2674f156031eb04e785986c2744aca8 Author: Yicong Yang Date: Thu Sep 25 11:31:23 2025 +0800 drivers/perf: hisi: Add tt_core_deprecated for compatibility Previously tt_core is defined as config1:0-7 which may not cover all the CPUs sharing L3C on platforms with more than 8 CPUs in a L3C. In order to support such platforms extend tt_core to 16 bits, since no spare space in config1, tt_core was moved to config2:0-15. Though linux expects the users to retrieve the control encoding from sysfs first for each option, it's possible if user doesn't follow this and hardcoded tt_core in config1. So add an option tt_core_deprecated for config1:0-7 for backward compatibility. Signed-off-by: Yicong Yang Signed-off-by: Will Deacon commit 088bb10e37252034ec58a6152f20bfdc8a837f54 Author: Heiko Carstens Date: Tue Sep 23 17:34:30 2025 +0200 s390/mm: Add memory allocation profiling hooks Similar to common code changes [1] add alloc_hook() wrappers to page table allocation functions to allow for memory allocation profiling. If CONFIG_MEM_ALLOC_PROFILING is enabled call sites of page table allocations are accounted, instead of e.g. only crst_table_alloc() and page_table_alloc(). This allows for slightly better profiling data, and the output of /proc/allocinfo is similar to other architectures. Without alloc_hook() wrappers the output of /proc/allocinfo looks like this: 17096704 4174 mm/memory.c:1061 func:folio_prealloc 17809408 4348 mm/memory.c:1063 func:folio_prealloc 0 0 mm/memory.c:4422 func:alloc_swap_folio 0 0 mm/memory.c:4286 func:__alloc_swap_folio 0 0 mm/memory.c:4971 func:alloc_anon_folio ... 1589248 97 arch/s390/mm/pgalloc.c:25 func:crst_table_alloc 0 0 arch/s390/mm/pgalloc.c:124 func:page_table_alloc_pgste 4280320 1045 arch/s390/mm/pgalloc.c:149 func:page_table_alloc With alloc_hook() wrappers: 1097728 268 mm/memory.c:5147 func:__do_fault 20119552 4912 mm/memory.c:1061 func:folio_prealloc 17534976 4281 mm/memory.c:1063 func:folio_prealloc 0 0 mm/memory.c:4422 func:alloc_swap_folio 0 0 mm/memory.c:4286 func:__alloc_swap_folio 786432 192 mm/memory.c:452 func:__pte_alloc 405504 99 mm/memory.c:464 func:__pte_alloc_kernel 1880064 459 mm/memory.c:5525 func:do_fault_around 0 0 mm/memory.c:6403 func:__p4d_alloc 0 0 mm/memory.c:6426 func:__pud_alloc 1064960 65 mm/memory.c:6450 func:__pmd_alloc 0 0 mm/memory.c:4971 func:alloc_anon_folio 0 0 mm/memory.c:5233 func:do_set_pmd [1] commit 2c321f3f70bc ("mm: change inlined allocation helpers to account at the call site") Signed-off-by: Heiko Carstens Acked-by: Alexander Gordeev Signed-off-by: Alexander Gordeev commit 72105fc1c1cb67e779fe2da9d22ffae189c00cfc Author: Marco Crivellari Date: Wed Sep 17 17:38:59 2025 +0200 s390: Replace use of system_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue (replaced by system_percpu_wq), but the current code does not benefit from it. Because of that, system_wq has been replaced by system_dfl_wq, the new unbound workqueue. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Heiko Carstens Reviewed-by: Mete Durlu Signed-off-by: Alexander Gordeev commit dbfe205a344a865b9c36706738f45bc554a040c7 Author: Marco Crivellari Date: Wed Sep 17 17:38:58 2025 +0200 s390/diag324: Replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by renaming system_wq to system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq. The old wq will be kept for a few release cylces. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit f707d2f7a0c7793406daf0e223bad01bb748343e Author: Marco Crivellari Date: Wed Sep 17 17:38:57 2025 +0200 s390/tape: Add WQ_PERCPU to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. All existing users have been updated accordingly. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Alexander Gordeev Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 64826db1e2e177b58dcbc7cf1e1379527be2185a Author: Harrison Carter Date: Tue Sep 16 16:11:01 2025 +0100 dt-bindings: leds: as3645: Convert to DT schema Convert the ams,as3645a.txt to DT Schema format. Signed-off-by: Harrison Carter Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Lee Jones commit 017bdcdb3af941ca0070580a16162047090edd07 Author: Lukas Bulwahn Date: Fri Sep 12 09:46:38 2025 +0200 MAINTAINERS: Adjust file entry in LOONGSON SECURITY ENGINE DRIVERS Commit 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") adds a driver at drivers/char/tpm/tpm_loongson.c, and commit 74fddd5fbab8 ("MAINTAINERS: Add entry for Loongson Security Engine drivers") adds a new section LOONGSON SECURITY ENGINE DRIVERS intending to refer to that driver. It however adds the entry drivers/char/tpm_loongson.c; note that it misses the tpm subdirectory. Adjust the entry to refer to the intended file. Fixes: 74fddd5fbab8 ("MAINTAINERS: Add entry for Loongson Security Engine drivers") Signed-off-by: Lukas Bulwahn Signed-off-by: Lee Jones commit a727bc0588e77efb502c52d7356e8ed036b6a83e Author: Nathan Chancellor Date: Wed Sep 17 10:09:00 2025 -0700 tpm: loongson: Add bufsiz parameter to tpm_loongson_send() Commit 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") has a semantic conflict with commit 07d8004d6fb9 ("tpm: add bufsiz parameter in the .send callback"), as the former change was developed against a tree without the latter change. This results in a build error: drivers/char/tpm/tpm_loongson.c:48:17: error: initialization of 'int (*)(struct tpm_chip *, u8 *, size_t, size_t)' {aka 'int (*)(struct tpm_chip *, unsigned char *, long unsigned int, long unsigned int)'} from incompatible pointer type 'int (*)(struct tpm_chip *, u8 *, size_t)' {aka 'int (*)(struct tpm_chip *, unsigned char *, long unsigned int)'} [-Wincompatible-pointer-types] 48 | .send = tpm_loongson_send, | ^~~~~~~~~~~~~~~~~ drivers/char/tpm/tpm_loongson.c:48:17: note: (near initialization for 'tpm_loongson_ops.send') drivers/char/tpm/tpm_loongson.c:31:12: note: 'tpm_loongson_send' declared here 31 | static int tpm_loongson_send(struct tpm_chip *chip, u8 *buf, size_t count) | ^~~~~~~~~~~~~~~~~ Add the expected bufsiz parameter to tpm_loongson_send() to resolve the error. Fixes: 5c83b07df9c5 ("tpm: Add a driver for Loongson TPM device") Signed-off-by: Nathan Chancellor Reviewed-by: Jarkko Sakkinen Signed-off-by: Lee Jones commit 37fac070eb1e59db81a9b3b18340083878a0a2c9 Author: Masahiro Yamada Date: Wed Sep 24 21:47:58 2025 +0200 Documentation: kbuild: note CONFIG_DEBUG_EFI in reproducible builds CONFIG_EFI_DEBUG embeds absolute file paths into object files, which makes the resulting vmlinux specific to the build environment. Add a note about this in reproducible-builds.rst Signed-off-by: Masahiro Yamada Signed-off-by: Nicolas Schier Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20250924-kbuild-doc-config-debug-efi-in-reproducible-builds-v2-1-d2d6b9dcdb7d@kernel.org Signed-off-by: Nathan Chancellor commit dd948aa63ee48e3032804bd10c87a0f4edaa3515 Author: Magnus Karlsson Date: Mon Sep 15 14:01:44 2025 +0200 MAINTAINERS: Delete inactive maintainers from AF_XDP Delete Björn Töpel and Jonathan Lemon as maintainer and reviewer, respectively, as they have not been contributing towards AF_XDP for several years. I have spoken to Björn and he is ok with his removal. Signed-off-by: Magnus Karlsson Signed-off-by: Daniel Borkmann Reviewed-by: Jason Xing Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20250915120148.2922-1-magnus.karlsson@gmail.com commit 12de5f0f6c2d7aad7e60aada650fcfb374c28a5e Merge: bb6a22651b893c 5e9ff9378adcaf Author: Paolo Abeni Date: Thu Sep 25 12:42:52 2025 +0200 Merge branch 'net-gso-restore-outer-ip-ids-correctly' Richard Gobert says: ==================== net: gso: restore outer ip ids correctly GRO currently ignores outer IPv4 header IDs for encapsulated packets that have their don't-fragment flag set. GSO, however, always assumes that outer IP IDs are incrementing. This results in GSO mangling the outer IDs when they aren't incrementing. For example, GSO mangles the outer IDs of IPv6 packets that were converted to IPv4, which must have an ID of 0 according to RFC 6145, sect. 5.1. GRO+GSO is supposed to be entirely transparent by default. GSO already correctly restores inner IDs and IDs of non-encapsulated packets. The tx-tcp-mangleid-segmentation feature can be enabled to allow the mangling of such IDs so that TSO can be used. This series fixes outer ID restoration for encapsulated packets when tx-tcp-mangleid-segmentation is disabled. It also allows GRO to merge packets with fixed IDs that don't have their don't-fragment flag set. v1: https://lore.kernel.org/netdev/20250814114030.7683-1-richardbgobert@gmail.com/ v2: https://lore.kernel.org/netdev/20250819063223.5239-1-richardbgobert@gmail.com/ v3: https://lore.kernel.org/netdev/20250821073047.2091-1-richardbgobert@gmail.com/ v4: https://lore.kernel.org/netdev/20250901113826.6508-1-richardbgobert@gmail.com/ v5: https://lore.kernel.org/netdev/20250915113933.3293-1-richardbgobert@gmail.com/ v6: https://lore.kernel.org/netdev/20250916144841.4884-1-richardbgobert@gmail.com/ v7: https://lore.kernel.org/netdev/20250922084103.4764-1-richardbgobert@gmail.com/ ==================== Link: https://patch.msgid.link/20250923085908.4687-1-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 5e9ff9378adcaff1efd19d31f7be946472df02f8 Author: Richard Gobert Date: Tue Sep 23 10:59:08 2025 +0200 selftests/net: test ipip packets in gro.sh Add IPIP test-cases to the GRO selftest. This selftest already contains IP ID test-cases. They are now also tested for encapsulated packets. This commit also fixes ipip packet generation in the test. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-6-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit f095a358faf263bf1d8ae712bd38e13b71286819 Author: Richard Gobert Date: Tue Sep 23 10:59:07 2025 +0200 net: gro: remove unnecessary df checks Currently, packets with fixed IDs will be merged only if their don't-fragment bit is set. This restriction is unnecessary since packets without the don't-fragment bit will be forwarded as-is even if they were merged together. The merged packets will be segmented into their original forms before being forwarded, either by GSO or by TSO. The IDs will also remain identical unless NETIF_F_TSO_MANGLEID is set, in which case the IDs can become incrementing, which is also fine. Clean up the code by removing the unnecessary don't-fragment checks. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-5-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 3271f19bf7b9df665549666d789b9f126b4420c7 Author: Richard Gobert Date: Tue Sep 23 10:59:06 2025 +0200 net: gso: restore ids of outer ip headers correctly Currently, NETIF_F_TSO_MANGLEID indicates that the inner-most ID can be mangled. Outer IDs can always be mangled. Make GSO preserve outer IDs by default, with NETIF_F_TSO_MANGLEID allowing both inner and outer IDs to be mangled. This commit also modifies a few drivers that use SKB_GSO_FIXEDID directly. Signed-off-by: Richard Gobert Reviewed-by: Edward Cree # for sfc Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-4-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 21f7484220ace6c355cb0023d14d83da6fe5843d Author: Richard Gobert Date: Tue Sep 23 10:59:05 2025 +0200 net: gro: only merge packets with incrementing or fixed outer ids Only merge encapsulated packets if their outer IDs are either incrementing or fixed, just like for inner IDs and IDs of non-encapsulated packets. Add another ip_fixedid bit for a total of two bits: one for outer IDs (and for unencapsulated packets) and one for inner IDs. This commit preserves the current behavior of GSO where only the IDs of the inner-most headers are restored correctly. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-3-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit 25c550464acd40803d63868dfa4a42506df48b88 Author: Richard Gobert Date: Tue Sep 23 10:59:04 2025 +0200 net: gro: remove is_ipv6 from napi_gro_cb Remove is_ipv6 from napi_gro_cb and use sk->sk_family instead. This frees up space for another ip_fixedid bit that will be added in the next commit. udp_sock_create always creates either a AF_INET or a AF_INET6 socket, so using sk->sk_family is reliable. In IPv6-FOU, cfg->ipv6_v6only is always enabled. Signed-off-by: Richard Gobert Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250923085908.4687-2-richardbgobert@gmail.com Signed-off-by: Paolo Abeni commit bb6a22651b893c08c7855b34aa618b2a71bece9e Author: Mohsin Bashir Date: Mon Sep 22 16:18:55 2025 -0700 eth: fbnic: Read module EEPROM Add support to read module EEPROM for fbnic. Towards this, add required support to issue a new command to the firmware and to receive the response to the corresponding command. Create a local copy of the data in the completion struct before writing to ethtool_module_eeprom to avoid writing to data in case it is freed. Given that EEPROM pages are small, the overhead of additional copy is negligible. Do not block API with explicit checks since API has appropriate checks in place for length, offset, and page. Explicitly check bank, page, offset, and length in fbnic_fw_parse_qsfp_read_resp() to match EEPROM read responses to the correct request. This is important because if the driver times out waiting for an EEPROM read response, a subsequent read request with different values is susceptible to receiving an erroneous response (i.e., the response to the previous request). Reviewed-by: Ido Schimmel Signed-off-by: Jakub Kicinski Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250922231855.3717483-1-mohsin.bashr@gmail.com Signed-off-by: Paolo Abeni commit 45b7f780739a3145aeef24d2dfa02517a6c82ed6 Author: Menglong Dong Date: Wed Sep 17 14:09:16 2025 +0800 sched: Fix some typos in include/linux/preempt.h There are some typos in the comments of migrate in include/linux/preempt.h: elegible -> eligible it's -> its migirate_disable -> migrate_disable abritrary -> arbitrary Just fix them. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 378b7708194fff77c9020392067329931c3fcc04 Author: Menglong Dong Date: Wed Sep 17 14:09:15 2025 +0800 sched: Make migrate_{en,dis}able() inline For now, migrate_enable and migrate_disable are global, which makes them become hotspots in some case. Take BPF for example, the function calling to migrate_enable and migrate_disable in BPF trampoline can introduce significant overhead, and following is the 'perf top' of FENTRY's benchmark (./tools/testing/selftests/bpf/bench trig-fentry): 54.63% bpf_prog_2dcccf652aac1793_bench_trigger_fentry [k] bpf_prog_2dcccf652aac1793_bench_trigger_fentry 10.43% [kernel] [k] migrate_enable 10.07% bpf_trampoline_6442517037 [k] bpf_trampoline_6442517037 8.06% [kernel] [k] __bpf_prog_exit_recur 4.11% libc.so.6 [.] syscall 2.15% [kernel] [k] entry_SYSCALL_64 1.48% [kernel] [k] memchr_inv 1.32% [kernel] [k] fput 1.16% [kernel] [k] _copy_to_user 0.73% [kernel] [k] bpf_prog_test_run_raw_tp So in this commit, we make migrate_enable/migrate_disable inline to obtain better performance. The struct rq is defined internally in kernel/sched/sched.h, and the field "nr_pinned" is accessed in migrate_enable/migrate_disable, which makes it hard to make them inline. Alexei Starovoitov suggests to generate the offset of "nr_pinned" in [1], so we can define the migrate_enable/migrate_disable in include/linux/sched.h and access "this_rq()->nr_pinned" with "(void *)this_rq() + RQ_nr_pinned". The offset of "nr_pinned" is generated in include/generated/rq-offsets.h by kernel/sched/rq-offsets.c. Generally speaking, we move the definition of migrate_enable and migrate_disable to include/linux/sched.h from kernel/sched/core.c. The calling to __set_cpus_allowed_ptr() is leaved in ___migrate_enable(). The "struct rq" is not available in include/linux/sched.h, so we can't access the "runqueues" with this_cpu_ptr(), as the compilation will fail in this_cpu_ptr() -> raw_cpu_ptr() -> __verify_pcpu_ptr(): typeof((ptr) + 0) So we introduce the this_rq_raw() and access the runqueues with arch_raw_cpu_ptr/PERCPU_PTR directly. The variable "runqueues" is not visible in the kernel modules, and export it is not a good idea. As Peter Zijlstra advised in [2], we define and export migrate_enable/migrate_disable in kernel/sched/core.c too, and use them for the modules. Before this patch, the performance of BPF FENTRY is: fentry : 113.030 ± 0.149M/s fentry : 112.501 ± 0.187M/s fentry : 112.828 ± 0.267M/s fentry : 115.287 ± 0.241M/s After this patch, the performance of BPF FENTRY increases to: fentry : 143.644 ± 0.670M/s fentry : 149.764 ± 0.362M/s fentry : 149.642 ± 0.156M/s fentry : 145.263 ± 0.221M/s Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/bpf/CAADnVQ+5sEDKHdsJY5ZsfGDO_1SEhhQWHrt2SMBG5SYyQ+jt7w@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/20250819123214.GH4067720@noisy.programming.kicks-ass.net/ [2] commit 88a90315a99a9120cd471bf681515cc77cd7cdb8 Author: Menglong Dong Date: Wed Sep 17 14:09:14 2025 +0800 rcu: Replace preempt.h with sched.h in include/linux/rcupdate.h In the next commit, we will move the definition of migrate_enable() and migrate_disable() to linux/sched.h. However, migrate_enable/migrate_disable will be used in commit 1b93c03fb319 ("rcu: add rcu_read_lock_dont_migrate()") in bpf-next tree. In order to fix potential compiling error, replace linux/preempt.h with linux/sched.h in include/linux/rcupdate.h. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 35561bab768977c9e05f1f1a9bc00134c85f3e28 Author: Menglong Dong Date: Wed Sep 17 14:09:13 2025 +0800 arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c The include/generated/asm-offsets.h is generated in Kbuild during compiling from arch/SRCARCH/kernel/asm-offsets.c. When we want to generate another similar offset header file, circular dependency can happen. For example, we want to generate a offset file include/generated/test.h, which is included in include/sched/sched.h. If we generate asm-offsets.h first, it will fail, as include/sched/sched.h is included in asm-offsets.c and include/generated/test.h doesn't exist; If we generate test.h first, it can't success neither, as include/generated/asm-offsets.h is included by it. In x86_64, the macro COMPILE_OFFSETS is used to avoid such circular dependency. We can generate asm-offsets.h first, and if the COMPILE_OFFSETS is defined, we don't include the "generated/test.h". And we define the macro COMPILE_OFFSETS for all the asm-offsets.c for this purpose. Signed-off-by: Menglong Dong Signed-off-by: Peter Zijlstra (Intel) commit 6e65f4e8fc5b02f7a60ebb5b1b83772df0b86663 Merge: d969328c513c66 af075603f27b0f Author: Christian Brauner Date: Thu Sep 25 09:22:09 2025 +0200 Merge patch series "ns: tweak ns common handling" Christian Brauner says: This contains three minor tweaks for namespace handling: * Make struct ns_tree private. There's no need for anything to access that directly. * Drop a debug assert that would trigger in conditions that are benign. * Move the type of the namespace out of struct proc_ns_operations and into struct ns_common. This eliminates a pointer dereference and also allows assertions to work when the namespace type is disabled and the operations field set to NULL. * patches from https://lore.kernel.org/20250924-work-namespaces-fixes-v1-0-8fb682c8678e@kernel.org: ns: drop assert ns: move ns type into struct ns_common nstree: make struct ns_tree private Signed-off-by: Christian Brauner commit af075603f27b0f6e05f1bdf64bad42fa7cfb033b Author: Christian Brauner Date: Wed Sep 24 13:34:00 2025 +0200 ns: drop assert Otherwise we warn when e.g., no namespaces are configured but the initial namespace for is still around. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4055526d35746ce8b04bfa5e14e14f28bb163186 Author: Christian Brauner Date: Wed Sep 24 13:33:59 2025 +0200 ns: move ns type into struct ns_common It's misplaced in struct proc_ns_operations and ns->ops might be NULL if the namespace is compiled out but we still want to know the type of the namespace for the initial namespace struct. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 10cdfcd37ade7ce736bc4a1927680f390a6b1f7b Author: Christian Brauner Date: Wed Sep 24 13:33:58 2025 +0200 nstree: make struct ns_tree private Don't expose it directly. There's no need to do that. Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a19239ba14525c26ad097d59fd52cd9198b5bcdb Author: David Howells Date: Wed Sep 24 13:49:49 2025 +0100 afs: Add support for RENAME_NOREPLACE and RENAME_EXCHANGE Add support for RENAME_NOREPLACE and RENAME_EXCHANGE, if the server supports them. The default is translated to YFS.Rename_Replace, falling back to YFS.Rename; RENAME_NOREPLACE is translated to YFS.Rename_NoReplace and RENAME_EXCHANGE to YFS.Rename_Exchange, both of which fall back to reporting EINVAL. Signed-off-by: David Howells Link: https://lore.kernel.org/740476.1758718189@warthog.procyon.org.uk cc: Marc Dionne cc: Dan Carpenter cc: linux-afs@lists.infradead.org Signed-off-by: Christian Brauner commit fee2f45def0379ed140de4db8f998edb1d78e619 Author: Min Lin Date: Mon Aug 25 18:54:27 2025 +0530 riscv: dts: eswin: add HiFive Premier P550 board device tree Add minimal device tree for HiFive Premier P550 Development board Currently the data populated in this DT file is for UART. Signed-off-by: Min Lin Co-developed-by: Pinkesh Vaghela Signed-off-by: Pinkesh Vaghela Tested-by: Samuel Holland Tested-by: Ariel D'Alessandro Reviewed-by: Samuel Holland Link: https://lore.kernel.org/r/20250825132427.1618089-7-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 3329e2f3b524a6e2baef86236725e407493c46b8 Author: Min Lin Date: Mon Aug 25 18:54:26 2025 +0530 riscv: dts: add initial support for EIC7700 SoC Add initial support for EIC7700 SoC that uses a SiFive Quad-Core P550 CPU cluster. This file is expected to grow as more device drivers are added to the kernel. Signed-off-by: Min Lin Co-developed-by: Pritesh Patel Signed-off-by: Pritesh Patel Co-developed-by: Darshan Prajapati Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Link: https://lore.kernel.org/r/20250825132427.1618089-6-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 21b5a7ace6b2fc2fdee1eda4a802e0abfe192262 Author: Darshan Prajapati Date: Mon Aug 25 18:54:25 2025 +0530 dt-bindings: interrupt-controller: Add ESWIN EIC7700 PLIC Add compatible string for ESWIN EIC7700 PLIC. Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-5-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 3e907d0faa798f612747cbeacb6185e9a4ee4db1 Author: Pritesh Patel Date: Mon Aug 25 18:54:24 2025 +0530 dt-bindings: riscv: Add SiFive HiFive Premier P550 board Add DT binding documentation for the ESWIN EIC7700 SoC and HiFive Premier P550 Board Signed-off-by: Pritesh Patel Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Reviewed-by: Matthias Brugger Reviewed-by: Rob Herring (Arm) Acked-by: Min Lin Link: https://lore.kernel.org/r/20250825132427.1618089-4-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit faaf0ea59713732b66100d8b5440fe40e48b3847 Author: Pinkesh Vaghela Date: Mon Aug 25 18:54:23 2025 +0530 riscv: Add Kconfig option for ESWIN platforms Create a config option to build ESWIN SoC specific resources Signed-off-by: Pinkesh Vaghela Reviewed-by: Samuel Holland Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-3-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit b9607ff0f86ad310f4a5e6ac985b1e89d78fd3ec Author: Darshan Prajapati Date: Mon Aug 25 18:54:22 2025 +0530 dt-bindings: riscv: Add SiFive P550 CPU compatible Update Documentation for supporting SiFive P550 based CPU Signed-off-by: Darshan Prajapati Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250825132427.1618089-2-pinkesh.vaghela@einfochips.com Signed-off-by: Arnd Bergmann commit 6ca282c3e635cd98cc5a9bb24606b41379e1fd8e Author: Pavan S Date: Wed Oct 2 10:46:40 2024 +0300 accel/habanalabs: add Infineon version check On HL338 ASICs, the Infineon first‑stage firmware is not present and the reported version is 0. In this case printing a version number is misleading, as it suggests valid firmware when it does not exist. Fix this by printing the first‑stage Infineon firmware version only if the reported value is non‑zero. This avoids confusing or incorrect log messages on devices where the first stage is not applicable. Signed-off-by: Pavan S Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit a0d866bab184161ba155b352650083bf6695e50e Author: Konstantin Sinyuk Date: Tue Oct 1 15:52:27 2024 +0300 accel/habanalabs/gaudi2: read preboot status after recovering from dirty state Dirty state can occur when the host VM undergoes a reset while the device does not. In such a case, the driver must reset the device before it can be used again. As part of this reset, the device capabilities are zeroed. Therefore, the driver must read the Preboot status again to learn the Preboot state, capabilities, and security configuration. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 65a3f5bc331ca7384900641b46cadff63805c10e Author: Ariel Aviad Date: Tue Sep 24 11:02:49 2024 +0300 accel/habanalabs: add HL_GET_P_STATE passthrough type Add a new passthrough type HL_GET_P_STATE to the cpucp generic ioctl to allow userspace to read the device performance state via firmware. Signed-off-by: Ariel Aviad Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit eeb38d0e91860fb47bc42a2cc44ffd80989a04fc Author: Konstantin Sinyuk Date: Mon Sep 16 15:15:32 2024 +0300 accel/habanalabs: add debugfs interface for HLDIO testing Add debugfs files for NVMe Direct I/O (HLDIO) functionality. This interface allows userspace access to direct SSD ↔ device transfers through debugfs nodes. Four debugfs files are created under /sys/kernel/debug/habanalabs/hlN/: - dio_ssd2hl : trigger SSD-to-device transfers - dio_hl2ssd : trigger device-to-SSD transfers (placeholder, not yet implemented) - dio_stats : show transfer statistics - dio_reset : reset statistics counters Usage examples: # Perform SSD → device transfer echo "fd=3 va=0x10000 off=0 len=4096" > \ /sys/kernel/debug/habanalabs/hl0/dio_ssd2hl # View statistics cat /sys/kernel/debug/habanalabs/hl0/dio_stats # Reset counters echo 1 > /sys/kernel/debug/habanalabs/hl0/dio_reset This interface provides access to HLDIO functionality for validation and diagnostics. Signed-off-by: Konstantin Sinyuk Reviewed-by: Farah Kassabri Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 8cbacc9a2703c661c5e15bfbaeb1d4dcb58eb621 Author: Konstantin Sinyuk Date: Mon Sep 9 18:21:22 2024 +0300 accel/habanalabs: add NVMe Direct I/O (HLDIO) infrastructure Introduce NVMe Direct I/O (HLDIO) infrastructure to support peer‑to‑peer DMA in the habanalabs driver. This adds internal helpers and data structures to enable direct transfers between NVMe storage and device memory. The feature is built only when CONFIG_HL_HLDIO is enabled. A debugfs interface is also provided for functional validation. Signed-off-by: Konstantin Sinyuk Reviewed-by: Farah Kassabri Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 513024d5a0e34fd34247043f1876b6138ca52847 Author: Moti Haimovski Date: Sun Sep 8 15:01:26 2024 +0300 accel/habanalabs: support mapping cb with vmalloc-backed coherent memory When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range. If such an address is mapped without VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the VM_PFNMAP restriction. Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP in the VMA before mapping. This ensures safe mapping and avoids kernel crashes. The memory is still driver-allocated and cannot be accessed directly by userspace. Signed-off-by: Moti Haimovski Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 0668db41b5d8a834a04be3b281fa9452dcf3dc18 Author: Ilia Levi Date: Mon Aug 19 12:13:07 2024 +0300 accel/habanalabs: remove old interface variation of 'access_ok()' The access_ok() API no longer requires the VERIFY_WRITE argument, and the use of the old interface with VERIFY_WRITE is deprecated. Clean up the habanalabs memory manager to use the modern access_ok() interface consistently. This removes old #ifdef guards and aligns the driver with current upstream kernel APIs. Signed-off-by: Ilia Levi Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 0529b191ac9c907225593e12a68f1718a60b2fba Author: Konstantin Sinyuk Date: Thu Aug 15 15:24:24 2024 +0300 accel/habanalabs/gaudi2: use the CPLD_SHUTDOWN event handler After CPLD shutdown event the device is not usable anymore. The common CPLD_SHUTDOWN event handler disables any subsequent device access. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 083c53a85490b4cf5ed63876b09c067358085e20 Author: Konstantin Sinyuk Date: Thu Aug 15 11:24:24 2024 +0300 accel/habanalabs: disable device access after CPLD_SHUTDOWN After a CPLD shutdown event the device becomes unusable. Prevent further device access once this event is received. Signed-off-by: Konstantin Sinyuk Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit cade027efa9b358719dcb9305b845d905c3eafce Author: Tomer Tayar Date: Wed Jul 31 13:56:34 2024 +0300 accel/habanalabs: fix typo in trace output (cms -> cmd) Fix a typo in TP_printk format string of habanalabs tracepoint: replace "cms" with "cmd". Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit d0dd796becb08b164fb2d791dca4a76127b3e89a Author: Tomer Tayar Date: Thu Jul 25 11:39:58 2024 +0300 accel/habanalabs: clarify ctx use after hl_ctx_put() in dmabuf release In hl_release_dmabuf(), ctx is dereferenced after calling hl_ctx_put() to obtain the compute device file. This is safe because the dma-buf object holds a file reference taken in export_dmabuf(), and the file release (which drops another ctx reference) can only happen after we drop that file reference via fput(). Thus, this hl_ctx_put() call cannot be the last one at this point. Add a comment explaining this to avoid confusion. Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit b5cddeb0dc6521dfee669e74967c6d28b1fd0d9e Author: Sharley Calzolari Date: Thu Jul 18 18:01:52 2024 +0300 accel/habanalabs/gaudi2: add support for logging register accesses from debugfs Add infrastructure for logging the last configuration register accesses that occur via debugfs read/write operations. At interrupt time, these log entries can be dumped to dmesg, which helps in diagnosing the cause of RAZWI and ADDR_DEC interrupts. The logging is implemented as a ring buffer of access entries, with each entry recording timestamp and access details. To ensure correctness under concurrent access, operations are now protected using spinlocks. Entries are copied under lock and then printed after releasing it, which minimizes time spent in the critical section. Signed-off-by: Sharley Calzolari Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 214e26a43f237358eec59c7c4e5ed1eaf2bfe472 Author: Ariel Suller Date: Tue Jun 25 16:26:59 2024 +0300 accel/habanalabs/gaudi2: stringify engine/queue ids Print engine/queue names instead of numerical engine/queue IDs to make logs and debug output more readable. Signed-off-by: Ariel Suller Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 5295be6c4ea4e1ffd38ab0ab131a65afc6b78e9f Author: Vitaly Margolin Date: Sun Jun 23 09:19:15 2024 +0300 accel/habanalabs: add generic message type to get error counters Add a new CPUCP generic message type to retrieve HBM, SRAM and critical error counters from the device. Signed-off-by: Vitaly Margolin Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd Author: Vered Yavniely Date: Tue Jun 18 19:58:30 2024 +0300 accel/habanalabs/gaudi2: fix BMON disable configuration Change the BMON_CR register value back to its original state before enabling, so that BMON does not continue to collect information after being disabled. Signed-off-by: Vered Yavniely Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 Author: Tomer Tayar Date: Sun May 26 16:32:32 2024 +0300 accel/habanalabs: return ENOMEM if less than requested pages were pinned EFAULT is currently returned if less than requested user pages are pinned. This value means a "bad address" which might be confusing to the user, as the address of the given user memory is not necessarily "bad". Modify the return value to ENOMEM, as "out of memory" is more suitable in this case. Signed-off-by: Tomer Tayar Reviewed-by: Koby Elbaz Signed-off-by: Koby Elbaz commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 Author: Qi Xi Date: Tue Sep 9 19:29:10 2025 +0800 once: fix race by moving DO_ONCE to separate section The commit c2c60ea37e5b ("once: use __section(".data.once")") moved DO_ONCE's ___done variable to .data.once section, which conflicts with DO_ONCE_LITE() that also uses the same section. This creates a race condition when clear_warn_once is used: Thread 1 (DO_ONCE) Thread 2 (DO_ONCE) __do_once_start read ___done (false) acquire once_lock execute func __do_once_done write ___done (true) __do_once_start release once_lock // Thread 3 clear_warn_once reset ___done read ___done (false) acquire once_lock execute func schedule once_work __do_once_done once_deferred: OK write ___done (true) static_branch_disable release once_lock schedule once_work once_deferred: BUG_ON(!static_key_enabled) DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning macros. Keep its ___done flag in the .data..once section and allow resetting by clear_warn_once, as originally intended. In contrast, DO_ONCE() is used for functions like get_random_once() and relies on its ___done flag for internal synchronization. We should not reset DO_ONCE() by clear_warn_once. Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section, shielding it from clear_warn_once. Fixes: c2c60ea37e5b ("once: use __section(".data.once")") Reported-by: Hulk Robot Signed-off-by: Qi Xi Signed-off-by: Arnd Bergmann commit 9712fe00a7728c64be7e51f05162aafea231a929 Author: Luca Weiss Date: Tue Sep 9 08:02:14 2025 -0700 Input: pm8941-pwrkey - disable wakeup for resin by default 'Resin' (*Res*et *In*put) is usually connected to a volume down button on devices, which is usually not expected to wake up the device from suspend. On the other hand, pwrkey should keep wakeup on. So do not enable wakeup for resin unless the "wakeup-source" property is specified in devicetree. Note, that this does change behavior by turning off wakeup by default for 'resin' and requiring a new dt property to be added to turn it on again. But since this is not expected behavior in the first place, and most users will not expect this, I'd argue this change is acceptable. Signed-off-by: Luca Weiss Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250909-resin-wakeup-v1-2-46159940e02b@lucaweiss.eu Signed-off-by: Dmitry Torokhov commit 95e6b0af80525d14cb35fc664dd3ce5d5756dac1 Author: Luca Weiss Date: Tue Sep 9 07:59:51 2025 -0700 dt-bindings: input: pm8941-pwrkey: Document wakeup-source property The 'resin' keys (usually connected to a volume-down button) are generally not supposed to wake up the device from suspend, so explicitly document a wakeup-source property to enable this wakeup behavior. For 'pwrkey' the default stays that pressing the button does wake up the device from suspend. Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250909-resin-wakeup-v1-1-46159940e02b@lucaweiss.eu Signed-off-by: Dmitry Torokhov commit c87a819bec86f9aff695caf79d672082bb123451 Author: Oleh Kuzhylnyi Date: Wed Sep 24 21:43:14 2025 -0700 Input: add driver for Hynitron CST816x series Introduce support for the Hynitron CST816x series touchscreen controller used for 240×240 1.28-inch Round LCD Display Module manufactured by Waveshare Electronics. The driver is designed based on an Arduino implementation marked as under MIT License. This driver is written for a particular round display based on the CST816S controller, which is not compatiable with existing driver for Hynitron controllers. Signed-off-by: Oleh Kuzhylnyi Link: https://lore.kernel.org/r/20250921125939.249788-2-kuzhylol@gmail.com Signed-off-by: Dmitry Torokhov commit 67c9b685c7f8f19b2f449fdd5fb6a0a0c39f429a Author: Oleh Kuzhylnyi Date: Wed Sep 24 21:42:47 2025 -0700 dt-bindings: input: touchscreen: add hynitron cst816x series Add documentation for Hynitron CST816x series touchscreen bindings. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Oleh Kuzhylnyi Link: https://lore.kernel.org/r/20250921125939.249788-1-kuzhylol@gmail.com Signed-off-by: Dmitry Torokhov commit e2d3af0d64e5fe2ee269e8f082642f82bcca3903 Author: Gao Xiang Date: Wed Sep 24 11:28:26 2025 +0800 erofs: drop redundant sanity check for ztailpacking inline It is already performed in z_erofs_map_blocks_fo(). Also align the error message with that used for the uncompressed inline layout. Signed-off-by: Gao Xiang commit 1cf12c7177410afcb53f815315d1247ea57fae4f Author: Bo Liu (OpenAnolis) Date: Tue Sep 23 15:01:12 2025 +0800 erofs: Add support for FS_IOC_GETFSLABEL Add support for reading to the erofs volume label from the FS_IOC_GETFSLABEL ioctls. Signed-off-by: Bo Liu (OpenAnolis) Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit fb641516a6687801fddc25e889bee9ab46e133d7 Author: James Smart Date: Tue Sep 23 08:38:57 2025 -0700 scsi: MAINTAINERS: Update FC element owners I'm relinquishing my maintainer position on the different FC elements. I am updating them to the Emulex folk that have been watching over them for a while. Signed-off-by: James Smart Message-Id: <20250923153857.100616-1-jsmart2021@gmail.com> Signed-off-by: Martin K. Petersen commit 408445e9c1639e41e37876cb9e887cb0fadad381 Merge: 3bd70aec2614a1 7e5a43897aa3e5 Author: Martin K. Petersen Date: Wed Sep 24 22:35:14 2025 -0400 Merge patch series "mpt3sas: Few Enhancements and minor fixes" Ranjan Kumar says: Few Enhancements and minor fixes of mpt3sas driver. Signed-off-by: Martin K. Petersen commit 7e5a43897aa3e5df197475809dd5264cb724474a Author: Ranjan Kumar Date: Mon Sep 22 15:21:13 2025 +0530 scsi: mpt3sas: Update driver version to 54.100.00.00 Updated driver version to 54.100.00.00. Signed-off-by: Ranjan Kumar Message-Id: <20250922095113.281484-5-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen commit 4be7599d6b27bade41bfccca42901b917c01c30c Author: Ranjan Kumar Date: Mon Sep 22 15:21:12 2025 +0530 scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in _transport_convert_phy_link_rate(). This maps the new 22.5 Gbps negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link speeds. Signed-off-by: Ranjan Kumar Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com> Signed-off-by: Martin K. Petersen commit 27f0b41de1055a479267ab13e833c704f428f64a Author: Ranjan Kumar Date: Mon Sep 22 15:21:11 2025 +0530 scsi: mpt3sas: Suppress unnecessary IOCLogInfo on CONFIG_INVALID_PAGE Avoid unconditional IOCLogInfo prints for CONFIG_INVALID_PAGE. Log only if MPT_DEBUG_REPLY is enabled or when loginfo represents other errors. This reduces uncessary logging without losing useful error reporting. Signed-off-by: Ranjan Kumar Signed-off-by: Martin K. Petersen commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 Author: Ranjan Kumar Date: Mon Sep 22 15:21:10 2025 +0530 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device. Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal. [83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Ranjan Kumar Signed-off-by: Martin K. Petersen commit 3bd70aec2614a1a7ed2dfe83af63a10ebb8229ed Merge: 79dde5f7dc7c03 88f4d3aa29c8b1 Author: Martin K. Petersen Date: Wed Sep 24 22:28:45 2025 -0400 Merge patch series "Add DT-based gear and rate limiting support" Ram Kumar Dwivedi says: This patch series adds support for limiting the maximum high-speed gear and rate used by the UFS controller via device tree properties. Some platforms may have signal integrity, clock configuration, or layout issues that prevent reliable operation at higher gears or rates. This is especially critical in automotive and other platforms where stability is prioritized over peak performance. The series follows this logical progression: 1. Document the new DT properties in the common UFS binding 2. Clean up existing redundant code in the qcom driver 3. Add platform-level parsing support for the new properties 4. Integrate the platform support in the qcom driver This approach makes the functionality available to other UFS host drivers and provides a cleaner, more maintainable implementation. Signed-off-by: Martin K. Petersen commit 88f4d3aa29c8b1944ad506ac92c948258cbc004b Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:33 2025 +0530 scsi: ufs: ufs-qcom: Add support for limiting HS gear and rate Add support to limit Tx/Rx gear and rate during UFS initialization based on DT property. Also update the phy_gear to ensure PHY calibrations align with the required gear and rate. Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit 1cc577e64d68ba0a720329e37aa955c0de297a77 Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:32 2025 +0530 scsi: ufs: pltfrm: Add DT support to limit HS gear and gear rate Introduce parsing of 'limit-hs-gear' and 'limit-gear-rate' device tree properties to restrict high-speed gear and rate during initialization. This is useful in cases where the customer board may have signal integrity, clock configuration or layout issues that prevent reliable operation at higher gears. Such limitations are especially critical in those platforms, where stability is prioritized over peak performance. Co-developed-by: Nitin Rawat Signed-off-by: Nitin Rawat Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit d471a075ae019118fa2e1bd251bad7e98d97b49e Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:31 2025 +0530 scsi: ufs: ufs-qcom: Remove redundant re-assignment to hs_rate Remove the redundant else block that assigns PA_HS_MODE_B to hs_rate, as it is already assigned in ufshcd_init_host_params(). This avoids unnecessary reassignment and prevents overwriting hs_rate when it is explicitly set to a different value. Reviewed-by: Alim Akhtar Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Martin K. Petersen commit 91945660ac29341710b0914db200f6eacf251513 Author: Ram Kumar Dwivedi Date: Wed Sep 17 19:39:30 2025 +0530 scsi: ufs: dt-bindings: Document gear and rate limit properties Add optional "limit-hs-gear" and "limit-rate" properties to the UFS controller common binding. These properties allow limiting the maximum HS gear and rate. This is useful in cases where the customer board may have signal integrity, clock configuration or layout issues that prevent reliable operation at higher gears. Such limitations are especially critical in those platforms, where stability is prioritized over peak performance. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ram Kumar Dwivedi Reviewed-by: Alim Akhtar Signed-off-by: Martin K. Petersen commit 79dde5f7dc7c038eec903745dc1550cd4139980e Author: Zhongqiu Han Date: Wed Sep 17 17:41:43 2025 +0800 scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current implementation relies on the 'pm_qos_enabled' flag, which is insufficient to prevent concurrent access and cannot serve as a proper synchronization mechanism. This has led to data races and list corruption issues. A typical race condition call trace is: [Thread A] ufshcd_pm_qos_exit() --> cpu_latency_qos_remove_request() --> cpu_latency_qos_apply(); --> pm_qos_update_target() --> plist_del <--(1) delete plist node --> memset(req, 0, sizeof(*req)); --> hba->pm_qos_enabled = false; [Thread B] ufshcd_devfreq_target --> ufshcd_devfreq_scale --> ufshcd_scale_clks --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true --> cpu_latency_qos_update_request --> pm_qos_update_target --> plist_del <--(3) plist node use-after-free Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe access to PM QoS resources, including sysfs interface reads. Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver") Signed-off-by: Zhongqiu Han Reviewed-by: Bart Van Assche Tested-by: Huan Tang Signed-off-by: Martin K. Petersen commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba Author: Alok Tiwari Date: Mon Sep 15 11:37:57 2025 -0700 scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() The fc_ct_ms_fill() helper currently formats the OS name and version into entry->value using "%s v%s". Since init_utsname()->sysname and ->release are unbounded strings, snprintf() may attempt to write more than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a -Wformat-truncation warning with W=1. In file included from drivers/scsi/libfc/fc_elsct.c:18: drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’: drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may be truncated writing up to 64 bytes into a region of size between 62 and 126 [-Werror=format-truncation=] 359 | "%s v%s", | ^~ 360 | init_utsname()->sysname, 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between 3 and 131 bytes into a destination of size 128 357 | snprintf((char *)&entry->value, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 358 | FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 359 | "%s v%s", | ~~~~~~~~~ 360 | init_utsname()->sysname, | ~~~~~~~~~~~~~~~~~~~~~~~~ 361 | init_utsname()->release); | ~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by using "%.62s v%.62s", which ensures sysname and release are truncated to fit within the 128-byte field defined by FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN. [mkp: clarified commit description] Signed-off-by: Alok Tiwari Signed-off-by: Martin K. Petersen commit 15968590f07ce127839cb0e5ce002414c5ef067f Author: Liao Yuanhong Date: Tue Sep 2 21:23:46 2025 +0800 scsi: storvsc: Remove redundant ternary operators Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Reviewed-by: Michael Kelley Signed-off-by: Martin K. Petersen commit 253757797973c54ea967f8fd8f40d16e4a78e6d4 Author: Peter Wang Date: Wed Sep 24 17:16:19 2025 +0800 scsi: ufs: core: Change MCQ interrupt enable flow Move the MCQ interrupt enable process to ufshcd_mcq_make_queues_operational() to ensure that interrupts are set correctly when making queues operational, similar to ufshcd_make_hba_operational(). This change addresses the issue where ufshcd_mcq_make_queues_operational() was not fully operational due to missing interrupt enablement. This change only affects host drivers that call ufshcd_mcq_make_queues_operational(), i.e. ufs-mediatek. Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 0ac3c901fbeb87d7aaa89e913dbd692dd342c3a8 Author: Thorsten Blum Date: Mon Sep 22 22:18:33 2025 +0200 scsi: smartpqi: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to simplify and improve pqi_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'kernel_buffer' using memset(0). Return early if an error occurs. No functional changes intended. Signed-off-by: Thorsten Blum Acked-by: Don Brace Message-Id: <20250922201832.1697874-2-thorsten.blum@linux.dev> Signed-off-by: Martin K. Petersen commit ac01fc418f586c6a6e5582da16de7324e9c6391a Author: Thorsten Blum Date: Tue Sep 23 19:15:04 2025 +0200 scsi: hpsa: Replace kmalloc() + copy_from_user() with memdup_user() Replace kmalloc() followed by copy_from_user() with memdup_user() to improve and simplify hpsa_passthru_ioctl(). Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff' using memset(0). Return early if an error occurs and remove the 'out_kfree' label. No functional changes intended. Signed-off-by: Thorsten Blum Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 Author: Anup Patel Date: Mon Aug 18 09:39:03 2025 +0530 mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver Add a mailbox controller driver for the new SBI message proxy extension which is part of the SBI v3.0 specification. Acked-by: Jassi Brar Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-8-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 6f01c24f3a7525e953d514367a6d91b39c8f1f6a Author: Anup Patel Date: Mon Aug 18 09:39:02 2025 +0530 byteorder: Add memcpy_to_le32() and memcpy_from_le32() Add common memcpy APIs for copying u32 array to/from __le32 array. Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Anup Patel Reviewed-by: Linus Walleij Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-7-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit ba879dfc0574878f3e08f217b2b4fdf845c426c0 Author: Anup Patel Date: Mon Aug 18 09:39:01 2025 +0530 mailbox: Allow controller specific mapping using fwnode Introduce optional fw_node() callback which allows a mailbox controller driver to provide controller specific mapping using fwnode. The Linux OF framework already implements fwnode operations for the Linux DD framework so the fw_xlate() callback works fine with device tree as well. Acked-by: Jassi Brar Reviewed-by: Andy Shevchenko Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-6-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit b81296591c567b12d3873b05a37b975707959b94 Author: Thorsten Blum Date: Fri Sep 19 11:26:37 2025 +0200 scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally. Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0). Cc: stable@vger.kernel.org Fixes: edd163687ea5 ("[SCSI] hpsa: add driver for HP Smart Array controllers.") Signed-off-by: Thorsten Blum Acked-by: Don Brace Signed-off-by: Martin K. Petersen commit a1f1f2422e098485b09e55a492de05cf97f9954d Merge: 5de92bd0d7543f b9c8a2c5670a92 Author: Jakub Kicinski Date: Wed Sep 24 18:13:05 2025 -0700 Merge branch 'convert-3-drivers-to-ndo_hwtstamp-api' Vadim Fedorenko says: ==================== convert 3 drivers to ndo_hwtstamp API Convert tg3, bnxt_en and mlx5 to use ndo_hwtstamp API. These 3 drivers were chosen because I have access to the HW and is able to test the changes. Also there is a selftest provided to validated that the driver correctly sets up timestamp configuration, according to what is exposed as supported by the hardware. Selftest allows driver to fallback to some wider scope of RX timestamping, i.e. it allows the driver to set up ptpv2-event filter when ptpv2-l2-event is requested. ==================== Link: https://patch.msgid.link/20250923173310.139623-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit b9c8a2c5670a92f1cb3ad7d88cd8e274160b59d6 Author: Vadim Fedorenko Date: Tue Sep 23 17:33:10 2025 +0000 selftests: drv-net: add HW timestamping tests Add simple tests to validate that the driver sets up timestamping configuration according to what is reported in capabilities. For RX timestamping we allow driver to fallback to wider scope for timestamping if filter is applied. That actually means that driver can enable ptpv2-event when it reports ptpv2-l4-event is supported, but not vice versa. Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit bd94c3649b6bf2c1a556d8fa2ffda56ab9d36414 Author: Vadim Fedorenko Date: Tue Sep 23 17:33:08 2025 +0000 bnxt_en: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() Convert bnxt dirver to use new timestamping configuration API. Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit de0aa209b9355afc46f3f5a25e588e552e12f43b Author: Vadim Fedorenko Date: Tue Sep 23 17:33:07 2025 +0000 tg3: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() Convert tg3 driver to new timestamping configuration API. Reviewed-by: Pavan Chebbi Reviewed-by: Michael Chan Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20250923173310.139623-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 5de92bd0d7543f04e6f495103b69644f6e8e8d70 Author: Bagas Sanjaya Date: Mon Sep 22 19:41:37 2025 +0700 Documentation: rxrpc: Demote three sections Three sections ("Socket Options", "Security", and "Example Client Usage") use title headings, which increase number of entries in the networking docs toctree by three, and also make the rest of sections headed under "Example Client Usage". Demote these sections back to section headings. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Acked-by: David Howells Link: https://patch.msgid.link/20250922124137.5266-1-bagasdotme@gmail.com Signed-off-by: Jakub Kicinski commit cf7f0e3bd9fa9f359fc73544a4f2ce0e95301401 Author: Horatiu Vultur Date: Mon Sep 22 15:03:14 2025 +0200 net: phy: micrel: Fix default LED behaviour By default the LED will be ON when there is a link but they are not blinking when there is any traffic activity. Therefore change this to blink when there is any traffic. Fixes: 5a774b64cd6a ("net: phy: micrel: Add support for lan8842") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250922130314.758229-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit c7ab8024ca124afa8eab9a07a470a34676efe123 Merge: 74eecb7c62d10f c5ba345b2d358b Author: Jakub Kicinski Date: Wed Sep 24 17:45:14 2025 -0700 Merge tag 'nf-next-25-09-24' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Florian Westphal says: ==================== netfilter: fixes for net-next These fixes target next because the bug is either not severe or has existed for so long that there is no reason to cram them in at the last minute. 1) Fix IPVS ftp unregistering during netns cleanup, broken since netns support was introduced in 2011 in the 2.6.39 kernel. From Slavin Liu. 2) nfnetlink must reset the 'nlh' pointer back to the original address when a batch is replayed, else we emit bogus ACK messages and conceal real errno from userspace. From Fernando Fernandez Mancera. This was broken since 6.10. 3) Recent fix for nftables 'pipapo' set type was incomplete, it only made things work for the AVX2 version of the algorithm. 4) Testing revealed another problem with avx2 version that results in out-of-bounds read access, this bug always existed since feature was added in 5.7 kernel. This also comes with a selftest update. Last fix resolves a long-standing bug (since 4.9) in conntrack /proc interface: Decrease skip count when we reap an expired entry during dump. As-is we erronously elide one conntrack entry from dump for every expired entry seen. From Eric Dumazet. * tag 'nf-next-25-09-24' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack selftests: netfilter: nft_concat_range.sh: add check for double-create bug netfilter: nft_set_pipapo_avx2: fix skip of expired entries netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups netfilter: nfnetlink: reset nlh pointer during batch replay ipvs: Defer ip_vs_ftp unregister during netns cleanup ==================== Link: https://patch.msgid.link/20250924140654.10210-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 74eecb7c62d10f1feeb0a0d56bed605b7804a51a Merge: 1d7e0832509004 50acea3662bf54 Author: Jakub Kicinski Date: Wed Sep 24 17:40:29 2025 -0700 Merge branch 'net-stmmac-yet-more-cleanups' Russell King says: ==================== net: stmmac: yet more cleanups Building on the previous cleanup series, this cleans up yet more stmmac code. - Move stmmac_bus_clks_config() into stmmac_platform() which is where its onlny user is. - Move the xpcs Clause 73 test into stmmac_init_phy(), resulting in simpler code in __stmmac_open(). - Move "can't attach PHY" error message into stmmac_init_phy(). We then start moving stuff out of __stmac_open() into stmmac_open() (and correspondingly __stmmac_release() into stmmac_release()) which is not necessary when re-initialising the interface on e.g. MTU change. - Move initialisation of tx_lpi_timer - Move PHY attachment/detachment - Move PHY error message into stmmac_init_phy() Finally, simplfy the paths in stmmac_init_phy(). ==================== Link: https://patch.msgid.link/aNKDqqI7aLsuDD52@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 50acea3662bf54f3ea2cb6ca2db66ca3b1a0a0ee Author: Russell King (Oracle) Date: Tue Sep 23 12:26:24 2025 +0100 net: stmmac: simplify stmmac_init_phy() If we fail to attach a PHY, there is no point trying to configure WoL settings. Exit the function after printing the "cannot attach to PHY" error, and remove the now unnecessary code indentation for configuring the LPI timer in phylink. Since we know that "ret" must be zero at this point, change the final return to use a constant rather than "ret". Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v11A8-0000000774M-3pmH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit db299a0c09e98e5fc7e7b181d7f2b94560330a8c Author: Russell King (Oracle) Date: Tue Sep 23 12:26:19 2025 +0100 net: stmmac: move PHY handling out of __stmmac_open()/release() Move the PHY attachment/detachment from the network driver out of __stmmac_open() and __stmmac_release() into stmmac_open() and stmmac_release() where these actions will only happen when the interface is administratively brought up or down. It does not make sense to detach and re-attach the PHY during a change of MTU. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v11A3-0000000774G-3PKY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bae62989a31bde4018dc007b01d7cb408ccc91d7 Author: Russell King (Oracle) Date: Tue Sep 23 12:26:14 2025 +0100 net: stmmac: move initialisation of priv->tx_lpi_timer to stmmac_open() The initialisation of priv->tx_lpi_timer only happens once during the lifetime of the driver, which is during the initial administrative open of the device. Move this initialisation out of __stmmac_open() into stmmac_open(). Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119y-0000000774A-2vvl@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9641d727162d674902c7107eeab23a7849d5ff09 Author: Russell King (Oracle) Date: Tue Sep 23 12:26:09 2025 +0100 net: stmmac: move PHY attachment error message into stmmac_init_phy() Move the "cannot attach to PHY" error message into stmmac_init_phy() so we don't end up with multiple error messages printed when things go wrong. Drop the function name from the message, and use %pe to print the error code description rather than just a number. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119t-00000007744-2SxG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f005ec4a3d6bcbfac74069661a06dba2880f84fd Author: Russell King (Oracle) Date: Tue Sep 23 12:26:04 2025 +0100 net: stmmac: move xpcs clause 73 test into stmmac_init_phy() We avoid binding a PHY if the XPCS is using clause 73 negotiation. Rather than having this complexity in __stmmac_open(), move it to stmmac_init_phy() instead. There is no point checking the XPCS state this unless phylink wants a PHY, so place this appropriately. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119o-0000000773y-21gs@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 79d6e14e9cb3c9b8152c514e64674e820b5e9dce Author: Russell King (Oracle) Date: Tue Sep 23 12:25:59 2025 +0100 net: stmmac: move stmmac_bus_clks_config() to stmmac_platform.c stmmac_bus_clks_config() is only used by stmmac_platform.c, so rather than having it in stmmac_main.c and needing to export the symbol, move it to where it's used. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1v119j-0000000773s-1R2v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 217f92d91c9faeb6b78bd6205b3585944cbcb433 Author: Igor Belwon Date: Sat Sep 20 19:22:52 2025 +0200 dt-bindings: i2c: i2c-mt65xx: Document MediaTek MT6878 I2C Document the I2C controllers found in the MediaTek MT6878 SoC, by adding a new compatible string for the controllers. Their design is compatible with the design from the MediaTek MT8188 SoC. Signed-off-by: Igor Belwon Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250920-mt6878-i2c-bringup-v2-1-70a951f10be9@mentallysanemainliners.org Signed-off-by: Andi Shyti commit 25aab8f3ce56fd3cdf921c206ce42d1cdede5259 Author: Krzysztof Kozlowski Date: Sat Aug 30 12:36:03 2025 +0200 dt-bindings: i2c: samsung,s3c2410-i2c: Drop S3C2410 Samsung S3C2410 SoC was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of "samsung,s3c2410-i2c" compatible. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250830103601.82046-4-krzysztof.kozlowski@linaro.org commit f2b6b51d21ce7b84bc01d252b451684b86ad1cdc Author: Krzysztof Kozlowski Date: Sat Aug 30 12:36:02 2025 +0200 i2c: s3c2410: Drop S3C2410 OF support Samsung S3C2410 SoC was removed from the Linux kernel in the commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support"), in January 2023. There are no in-kernel users of "samsung,s3c2410-i2c" compatible. However, there is still a user of "s3c2410-i2c" platform device ID, S3C64xx platform, so that part needs to stay. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250830103601.82046-3-krzysztof.kozlowski@linaro.org commit 15c5867b0ae6a47914b45daf3b64e2d2aceb4ee5 Author: Ilpo Järvinen Date: Wed Sep 24 16:56:41 2025 +0300 PCI: Don't print stale information about resource pbus_size_mem() logs the bridge window resource using pci_info() before the start and end fields of the resource have been updated which then prints stale information. Set resource addresses earlier to make understanding logs easier. Regrettably, this results in setting the addresses multiple times but that seems unavoidable. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250924135641.3399-1-ilpo.jarvinen@linux.intel.com commit f32a26fab3672e60f622bd7461bf978fc72f29ec Author: Viacheslav Dubeyko Date: Wed Sep 24 16:24:41 2025 -0700 hfs/hfsplus: rework debug output subsystem Currently, HFS/HFS+ has very obsolete and inconvenient debug output subsystem. Also, the code is duplicated in HFS and HFS+ driver. This patch introduces linux/hfs_common.h for gathering common declarations, inline functions, and common short methods. Currently, this file contains only hfs_dbg() function that employs pr_debug() with the goal to print a debug-level messages conditionally. So, now, it is possible to enable the debug output by means of: echo 'file extent.c +p' > /proc/dynamic_debug/control echo 'func hfsplus_evict_inode +p' > /proc/dynamic_debug/control And debug output looks like this: hfs: pid 5831:fs/hfs/catalog.c:228 hfs_cat_delete(): delete_cat: 00,48 hfs: pid 5831:fs/hfs/extent.c:484 hfs_file_truncate(): truncate: 48, 409600 -> 0 hfs: pid 5831:fs/hfs/extent.c:212 hfs_dump_extent(): hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 78:4 hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 0:0 hfs: pid 5831:fs/hfs/extent.c:214 hfs_dump_extent(): 0:0 v4 Debug messages have been reworked and information about new HFS/HFS+ shared declarations file has been added to MAINTAINERS file. v5 Yangtao Li suggested to clean up debug output and fix several typos. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org cc: Johannes Thumshirn Signed-off-by: Viacheslav Dubeyko commit 1d7e08325090045b6b08ecda6f9eaa471d309880 Author: J. Neuschäfer Date: Tue Sep 23 01:10:01 2025 +0200 dt-bindings: net: ethernet-controller: Fix grammar in comment "difference" is a noun, so "sufficient" is an adjective without "ly". Signed-off-by: J. Neuschäfer Reviewed-by: Andrew Lunn Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250923-dt-net-typo-v1-1-08e1bdd14c74@posteo.net Signed-off-by: Jakub Kicinski commit b6db19d1df8a75b5f05f5fe487cbd09f48760a3c Author: Gustavo A. R. Silva Date: Tue Sep 23 22:45:10 2025 +0200 tls: Avoid -Wflex-array-member-not-at-end warning Remove unused flexible-array member in struct tls_rec and, with this, fix the following warning: net/tls/tls.h:131:29: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Also, add a comment to prevent people from adding any members after struct aead_request, which is a flexible structure --this is a structure that ends in a flexible-array member. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/aNMG1lyXw4XEAVaE@kspp Signed-off-by: Jakub Kicinski commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 Author: Kaushlendra Kumar Date: Wed Sep 17 10:38:20 2025 +0530 tools/cpupower: Fix incorrect size in cpuidle_state_disable() Fix incorrect size parameter passed to cpuidle_state_write_file() in cpuidle_state_disable(). The function was incorrectly using sizeof(disable) which returns the size of the unsigned int variable (4 bytes) instead of the actual length of the string stored in the 'value' buffer. Since 'value' is populated with snprintf() to contain the string representation of the disable value, we should use the length returned by snprintf() to get the correct string length for writing to the sysfs file. This ensures the correct number of bytes is written to the cpuidle state disable file in sysfs. Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com Signed-off-by: Kaushlendra Kumar Signed-off-by: Shuah Khan commit 340974c4f709ce8142a672ab11f1889dff94d6dc Author: Anup Patel Date: Mon Aug 18 09:39:00 2025 +0530 mailbox: Add common header for RPMI messages sent via mailbox The RPMI based mailbox controller drivers and mailbox clients need to share defines related to RPMI messages over mailbox interface so add a common header for this purpose. Acked-by: Jassi Brar Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-5-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 508da38677a67ed9aa87c3cf32807284f293c304 Author: Anup Patel Date: Mon Aug 18 09:38:59 2025 +0530 RISC-V: Add defines for the SBI message proxy extension Add defines for the new SBI message proxy extension which is part of the SBI v3.0 specification. Reviewed-by: Atish Patra Reviewed-by: Andy Shevchenko Co-developed-by: Rahul Pathak Signed-off-by: Rahul Pathak Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20250818040920.272664-4-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 581b4da1f73c9e0caf9b7d0a46d1b5a0b36fbe20 Author: Anup Patel Date: Mon Aug 18 09:38:58 2025 +0530 dt-bindings: mailbox: Add bindings for RISC-V SBI MPXY extension Add device tree bindings for the RISC-V SBI Message Proxy (MPXY) extension as a mailbox controller. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-3-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 23ef9d439769d5f35353650e771c63d13824235b Author: Kees Cook Date: Tue Sep 23 14:34:19 2025 -0700 kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI The kernel's CFI implementation uses the KCFI ABI specifically, and is not strictly tied to a particular compiler. In preparation for GCC supporting KCFI, rename CONFIG_CFI_CLANG to CONFIG_CFI (along with associated options). Use new "transitional" Kconfig option for old CONFIG_CFI_CLANG that will enable CONFIG_CFI during olddefconfig. Reviewed-by: Linus Walleij Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-3-kees@kernel.org Signed-off-by: Kees Cook commit 072c3547979053c575e819070074911b3d0bd4fb Merge: 2136c694a045c3 3df7ce0e43ad94 Author: Arnd Bergmann Date: Wed Sep 24 23:26:53 2025 +0200 Merge tag 'riscv-config-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/defconfig RISC-V config for v6.18 Enable the MMP_PDMA driver as a module in defconfig builds, where it is needed by Spacemit K1 boards. This depends on a savedefconfig reorder that it'd otherwise conflict with, so that's here too. Signed-off-by: Conor Dooley * tag 'riscv-config-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: defconfig: Enable MMP_PDMA support for SpacemiT K1 SoC riscv: defconfig: run savedefconfig to reorder it Link: https://lore.kernel.org/r/20250924-unenvied-armful-5fcc80c23d19@spud Signed-off-by: Arnd Bergmann commit 8c0650e0cef283fb31aca5dc7c72b891ff121a88 Merge: 0d4495122a5e0e 4cce8b2503ab50 Author: Arnd Bergmann Date: Wed Sep 24 23:22:49 2025 +0200 Merge tag 'riscv-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Misc Devicetrees for v6.18 Starfive: The main new addition is support for the JH7110 Milk-V Mars CM lite SoM. Other than that, there's several cleanups done to the common JH7110 dtsi file, some relating to properties used by U-Boot or encountered during U-Boot development. Additionally, there's a binding and devicetree node for the memory controller on the JH7110. The memory controller only sees use in U-Boot, so the binding is here rather than in Krzysztof's branch. SiFive: Support for SiFive vendor-specific extensions in the binding file for extensions. These currently only see use in the SBI implementation. Microchip: Addition of support for the PolarFire SoC Discovery kit and non-engineering sample Icicle kit. The latter differs very slightly from the final ES devices due to bug fixes affecting functionality, and needs its own dts. To reduce duplication, the common portion of the two Icicle kits are moved into a dtsi. There's a few minor fixes here too, mostly low-hanging fruit detected during the addition of the Discovery kit that were then applied to the Icicle. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: starfive: add Milk-V Mars CM Lite system-on-module dt-bindings: riscv: starfive: add milkv,marscm-lite riscv: dts: starfive: add Milk-V Mars CM system-on-module dt-bindings: riscv: starfive: add milkv,marscm-emmc riscv: dts: starfive: add common board dtsi for Milk-V Mars CM variants riscv: dts: microchip: add a device tree for Discovery Kit dt-bindings: riscv: microchip: document Discovery Kit riscv: dts: microchip: rename icicle kit ccc clock and other minor fixes riscv: dts: microchip: add icicle kit with production device dt-bindings: riscv: microchip: document icicle kit with production device riscv: dts: microchip: add common board dtsi for icicle kit variants riscv: dts: starfive: jh7110-common: drop mmc post-power-on-delay-ms riscv: dts: starfive: jh7110-common: drop no-mmc property from mmc1 riscv: dts: starfive: jh7110: bootph-pre-ram hinting needed by boot loader riscv: dts: starfive: jh7110: add DMC memory controller dt-bindings: memory-controllers: add StarFive JH7110 SoC DMC riscv: dts: starfive: jh7110-common: drop no-sdio property from mmc1 riscv: dts: microchip: Minor whitespace cleanup dt-bindings: riscv: Add SiFive vendor extensions description Link: https://lore.kernel.org/r/20250924-frighten-magazine-ee2f16e64638@spud Signed-off-by: Arnd Bergmann commit f9afce4f32e9a120fc902fa6c9e0b90ad799a6ec Author: Kees Cook Date: Tue Sep 23 14:34:18 2025 -0700 kconfig: Add transitional symbol attribute for migration support During kernel option migrations (e.g. CONFIG_CFI_CLANG to CONFIG_CFI), existing .config files need to maintain backward compatibility while preventing deprecated options from appearing in newly generated configurations. This is challenging with existing Kconfig mechanisms because: 1. Simply removing old options breaks existing .config files. 2. Manually listing an option as "deprecated" leaves it needlessly visible and still writes them to new .config files. 3. Using any method to remove visibility (.e.g no 'prompt', 'if n', etc) prevents the option from being processed at all. Add a "transitional" attribute that creates symbols which are: - Processed during configuration (can influence other symbols' defaults) - Hidden from user menus (no prompts appear) - Omitted from newly written .config files (gets migrated) - Restricted to only having help sections (no defaults, selects, etc) making it truly just a "prior value pass-through" option. The transitional syntax requires a type argument and prevents type redefinition: config NEW_OPTION bool "New option" default OLD_OPTION config OLD_OPTION bool transitional help Transitional config for OLD_OPTION migration. This allows seamless migration: olddefconfig processes existing CONFIG_OLD_OPTION=y settings to enable CONFIG_NEW_OPTION=y, while CONFIG_OLD_OPTION is omitted from newly generated .config files. Added positive and negative testing via "testconfig" make target. Co-developed-by: Vegard Nossum Signed-off-by: Vegard Nossum Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-2-kees@kernel.org Signed-off-by: Kees Cook commit 64f4ea200eca05a248533b8374d7b5f0756a3990 Author: Kees Cook Date: Tue Sep 23 14:34:17 2025 -0700 kconfig: Fix BrokenPipeError warnings in selftests The kconfig test harness ("make testconfig") was generating BrokenPipeError warnings when running interactive tests like oldaskconfig and oldconfig: /usr/lib/python3/dist-packages/_pytest/unraisableexception.py:85: PytestUnraisableExceptionWarning: Exception ignored in: <_io.BufferedWriter name=12> Traceback (most recent call last): File "/srv/code/scripts/kconfig/tests/conftest.py", line 127, in oldaskconfig return self._run_conf('--oldaskconfig', dot_config=dot_config, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ interactive=True, in_keys=in_keys) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ BrokenPipeError: [Errno 32] Broken pipe The issue occurred when the test framework attempted to write to stdin after the conf subprocess had already exited. Wrap stdin write operations in try/except to catch BrokenPipeError and stop sending more input. Add explicit flush() after writes so we can see delivery errors immediately. Ignore BrokenPipeError when closing stdin. Explicitly call wait() to validate subprocess termination. Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250923213422.1105654-1-kees@kernel.org Signed-off-by: Kees Cook commit 5042e57d39719e531f3e122f12bf320869e84782 Author: Dario Binacchi Date: Tue Sep 23 16:37:37 2025 +0200 Input: imx6ul_tsc - set glitch threshold by DTS property Set the glitch threshold by DTS property and keep the existing default behavior if the 'debounce-delay-us' is not present. Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250923143746.2857292-7-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit 3fccd1f9552dd073915b0a69d43cc03c582ce79b Author: Dario Binacchi Date: Tue Sep 23 16:37:35 2025 +0200 dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold Support the debounce-delay-us property. Drivers must convert this value to IPG clock cycles and map it to one of the four discrete thresholds exposed by the TSC_DEBUG_MODE2 register: 0: 8191 IPG cycles 1: 4095 IPG cycles 2: 2047 IPG cycles 3: 1023 IPG cycles Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250923143746.2857292-5-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit cf6f234d7dfbbb13197eb71e7716412d4e30988d Author: Dario Binacchi Date: Tue Sep 23 16:37:34 2025 +0200 dt-bindings: touchscreen: add debounce-delay-us property Add support for glitch delay configuration. A detected signal is valid only if it remains stable longer than the configured delay; otherwise, it is considered a glitch. This property was introduced for the i.MX6UL touchscreen controller (TSC), which provides a hardware deglitch filter with four thresholds depending on the IPG clock frequency. In this use case, the IPG clock rate is 66 MHz, resulting in thresholds of 124 µs, 62 µs, 31 µs, and 15 µs, which requires a property with microsecond-level resolution. Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250923143746.2857292-4-dario.binacchi@amarulasolutions.com Signed-off-by: Dmitry Torokhov commit c4ebd661282df563a0c83acacbc35cfd4d8da541 Merge: a53811fb37d306 941327ca5ddd45 Author: Arnd Bergmann Date: Wed Sep 24 23:17:20 2025 +0200 Merge tag 'riscv-cache-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers RISC-V cache drivers for v6.18 sifive: Reduce the number of fences issued while flushing. Samuel reports that this is approximately a 15% speed-up. ax45mp: Fix the binding so that it permits the cache-sets setting used by the recently added QiLai SoC. Signed-off-by: Conor Dooley * tag 'riscv-cache-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: cache: sifive_ccache: Optimize cache flushes dt-bindings: cache: ax45mp: add 2048 as a supported cache-sets value Link: https://lore.kernel.org/r/20250924-relenting-aqua-a4a93b89809e@spud Signed-off-by: Arnd Bergmann commit a53811fb37d30622db1fdfc37feb40a3190b9731 Merge: 0a8c31049107ed 5498f07842cbdd Author: Arnd Bergmann Date: Wed Sep 24 23:16:12 2025 +0200 Merge tag 'soc_fsl-6.18-1' of https://github.com/chleroy/linux into soc/drivers FSL SOC Changes for 6.18: - Use for_each_online_cpu() instead of for_each_cpu() in qbman - Update FSL QUICC ENGINE GPIO driver to a standard platform driver and stop using legacy-of-mm-gpiochip.h header - Misc fixes on bus/fsl-mc * tag 'soc_fsl-6.18-1' of https://github.com/chleroy/linux: soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu() soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver soc: fsl: qe: Change GPIO driver to a proper platform driver bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions bus: fsl-mc: Check return value of platform_get_resource() Link: https://lore.kernel.org/r/26615a15-3494-435f-b0c1-861122b4b5e1@csgroup.eu Signed-off-by: Arnd Bergmann commit 0a8c31049107ed39a68d21849e7b1b87856b240e Merge: ff0bebab778c74 d5cf5b37064b16 Author: Arnd Bergmann Date: Wed Sep 24 23:12:17 2025 +0200 Merge tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers TEE fix2 for v6.17 Fixing incorrect error handling for a call to iov_iter_extract_pages(). * tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: fix register_shm_helper() Link: https://lore.kernel.org/r/20250924083404.GA3747732@rayden Signed-off-by: Arnd Bergmann commit 7b1f8e7671ebe3cd8899aef17db870e9eba938a3 Author: J. Neuschäfer Date: Tue Sep 23 02:14:50 2025 +0200 Input: ps2-gpio - fix typo "The data line must be sampled" makes much more sense than what was previously written, and given that "s" and "d" are neighbors on the QWERTY keybord, it was probably a typo. Signed-off-by: J. Neuschäfer Link: https://lore.kernel.org/r/20250923-ps2-typo-v1-1-03d2468acc32@posteo.net Signed-off-by: Dmitry Torokhov commit 5cf952c54f3546f904ded645aecc1788d1090bd2 Author: Srinivas Pandruvada Date: Tue Sep 23 13:56:31 2025 -0700 thermal: intel: int340x: Power Slider: Validate slider_balance range When the module parameter slider_balance is set to the performance slider value of 0, the SoC slider profile switches to the performance mode. This can cause the Linux power-profiles-daemon to change the system power mode to performance from balanced mode. This happens when there is only one platform profile registered as there will be no conflict with other platform profiles. Same issue occurs when the slider_balance is set to the power-saver slider value. Prevent module parameter slider_balance from overlapping with performance and power-saver slider values by adding range validation. Return an error when an invalid value is provided. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250923205631.3056590-1-srinivas.pandruvada@linux.intel.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit d3f8f8d03061d2706f8410aea7811acee65dc1f5 Merge: c51f0d3b6ef1d1 e3f761be5a178b Author: Rafael J. Wysocki Date: Wed Sep 24 21:33:56 2025 +0200 Merge tag 'amd-pstate-v6.18-2025-09-24' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Merge amd-pstate content for 6.18 from Mario Limonciello: "* Fix for amd_pstate_trace package references" * tag 'amd-pstate-v6.18-2025-09-24' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names commit c51f0d3b6ef1d1e40b6d7a5db76fadc034a98109 Merge: 4ea5af08590825 9a1aa642c1fb5a Author: Rafael J. Wysocki Date: Wed Sep 24 21:32:28 2025 +0200 Merge back earlier cpufreq material for 6.18 commit f8c9ad46b00453a8c075453f3745f8d263f44834 Author: Vidya Sagar Date: Mon Sep 22 16:08:26 2025 +0200 PCI: tegra194: Handle errors in BPMP response The return value from tegra_bpmp_transfer() indicates the success or failure of the IPC transaction with BPMP. If the transaction succeeded, we also need to check the actual command's result code. If we don't have error handling for tegra_bpmp_transfer(), we will set the pcie->ep_state to EP_STATE_ENABLED even when the tegra_bpmp_transfer() command fails. Thus, the pcie->ep_state will get out of sync with reality, and any further PERST# assert + deassert will be a no-op and will not trigger the hardware initialization sequence. This is because pex_ep_event_pex_rst_deassert() checks the current pcie->ep_state, and does nothing if the current state is already EP_STATE_ENABLED. Thus, it is important to have error handling for tegra_bpmp_transfer(), such that the pcie->ep_state can not get out of sync with reality, so that we will try to initialize the hardware not only during the first PERST# assert + deassert, but also during any succeeding PERST# assert + deassert. One example where this fix is needed is when using a rock5b as host. During the initial PERST# assert + deassert (triggered by the bootloader on the rock5b) pex_ep_event_pex_rst_deassert() will get called, but for some unknown reason, the tegra_bpmp_transfer() call to initialize the PHY fails. Once Linux has been loaded on the rock5b, the PCIe driver will once again assert + deassert PERST#. However, without tegra_bpmp_transfer() error handling, this second PERST# assert + deassert will not trigger the hardware initialization sequence. With tegra_bpmp_transfer() error handling, the second PERST# assert + deassert will once again trigger the hardware to be initialized and this time the tegra_bpmp_transfer() succeeds. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Vidya Sagar [cassel: improve commit log] Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Jon Hunter Acked-by: Thierry Reding Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-8-cassel@kernel.org commit 42f9c66a6d0cc45758dab77233c5460e1cf003df Author: Niklas Cassel Date: Mon Sep 22 16:08:25 2025 +0200 PCI: tegra194: Reset BARs when running in PCIe endpoint mode Tegra already defines all BARs except BAR0 as BAR_RESERVED. This is sufficient for pci-epf-test to not allocate backing memory and to not call set_bar() for those BARs. However, marking a BAR as BAR_RESERVED does not mean that the BAR gets disabled. The host side driver, pci_endpoint_test, simply does an ioremap for all enabled BARs and will run tests against all enabled BARs, so it will run tests against the BARs marked as BAR_RESERVED. After running the BAR tests (which will write to all enabled BARs), the inbound address translation is broken. This is because the tegra controller exposes the ATU Port Logic Structure in BAR4, so when BAR4 is written, the inbound address translation settings get overwritten. To avoid this, implement the dw_pcie_ep_ops .init() callback and start off by disabling all BARs (pci-epf-test will later enable/configure BARs that are not defined as BAR_RESERVED). This matches the behavior of other PCIe endpoint drivers: dra7xx, imx6, layerscape-ep, artpec6, dw-rockchip, qcom-ep, rcar-gen4, and uniphier-ep. With this, the PCI endpoint kselftest test case CONSECUTIVE_BAR_TEST (which was specifically made to detect address translation issues) passes. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-7-cassel@kernel.org commit 48991e4935078b05f80616c75d1ee2ea3ae18e58 Author: Brian Norris Date: Wed Sep 24 09:57:11 2025 -0700 PCI/sysfs: Ensure devices are powered for config reads The "max_link_width", "current_link_speed", "current_link_width", "secondary_bus_number", and "subordinate_bus_number" sysfs files all access config registers, but they don't check the runtime PM state. If the device is in D3cold or a parent bridge is suspended, we may see -EINVAL, bogus values, or worse, depending on implementation details. Wrap these access in pci_config_pm_runtime_{get,put}() like most of the rest of the similar sysfs attributes. Notably, "max_link_speed" does not access config registers; it returns a cached value since d2bd39c0456b ("PCI: Store all PCIe Supported Link Speeds"). Fixes: 56c1af4606f0 ("PCI: Add sysfs max_link_speed/width, current_link_speed/width, etc") Signed-off-by: Brian Norris Signed-off-by: Brian Norris Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250924095711.v2.1.Ibb5b6ca1e2c059e04ec53140cd98a44f2684c668@changeid commit 10fd0285305d0b48e8a3bf15d4f17fc4f3d68cb6 Merge: 181ce6b01ad52a b02a2c060b6572 Author: Marc Zyngier Date: Wed Sep 24 19:35:50 2025 +0100 Merge branch kvm-arm64/selftests-6.18 into kvmarm-master/next * kvm-arm64/selftests-6.18: : . : KVM/arm64 selftest updates for 6.18: : : - Large update to run EL1 selftests at EL2 when possible : (20250917212044.294760-1-oliver.upton@linux.dev) : : - Work around lack of ID_AA64MMFR4_EL1 trapping on CPUs : without FEAT_FGT : (20250923173006.467455-1-oliver.upton@linux.dev) : : - Additional fixes and cleanups : (20250920-kvm-arm64-id-aa64isar3-el1-v1-0-1764c1c1c96d@kernel.org) : . KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs KVM: arm64: selftests: Cope with arch silliness in EL2 selftest KVM: arm64: selftests: Add basic test for running in VHE EL2 KVM: arm64: selftests: Enable EL2 by default KVM: arm64: selftests: Initialize HCR_EL2 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 KVM: arm64: selftests: Select SMCCC conduit based on current EL KVM: arm64: selftests: Provide helper for getting default vCPU target KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts KVM: arm64: selftests: Create a VGICv3 for 'default' VMs KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation KVM: arm64: selftests: Add helper to check for VGICv3 support KVM: arm64: selftests: Initialize VGICv3 only once KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code Signed-off-by: Marc Zyngier commit b02a2c060b657296c080cff1b54ee4e9e650811c Author: Mark Brown Date: Sat Sep 20 20:52:00 2025 +0100 KVM: arm64: selftests: Cover ID_AA64ISAR3_EL1 in set_id_regs We have a couple of writable bitfields in ID_AA64ISAR3_EL1 but the set_id_regs selftest does not cover this register at all, add coverage. Signed-off-by: Mark Brown Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 5a070fc376babc7efdc8288b97431e43e18f4646 Author: Mark Brown Date: Sat Sep 20 20:51:59 2025 +0100 KVM: arm64: selftests: Remove a duplicate register listing in set_id_regs Currently we list the main set of registers with bits we test three times, once in the test_regs array which is used at runtime, once in the guest code and once in a list of ARRAY_SIZE() operations we use to tell kselftest how many tests we plan to execute. This is needlessly fiddly, when adding new registers as the test_cnt calculation is formatted with two registers per line. Instead count the number of bitfields in the register arrays at runtime. The existing code subtracts ARRAY_SIZE(test_regs) from the number of tests to account for the terminating FTR_REG_END entries in the per register arrays, the new code accounts for this when enumerating. Signed-off-by: Mark Brown Reviewed-by: Oliver Upton Signed-off-by: Marc Zyngier commit 75b2fdc1a82195997cab4836f9e511cbe8c8eb52 Author: Oliver Upton Date: Tue Sep 23 10:30:06 2025 -0700 KVM: arm64: selftests: Cope with arch silliness in EL2 selftest Implementations without FEAT_FGT aren't required to trap the entire ID register space when HCR_EL2.TID3 is set. This is a terrible idea, as the hypervisor may need to advertise the absence of a feature to the VM using a negative value in a signed field, FEAT_E2H0 being a great example of this. Cope with uncooperative implementations in the EL2 selftest by accepting a zero value when FEAT_FGT is absent and otherwise only tolerating the expected nonzero value. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit f677b0efa93ce0afb127ccffb8aaf708045fcf10 Author: Oliver Upton Date: Wed Sep 17 14:20:43 2025 -0700 KVM: arm64: selftests: Add basic test for running in VHE EL2 Add an embarrassingly simple selftest for sanity checking KVM's VHE EL2 and test that the ID register bits are consistent with HCR_EL2.E2H being RES1. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 2de21fb62387459f762c93eec3d04e4f7540b952 Author: Oliver Upton Date: Wed Sep 17 14:20:42 2025 -0700 KVM: arm64: selftests: Enable EL2 by default Take advantage of VHE to implicitly promote KVM selftests to run at EL2 with only slight modification. Update the smccc_filter test to account for this now that the EL2-ness of a VM is visible to tests. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 05c93cbe6653e7e77567962aa6533b618df5e19f Author: Oliver Upton Date: Wed Sep 17 14:20:41 2025 -0700 KVM: arm64: selftests: Initialize HCR_EL2 Initialize HCR_EL2 such that EL2&0 is considered 'InHost', allowing the use of (mostly) unmodified EL1 selftests at EL2. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 7ae44d1cdad8a2483465373b9c9e91f0461ca9b2 Author: Oliver Upton Date: Wed Sep 17 14:20:40 2025 -0700 KVM: arm64: selftests: Use the vCPU attr for setting nr of PMU counters Configuring the number of implemented counters via PMCR_EL0.N was a bad idea in retrospect as it interacts poorly with nested. Migrate the selftest to use the vCPU attribute instead of the KVM_SET_ONE_REG mechanism. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 0910778e49c6639d265ab2d7a47d0b461b8e2963 Author: Oliver Upton Date: Wed Sep 17 14:20:39 2025 -0700 KVM: arm64: selftests: Use hyp timer IRQs when test runs at EL2 Arch timer registers are redirected to their hypervisor counterparts when running in VHE EL2. This is great, except for the fact that the hypervisor timers use different PPIs. Use the correct INTIDs when that is the case. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit d72543ac728ae4a4708cbefad2761df84599c268 Author: Oliver Upton Date: Wed Sep 17 14:20:38 2025 -0700 KVM: arm64: selftests: Select SMCCC conduit based on current EL HVCs are taken within the VM when EL2 is in use. Ensure tests use the SMC instruction when running at EL2 to interact with the host. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a1b91ac2381d86aa47b7109bbcde0c71e775f6d9 Author: Oliver Upton Date: Wed Sep 17 14:20:37 2025 -0700 KVM: arm64: selftests: Provide helper for getting default vCPU target The default vCPU target in KVM selftests is pretty boring in that it doesn't enable any vCPU features. Expose a helper for getting the default target to prepare for cramming in more features. Call KVM_ARM_PREFERRED_TARGET directly from get-reg-list as it needs fine-grained control over feature flags. Signed-off-by: Oliver Upton Reviewed-by: Itaru Kitayama Signed-off-by: Marc Zyngier commit 1c9604ba234711ca759f1147f2fbc7a94a5a486d Author: Oliver Upton Date: Wed Sep 17 14:20:36 2025 -0700 KVM: arm64: selftests: Alias EL1 registers to EL2 counterparts FEAT_VHE has the somewhat nice property of implicitly redirecting EL1 register aliases to their corresponding EL2 representations when E2H=1. Unfortunately, there's no such abstraction for userspace and EL2 registers are always accessed by their canonical encoding. Introduce a helper that applies EL2 redirections to sysregs and use aggressive inlining to catch misuse at compile time. Go a little past the architectural definition for ease of use for test authors (e.g. the stack pointer). Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 8911c7dbc607212bf3dfc963004b062588c0ab38 Author: Oliver Upton Date: Wed Sep 17 14:20:35 2025 -0700 KVM: arm64: selftests: Create a VGICv3 for 'default' VMs Start creating a VGICv3 by default unless explicitly opted-out by the test. While having an interrupt controller is nice, the real benefit here is clearing a hurdle for EL2 VMs which mandate the presence of a VGIC. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit b8daa7ceac1c56e39b6ef4e62510a7d846511695 Author: Oliver Upton Date: Wed Sep 17 14:20:34 2025 -0700 KVM: arm64: selftests: Add unsanitised helpers for VGICv3 creation vgic_v3_setup() has a good bit of sanity checking internally to ensure that vCPUs have actually been created and match the dimensioning of the vgic itself. Spin off an unsanitised setup and initialization helper so vgic initialization can be wired in around a 'default' VM's vCPU creation. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit b712afa7a1cdb787f311f51c04df81fc6f026368 Author: Oliver Upton Date: Wed Sep 17 14:20:33 2025 -0700 KVM: arm64: selftests: Add helper to check for VGICv3 support Introduce a proper predicate for probing VGICv3 by performing a 'test' creation of the device on a dummy VM. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit a5022da5f9a3a791ff2caf5fe3789561ae687747 Author: Oliver Upton Date: Wed Sep 17 14:20:32 2025 -0700 KVM: arm64: selftests: Initialize VGICv3 only once vgic_v3_setup() unnecessarily initializes the vgic twice. Keep the initialization after configuring MMIO frames and get rid of the other. Signed-off-by: Oliver Upton Reviewed-by: Zenghui Yu Signed-off-by: Marc Zyngier commit 7326348209a0079a83c7bd7963a0e32d26af61c8 Author: Oliver Upton Date: Wed Sep 17 14:20:31 2025 -0700 KVM: arm64: selftests: Provide kvm_arch_vm_post_create() in library code In order to compel the default usage of EL2 in selftests, move kvm_arch_vm_post_create() to library code and expose an opt-in for using MTE by default. Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier commit 96da9d67da780c9fc10edc8822dcc69d62898d8d Author: Alexander Lobakin Date: Thu Sep 11 18:22:33 2025 +0200 idpf: enable XSk features and ndo_xsk_wakeup Now that AF_XDP functionality is fully implemented, advertise XSk XDP feature and add .ndo_xsk_wakeup() callback to be able to use it with this driver. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 9705d6552f5871a66b8701863567f11cee08dc76 Author: Alexander Lobakin Date: Thu Sep 11 18:22:32 2025 +0200 idpf: implement Rx path for AF_XDP Implement Rx packet processing specific to AF_XDP ZC using the libeth XSk infra. Initialize queue registers before allocating buffers to avoid redundant ifs when updating the queue tail. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 8ff6d62261a3d9a522e4bc90e27a2f6b745a22c4 Author: Alexander Lobakin Date: Thu Sep 11 18:22:31 2025 +0200 idpf: implement XSk xmit Implement the XSk transmit path using the libeth (libeth_xdp) XSk infra. When the NAPI poll is called, XSk Tx queues are polled first, before regular Tx and Rx. They're generally faster to serve and have higher priority comparing to regular traffic. Co-developed-by: Michal Kubiak Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 3d57b2c00f09afb321bfc203c86a3eb674c0ff2c Author: Michal Kubiak Date: Thu Sep 11 18:22:30 2025 +0200 idpf: add XSk pool initialization Add functionality to setup an XSk buffer pool, including ability to stop, reconfig and start only selected queues, not the whole device. Pool DMA mapping is managed by libeth_xdp. Signed-off-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 6b8e30b640653bb300a0d47aa7e2b2369eac674f Author: Michal Kubiak Date: Thu Sep 11 18:22:29 2025 +0200 idpf: add virtchnl functions to manage selected queues Implement VC functions dedicated to enabling, disabling and configuring not all but only selected queues. Also, refactor the existing implementation to make the code more modular. Introduce new generic functions for sending VC messages consisting of chunks, in order to isolate the sending algorithm and its implementation for specific VC messages. Finally, rewrite the function for mapping queues to q_vectors using the new modular approach to avoid copying the code that implements the VC message sending algorithm. Signed-off-by: Michal Kubiak Co-developed-by: Alexander Lobakin Signed-off-by: Alexander Lobakin Tested-by: Ramu R Signed-off-by: Tony Nguyen commit 5e3fee34f626a8cb8715f5b5409416c481714ebf Merge: dc1dea796b197a 55d5a5154d7510 Author: Jakub Kicinski Date: Wed Sep 24 10:21:39 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-09-23 We've added 9 non-merge commits during the last 33 day(s) which contain a total of 10 files changed, 480 insertions(+), 53 deletions(-). The main changes are: 1) A new bpf_xdp_pull_data kfunc that supports pulling data from a frag into the linear area of a xdp_buff, from Amery Hung. This includes changes in the xdp_native.bpf.c selftest, which Nimrod's future work depends on. It is a merge from a stable branch 'xdp_pull_data' which has also been merged to bpf-next. There is a conflict with recent changes in 'include/net/xdp.h' in the net-next tree that will need to be resolved. 2) A compiler warning fix when CONFIG_NET=n in the recent dynptr skb_meta support, from Jakub Sitnicki. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests: drv-net: Pull data before parsing headers selftests/bpf: Test bpf_xdp_pull_data bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN bpf: Make variables in bpf_prog_test_run_xdp less confusing bpf: Clear packet pointers after changing packet data in kfuncs bpf: Support pulling non-linear xdp data bpf: Allow bpf_xdp_shrink_data to shrink a frag from head and tail bpf: Clear pfmemalloc flag when freeing all fragments bpf: Return an error pointer for skb metadata when CONFIG_NET=n ==================== Link: https://patch.msgid.link/20250924050303.2466356-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 82f1cc171ce95544c024837c20a54d1954a67a76 Author: Niklas Cassel Date: Wed Sep 24 21:50:52 2025 +0530 PCI: tegra194: Set pci_epc_features::msi_capable to true Since the driver supports MSI, set the flag to true. This helps pci_endpoint_test to use the optimal IRQ type when using PCITEST_IRQ_TYPE_AUTO. Signed-off-by: Niklas Cassel [mani: splitted this change from the bug fix] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250922140822.519796-6-cassel@kernel.org commit b640d42a6ac9ba01abe65ec34f7c73aaf6758ab8 Author: Niklas Cassel Date: Mon Sep 22 16:08:24 2025 +0200 PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() The pci_epc_raise_irq() supplies a MSI or MSI-X interrupt number in range (1-N), as per the pci_epc_raise_irq() kdoc, where N is 32 for MSI. But tegra_pcie_ep_raise_msi_irq() incorrectly uses the interrupt number as the MSI vector. This causes wrong MSI vector to be triggered, leading to the failure of PCI endpoint Kselftest MSI_TEST test case. To fix this issue, convert the interrupt number to MSI vector. Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250922140822.519796-6-cassel@kernel.org commit c7d3dd9163e6095b2d4d000433ccdc166c33aa3c Merge: 95ee3364b29313 3328d39a8dca2d Author: Nathan Chancellor Date: Wed Sep 24 09:10:54 2025 -0700 Merge patch series "Add generated modalias to modules.builtin.modinfo" Alexey Gladkov says: The modules.builtin.modinfo file is used by userspace (kmod to be specific) to get information about builtin modules. Among other information about the module, information about module aliases is stored. This is very important to determine that a particular modalias will be handled by a module that is inside the kernel. There are several mechanisms for creating modalias for modules: The first is to explicitly specify the MODULE_ALIAS of the macro. In this case, the aliases go into the '.modinfo' section of the module if it is compiled separately or into vmlinux.o if it is builtin into the kernel. The second is the use of MODULE_DEVICE_TABLE followed by the use of the modpost utility. In this case, vmlinux.o no longer has this information and does not get it into modules.builtin.modinfo. For example: $ modinfo pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 modinfo: ERROR: Module pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 not found. $ modinfo xhci_pci name: xhci_pci filename: (builtin) license: GPL file: drivers/usb/host/xhci-pci description: xHCI PCI Host Controller Driver The builtin module is missing alias "pci:v*d*sv*sd*bc0Csc03i30*" which will be generated by modpost if the module is built separately. To fix this it is necessary to add the generated by modpost modalias to modules.builtin.modinfo. Fortunately modpost already generates .vmlinux.export.c for exported symbols. It is possible to add `.modinfo` for builtin modules and modify the build system so that `.modinfo` section is extracted from the intermediate vmlinux after modpost is executed. Link: https://patch.msgid.link/cover.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 3328d39a8dca2d6ed27197a0025df7540b99adf2 Author: Alexey Gladkov Date: Thu Sep 18 10:05:52 2025 +0200 kbuild: vmlinux.unstripped should always depend on .vmlinux.export.o Since .vmlinux.export.c is used to add generated by modpost modaliases for builtin modules the .vmlinux.export.o is no longer optional and should always be created. The generation of this file is not dependent on CONFIG_MODULES. Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/0e63a9c7741fe8217e4fd7c60afcf057ffa2ef5a.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 5ab23c7923a1d2ae1890026866a2d8506b010a4a Author: Alexey Gladkov Date: Thu Sep 18 10:05:51 2025 +0200 modpost: Create modalias for builtin modules For some modules, modalias is generated using the modpost utility and the section is added to the module file. When a module is added inside vmlinux, modpost does not generate modalias for such modules and the information is lost. As a result kmod (which uses modules.builtin.modinfo in userspace) cannot determine that modalias is handled by a builtin kernel module. $ cat /sys/devices/pci0000:00/0000:00:14.0/modalias pci:v00008086d0000A36Dsv00001043sd00008694bc0Csc03i30 $ modinfo xhci_pci name: xhci_pci filename: (builtin) license: GPL file: drivers/usb/host/xhci-pci description: xHCI PCI Host Controller Driver Missing modalias "pci:v*d*sv*sd*bc0Csc03i30*" which will be generated by modpost if the module is built separately. To fix this it is necessary to generate the same modalias for vmlinux as for the individual modules. Fortunately '.vmlinux.export.o' is already generated from which '.modinfo' can be extracted in the same way as for vmlinux.o. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Tested-by: Stephen Rothwell Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/28d4da3b0e3fc8474142746bcf469e03752c3208.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 83fb49389bbe07defb85b063f7ff0fd016f06b35 Author: Alexey Gladkov Date: Thu Sep 18 10:05:50 2025 +0200 modpost: Add modname to mod_device_table alias At this point, if a symbol is compiled as part of the kernel, information about which module the symbol belongs to is lost. To save this it is possible to add the module name to the alias name. It's not very pretty, but it's possible for now. Cc: Miguel Ojeda Cc: Andreas Hindborg Cc: Danilo Krummrich Cc: Alex Gaynor Cc: rust-for-linux@vger.kernel.org Signed-off-by: Alexey Gladkov Acked-by: Danilo Krummrich Acked-by: Nicolas Schier Link: https://patch.msgid.link/1a0d0bd87a4981d465b9ed21e14f4e78eaa03ded.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit b88f88c26705ad436ff9675258f76082dd43996a Author: Alexey Gladkov Date: Thu Sep 18 10:05:49 2025 +0200 scsi: Always define blogic_pci_tbl structure The blogic_pci_tbl structure is used by the MODULE_DEVICE_TABLE macro. There is no longer a need to protect it with the MODULE condition, since this no longer causes the compiler to warn about an unused variable. To avoid warnings when -Wunused-const-variable option is used, mark it as __maybe_unused for such configuration. Cc: Khalid Aziz Cc: Martin K. Petersen Cc: linux-scsi@vger.kernel.org Suggested-by: James Bottomley Signed-off-by: Alexey Gladkov Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Acked-by: Martin K. Petersen Link: https://patch.msgid.link/fd8e30de07de79a4923ae967eaee5ba2f2fcef00.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 39cfd5b12160be4f57df1c3ba60139741c827616 Author: Masahiro Yamada Date: Thu Sep 18 10:05:48 2025 +0200 kbuild: extract modules.builtin.modinfo from vmlinux.unstripped Currently, we assume all the data for modules.builtin.modinfo are available in vmlinux.o. This makes it impossible for modpost, which is invoked after vmlinux.o, to add additional module info. This commit moves the modules.builtin.modinfo rule after modpost. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/cdb3e5b9a739666b755cd0097dc34ab69c350e51.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5 Author: Masahiro Yamada Date: Thu Sep 18 10:05:47 2025 +0200 kbuild: keep .modinfo section in vmlinux.unstripped Keep the .modinfo section during linking, but strip it from the final vmlinux. Adjust scripts/mksysmap to exclude modinfo symbols from kallsyms. This change will allow the next commit to extract the .modinfo section from the vmlinux.unstripped intermediate. Signed-off-by: Masahiro Yamada Signed-off-by: Alexey Gladkov Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/aaf67c07447215463300fccaa758904bac42f992.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 0ce5139fd96e9d415d3faaef1c575e238f9bbd67 Author: Masahiro Yamada Date: Thu Sep 18 10:05:46 2025 +0200 kbuild: always create intermediate vmlinux.unstripped Generate the intermediate vmlinux.unstripped regardless of CONFIG_ARCH_VMLINUX_NEEDS_RELOCS. If CONFIG_ARCH_VMLINUX_NEEDS_RELOCS is unset, vmlinux.unstripped and vmlinux are identiacal. This simplifies the build rule, and allows to strip more sections by adding them to remove-section-y. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/a48ca543fa2305bd17324f41606dcaed9b19f2d4.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 Author: Alexey Gladkov Date: Thu Sep 18 10:05:45 2025 +0200 s390: vmlinux.lds.S: Reorder sections In the upcoming changes, the ELF_DETAILS macro will be extended with the ".modinfo" section, which will cause an error: >> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment >> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment >> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment This happens because the .vmlinux.info use :NONE to override the default segment and tell the linker to not put the section in any segment at all. To avoid this, we need to change the sections order that will be placed in the default segment. Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: linux-s390@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/ Signed-off-by: Alexey Gladkov Acked-by: Heiko Carstens Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org Signed-off-by: Nathan Chancellor commit 1f6113ae5ac4927fe80256154ebb0461e670fa85 Author: Ard Biesheuvel Date: Wed Sep 24 17:53:11 2025 +0200 x86/boot: Drop erroneous __init annotation from early_set_pages_state() The kexec code will call set_pages_state() after tearing down all the GHCBs, which will therefore result in a call to early_set_pages_state(). This means the __init annotation is wrong, and must be dropped. Fixes: c5c30a373693 ("x86/boot: Move startup code out of __head section") Reported-by: Srikanth Aithal Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Tested-by: Srikanth Aithal commit ea0b39168d3a2313eabd145fb3440c946ccff4d1 Author: Jiapeng Chong Date: Tue Sep 23 11:50:23 2025 +0800 arm64: cpufeature: Remove duplicate asm/mmu.h header ./arch/arm64/kernel/cpufeature.c: asm/mmu.h is included more than once. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Will Deacon commit be9c94ca4ed5908e775dd9e31f9bd6bfb35adc70 Merge: 4e4e36dce3e44b 281817dffe2855 Author: Will Deacon Date: Wed Sep 24 16:35:10 2025 +0100 Merge branch 'for-next/vdso' into for-next/core * for-next/vdso: arm64: vdso32: Respect -Werror from kbuild arm64: vdso32: Stop suppressing warnings commit 4e4e36dce3e44b28b041aefedd5a0c1b150a8f43 Merge: c7c7eb4f0eff06 ea87c5536aa8c2 Author: Will Deacon Date: Wed Sep 24 16:35:06 2025 +0100 Merge branch 'for-next/uprobes' into for-next/core * for-next/uprobes: arm64: probes: Fix incorrect bl/blr address and register usage uprobes: uprobe_warn should use passed task arm64: Kconfig: Remove GCS restrictions on UPROBES arm64: uprobes: Add GCS support to uretprobes arm64: probes: Add GCS support to bl/blr/ret arm64: uaccess: Add additional userspace GCS accessors arm64: uaccess: Move existing GCS accessors definitions to gcs.h arm64: probes: Break ret out from bl/blr commit c7c7eb4f0eff06d0605051d4fd286b84adb072e0 Merge: 712f4ee70a38d5 14f158552eec70 Author: Will Deacon Date: Wed Sep 24 16:35:01 2025 +0100 Merge branch 'for-next/sysregs' into for-next/core * for-next/sysregs: arm64/sysreg: Update TCR_EL1 register arm64: sysreg: Add validation checks to sysreg header generation script arm64: sysreg: Correct sign definitions for EIESB and DoubleLock arm64: sysreg: Fix and tidy up sysreg field definitions commit 712f4ee70a38d5b39682c18d20a8a14c764d1e6c Merge: f2d64a22faeeec 777fb19ed8d6f1 Author: Will Deacon Date: Wed Sep 24 16:34:56 2025 +0100 Merge branch 'for-next/selftests' into for-next/core * for-next/selftests: kselftest/arm64: Add lsfe to the hwcaps test kselftest/arm64: Check that unsupported regsets fail in sve-ptrace kselftest/arm64: Verify that we reject out of bounds VLs in sve-ptrace kselftest/arm64/gcs/basic-gcs: Respect parent directory CFLAGS selftests/arm64: Fix grammatical error in string literals kselftest/arm64: Add parentheses around sizeof for clarity kselftest/arm64: Supress warning and improve readability kselftest/arm64: Remove extra blank line kselftest/arm64/gcs: Use nolibc's getauxval() kselftest/arm64/gcs: Correctly check return value when disabling GCS selftests: arm64: Fix -Waddress warning in tpidr2 test kselftest/arm64: Log error codes in sve-ptrace selftests: arm64: Check fread return value in exec_target commit f2d64a22faeeecff385b4c91fab5fe036ab00162 Merge: 77dfca70baefcb 2084660ad288c9 Author: Will Deacon Date: Wed Sep 24 16:34:52 2025 +0100 Merge branch 'for-next/perf' into for-next/core * for-next/perf: (29 commits) perf/dwc_pcie: Fix use of uninitialized variable Documentation: hisi-pmu: Add introduction to HiSilicon V3 PMU Documentation: hisi-pmu: Fix of minor format error drivers/perf: hisi: Add support for L3C PMU v3 drivers/perf: hisi: Refactor the event configuration of L3C PMU drivers/perf: hisi: Extend the field of tt_core drivers/perf: hisi: Extract the event filter check of L3C PMU drivers/perf: hisi: Simplify the probe process of each L3C PMU version drivers/perf: hisi: Export hisi_uncore_pmu_isr() drivers/perf: hisi: Relax the event ID check in the framework perf: Fujitsu: Add the Uncore PMU driver perf/arm-cmn: Fix CMN S3 DTM offset perf: arm_spe: Prevent overflow in PERF_IDX2OFF() coresight: trbe: Prevent overflow in PERF_IDX2OFF() MAINTAINERS: Remove myself from HiSilicon PMU maintainers drivers/perf: hisi: Add support for HiSilicon MN PMU driver drivers/perf: hisi: Add support for HiSilicon NoC PMU perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS arm64/boot: Factor out a macro to check SPE version ... commit 77dfca70baefcb988318a72fe69eb99f6dabbbb1 Merge: 30f9386820cddb 5973a62efa34c8 Author: Will Deacon Date: Wed Sep 24 16:34:34 2025 +0100 Merge branch 'for-next/mm' into for-next/core * for-next/mm: arm64: map [_text, _stext) virtual address range non-executable+read-only arm64: Enable vmalloc-huge with ptdump arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: support large block mapping when rodata=full arm64: Enable permission change on arm64 kernel block mappings arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED arm64: mm: Rework the 'rodata=' options arm64: mm: Represent physical memory with phys_addr_t and resource_size_t arm64: mm: Make map_fdt() return mapped pointer arm64: mm: Cast start/end markers to char *, not u64 commit 30f9386820cddbba59b48ae0670c3a1646dd440e Merge: 7df73a00490c9b 1cf89b6bf660c2 Author: Will Deacon Date: Wed Sep 24 16:34:06 2025 +0100 Merge branch 'for-next/misc' into for-next/core * for-next/misc: arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN arm64: Kconfig: Spell out "ARMv9.4" in menuconfig text arm64/fpsimd: simplify sme_setup() commit 7df73a00490c9b7a1b7c48d18881fe02ab0fabb4 Merge: e0669b95f7a561 da9e5c04be5895 Author: Will Deacon Date: Wed Sep 24 16:34:02 2025 +0100 Merge branch 'for-next/entry' into for-next/core * for-next/entry: arm/syscalls: mark syscall invocation as likely in invoke_syscall arm64: entry: Switch to generic IRQ entry arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() arm64: entry: Refactor preempt_schedule_irq() check code entry: Add arch_irqentry_exit_need_resched() for arm64 arm64: entry: Use preempt_count() and need_resched() helper arm64: entry: Rework arm64_preempt_schedule_irq() arm64: entry: Refactor the entry and exit for exceptions from EL1 arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() commit e0669b95f7a5614159045cd930071ff711f82b3e Merge: 3d751c56c9de79 3c0979c64481f0 Author: Will Deacon Date: Wed Sep 24 16:33:58 2025 +0100 Merge branch 'for-next/docs' into for-next/core * for-next/docs: arm64/sme: Drop inaccurate documentation of streaming mode switches commit 3d751c56c9de79b1624e45aba404177115b268c0 Merge: 5647d32f514eca 8fca3852e33d76 Author: Will Deacon Date: Wed Sep 24 16:33:53 2025 +0100 Merge branch 'for-next/cpufeature' into for-next/core * for-next/cpufeature: arm64: cpufeature: add Neoverse-V3AE to BBML2 allow list arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions arm64: cpufeature: add AmpereOne to BBML2 allow list arm64: cpufeature: Add Olympus MIDR to BBML2 allow list arm64: cputype: Add NVIDIA Olympus definitions arm64: cputype: Remove duplicate Cortex-X1C definitions arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE arm64: cputype: Add Cortex-A720AE definitions arm64/hwcap: Add hwcap for FEAT_LSFE commit 5647d32f514ecac98760d60a77c1fcfbc5fb2ed0 Merge: 57f13e3d912089 d02c2e45b1e776 Author: Will Deacon Date: Wed Sep 24 16:33:25 2025 +0100 Merge branch 'for-next/cca' into for-next/core * for-next/cca: arm64: acpi: Enable ACPI CCEL support arm64: Enable EFI secret area Securityfs support arm64: realm: ioremap: Allow mapping memory as encrypted commit 57f13e3d91208900c59fbb4d4314a0281762cfb6 Merge: 8f5ae30d69d754 a7ed7b9d0ebb03 Author: Will Deacon Date: Wed Sep 24 16:33:03 2025 +0100 Merge branch 'for-next/fixes' into for-next/core * for-next/fixes: arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO kselftest/arm64: Don't open code SVE_PT_SIZE() in fp-ptrace arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature commit 1cf89b6bf660c2e9fa137b3e160c7b1001937a78 Author: Will Deacon Date: Fri Sep 19 19:40:25 2025 +0100 arm64: Kconfig: Make CPU_BIG_ENDIAN depend on BROKEN Big-endian arm64 configurations are vanishingly rare, yet we still claim to support them in Linux despite very limited testing or visible interest. Supporting big-endian adds unnecessary burden to reviewers and contributors which, without any known active users, is hard to justify. For example, recent work to improve our futex routines and to implement nested virtualisation support is non-trivially complicated by having to support both big- and little-endianness. Back in 2019 [1], it was claimed that Huawei were using arm64 big-endian machines in their telecommunication products but I don't know whether that's still the case and certainly haven't seen any patch contributions to help support or maintain it. Make CPU_BIG_ENDIAN depend on BROKEN as an initial deprecation step towards its removal. Cc: Catalin Marinas Cc: Marc Zyngier Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: Hanjun Guo Cc: Jonathan Cameron Cc: Guenter Roeck Link: https://lore.kernel.org/linux-arm-kernel/73701e9f-bee1-7ae8-2277-7a3576171cd4@huawei.com/ [1] Acked-by: Catalin Marinas Acked-by: Marc Zyngier Acked-by: Ard Biesheuvel Signed-off-by: Will Deacon commit 896d52af944107c0644c12378741af9a3834c514 Merge: 2d51a5b83cf88d 6742ca18cb4169 Author: Marc Kleine-Budde Date: Wed Sep 24 17:10:01 2025 +0200 Merge patch series "can: netlink: preparation before introduction of CAN XL step 3/3" Vincent Mailhol says: In November last year, I sent an RFC to introduce CAN XL [1]. That RFC, despite positive feedback, was put on hold due to some unanswered question concerning the PWM encoding [2]. While stuck, some small preparation work was done in parallel in [3] by refactoring the struct can_priv and doing some trivial clean-up and renaming. Initially, [3] received zero feedback but was eventually merged after splitting it in smaller parts and resending it. Finally, in July this year, we clarified the remaining mysteries about PWM calculation, thus unlocking the series. Summer being a bit busy because of some personal matters brings us to now. After doing all the refactoring and adding all the CAN XL features, the final result is more than 30 patches, definitively too much for a single series. So I am splitting the remaining changes three: - can: rework the CAN MTU logic [4] - can: netlink: preparation before introduction of CAN XL (this series) - CAN XL (will come right after the two preparation series get merged) And thus, this series continues and finishes the preparation work done in [3] and [4]. It contains all the refactoring needed to smoothly introduce CAN XL. The goal is to: - split the functions in smaller pieces: CAN XL will introduce a fair amount of code. And some functions which are already fairly long (86 lines for can_validate(), 215 lines for can_changelink()) would grow to disproportionate sizes if the CAN XL logic were to be inlined in those functions. - repurpose the existing code to handle both CAN FD and CAN XL: a huge part of CAN XL simply reuses the CAN FD logic. All the existing CAN FD logic is made more generic to handle both CAN FD and XL. In more details: - Patch #1 moves struct data_bittiming_params from dev.h to bittiming.h and patch #2 makes can_get_relative_tdco() FD agnostic before also moving it to bittiming.h. - Patch #3 adds some comments to netlink.h tagging which IFLA symbols are FD specific. - Patches #4 to #6 are refactoring can_validate() and can_validate_bittiming(). - Patches #7 to #11 are refactoring can_changelink() and can_tdc_changelink(). - Patches #12 and #13 are refactoring can_get_size() and can_tdc_get_size(). - Patches #14 to #17 are refactoring can_fill_info() and can_tdc_fill_info(). - Patch #18 makes can_calc_tdco() FD agnostic. - Patch #19 adds can_get_ctrlmode_str() which converts control mode flags into strings. This is done in preparation of patch #20. - Patch #20 is the final patch and improves the user experience by providing detailed error messages whenever invalid parameters are provided. All those error messages came into handy when debugging the upcoming CAN XL patches. Aside from the last patch, the other changes do not impact any of the existing functionalities. The follow up series which introduces CAN XL is nearly completed but will be sent only once this one is approved: one thing at a time, I do not want to overwhelm people (including myself). [1] https://lore.kernel.org/linux-can/20241110155902.72807-16-mailhol.vincent@wanadoo.fr/ [2] https://lore.kernel.org/linux-can/c4771c16-c578-4a6d-baee-918fe276dbe9@wanadoo.fr/ [3] https://lore.kernel.org/linux-can/20241110155902.72807-16-mailhol.vincent@wanadoo.fr/ [4] https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v2-0-984f9868db69@kernel.org/ Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-0-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 6742ca18cb4169dc9a7f2860d18e78fcf00c6717 Author: Vincent Mailhol Date: Tue Sep 23 15:58:45 2025 +0900 can: netlink: add userland error messages Use NL_SET_ERR_MSG() and NL_SET_ERR_MSG_FMT() to return meaningful error messages to the userland whenever a -EOPNOTSUPP error is returned due to a failed validation of the CAN netlink arguments. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-20-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 7de54546fff11cb0a53f47847d62f7b1a5792d17 Author: Vincent Mailhol Date: Tue Sep 23 15:58:44 2025 +0900 can: dev: add can_get_ctrlmode_str() In an effort to give more human readable messages when errors occur because of conflicting options, it can be useful to convert the CAN control mode flags into text. Add a function which converts the first set CAN control mode into a human readable string. The reason to only convert the first one is to simplify edge cases: imagine that there are several invalid control modes, we would just return the first invalid one to the user, thus not having to handle complex string concatenation. The user can then solve the first problem, call the netlink interface again and see the next issue. People who wish to enumerate all the control modes can still do so by, for example, using this new function in a for_each_set_bit() loop. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-19-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 6ffc1230d3a728e07d7d2464f388ad4bbefe90c2 Author: Vincent Mailhol Date: Tue Sep 23 15:58:43 2025 +0900 can: calc_bittiming: make can_calc_tdco() FD agnostic can_calc_tdco() uses the CAN_CTRLMODE_FD_TDC_MASK and CAN_CTRLMODE_TDC_AUTO macros making it specific to CAN FD. Add the tdc mask to the function parameter list. The value of the tdc auto flag can then be derived from that mask and stored in a local variable. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-18-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e72f1ba700e3d502cd0a604fda86e38431467a46 Author: Vincent Mailhol Date: Tue Sep 23 15:58:42 2025 +0900 can: netlink: make can_tdc_fill_info() FD agnostic can_tdc_fill_info() depends on some variables which are specific to CAN FD. Move these to the function parameters list so that, later on, this function can be reused for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-17-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit d5ee934ee19b563a965da135e04d6d93067ccf2c Author: Vincent Mailhol Date: Tue Sep 23 15:58:41 2025 +0900 can: netlink: add can_bitrate_const_fill_info() Add can_bitrate_const_fill_info() to factorise the logic when filling the bitrate constant information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-16-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit aaeebdb7a7235ffec5c56a8a0144cac94b5a8e3e Author: Vincent Mailhol Date: Tue Sep 23 15:58:40 2025 +0900 can: netlink: add can_bittiming_const_fill_info() Add function can_bittiming_const_fill_info() to factorise the logic when filling the bittiming constant information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-15-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e1a2be5a6967143b56e253920be208635fc627b8 Author: Vincent Mailhol Date: Tue Sep 23 15:58:39 2025 +0900 can: netlink: add can_bittiming_fill_info() Add can_bittiming_fill_info() to factorise the logic when filling the bittiming information for Classical CAN and CAN FD. This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-14-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit d5f45ef88ba4e6af14a0d36ed3323b5813f07988 Author: Vincent Mailhol Date: Tue Sep 23 15:58:38 2025 +0900 can: netlink: add can_data_bittiming_get_size() Add the can_data_bittiming_get_size() function to factorise the logic to retrieve the size of below data bittiming parameters: - data_bittiming - data_bittiming_const - data_bitrate_const - tdc parameters This function will be reused later on for CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-13-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 63888a57801656ee1204f750ec4f98bd75fe44aa Author: Vincent Mailhol Date: Tue Sep 23 15:58:37 2025 +0900 can: netlink: make can_tdc_get_size() FD agnostic can_tdc_get_size() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. can_tdc_get_size() also uses the CAN_CTRLMODE_TDC_MANUAL macro making it specific to CAN FD. Add the tdc mask to the function parameter list. The value of the tdc manual flag can then be derived from that mask and stored in a local variable. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-12-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit e1a5cd9d6665c44119d5e664ecaccdb6467aecda Author: Vincent Mailhol Date: Tue Sep 23 15:58:36 2025 +0900 can: netlink: add can_ctrlmode_changelink() Split the control mode change link logic into a new function: can_ctrlmode_changelink(). The purpose is to increase code readability by preventing can_changelink() from becoming too big. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-11-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2e543af483a98a5e51509d8a720940fa8a35fdce Author: Vincent Mailhol Date: Tue Sep 23 15:58:35 2025 +0900 can: netlink: add can_dtb_changelink() Factorise the databittiming parsing out of can_changelink() and move it in the new can_dtb_changelink() function. This is a preparation patch for the introduction of CAN XL because the databittiming changelink logic will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-10-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 530c918f8cf68c06e82dbebf44bda67c60fd004b Author: Vincent Mailhol Date: Tue Sep 23 15:58:34 2025 +0900 can: netlink: make can_tdc_changelink() FD agnostic can_tdc_changelink() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-9-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2b0a6930ae7c54ef401cd0a98ba194236ff8fbf7 Author: Vincent Mailhol Date: Tue Sep 23 15:58:33 2025 +0900 can: netlink: remove useless check in can_tdc_changelink() can_tdc_changelink() return -EOPNOTSUPP under this condition: !tdc_const || !can_fd_tdc_is_enabled(priv) But this function is only called if the data[IFLA_CAN_TDC] parameters are provided. At this point, can_validate_tdc() already checked that either of the tdc auto or tdc manual control modes were provided, that is to say, can_fd_tdc_is_enabled(priv) must be true. Because the right hand operand of this condition is always true, remove it. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-8-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 45be26b7e35a70ac7c79341747bd596d83dee977 Author: Vincent Mailhol Date: Tue Sep 23 15:58:32 2025 +0900 can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic CAN_CTRLMODE_TDC_AUTO and CAN_CTRLMODE_TDC_MANUAL are mutually exclusive. This means that whenever the user switches from auto to manual mode (or vice versa), the other flag which was set previously needs to be cleared. Currently, this is handled with a masking operation. It can be done in a simpler manner by clearing any of the previous TDC flags before copying netlink attributes. The code becomes easier to understand and will make it easier to add the new upcoming CAN XL flags which will have a similar reset logic as the current TDC flags. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-7-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 3820a415bece1feb7d832f6bda6c927d91c3ab52 Author: Vincent Mailhol Date: Tue Sep 23 15:58:31 2025 +0900 can: netlink: add can_validate_databittiming() Factorise the databittiming validation out of can_validate() and move it in the new add can_validate_databittiming() function. Also move can_validate()'s comment because it is specific to CAN FD. This is a preparation patch for the introduction of CAN XL as this databittiming validation will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-6-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit b23a8425cba5d7908d69f3bce8f3c697362b50ae Author: Vincent Mailhol Date: Tue Sep 23 15:58:30 2025 +0900 can: netlink: add can_validate_tdc() Factorise the TDC validation out of can_validate() and move it in the new can_validate_tdc() function. This is a preparation patch for the introduction of CAN XL because this TDC validation will be reused later on. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-5-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit f5ae5a75412db0b8ded2342d409c7ba504eb198f Author: Vincent Mailhol Date: Tue Sep 23 15:58:29 2025 +0900 can: netlink: refactor can_validate_bittiming() Whenever can_validate_bittiming() is called, it is always preceded by some boilerplate code which was copy pasted all over the place. Move that repeated code directly inside can_validate_bittiming(). Finally, the mempcy() is not needed: the nla attributes are four bytes aligned which is just enough for struct can_bittiming. Add a static_assert() to document that the alignment is correct and just use the pointer returned by nla_data() as-is. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-4-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 94040a8f484576cb1b7df3b2e93118c3b3e3aff4 Author: Vincent Mailhol Date: Tue Sep 23 15:58:28 2025 +0900 can: netlink: document which symbols are FD specific The CAN XL netlink interface will also have data bitrate and TDC parameters. The current FD parameters do not have a prefix in their names to differentiate them. Because the netlink interface is part of the UAPI, it is unfortunately not feasible to rename the existing symbols to add an FD_ prefix. The best alternative is to add a comment for each of the symbols to notify the reader of which parts are CAN FD specific. While at it, fix a typo: transiver -> transceiver. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-3-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 7208385df7846d30e29febc6c6280cb32e91ee82 Author: Vincent Mailhol Date: Tue Sep 23 15:58:27 2025 +0900 can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h can_get_relative_tdco() needs to access can_priv->fd making it specific to CAN FD. Change the function parameter from struct can_priv to struct data_bittiming_params. This way, the function becomes CAN FD agnostic and can be reused later on for the CAN XL TDC. Now that we dropped the dependency on struct can_priv, also move can_get_relative_tdco() back to bittiming.h where it was meant to belong to. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-2-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit cc470fcf1d59f9d6186810ea5253da49a4f85f83 Author: Vincent Mailhol Date: Tue Sep 23 15:58:26 2025 +0900 can: dev: move struct data_bittiming_params to linux/can/bittiming.h In commit b803c4a4f788 ("can: dev: add struct data_bittiming_params to group FD parameters"), struct data_bittiming_params was put into linux/can/dev.h. This structure being a collection of bittiming parameters, on second thought, bittiming.h is actually a better location. This way, users of struct data_bittiming_params will not have to forcefully include linux/can/dev.h thus removing some complexity and reducing the risk of circular dependencies in headers. Move struct data_bittiming_params from linux/can/dev.h to linux/can/bittiming.h. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-canxl-netlink-prep-v4-1-e720d28f66fe@kernel.org Signed-off-by: Marc Kleine-Budde commit 2d51a5b83cf88dcf0100c2f1404da279fe66b522 Merge: c0b595230cc198 b98aceb65e2c57 Author: Marc Kleine-Budde Date: Wed Sep 24 17:06:20 2025 +0200 Merge patch series "can: rework the CAN MTU logic (CAN XL preparation step 2/3)" Vincent Mailhol says: The CAN MTU logic is currently broken. can_change_mtu() will update both the MTU and the CAN_CTRLMODE_FD flag. Back then, commit bc05a8944a34 ("can: allow to change the device mtu for CAN FD capable devices") stated that: The configuration can be done either with the 'fd { on | off }' option in the 'ip' tool from iproute2 or by setting the CAN netdevice MTU to CAN_MTU (16) or to CANFD_MTU (72). Link: https://git.kernel.org/torvalds/c/bc05a8944a34 The problem is that after doing for example: $ ip link set can0 mtu 72 bittiming 500000 on a CAN FD interface, we are left with a device on which CAN FD is enabled but which does not have the FD databittiming parameters configured. The same goes on when setting the mtu back to 16: ip link set can0 type can bitrate 500000 fd on dbitrate 5000000 ip link set can0 mtu 16 The device is now in Classical CAN mode but iproute2 is still reporting the databittiming values (although this time, the issue seems less critical as it is only a reporting problem). The only way to resolve the problem and bring the device back to a coherent state is to call again the netlink interface using the "fd on" or "fd off" options. The idea of being able to infer the CAN_CTRLMODE_FD flag from the MTU value is just incorrect for physical devices. Note that this logic remains valid on virtual interfaces (vcan and vxcan) because those do not have control mode flags and thus no conflict occurs. This series reworks the CAN MTU logic. The goal is to always maintain a coherent state between the MTU and the control mode flags as listed in below table: fd off, xl off fd on, xl off fd any, xl on --------------------------------------------------------------------------- default mtu CAN_MTU CANFD_MTU CANXL_MTU min mtu CAN_MTU CANFD_MTU CANXL_MIN_MTU max mtu CAN_MTU CANFD_MTU CANXL_MAX_MTU In order to switch between one column to another, the user must use the fd/xl on/off flags. Directly modifying the MTU from one column to the other is not permitted any more. The CAN XL is not yet supported at the moment, so the last column is just given as a reference to better understand what is coming up. This series will just implement the first two columns. While doing the rewrite, the logic is adjusted to reuse as much as possible the net core infrastructure. By populating: net_device->min_mtu and net_device->max_mtu the net core infrastructure will automatically: 1. validate that the user's inputs are in range. 2. report those min and max MTU values through the netlink interface. Point 1. will allow us to get rid of the can_change_mtu() in a near future for all the physical devices and point 2. allows the end user to see the valid MTU range by doing a: $ ip --details link show can0 Finally, because using the net core, it will be possible after the removal of can_change_mtu() to modify the MTU while the device is up. As stated previously, the only modifications allowed will be within the MTU range of a given CAN protocol. So for Classical CAN and CAN FD, the MTU is fixed to, respectively, CAN_MTU and CANFD_MTU. For the upcoming CAN XL, the user will be able to change the MTU to anything between CANXL_MIN_MTU and CANXL_MAX_MTU even if the device is up. The first patch of this series annotates the read access on net_device->mtu. This preparation is needed to prevent any race condition to occur when modifying the MTU while the device is up. The second patch is another preparation change which moves can_set_static_ctrlmode() from dev.h to dev.c. The third patch populates the MTU minimum and maximum value. The fourth patch is just a clean-up to remove the old can_change_mtu(). The fourth and last patch comes as a bonus content and modifies the default MTU of the vcan and vxcan so that CAN XL is on by default. Note that after this series, the old can_change_mtu() becomes useless. That function can not yet be removed because some pending changes from other maintainers' trees still depend on it. It will be removed in the next development window once all those changes reach net-next. Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-0-581bde113f52@kernel.org [mkl: squashed fixup patch into 3] Signed-off-by: Marc Kleine-Budde commit b98aceb65e2c57df9646530e5f2b2531a661203f Author: Vincent Mailhol Date: Tue Sep 23 15:37:11 2025 +0900 can: enable CAN XL for virtual CAN devices by default In commit 97edec3a11cf ("can: enable CAN FD for virtual CAN devices by default"), vcan and vxcan default MTU was set to CANFD_MTU by default. The reason was that users were confused on how to activate CAN FD on virtual interfaces. Following the introduction of CAN XL, the same logic should be applied. Set the MTU to CANXL_MTU by default. The users who really wish to use a Classical CAN only or a CAN FD virtual device can do respectively: $ ip link set vcan0 mtu 16 or $ ip link set vcan0 mtu 72 to force the old behaviour. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-4-581bde113f52@kernel.org Signed-off-by: Marc Kleine-Budde commit 23049938605bda390f875ce20e0704252c2e5c3d Author: Vincent Mailhol Date: Tue Sep 23 15:37:10 2025 +0900 can: populate the minimum and maximum MTU values By populating: net_device->min_mtu and net_device->max_mtu the net core infrastructure will automatically: 1. validate that the user's inputs are in range. 2. report those min and max MTU values through the netlink interface. Add can_set_default_mtu() which sets the default mtu value as well as the minimum and maximum values. The logic for the default mtu value remains unchanged: - CANFD_MTU if the device has a static CAN_CTRLMODE_FD. - CAN_MTU otherwise. Call can_set_default_mtu() each time the CAN_CTRLMODE_FD is modified. This will guarantee that the MTU value is always consistent with the control mode flags. With this, the checks done in can_change_mtu() become fully redundant and will be removed in an upcoming change and it is now possible to confirm the minimum and maximum MTU values on a physical CAN interface by doing: $ ip --details link show can0 The virtual interfaces (vcan and vxcan) are not impacted by this change. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org [mkl: squashed https://patch.msgid.link/20250924143644.17622-2-mailhol@kernel.org] Signed-off-by: Marc Kleine-Budde commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 Author: Armin Wolf Date: Wed Sep 17 20:10:36 2025 +0200 hwmon: (dell-smm) Add support for Dell OptiPlex 7040 The Dell OptiPlex 7040 supports the legacy SMM interface for reading sensors and performing fan control. Whitelist this machine so that this driver loads automatically. Closes: https://github.com/Wer-Wolf/i8kutils/issues/15 Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 1c1658058c99bcfd3b2347e587a556986037f80a Author: Armin Wolf Date: Wed Sep 17 20:10:35 2025 +0200 hwmon: (dell-smm) Add support for automatic fan mode Many machines treat fan state 3 as some sort of automatic mode, which is superior to the separate SMM calls for switching to automatic fan mode for two reasons: - the fan control mode can be controlled for each fan separately - the current fan control mode can be retrieved from the BIOS On some machines however, this special fan state does not exist. Fan state 3 acts like a regular fan state on such machines or does not exist at all. Such machines usually use separate SMM calls for enabling/disabling automatic fan control. Add support for it. If the machine supports separate SMM calls for changing the fan control mode, then the other interface is ignored. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-4-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 205c730262215fe1940668394a856f69ece55c66 Author: Cryolitia PukNgae Date: Wed Sep 24 15:48:38 2025 +0800 hwmon: (gpd-fan) complete Kconfig dependencies DMI and HAS_IOPORT is also needed Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509200214.i2QX7iwD-lkp@intel.com/ Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250924-hwmon2-v1-1-fc529865a325@uniontech.com Signed-off-by: Guenter Roeck commit 584d55be66ef151e6ef9ccb3dcbc0a2155559be1 Author: Ben Copeland Date: Tue Sep 23 21:26:56 2025 +0200 hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex Some motherboards require more time to acquire the ACPI mutex, causing "Failed to acquire mutex" messages to appear in the kernel log. Increase the timeout from 500ms to 800ms to accommodate these cases. Signed-off-by: Ben Copeland Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250923192935.11339-3-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 2c8ac03aad7a8dd649de9080503c68319afb43f9 Author: Ben Copeland Date: Tue Sep 23 21:26:55 2025 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X870E-E GAMING WIFI Add support for ROG STRIX X870E-E GAMING WIFI This board uses the same sensor configuration as the ProArt X870E-CREATOR WIFI motherboard. Signed-off-by: Ben Copeland Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250923192935.11339-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit b3499883c6d5f968f44e87d021ff2bd47ab5d094 Author: Armin Wolf Date: Wed Sep 17 20:10:34 2025 +0200 hwmon: (dell-smm) Move clamping of fan speed out of i8k_set_fan() Currently i8k_set_fan() clamps the fan speed before performing the SMM call to ensure that the speed is not negative and not greater than i8k_fan_max. This however is mostly unnecessary as the hwmon and thermal interfaces alread ensure this. Only the legacy ioctl interface does not ensure that the fan speed passed to i8k_set_fan() does meet the above criteria. Move the clamping out of i8k_set_fan() and into the legacy ioctl handler to prepare for future changes. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-3-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit ddb61e737f04e3c6c8299c1e00bf17a42a7f05cf Author: Armin Wolf Date: Wed Sep 17 20:10:33 2025 +0200 hwmon: (dell-smm) Remove Dell Precision 490 custom config data It turns out the second fan on the Dell Precision 490 does not really support I8K_FAN_TURBO. Setting the fan state to 3 enables automatic fan control, just like on the other two fans. The reason why this was misinterpreted as turbo mode was that the second fan normally spins faster in automatic mode than in the previous fan states. Yet when in state 3, the fan speed reacts to heat exposure, exposing the automatic mode setting. Link: https://github.com/lm-sensors/lm-sensors/pull/383 Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250917181036.10972-2-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 5d5ec7c81c372d33875e0176f9f6d68e3e813e32 Author: Shane Fagan Date: Sun Sep 14 09:41:14 2025 +0200 hwmon: (asus-ec-sensors) add ROG STRIX X670E-E GAMING WIFI Add support for ROG STRIX X670E-E GAMING WIFI Signed-off-by: Shane Fagan Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250914074125.135656-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 1fac317b6cae373d5d1a5695a5175c65c745922f Author: Cryolitia PukNgae Date: Fri Sep 19 16:38:49 2025 +0800 hwmon: (gpd-fan) Fix range check for pwm input Fixed the maximum value in the PWM input range check, allowing the input to be set to 255. Fixes: 0ab88e239439 ("hwmon: add GPD devices sensor driver") Reported-by: Chenx Dust Link: https://github.com/Cryolitia/gpd-fan-driver/pull/18 Co-developed-by: Chenx Dust Signed-off-by: Chenx Dust Signed-off-by: Cryolitia PukNgae Link: https://lore.kernel.org/r/20250919-hwmon-v1-1-2b69c8b9c062@uniontech.com Signed-off-by: Guenter Roeck commit bef3c793542b132ab1dc19076ce4f91594b5fbdc Author: Cosmo Chou Date: Tue Sep 16 17:50:26 2025 +0800 hwmon: (pmbus/mp5990) add support for MP5998 Add support for the MPS MP5998 hot-swap controller. Like MP5990, MP5998 uses EFUSE_CFG (0xC4) bit 9 to indicate linear/direct data format. Signed-off-by: Cosmo Chou Link: https://lore.kernel.org/r/20250916095026.800164-2-chou.cosmo@gmail.com Signed-off-by: Guenter Roeck commit bca9b6633fb92ff37247442d08f3889a2e87881c Author: Cosmo Chou Date: Tue Sep 16 17:50:25 2025 +0800 dt-bindings: trivial-devices: add mps,mp5998 Add dt-bindings for MPS mp5998 hot-swap controller. Signed-off-by: Cosmo Chou Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250916095026.800164-1-chou.cosmo@gmail.com Signed-off-by: Guenter Roeck commit 6c4e0cb3d87ad63a30e05e7624a45a6f01240e70 Author: Heiko Carstens Date: Mon Sep 22 13:40:20 2025 +0200 s390/bitops: Switch to generic ffs() if supported by compiler Use generic ffs() / __builtin_ffs() if supported by the compiler. GCC 16 will have support for __builtin_ffs(). See gcc commit f50cff9766c5 ("s390: Implement clz and ctz for SI mode"). In the distant future when GCC 16 becomes the minimum supported version, this allows to get rid of the flogr inline assembly. Kernel image size is reduced by ~500 bytes (gcc 16 beta + defconfig). Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 7b80a23c0e33ae5a3ae68e0cf5b5a59e8a368c37 Author: Heiko Carstens Date: Mon Sep 22 13:40:19 2025 +0200 s390/bitops: Switch to generic fls(), fls64(), etc. Switch to generic fls(), fls64(), etc. which are implemented with __builtin_ctzl(), __builtin_clzl(). Those builtins are available for all supported compilers. Kernel image size is reduced by ~10kb (gcc 15.1.0 + defconfig). Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 5671ce2a1fc6b4a16cff962423bc416b92cac3c8 Author: Heiko Carstens Date: Mon Sep 22 17:24:05 2025 +0200 s390/mm: Use __GFP_ACCOUNT for user page table allocations Add missing kmemcg accounting of user page table allocations. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8327bd4fcb6c1dab01ce5c6ff00b42496836dcd2 Author: Varad Gautam Date: Sun Mar 30 16:42:29 2025 +0000 asm-generic/io.h: Skip trace helpers if rwmmio events are disabled With `CONFIG_TRACE_MMIO_ACCESS=y`, the `{read,write}{b,w,l,q}{_relaxed}()` mmio accessors unconditionally call `log_{post_}{read,write}_mmio()` helpers, which in turn call the ftrace ops for `rwmmio` trace events This adds a performance penalty per mmio accessor call, even when `rwmmio` events are disabled at runtime (~80% overhead on local measurement). Guard these with `tracepoint_enabled()`. Signed-off-by: Varad Gautam Fixes: 210031971cdd ("asm-generic/io: Add logging support for MMIO accessors") Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann commit fb0b08297ecb429b60cb2b6ed40632ce5294220c Author: Alok Tiwari Date: Wed Sep 24 04:01:27 2025 -0700 RDMA/bnxt_re: improve clarity in ALLOC_PAGE handler Update uverbs_copy_to call to use sizeof(dpi) instead of sizeof(length) when copying the device page index (DPI) back to user space. Both dpi and length are declared as u32, so this change has no functional impact but makes the code clearer. Link: https://patch.msgid.link/r/20250924110130.340195-1-alok.a.tiwari@oracle.com Signed-off-by: Alok Tiwari Reviewed-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit 880245fd029a8f8ee8fd557c2681d077c1b1a959 Author: Jacob Moroni Date: Tue Sep 23 14:21:28 2025 +0000 RDMA/irdma: Remove unused struct irdma_cq fields These fields were set but not used anywhere, so remove them. Link: https://patch.msgid.link/r/20250923142128.943240-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe commit 4bab6d9584497191c449212c85799de4d84a1263 Author: Dan Carpenter Date: Tue Sep 23 14:20:45 2025 +0300 RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() This code accidentally returns positive EINVAL instead of negative -EINVAL. Some of the callers treat positive returns as success. Add the missing '-' char. Fixes: a24a29c8747f ("RDMA/irdma: Add Atomic Operations support") Link: https://patch.msgid.link/r/aNKCjcD6Nab1jWEV@stanley.mountain Signed-off-by: Dan Carpenter Signed-off-by: Jason Gunthorpe commit 45d78cd0bf2c40e74c31f70340484e20aae45b07 Author: SungMin Park Date: Wed Sep 17 12:43:11 2025 +0530 dt-bindings: timer: exynos4210-mct: Add compatible for ARTPEC-9 SoC Add Axis ARTPEC-9 mct compatible to the bindings documentation. The design for the timer is reused from previous Samsung SoCs like exynos4210 and ARTPEC-8. Signed-off-by: SungMin Park Signed-off-by: Ravi Patel Signed-off-by: Daniel Lezcano Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250917071311.1404-1-ravi.patel@samsung.com commit 7fcf00bd7f30540cf7096c8f2fadab5d890d4cf2 Author: Anantha Prabhu Date: Tue Sep 23 11:56:57 2025 +0530 RDMA/bnxt_re: Remove non-statistics counters from hw_counters Remove non-statistics counters from the RDMA hw_counters framework. The removed data includes: - Active resource counts (ACTIVE_PD, ACTIVE_QP, etc.) - Resource watermarks (WATERMARK_PD, WATERMARK_QP, etc.) - Operational counters (RESIZE_CQ_CNT) - DB pacing metrics (PACING_RESCHED, PACING_CMPL, etc.) This change ensures hw_counters contains only true performance and error statistics. Link: https://patch.msgid.link/r/20250923062657.981487-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Anantha Prabhu Signed-off-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit 604f202bc9ebf9d8a96caec3375a7ba3bcf149b2 Author: Anantha Prabhu Date: Tue Sep 23 11:56:56 2025 +0530 RDMA/bnxt_re: Add debugfs info entry for device and resource information Add a new debugfs info entry that displays device information and non-statistics data using the seq_file interface. This entry shows: - Resource watermarks (peak usage tracking) - Operational counters (CQ resize count) - Doorbell pacing information Link: https://patch.msgid.link/r/20250923062657.981487-2-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Anantha Prabhu Signed-off-by: Kalesh AP Signed-off-by: Jason Gunthorpe commit e216c49b3ebb0729c50870ebfb8b798376dc1edf Author: Takashi Sakamoto Date: Wed Sep 24 22:18:23 2025 +0900 Revert "firewire: core: disable bus management work temporarily during updating topology" This reverts commit abe7159125702c734e851bc0c52b51cd446298a5. The bus manager work item acquires the spin lock of fw_card again, thus no need to serialize it against fw_core_handle_bus_reset(). Link: https://lore.kernel.org/r/20250924131823.262136-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit a6176b7b2a025f050740887238a7fbd3916ab6b5 Author: Takashi Sakamoto Date: Wed Sep 24 22:18:22 2025 +0900 Revert "firewire: core: shrink critical section of fw_card spinlock in bm_work" This reverts commit 582310376d6e9a8d261b682178713cdc4b251af6. The bus manager work has the race condition against fw_destroy_nodes() called by fw_core_remove_card(). The acquition of spin lock of fw_card is left as is again. Link: https://lore.kernel.org/r/20250924131823.262136-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 8ec6a8ec23b9529d6203cab50a22fab3a5fd0d80 Author: Takashi Sakamoto Date: Wed Sep 24 22:11:40 2025 +0900 firewire: core: suppress overflow warning when computing jiffies from isochronous cycle The multiplication by USEC_PER_SEC (=1000000L) may trigger an overflow warning with 32 bit storage. In the case of the subsystem the input value ranges between 800 and 16000, thus the result always fits within 32 bit storage. This commit suppresses the warning by using widening conversion to 64 bit storage before multiplication, then using narrowing conversion to 32 bit storage. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509170136.b5ZHaNAV-lkp@intel.com/ Fixes: 379b870c28c6 ("firewire: core: use helper macros instead of direct access to HZ") Link: https://lore.kernel.org/r/20250924131140.261686-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 2235b26c1b25daf253748acff501af3ea85faaa8 Author: Bartosz Golaszewski Date: Wed Sep 17 10:54:06 2025 +0200 gpio: generic: move GPIO_GENERIC_ flags to the correct header These flags are specific to gpio-mmio and belong in linux/gpio/generic.h so move them there. Link: https://lore.kernel.org/r/20250917-gpio-generic-flags-v1-2-69f51fee8c89@linaro.org Signed-off-by: Bartosz Golaszewski commit 64f89f6e1f2b7f8f203d218a8c8d90922e1d4048 Author: Bartosz Golaszewski Date: Wed Sep 17 10:54:05 2025 +0200 gpio: generic: rename BGPIOF_ flags to GPIO_GENERIC_ Make the flags passed to gpio_generic_chip_init() use the same prefix as the rest of the modernized generic GPIO chip API. Link: https://lore.kernel.org/r/20250917-gpio-generic-flags-v1-1-69f51fee8c89@linaro.org Signed-off-by: Bartosz Golaszewski commit f85e254b51aeadf8dc367aaf2fbd2c20378f75c2 Author: Caleb Sander Mateos Date: Tue Sep 23 09:52:48 2025 -0600 ublk: remove redundant zone op check in ublk_setup_iod() ublk_setup_iod() checks first whether the request is a zoned operation issued to a device without zoned support and returns BLK_STS_IOERR if so. However, such a request would already hit the default case in the subsequent switch statement and fail the ublk_queue_is_zoned() check, which also results in a return of BLK_STS_IOERR. So remove the redundant early check for unsupported zone ops. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit dc64b3d42cb361d4b39eb7cc73037fec52ef9676 Author: Dan Carpenter Date: Tue Sep 23 14:28:39 2025 +0300 ASoC: codecs: wcd-common: fix signedness bug in wcd_dt_parse_micbias_info() The error handling does not work because common->micb_vout[] is an array of u32. We need a signed variable to store negative error codes. Fixes: 4f16b6351bbf ("ASoC: codecs: wcd: add common helper for wcd codecs") Signed-off-by: Dan Carpenter Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/aNKEZ3VqJ8js208v@stanley.mountain Signed-off-by: Mark Brown commit 2cc6710595fb2b693e1e9da4521d9a438d653ad8 Merge: 6be988660b4745 82fd5dc99d63f9 Author: Mark Brown Date: Wed Sep 24 13:45:01 2025 +0200 MediaTek devicetree/bindings warnings sanitization Merge series from Julien Massot : This patch series continues the effort to address Device Tree validation warnings for MediaTek platforms, with a focus on MT8183. It follows the initial cleanup series by Angelo (https://www.spinics.net/lists/kernel/msg5780177.html). The patches in this set eliminate several of the remaining warnings by improving or converting DT bindings to DT schema, adding missing properties, and updating device tree files accordingly. commit 2084660ad288c998b6f0c885e266deb364f65fba Author: Ilkka Koskinen Date: Tue Sep 23 14:31:36 2025 -0700 perf/dwc_pcie: Fix use of uninitialized variable Fix use of uninitialized variable in group validation code. Fixes: 71396cfac97d ("perf/dwc_pcie: Support counting multiple lane events in parallel") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202509231223.gZsX6Eio-lkp@intel.com/ Signed-off-by: Ilkka Koskinen Signed-off-by: Will Deacon commit cc80dbb73b5d0c75b105e5214f34e1360670e0a5 Author: Daniel Almeida Date: Mon Aug 25 15:18:06 2025 -0300 samples: rust: add a USB driver sample In light of the newly-added Rust abstractions for USB devices and drivers, add a sample USB rust driver that serves both to showcase what is currently supported, as well as be the only user of the USB abstractions for now. Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250825-b4-usb-v1-2-7aa024de7ae8@collabora.com [ force USB = y for now - gregkh ] Signed-off-by: Greg Kroah-Hartman commit e7e2296b0ecf9b6e934f7a1118cee91d4d486a84 Author: Daniel Almeida Date: Mon Aug 25 15:18:05 2025 -0300 rust: usb: add basic USB abstractions Add basic USB abstractions, consisting of usb::{Device, Interface, Driver, Adapter, DeviceId} and the module_usb_driver macro. This is the first step in being able to write USB device drivers, which paves the way for USB media drivers - for example - among others. This initial support will then be used by a subsequent sample driver, which constitutes the only user of the USB abstractions so far. Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250825-b4-usb-v1-1-7aa024de7ae8@collabora.com [ force USB = y for now - gregkh ] Signed-off-by: Greg Kroah-Hartman commit a446baa83e98e15b8f911ab7371b405f3063d65a Merge: d943fa61aeebac 01f96b812526a2 Author: Greg Kroah-Hartman Date: Wed Sep 24 13:05:19 2025 +0200 Merge tag 'coresight-next-v6.18-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for Linux v6.18, take 2 This is an updated drop for v6.18, fixing the invalid commit reference in the original tag. CoreSight selfhosted tracing subsystem updates targeting Linux v6.18, includes: - Clean up and consolidate clocks handling - Support for exposing labels via sysfs for better device identification - Add Qualcomm Trace Network On Chip driver support - Miscellaneous fixes Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.18-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits) coresight: Add label sysfs node support dt-bindings: arm: Add label in the coresight components coresight: tnoc: add new AMBA ID to support Trace Noc V2 coresight: Fix incorrect handling for return value of devm_kzalloc coresight: tpda: fix the logic to setup the element size coresight: trbe: Return NULL pointer for allocation failures coresight: Refactor runtime PM coresight: Make clock sequence consistent coresight: Refactor driver data allocation coresight: Consolidate clock enabling coresight: Avoid enable programming clock duplicately coresight: Appropriately disable trace bus clocks coresight: Appropriately disable programming clocks coresight: etm4x: Support atclk coresight: catu: Support atclk coresight: tmc: Support atclk coresight-etm4x: Conditionally access register TRCEXTINSELR coresight: fix indentation error in cscfg_remove_owned_csdev_configs() coresight: tnoc: Fix a NULL vs IS_ERR() bug in probe coresight: add coresight Trace Network On Chip driver ... commit 8aa035a8407f6b6e999afa33839e38267fdc8790 Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:42 2025 +0300 HID: playstation: Switch to scoped_guard() in {dualsense|dualshock4}_output_worker() Those functions were initially excepted from using the scoped_guard() infrastructure as they contain too many long statements, while adding yet another level of indentation seemed to lower readability without bringing an immediate benefit. However, consistency should be more important, hence do the switch and get rid of the remaining explicit acquires & releases of the spinlocks. Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit 3969f77f5dd5c69d513a33f350128e61e0e1ab00 Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:41 2025 +0300 HID: playstation: Silence sparse warnings for locking context imbalances It seems sparse has some difficulties with guard() handling or when mixing it with scoped_guard(), as it shows a bunch lock related warnings: hid-playstation.c:1230:32: warning: context imbalance in 'dualsense_player_led_set_brightness' - wrong count at exit hid-playstation.c:1414:12: warning: context imbalance in 'dualsense_parse_report' - wrong count at exit hid-playstation.c:1615:12: warning: context imbalance in 'dualsense_play_effect' - different lock contexts for basic block hid-playstation.c:1668:13: warning: context imbalance in 'dualsense_set_lightbar' - wrong count at exit hid-playstation.c:1680:13: warning: context imbalance in 'dualsense_set_player_leds' - wrong count at exit hid-playstation.c:2185:33: warning: context imbalance in 'dualshock4_led_set_blink' - wrong count at exit hid-playstation.c:2226:33: warning: context imbalance in 'dualshock4_led_set_brightness' - wrong count at exit hid-playstation.c:2596:12: warning: context imbalance in 'dualshock4_play_effect' - different lock contexts for basic block hid-playstation.c:2634:13: warning: context imbalance in 'dualshock4_set_bt_poll_interval' - wrong count at exit hid-playstation.c:2642:13: warning: context imbalance in 'dualshock4_set_default_lightbar_colors' - wrong count at exit Silent them by switching from guard() to scoped_guard() in {dualsense|dualshock4}_schedule_work(). Reported-by: Benjamin Tissoires Suggested-by: Benjamin Tissoires Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit d335230cb29b7f578dba0b770d97cd320c83892b Author: Cristian Ciocaltea Date: Tue Sep 23 00:29:40 2025 +0300 HID: playstation: Update SP preamp gain comment line Adjusting speaker pre-amp gain to 0x2 indicates +6dB, hence update the related comment line accordingly. Suggested-by: Roderick Colenbrander Signed-off-by: Cristian Ciocaltea Signed-off-by: Jiri Kosina commit afb100a5ea7a13d7e6937dcd3b36b19dc6cc9328 Author: Renjiang Han Date: Thu Sep 18 17:31:08 2025 +0530 media: venus: pm_helpers: add fallback for the opp-table Since the device trees for both HFI_VERSION_1XX and HFI_VERSION_3XX do not include an opp-table and have not configured opp-pmdomain, they still need to use the frequencies defined in the driver's freq_tbl. Both core_power_v1 and core_power_v4 functions require core_clks_enable function during POWER_ON. Therefore, in the core_clks_enable function, if calling dev_pm_opp_find_freq_ceil to obtain the frequency fails, it needs to fall back to the freq_tbl to retrieve the frequency. Fixes: b179234b5e59 ("media: venus: pm_helpers: use opp-table for the frequency") Cc: stable@vger.kernel.org Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Closes: https://lore.kernel.org/linux-media/CA+G9fYu5=3n84VY+vTbCAcfFKOq7Us5vgBZgpypY4MveM=eVwg@mail.gmail.com Signed-off-by: Renjiang Han Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 94662f560bfff75b58a7a68cab4bbd276c785da7 Author: Loic Poulain Date: Wed Sep 17 14:43:12 2025 +0200 media: qcom: camss: vfe: Fix BPL alignment for QCM2290 VFE-340 requires 8-byte alignment instead of 16-byte. This adjustment prevents image corruption/misaligment when padding is needed. Example: For SRGGB10_1X10/3280x2464, aligned BPL was 4112 instead of 4104 Fixes: 9e89149a19ed ("media: qcom: camss: add support for QCM2290 camss") Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 Author: Eric Dumazet Date: Wed Sep 24 07:27:09 2025 +0000 netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack ct_seq_show() has an opportunistic garbage collector : if (nf_ct_should_gc(ct)) { nf_ct_kill(ct); goto release; } So if one nf_conn is killed there, next time ct_get_next() runs, we skip the following item in the bucket, even if it should have been displayed if gc did not take place. We can decrement st->skip_elems to tell ct_get_next() one of the items was removed from the chain. Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack") Signed-off-by: Eric Dumazet Signed-off-by: Florian Westphal commit 94bd247bc25b7f1560f96e9c912db3ec1fc878ea Author: Florian Westphal Date: Wed Sep 10 01:39:48 2025 +0200 selftests: netfilter: nft_concat_range.sh: add check for double-create bug Add a test case for bug resolved with: 'netfilter: nft_set_pipapo_avx2: fix skip of expired entries'. It passes on nf.git (it uses the generic/C version for insertion duplicate check) but fails on unpatched nf-next if AVX2 is supported: cannot create same element twice 0s [FAIL] Could create element twice in same transaction table inet filter { # handle 8 [..] elements = { 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0, 1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0, 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0, 1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0 } Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 5823699a11cf3c05d751b473c66920d2d3cac0a5 Author: Florian Westphal Date: Tue Sep 9 14:11:48 2025 +0200 netfilter: nft_set_pipapo_avx2: fix skip of expired entries KASAN reports following splat: BUG: KASAN: slab-out-of-bounds in pipapo_get_avx2+0x941/0x25d0 Read of size 1 at addr ffff88814c561be0 by task nft/3944 Call Trace: pipapo_get_avx2+0x941/0x25d0 nft_pipapo_insert+0x440/0x11b0 nf_tables_newsetelem+0x220a/0x3a00 .. This bisects to commit 84c1da7b38d9 ("netfilter: nft_set_pipapo: use AVX2 algorithm for insertions too"). However, that change merely uncovers this bug. When we find a match but that match has expired or timed out, the AVX2 implementation restarts the full match loop. At that point, the pointer to the key data has already been changed and points to the keys last field. This will then result in out-of-bounds read once its incremented again for the next field. The restart logic in AVX2 is different compared to the plain C implementation, but both should follow the same logic. The C implementation just calls pipapo_refill() again do check the next entry. Do the same in the AVX2 implementation. Note that with this change, due to implementation differences of pipapo_refill vs. nft_pipapo_avx2_refill, the refill call will return the same element again. Then, on the next call, it will move to the next entry as expected. This is because avx2_refill doesn't clear the bitmap in the 'last' conditional. This is harmless. Expired/timed out elements are also not expected to be frequent. selftest is added in a followup commit. Fixes: 7400b063969b ("nft_set_pipapo: Introduce AVX2-based lookup implementation") Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 4dbac7db17f1e973fbbd6aea07a00181cd4cd162 Author: Florian Westphal Date: Tue Sep 16 18:34:01 2025 +0200 netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups In commit c4eaca2e1052 ("netfilter: nft_set_pipapo: don't check genbit from packetpath lookups") I replaced genmask_cur() with NFT_GENMASK_ANY, but this change has no effect in the pipapo set type. New entries are unreachable from the active copy, so NFT_GENMASK_ANY has same result as genmask_cur(): current-gen elements are disabled and the new-generation elements cannot be found. Tests did not catch this incomplete fix because the change also dropped the genmask test from the AVX2 version of the algorithm, so test only fails if host cpu lacks AVX2 support. Use genmask test only from the control plane (inserts, deletions, ..). Packet path has to skip the check, use of 0 is enough for this because ext->genmask has a the relevant bit set when the element is INACTIVE in that generation: using a 0 genmask thus makes nft_set_elem_active() always return true. Fix the comment and replace NFT_GENMASK_ANY with 0. Fixes: c4eaca2e1052 ("netfilter: nft_set_pipapo: don't check genbit from packetpath lookups") Signed-off-by: Florian Westphal commit 09efbac953f6f076a07735f9ba885148d4796235 Author: Fernando Fernandez Mancera Date: Fri Sep 19 14:40:43 2025 +0200 netfilter: nfnetlink: reset nlh pointer during batch replay During a batch replay, the nlh pointer is not reset until the parsing of the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") that is problematic as the condition to add an ACK for batch begin will evaluate to true even if NLM_F_ACK wasn't used for batch begin message. If there is an error during the command processing, netlink is sending an ACK despite that. This misleads userspace tools which think that the return code was 0. Reset the nlh pointer to the original one when a replay is triggered. Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 134121bfd99a06d44ef5ba15a9beb075297c0821 Author: Slavin Liu Date: Fri Sep 12 01:57:59 2025 +0800 ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") Suggested-by: Julian Anastasov Signed-off-by: Slavin Liu Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e Author: Andrea Righi Date: Wed Sep 24 10:14:26 2025 +0200 bpf: Mark kfuncs as __noclone Some distributions (e.g., CachyOS) support building the kernel with -O3, but doing so may break kfuncs, resulting in their symbols not being properly exported. In fact, with gcc -O3, some kfuncs may be optimized away despite being annotated as noinline. This happens because gcc can still clone the function during IPA optimizations, e.g., by duplicating or inlining it into callers, and then dropping the standalone symbol. This breaks BTF ID resolution since resolve_btfids relies on the presence of a global symbol for each kfunc. Currently, this is not an issue for upstream, because we don't allow building the kernel with -O3, but it may be safer to address it anyway, to prevent potential issues in the future if compilers become more aggressive with optimizations. Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never cloned and remain distinct, globally visible symbols, regardless of the optimization level. Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs") Acked-by: David Vernet Acked-by: Yonghong Song Signed-off-by: Andrea Righi Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com Signed-off-by: Alexei Starovoitov commit ceeaa7135723d77eb1bdab90379125d7c5a56696 Merge: 34f033a6c9c94a 3d237467a444d4 Author: Alexei Starovoitov Date: Wed Sep 24 02:25:07 2025 -0700 Merge branch 'uprobe-bpf-allow-to-change-app-registers-from-uprobe-registers' Jiri Olsa says: ==================== we recently had several requests for tetragon to be able to change user application function return value or divert its execution through instruction pointer change. This patchset adds support for uprobe program to change app's registers including instruction pointer. v4 changes: - rebased on bpf-next/master, we will handle the future simple conflict with tip/perf/core - changed condition in kprobe_prog_is_valid_access [Andrii] - added acks ==================== Link: https://patch.msgid.link/20250916215301.664963-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 3d237467a444d4f23b78ac72210fe5860cd7aed8 Author: Jiri Olsa Date: Tue Sep 16 23:53:01 2025 +0200 selftests/bpf: Add kprobe multi write ctx attach test Adding test to check we can't attach kprobe multi program that writes to the context. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-7-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 1b881ee294b2d8929a77b0e489047765d55f0191 Author: Jiri Olsa Date: Tue Sep 16 23:53:00 2025 +0200 selftests/bpf: Add kprobe write ctx attach test Adding test to check we can't attach standard kprobe program that writes to the context. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-6-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 6a4ea0d1cb4408a7ca8ad0d12bd1d08a35838160 Author: Jiri Olsa Date: Tue Sep 16 23:52:59 2025 +0200 selftests/bpf: Add uprobe context ip register change test Adding test to check we can change the application execution through instruction pointer change through uprobe program. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 7f8a05c5d388668d5631275b3e3a59bfc8669e06 Author: Jiri Olsa Date: Tue Sep 16 23:52:58 2025 +0200 selftests/bpf: Add uprobe context registers changes test Adding test to check we can change common register values through uprobe program. It's x86_64 specific test. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 4363264111e1297fa37aa39b0598faa19298ecca Author: Jiri Olsa Date: Tue Sep 16 23:52:57 2025 +0200 uprobe: Do not emulate/sstep original instruction when ip is changed If uprobe handler changes instruction pointer we still execute single step) or emulate the original instruction and increment the (new) ip with its length. This makes the new instruction pointer bogus and application will likely crash on illegal instruction execution. If user decided to take execution elsewhere, it makes little sense to execute the original instruction, so let's skip it. Acked-by: Oleg Nesterov Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 7384893d970ea114952aef54ad7e3d7d2ca82d4f Author: Jiri Olsa Date: Tue Sep 16 23:52:56 2025 +0200 bpf: Allow uprobe program to change context registers Currently uprobe (BPF_PROG_TYPE_KPROBE) program can't write to the context registers data. While this makes sense for kprobe attachments, for uprobe attachment it might make sense to be able to change user space registers to alter application execution. Since uprobe and kprobe programs share the same type (BPF_PROG_TYPE_KPROBE), we can't deny write access to context during the program load. We need to check on it during program attachment to see if it's going to be kprobe or uprobe. Storing the program's write attempt to context and checking on it during the attachment. Acked-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20250916215301.664963-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 82fd5dc99d63f948c59ac3b08137ef49125938bc Author: Julien Massot Date: Tue Aug 26 09:39:39 2025 +0200 ASoC: dt-binding: Convert MediaTek mt8183-mt6358 to DT schema Convert the existing text-based DT binding for MT8183 sound cards using MT6358 and various other codecs to a DT schema. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-6-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit cf5be90ee4dfa3c38dc64fbcc4fb70fa0180b7b7 Author: Julien Massot Date: Tue Aug 26 09:39:38 2025 +0200 ASoC: Convert MT8183 DA7219 sound card to DT schema Convert the Device Tree binding for MT8183-based boards using the DA7219 headset codec and optional MAX98357, RT1015 or RT1015P speaker amplifiers from the legacy .txt format to DT schema. This improves binding validation and removes DT schema warnings for boards using these audio components. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-5-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit 52aefc1e3c5fbdfdd216796fbe78443ae67e447f Author: Julien Massot Date: Tue Aug 26 09:39:35 2025 +0200 ASoC: dt-binding: Convert mt8183-afe-pcm to dt-schema Convert the MediaTek MT8183 AFE PCM Device Tree binding from the old .txt format to dt-schema format to improve validation. While converting, also document all clock inputs and memory-region used by the AFE block. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Julien Massot Link: https://patch.msgid.link/20250826-mtk-dtb-warnings-v3-2-20e89886a20e@collabora.com Signed-off-by: Mark Brown commit 56d9de46715245c9cc46dbe16830e431056abbc3 Author: Marco Crivellari Date: Tue Sep 23 16:59:05 2025 +0200 wifi: libertas: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. Explicitly add the WQ_UNBOUND flag to alloc_workqueue() users, marking the workqueue unbound. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250923145905.327269-2-marco.crivellari@suse.com [use imperative voice in subject, fix typos] Signed-off-by: Johannes Berg commit 04ffa809728f106e1f8824ba0a0ee32054e393bd Author: Johannes Berg Date: Wed Sep 24 10:47:48 2025 +0200 Revert "wifi: libertas: WQ_PERCPU added to alloc_workqueue users" This reverts commit 1e06a137513d ("wifi: libertas: WQ_PERCPU added to alloc_workqueue users") since there's really no reason to use per-CPU here. Signed-off-by: Johannes Berg commit 6be988660b474564c77cb6ff60776dafcd850a18 Author: Colin Ian King Date: Tue Sep 23 19:50:06 2025 +0100 ASoc: tas2783A: Fix spelling mistake "Perifpheral" -> "Peripheral" There is a spelling mistake in a dev_dbg debug message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250923185006.213861-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 70a0bcde87512c269269443444c109740dcacc19 Author: Chen Ni Date: Wed Sep 24 10:05:40 2025 +0800 ASoc: tas2783A: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20250924020540.234560-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 Author: Xiaowei Li Date: Wed Sep 24 11:16:50 2025 +0800 USB: serial: option: add SIMCom 8230C compositions Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip. USB Device Listings: 0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9071 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=9078 Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1e0e ProdID=907b Rev= 5.15 S: Manufacturer=SIMCOM S: Product=SDXBAAGHA-IDP _SN:D744C4C5 S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01 I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Xiaowei Li Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit df10932ad740ba1f871b6dd2ddafc7dc8cea944f Author: Tejun Heo Date: Tue Sep 23 20:38:23 2025 -1000 Revert "sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast()" This reverts commit c8191ee8e64a8c5c021a34e32868f2380965e82b which triggers the following suspicious RCU usage warning: [ 6.647598] ============================= [ 6.647603] WARNING: suspicious RCU usage [ 6.647605] 6.17.0-rc7-virtme #1 Not tainted [ 6.647608] ----------------------------- [ 6.647608] ./include/linux/rhashtable.h:602 suspicious rcu_dereference_check() usage! [ 6.647610] [ 6.647610] other info that might help us debug this: [ 6.647610] [ 6.647612] [ 6.647612] rcu_scheduler_active = 2, debug_locks = 1 [ 6.647613] 1 lock held by swapper/10/0: [ 6.647614] #0: ffff8b14bbb3cc98 (&rq->__lock){-.-.}-{2:2}, at: +raw_spin_rq_lock_nested+0x20/0x90 [ 6.647630] [ 6.647630] stack backtrace: [ 6.647633] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.17.0-rc7-virtme #1 +PREEMPT(full) [ 6.647643] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 6.647646] Sched_ext: beerland_1.0.2_g27d63fc3_x86_64_unknown_linux_gnu (enabled+all) [ 6.647648] Call Trace: [ 6.647652] [ 6.647655] dump_stack_lvl+0x78/0xe0 [ 6.647665] lockdep_rcu_suspicious+0x14a/0x1b0 [ 6.647672] __rhashtable_lookup.constprop.0+0x1d5/0x250 [ 6.647680] find_dsq_for_dispatch+0xbc/0x190 [ 6.647684] do_enqueue_task+0x25b/0x550 [ 6.647689] enqueue_task_scx+0x21d/0x360 [ 6.647692] ? trace_lock_acquire+0x22/0xb0 [ 6.647695] enqueue_task+0x2e/0xd0 [ 6.647698] ttwu_do_activate+0xa2/0x290 [ 6.647703] sched_ttwu_pending+0xfd/0x250 [ 6.647706] __flush_smp_call_function_queue+0x1cd/0x610 [ 6.647714] __sysvec_call_function_single+0x34/0x150 [ 6.647720] sysvec_call_function_single+0x6e/0x80 [ 6.647726] [ 6.647726] [ 6.647727] asm_sysvec_call_function_single+0x1a/0x20 Reported-by: Andrea Righi Signed-off-by: Tejun Heo commit 7378b003e9e091b9ee69d0545a6468057e7dbc91 Merge: 5d726c4dbeedde 2e482655019ab6 Author: Jens Axboe Date: Tue Sep 23 23:12:20 2025 -0600 Merge tag 'nvme-6.18-2025-09-23' of git://git.infradead.org/nvme into for-6.18/block Pull NVMe updates from Keith: " - FC target fixes (Daniel) - Authentication fixes and updates (Martin, Chris) - Admin controller handling (Kamaljit) - Target lockdep assertions (Max) - Keep-alive updates for discovery (Alastair) - Suspend quirk (Georg)" * tag 'nvme-6.18-2025-09-23' of git://git.infradead.org/nvme: nvme: Use non zero KATO for persistent discovery connections nvmet: add safety check for subsys lock nvme-core: use nvme_is_io_ctrl() for I/O controller check nvme-core: do ioccsz/iorcsz validation only for I/O controllers nvme-core: add method to check for an I/O controller nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk nvme-auth: use hkdf_expand_label() nvme-auth: add hkdf_expand_label() nvme-tcp: send only permitted commands for secure concat nvme-fc: use lock accessing port_state and rport state nvmet-fcloop: call done callback even when remote port is gone nvmet-fc: avoid scheduling association deletion twice nvmet-fc: move lsop put work to nvmet_fc_ls_req_op nvme-auth: update bi_directional flag commit 492263fd564c882a7170a58d3dffb4574de042d4 Author: Anup Patel Date: Mon Aug 18 09:38:57 2025 +0530 dt-bindings: mailbox: Add bindings for RPMI shared memory transport Add device tree bindings for the common RISC-V Platform Management Interface (RPMI) shared memory transport as a mailbox controller. Reviewed-by: Conor Dooley Signed-off-by: Anup Patel Acked-by: Jassi Brar Link: https://lore.kernel.org/r/20250818040920.272664-2-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit dc1dea796b197aba2c3cae25bfef45f4b3ad46fe Author: Kuniyuki Iwashima Date: Tue Sep 23 00:54:19 2025 +0000 tcp: Remove stale locking comment for TFO. The listener -> child locking no longer exists in the fast path since commit e994b2f0fb92 ("tcp: do not lock listener to process SYN packets"). Let's remove the stale comment for reqsk_fastopen_remove(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250923005441.4131554-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e8ab231782e92bc26e5eb605263525636a2f7ae7 Author: Vadim Fedorenko Date: Mon Sep 22 16:19:24 2025 -0700 net: ethtool: tsconfig: set command must provide a reply Timestamping configuration through ethtool has inconsistent behavior of skipping the reply for set command if configuration was not changed. Fix it be providing reply in any case. Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config") Signed-off-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com Signed-off-by: Jakub Kicinski commit f67e9ae72dd72ae37d186d68f7a9f9eb8082cd95 Author: Petr Machata Date: Mon Sep 22 16:14:49 2025 +0200 selftests: bridge_fdb_local_vlan_0: Test FDB vs. NET_ADDR_SET behavior The previous patch fixed an issue whereby no FDB entry would be created for the bridge itself on VLAN 0 under some circumstances. This could break forwarding. Add a test for the fix. Signed-off-by: Petr Machata Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/137cc25396f5a4f407267af895a14bc45552ba5f.1758550408.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 Author: Petr Machata Date: Mon Sep 22 16:14:48 2025 +0200 net: bridge: Install FDB for bridge MAC on VLAN 0 Currently, after the bridge is created, the FDB does not hold an FDB entry for the bridge MAC on VLAN 0: # ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 92:19:8c:4e:01:ed # bridge fdb show | grep 92:19:8c:4e:01:ed 92:19:8c:4e:01:ed dev br vlan 1 master br permanent Later when the bridge MAC is changed, or in fact when the address is given during netdevice creation, the entry appears: # ip link add name br up address 00:11:22:33:44:55 type bridge # bridge fdb show | grep 00:11:22:33:44:55 00:11:22:33:44:55 dev br vlan 1 master br permanent 00:11:22:33:44:55 dev br master br permanent However when the bridge address is set by the user to the current bridge address before the first port is enslaved, none of the address handlers gets invoked, because the address is not actually changed. The address is however marked as NET_ADDR_SET. Then when a port is enslaved, the address is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not added, and it has not been added previously either: # ip link add name br up type bridge # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 # ip link set dev br addr 7e:f0:a8:1a:be:c2 # ip link add name v up type veth # ip link set dev v master br # ip -br link show dev br br UNKNOWN 7e:f0:a8:1a:be:c2 # bridge fdb | grep 7e:f0:a8:1a:be:c2 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent Then when the bridge MAC is used as DMAC, and br_handle_frame_finish() looks up an FDB entry with VLAN=0, it doesn't find any, and floods the traffic instead of passing it up. Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always on netdevice creation. This also makes the behavior consistent with how ports are treated: ports always have an FDB entry for each member VLAN as well as VLAN 0. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit bc992abe0fd1faa8c470c4a652f360b733d5bded Merge: 7e554f317be8e4 092263a0310553 Author: Jakub Kicinski Date: Tue Sep 23 16:58:44 2025 -0700 Merge branch 'net-phy-stop-exporting-phy_driver_register' Heiner Kallweit says: ==================== net: phy: stop exporting phy_driver_register Once the last user of a clock in dp83640 has been removed, the clock should be removed. So far orphaned clocks are cleaned up in dp83640_free_clocks() only. Add the logic to remove orphaned clocks in dp83640_remove(). This allows to simplify the code, and use standard macro module_phy_driver(). dp83640 was the last external user of phy_driver_register(), so we can stop exporting this function afterwards. ==================== Link: https://patch.msgid.link/b86c2ecc-41f6-4f7f-85db-b7fa684d1fb7@gmail.com Signed-off-by: Jakub Kicinski commit 092263a03105539b8dfe74c59be4c6cce1304d5f Author: Heiner Kallweit Date: Sat Sep 20 23:34:07 2025 +0200 net: phy: stop exporting phy_driver_register phy_driver_register() isn't used outside phy_device.c any longer, so we can stop exporting it. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/dff44b83-4a85-4fff-bf6b-f12efd97b56e@gmail.com Signed-off-by: Jakub Kicinski commit 42e2a9e11a1dcb81c83d50d18c547dc9a1c6d6ed Author: Heiner Kallweit Date: Sat Sep 20 23:33:16 2025 +0200 net: phy: dp83640: improve phydev and driver removal handling Once the last user of a clock has been removed, the clock should be removed. So far orphaned clocks are cleaned up in dp83640_free_clocks() only. Add the logic to remove orphaned clocks in dp83640_remove(). This allows to simplify the code, and use standard macro module_phy_driver(). dp83640 was the last external user of phy_driver_register(), so we can stop exporting this function afterwards. Signed-off-by: Heiner Kallweit Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/6d4e80e7-c684-4d95-abbd-ea62b79a9a8a@gmail.com Signed-off-by: Jakub Kicinski commit 7e554f317be8e41ce2f2ce9f6faca14e697b0d26 Author: Heiner Kallweit Date: Sat Sep 20 23:11:54 2025 +0200 net: phy: move config symbol MDIO_BUS to drivers/net/phy/Kconfig Config symbol MDIO_BUS isn't used in drivers/net/mdio. It's only used in drivers/net/phy. So move it there. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/164ff1c6-2cf9-4e30-80fb-da4cc7165dc8@gmail.com Signed-off-by: Jakub Kicinski commit f77064586026df2acbab0631df237d4147350983 Author: Alok Tiwari Date: Sun Sep 21 12:21:08 2025 -0700 selftests: rtnetlink: correct error message in rtnetlink.sh fou test The rtnetlink FOU selftest prints an incorrect string: "FAIL: fou"s. Change it to the intended "FAIL: fou" by removing a stray character in the end_test string of the test. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250921192111.1567498-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 09630ab91d840416b0178f3660afa4eebce24286 Author: Gustavo A. R. Silva Date: Mon Sep 22 16:08:21 2025 +0200 net: airoha: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration to the end of the corresponding structure. Notice that `struct airoha_foe_entry` is a flexible structure, this is a structure that contains a flexible-array member. Fix the following warning: drivers/net/ethernet/airoha/airoha_eth.h:474:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Link: https://patch.msgid.link/aNFYVYLXQDqm4yxb@kspp Signed-off-by: Jakub Kicinski commit b650bf0977d34c52befb31a9fa711534e11b220f Author: Eric Dumazet Date: Mon Sep 22 10:42:40 2025 +0000 udp: remove busylock and add per NUMA queues busylock was protecting UDP sockets against packet floods, but unfortunately was not protecting the host itself. Under stress, many cpus could spin while acquiring the busylock, and NIC had to drop packets. Or packets would be dropped in cpu backlog if RPS/RFS were in place. This patch replaces the busylock by intermediate lockless queues. (One queue per NUMA node). This means that fewer number of cpus have to acquire the UDP receive queue lock. Most of the cpus can either: - immediately drop the packet. - or queue it in their NUMA aware lockless queue. Then one of the cpu is chosen to process this lockless queue in a batch. The batch only contains packets that were cooked on the same NUMA node, thus with very limited latency impact. Tested: DDOS targeting a victim UDP socket, on a platform with 6 NUMA nodes (Intel(R) Xeon(R) 6985P-C) Before: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 1004179 0.0 Udp6InErrors 3117 0.0 Udp6RcvbufErrors 3117 0.0 After: nstat -n ; sleep 1 ; nstat | grep Udp Udp6InDatagrams 1116633 0.0 Udp6InErrors 14197275 0.0 Udp6RcvbufErrors 14197275 0.0 We can see this host can now proces 14.2 M more packets per second while under attack, and the victim socket can receive 11 % more packets. I used a small bpftrace program measuring time (in us) spent in __udp_enqueue_schedule_skb(). Before: @udp_enqueue_us[398]: [0] 24901 |@@@ | [1] 63512 |@@@@@@@@@ | [2, 4) 344827 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [4, 8) 244673 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [8, 16) 54022 |@@@@@@@@ | [16, 32) 222134 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [32, 64) 232042 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [64, 128) 4219 | | [128, 256) 188 | | After: @udp_enqueue_us[398]: [0] 5608855 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [1] 1111277 |@@@@@@@@@@ | [2, 4) 501439 |@@@@ | [4, 8) 102921 | | [8, 16) 29895 | | [16, 32) 43500 | | [32, 64) 31552 | | [64, 128) 979 | | [128, 256) 13 | | Note that the remaining bottleneck for this platform is in udp_drops_inc() because we limited struct numa_drop_counters to only two nodes so far. Signed-off-by: Eric Dumazet Acked-by: Paolo Abeni Reviewed-by: Willem de Bruijn Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250922104240.2182559-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 34f033a6c9c94a6e71c03133f006931bf7d5678b Merge: 8b52d09a1dfe94 5000380e3204fa Author: Martin KaFai Lau Date: Tue Sep 23 16:23:58 2025 -0700 Merge branch 'bpf-next/xdp_pull_data' into 'bpf-next/master' Merge the xdp_pull_data stable branch into the master branch. No conflict. Signed-off-by: Martin KaFai Lau commit a729c16646198872e345bf6c48dbe540ad8a9753 Author: Manivannan Sadhasivam Date: Mon Sep 22 21:46:45 2025 +0530 PCI: qcom: Remove custom ASPM enablement code Since the PCI subsystem has started enabling all ASPM states for all devicetree based platforms, the ASPM enablement code from this driver can now be dropped. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922-pci-dt-aspm-v2-2-2a65cf84e326@oss.qualcomm.com commit f3ac2ff14834a0aa056ee3ae0e4b8c641c579961 Author: Manivannan Sadhasivam Date: Mon Sep 22 21:46:44 2025 +0530 PCI/ASPM: Enable all ClockPM and ASPM states for devicetree platforms So far, the PCI subsystem has honored the ASPM and Clock PM states set by the BIOS (through LNKCTL) during device initialization, if it relies on the default state selected using: * Kconfig: CONFIG_PCIEASPM_DEFAULT=y, or * cmdline: "pcie_aspm=off", or * FADT: ACPI_FADT_NO_ASPM This was done conservatively to avoid issues with the buggy devices that advertise ASPM capabilities, but behave erratically if the ASPM states are enabled. So the PCI subsystem ended up trusting the BIOS to enable only the ASPM states that were known to work for the devices. But this turned out to be a problem for devicetree platforms, especially the ARM based devicetree platforms powering Embedded and *some* Compute devices as they tend to run without any standard BIOS. So the ASPM states on these platforms were left disabled during boot and the PCI subsystem never bothered to enable them, unless the user has forcefully enabled the ASPM states through Kconfig, cmdline, and sysfs or the device drivers themselves, enabling the ASPM states through pci_enable_link_state() APIs. This caused runtime power issues on those platforms. So a couple of approaches were tried to mitigate this BIOS dependency without user intervention by enabling the ASPM states in the PCI controller drivers after device enumeration, and overriding the ASPM/Clock PM states by the PCI controller drivers through an API before enumeration. But it has been concluded that none of these mitigations should really be required and the PCI subsystem should enable the ASPM states advertised by the devices without relying on BIOS or the PCI controller drivers. If any device is found to be misbehaving after enabling ASPM states that they advertised, then those devices should be quirked to disable the problematic ASPM/Clock PM states. In an effort to do so, start by overriding the ASPM and Clock PM states set by the BIOS for devicetree platforms first. Separate helper functions are introduced to override the BIOS set states by enabling all of them if of_have_populated_dt() returns true. To aid debugging, print the overridden ASPM and Clock PM states as well. In the future, these helpers could be extended to allow other platforms like VMD, newer ACPI systems with a cutoff year etc... to follow the path. Link: https://lore.kernel.org/linux-pci/20250828204345.GA958461@bhelgaas Suggested-by: Bjorn Helgaas Signed-off-by: Manivannan Sadhasivam [bhelgaas: tweak comments and dmesg logs] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250922-pci-dt-aspm-v2-1-2a65cf84e326@oss.qualcomm.com commit 55d5a5154d751023bdf12c196fb0f1accdacf300 Merge: 2dfd8b8de66d9b 5000380e3204fa Author: Martin KaFai Lau Date: Tue Sep 23 15:46:52 2025 -0700 Merge branch 'bpf-next/xdp_pull_data' into 'bpf-next/net' Merge the xdp_pull_data stable branch into the net branch. No conflict. Signed-off-by: Martin KaFai Lau commit 649764145b70a0328fc020fe31fc80594761a707 Author: Wolfram Sang Date: Tue Sep 23 22:35:58 2025 +0200 i3c: Remove superfluous FIXME I2C adapters can already change timeout and retry parameters via IOCTL. This allows for better tuning to workloads compared to per-adapter defaults. So, the FIXME is not needed. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250923203557.18298-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit da3a88e9656c17a34daf49c9acc6d85f73b4d3d9 Author: Bartosz Golaszewski Date: Wed Sep 10 09:25:46 2025 +0200 pinctrl: use more common syntax for compound literals The (typeof(foo)) construct is unusual in the kernel, use a more typical syntax by explicitly spelling out the type. Link: https://lore.kernel.org/all/20250909-gpio-mmio-gpio-conv-part4-v1-13-9f723dc3524a@linaro.org/ Suggested-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 2e482655019ab6fcfe8865b62432c6d03f0b5f80 Author: Alistair Francis Date: Tue Sep 2 13:52:11 2025 +1000 nvme: Use non zero KATO for persistent discovery connections The NVMe Base Specification 2.1 states that: """ A host requests an explicit persistent connection ... by specifying a non-zero Keep Alive Timer value in the Connect command. """ As such if we are starting a persistent connection to a discovery controller and the KATO is currently 0 we need to update KATO to a non zero value to avoid continuous timeouts on the target. Signed-off-by: Alistair Francis Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 20015410fbdff3633418484165c694f6ceeb855b Author: Max Gurtovoy Date: Sun Sep 21 15:44:05 2025 +0300 nvmet: add safety check for subsys lock Replace comment about required lock with a lockdep_assert_held() check in the following functions: - nvmet_p2pmem_ns_add_p2p() - nvmet_setup_p2p_ns_map() - nvmet_release_p2p_ns_map() This ensures the subsystem lock is held at runtime. Signed-off-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 80e653fab6676fdcdfe2710cab5fc4312ac47edd Author: Martin George Date: Mon Sep 22 17:35:32 2025 +0530 nvme-core: use nvme_is_io_ctrl() for I/O controller check Replace the current I/O controller check in nvme_init_non_mdts_limits() with the helper nvme_is_io_ctrl() function to maintain consistency with similar checks in other parts of the code and improve code readability. Signed-off-by: Martin George Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit f7e9a615302fec524445da213745609a06b9914d Author: Kamaljit Singh Date: Fri Sep 5 16:25:50 2025 -0700 nvme-core: do ioccsz/iorcsz validation only for I/O controllers An administrative controller does not support I/O queues, hence it should ignore existing checks for IOCCSZ/IORCSZ. Currently, these checks only exclude a discovery controller but need to also exclude an administrative controller. Signed-off-by: Kamaljit Singh Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit a5b852797411a65b99b467766a03be8f24284ddc Author: Kamaljit Singh Date: Fri Sep 5 16:25:49 2025 -0700 nvme-core: add method to check for an I/O controller Add nvme_is_io_ctrl() to check if the controller is of type I/O controller. Uses negative logic by excluding an administrative controller and a discovery controller. Signed-off-by: Kamaljit Singh Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit 5000380e3204fa19a049c6ad5549ff3412124abd Merge: 54728bd535fb38 efec2e55bdefb8 Author: Martin KaFai Lau Date: Tue Sep 23 13:35:13 2025 -0700 Merge branch 'add-kfunc-bpf_xdp_pull_data' Amery Hung says: ==================== Add kfunc bpf_xdp_pull_data v7 -> v6 patch 5 (new patch) - Rename variables in bpf_prog_test_run_xdp() patch 6 - Fix bugs (Martin) v6 -> v5 patch 6 - v5 selftest failed on S390 when changing how tailroom occupied by skb_shared_info is calculated. Revert selftest to v4, where we get SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) by running an XDP program Link: https://lore.kernel.org/bpf/20250919230952.3628709-1-ameryhung@gmail.com/ v5 -> v4 patch 1 - Add a new patch clearing pfmemalloc bit in xdp->frags when all frags are freed in bpf_xdp_adjust_tail() (Maciej) patch 2 - Refactor bpf_xdp_shrink_data() (Maciej) patch 3 - Clear pfmemalloc when all frags are freed in bpf_xdp_pull_data() (Maciej) patch 6 - Use BTF to get sizes of skb_shared_info and xdp_frame (Maciej) Link: https://lore.kernel.org/bpf/20250919182100.1925352-1-ameryhung@gmail.com/ v3 -> v4 patch 2 - Improve comments (Jakub) - Drop new_end and len_free to simplify code (Jakub) patch 4 - Instead of adding is_xdp to bpf_test_init, move lower-bound check of user_size to callers (Martin) - Simplify linear data size calculation (Martin) patch 5 - Add static function identifier (Martin) - Free calloc-ed buf (Martin) Link: https://lore.kernel.org/bpf/20250917225513.3388199-1-ameryhung@gmail.com/ v2 -> v3 Separate mlx5 fixes from the patchset patch 2 - Use headroom for pulling data by shifting metadata and data down (Jakub) - Drop the flags argument (Martin) patch 4 - Support empty linear xdp data for BPF_PROG_TEST_RUN Link: https://lore.kernel.org/bpf/20250915224801.2961360-1-ameryhung@gmail.com/ v1 -> v2 Rebase onto bpf-next Try to build on top of the mlx5 patchset that avoids copying payload to linear part by Christoph but got a kernel panic. Will rebase on that patchset if it got merged first, or separate the mlx5 fix from this set. patch 1 - Remove the unnecessary head frag search (Dragos) - Rewind the end frag pointer to simplify the change (Dragos) - Rewind the end frag pointer and recalculate truesize only when the number of frags changed (Dragos) patch 3 - Fix len == zero behavior. To mirror bpf_skb_pull_data() correctly, the kfunc should do nothing (Stanislav) - Fix a pointer wrap around bug (Jakub) - Use memmove() when moving sinfo->frags (Jakub) Link: https://lore.kernel.org/bpf/20250905173352.3759457-1-ameryhung@gmail.com/ ==================== Link: https://patch.msgid.link/20250922233356.3356453-1-ameryhung@gmail.com Signed-off-by: Martin KaFai Lau commit efec2e55bdefb889639a6e7fe1f1f2431cdddc6a Author: Amery Hung Date: Mon Sep 22 16:33:56 2025 -0700 selftests: drv-net: Pull data before parsing headers It is possible for drivers to generate xdp packets with data residing entirely in fragments. To keep parsing headers using direct packet access, call bpf_xdp_pull_data() to pull headers into the linear data area. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-9-ameryhung@gmail.com commit 89a3ecca49ee889cc1ab4def6caa0452df196efb Author: Pratyush Yadav Date: Wed Sep 17 14:56:54 2025 +0200 kho: make sure page being restored is actually from KHO When restoring a page, no sanity checks are done to make sure the page actually came from a kexec handover. The caller is trusted to pass in the right address. If the caller has a bug and passes in a wrong address, an in-use page might be "restored" and returned, causing all sorts of memory corruption. Harden the page restore logic by stashing in a magic number in page->private along with the order. If the magic number does not match, the page won't be touched. page->private is an unsigned long. The union kho_page_info splits it into two parts, with one holding the order and the other holding the magic number. Link: https://lkml.kernel.org/r/20250917125725.665-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 20571b187051e5b78b48b99c9bdd425c94b29e18 Author: Pratyush Yadav Date: Wed Sep 17 14:56:53 2025 +0200 kho: move sanity checks to kho_restore_page() While KHO exposes folio as the primitive externally, internally its restoration machinery operates on pages. This can be seen with kho_restore_folio() for example. It performs some sanity checks and hands it over to kho_restore_page() to do the heavy lifting of page restoration. After the work done by kho_restore_page(), kho_restore_folio() only converts the head page to folio and returns it. Similarly, deserialize_bitmap() operates on the head page directly to store the order. Move the sanity checks for valid phys and order from the public-facing kho_restore_folio() to the private-facing kho_restore_page(). This makes the boundary between page and folio clearer from KHO's perspective. While at it, drop the comment above kho_restore_page(). The comment is misleading now. The function stopped looking like free_reserved_page() since 12b9a2c05d1b4 ("kho: initialize tail pages for higher order folios properly"), and now looks even more different. Link: https://lkml.kernel.org/r/20250917125725.665-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Baoquan He Cc: Changyuan Lyu Cc: Chris Li Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 0389c305ef56cbadca4cbef44affc0ec3213ed30 Author: Lance Yang Date: Wed Sep 17 21:31:37 2025 +0800 selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled The madv_populate and soft-dirty kselftests currently fail on systems where CONFIG_MEM_SOFT_DIRTY is disabled. Introduce a new helper softdirty_supported() into vm_util.c/h to ensure tests are properly skipped when the feature is not enabled. Link: https://lkml.kernel.org/r/20250917133137.62802-1-lance.yang@linux.dev Fixes: 9f3265db6ae8 ("selftests: vm: add test for Soft-Dirty PTE bit") Signed-off-by: Lance Yang Acked-by: David Hildenbrand Suggested-by: David Hildenbrand Cc: Lorenzo Stoakes Cc: Shuah Khan Cc: Gabriel Krisman Bertazi Cc: Signed-off-by: Andrew Morton commit 8d009da32f13759ee7a6ec002ba62dc8faeb6423 Author: SeongJae Park Date: Wed Sep 17 08:31:54 2025 -0700 mm/damon/sysfs: set damon_ctx->min_sz_region only for paddr use case damon_ctx->addr_unit is respected only for physical address space monitoring use case. Meanwhile, damon_ctx->min_sz_region is used by the core layer for aligning regions, regardless of whether it is set for physical address space monitoring or virtual address spaces monitoring. And it is set as 'DAMON_MIN_REGION / damon_ctx->addr_unit'. Hence, if user sets ->addr_unit on virtual address spaces monitoring mode, regions can be unexpectedly aligned in min_sz_region only when it is configured for physical address space monitoring. The issue was found from a result of Chris' experiments that thankfully shared with me off-list. Link: https://lkml.kernel.org/r/20250917160041.53187-1-sj@kernel.org Fixes: d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") Signed-off-by: SeongJae Park Cc: Chris Mason Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit 7ef5268a907534c4e6373b0d3fe45e0b3d95bfe2 Author: Uladzislau Rezki (Sony) Date: Wed Sep 17 20:59:06 2025 +0200 mm/vmalloc: move resched point into alloc_vmap_area() Currently vm_area_alloc_pages() contains two cond_resched() points. However, the page allocator already has its own in slow path so an extra resched is not optimal because it delays the loops. The place where CPU time can be consumed is in the VA-space search in alloc_vmap_area(), especially if the space is really fragmented using synthetic stress tests, after a fast path falls back to a slow one. Move a single cond_resched() there, after dropping free_vmap_area_lock in a slow path. This keeps fairness where it matters while removing redundant yields from the page-allocation path. [akpm@linux-foundation.org: tweak comment grammar] Link: https://lkml.kernel.org/r/20250917185906.1595454-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Baoquan He Cc: Michal Hocko Signed-off-by: Andrew Morton commit 1b00ab48892fe6115618e2c81f9c1891ad0c0a5a Author: Matthew Wilcox (Oracle) Date: Tue Sep 16 19:11:59 2025 +0100 ksm: use a folio inside cmp_and_merge_page() This removes the last call to page_stable_node(), so delete the wrapper. It also removes a call to trylock_page() and saves a call to compound_head(), as well as removing a reference to folio->page. Link: https://lkml.kernel.org/r/20250916181219.2400258-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chengming Zhou Acked-by: David Hildenbrand Cc: Longlong Xia Cc: xu xin Signed-off-by: Andrew Morton commit 19c5fb83f2a4dde7b53b3aeb1fa87bfa3559286b Author: Johannes Weiner Date: Fri Sep 19 12:21:34 2025 -0400 mm: page_alloc: avoid kswapd thrashing due to NUMA restrictions On NUMA systems without bindings, allocations check all nodes for free space, then wake up the kswapds on all nodes and retry. This ensures all available space is evenly used before reclaim begins. However, when one process or certain allocations have node restrictions, they can cause kswapds on only a subset of nodes to be woken up. Since kswapd hysteresis targets watermarks that are *higher* than needed for allocation, even *unrestricted* allocations can now get suckered onto such nodes that are already pressured. This ends up concentrating all allocations on them, even when there are idle nodes available for the unrestricted requests. This was observed with two numa nodes, where node0 is normal and node1 is ZONE_MOVABLE to facilitate hotplugging: a kernel allocation wakes kswapd on node0 only (since node1 is not eligible); once kswapd0 is active, the watermarks hover between low and high, and then even the movable allocations end up on node0, only to be kicked out again; meanwhile node1 is empty and idle. Similar behavior is possible when a process with NUMA bindings is causing selective kswapd wakeups. To fix this, on NUMA systems augment the (misleading) watermark test with a check for whether kswapd is already active during the first iteration through the zonelist. If this fails to place the request, kswapd must be running everywhere already, and the watermark test is good enough to decide placement. With this patch, unrestricted requests successfully make use of node1, even while kswapd is reclaiming node0 for restricted allocations. [gourry@gourry.net: don't retry if no kswapds were active] Link: https://lkml.kernel.org/r/20250919162134.1098208-1-hannes@cmpxchg.org Signed-off-by: Gregory Price Tested-by: Joshua Hahn Signed-off-by: Johannes Weiner Acked-by: Zi Yan Cc: Brendan Jackman Cc: Joshua Hahn Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fde591dad10900b9b4af07a532b5f91c53b20e25 Author: Lorenzo Stoakes Date: Wed Sep 17 06:16:37 2025 +0100 mm/oom_kill.c: fix inverted check Fix an incorrect logic conversion in process_mrelease(). Link: https://lkml.kernel.org/r/3b7f0faf-4dbc-4d67-8a71-752fbcdf0906@lucifer.local Fixes: 12e423ba4eae ("mm: convert core mm to mm_flags_*() accessors") Signed-off-by: Lorenzo Stoakes Reported-by: Chris Mason Closes: https://lkml.kernel.org/r/c2e28e27-d84b-4671-8784-de5fe0d14f41@lucifer.local Signed-off-by: Andrew Morton commit f8a01513f5749180228d6460662188dd1e101a53 Author: Kiryl Shutsemau Date: Mon Sep 15 14:52:53 2025 +0100 mm/khugepaged: do not fail collapse_pte_mapped_thp() on SCAN_PMD_NULL MADV_COLLAPSE on a file mapping behaves inconsistently depending on if PMD page table is installed or not. Consider following example: p = mmap(NULL, 2UL << 20, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); err = madvise(p, 2UL << 20, MADV_COLLAPSE); fd is a populated tmpfs file. The result depends on the address that the kernel returns on mmap(). If it is located in an existing PMD table, the madvise() will succeed. However, if the table does not exist, it will fail with -EINVAL. This occurs because find_pmd_or_thp_or_none() returns SCAN_PMD_NULL when a page table is missing, which causes collapse_pte_mapped_thp() to fail. SCAN_PMD_NULL and SCAN_PMD_NONE should be treated the same in collapse_pte_mapped_thp(): install the PMD leaf entry and allocate page tables as needed. Link: https://lkml.kernel.org/r/v5ivpub6z2n2uyemlnxgbilzs52ep4lrary7lm7o6axxoneb75@yfacfl5rkzeh Signed-off-by: Kiryl Shutsemau Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Reviewed-by: Zach O'Keefe Cc: Barry Song Cc: "Kirill A. Shutemov" Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ff0bebab778c7474c328bc7e5e9bf3c39bf4fc1a Merge: ebc5eb9ea01fec dcc7a571a3665a Author: Arnd Bergmann Date: Tue Sep 23 23:08:23 2025 +0200 Merge tag 'tee-qcomtee-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers Add Qualcomm TEE driver (QTEE) This introduces a Trusted Execution Environment (TEE) driver for Qualcomm TEE (QTEE). QTEE enables Trusted Applications (TAs) and services to run securely. It uses an object-based interface, where each service is an object with sets of operations. Kernel and userspace services are also available to QTEE through a similar approach. QTEE makes callback requests that are converted into object invocations. These objects can represent services within the kernel or userspace process. We extend the TEE subsystem to understand object parameters and an ioctl call so client can invoke objects in QTEE: - TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_* - TEE_IOC_OBJECT_INVOKE The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are used for invoking services in the userspace process by QTEE. The TEE backend driver uses the QTEE Transport Message to communicate with QTEE. Interactions through the object INVOKE interface are translated into QTEE messages. Likewise, object invocations from QTEE for userspace objects are converted into SEND/RECV ioctl calls to supplicants. * tag 'tee-qcomtee-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: Documentation: tee: Add Qualcomm TEE driver tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl tee: qcom: add primordial object tee: add Qualcomm TEE driver tee: increase TEE_MAX_ARG_SIZE to 4096 tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF tee: add close_context to TEE driver operation tee: allow a driver to allocate a tee_device without a pool Link: https://lore.kernel.org/r/20250915174957.GA2040478@rayden Signed-off-by: Arnd Bergmann commit ebc5eb9ea01fecda0bf0666d856adc699d177150 Merge: 7150189b621b5f 3804cef4c59742 Author: Arnd Bergmann Date: Tue Sep 23 23:07:31 2025 +0200 Merge tag 'memory-controller-drv-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.18 1. STM32 OMM: Fix ineffective/missing setting of the req2ack in the device based on DT property, if the value is different than 0. 2. Samsung Exynos SROM: Fix IO map resource leak if of_platform_populate() in probe() failed. 3. Broadcom brcmstb: Document existing, older devices in Devicetree bindings. 4. Tegra 210 EMC: Document OPP table for interconnects (driver usage will come later) and define memory client IDs as bindings, because these are shared between DTS and driver. * tag 'memory-controller-drv-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra210: Use bindings for client ids dt-bindings: memory: tegra210: Add memory client IDs dt-bindings: memory: tegra210: emc: Document OPP table and interconnect dt-bindings: memory: Update brcmstb-memc-ddr binding with older chips memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe memory: stm32_omm: Fix req2ack update test Link: https://lore.kernel.org/r/20250912140030.204650-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 32cdf411b4f8c23f6a5e6d897a64d1501dfaaee3 Merge: ca8f96ffe67fa9 a1b20e06224557 Author: Arnd Bergmann Date: Tue Sep 23 23:06:28 2025 +0200 Merge tag 'v6.18-rockchip-arm32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/arm Commit d1bef995f61a ("ARM: rockchip: force built-in regulator support for PM") introduced the REGULATOR if PM dependency for the suspend code, while commit d1558dfd9f22 ("ARM: rockchip: Force CONFIG_PM on Rockchip systems") later always enabled PM. So we can simplify the REGULATOR dependency by dropping the if PM. * tag 'v6.18-rockchip-arm32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: remove REGULATOR conditional to PM Link: https://lore.kernel.org/r/6025175.zQ0Gbyo6oJ@diego Signed-off-by: Arnd Bergmann commit ca8f96ffe67fa97b39ac56cec8acbe87cec299f7 Merge: 1cdfe53d5798cb bb676996ed5834 Author: Arnd Bergmann Date: Tue Sep 23 23:05:04 2025 +0200 Merge tag 'omap-for-v6.18/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: OMAP: SoC: updates for v6.18 * tag 'omap-for-v6.18/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: OMAP2+: clock: convert from round_rate() to determine_rate() ARM: OMAP1: clock: convert from round_rate() to determine_rate() arm: omap2: use string choices helper ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init ARM: OMAP2+: use IS_ERR_OR_NULL() helper ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) Link: https://lore.kernel.org/r/7h7bxup0ob.fsf@baylibre.com Signed-off-by: Arnd Bergmann commit 1cdfe53d5798cbad2a1e67a108e8b3a4ef08edfb Merge: 9685b297597264 747436750bc0ef Author: Arnd Bergmann Date: Tue Sep 23 23:04:23 2025 +0200 Merge tag 'at91-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/arm Microchip arm-soc updates for v6.18 This update includes: - low priority fixes to the PM code, in relation to recent addition of sam9x75 or sama7d65 SoCs - removal of the 2.5V regulator for low power modes since this is no longer supported * tag 'at91-soc-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: pm: Remove 2.5V regulator ARM: at91: pm: save and restore ACR during PLL disable/enable ARM: at91: pm: fix MCKx restore routine ARM: at91: pm: fix .uhp_udp_mask specification for current SoCs Link: https://lore.kernel.org/r/20250916150328.27015-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit 7150189b621b5fc7bfbd069d441cd8c6eefeabc9 Merge: be6d2636807649 e6b84cc2a6fe62 Author: Arnd Bergmann Date: Tue Sep 23 23:02:47 2025 +0200 Merge tag 'sunxi-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers Allwinner driver changes for 6.18 Some changes to the sram driver. One to register a syscon explicitly. Another to add a new driver entry for the A523, which has two Ethernet controllers, and thus has two RGMII clock delay control registers. * tag 'sunxi-drivers-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: soc: sunxi: sram: register regmap as syscon soc: sunxi: sram: add entry for a523 Link: https://lore.kernel.org/r/aMrsfw-_v3IAiKH8@wens.tw Signed-off-by: Arnd Bergmann commit be6d2636807649b8b20f956e70b54b799aab5cfd Merge: 833bb53d5ecf22 037e496038f6e4 Author: Arnd Bergmann Date: Tue Sep 23 23:01:25 2025 +0200 Merge tag 'ti-driver-soc-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.18 - ti_sci: Add support for abort handling of entry to Low Power Mode - k3-socinfo: Add decode for AM62L SR1.1 silicon revision - pruss: Replace usage of %pK in printk with safer %p formatting * tag 'ti-driver-soc-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: k3-socinfo: Add information for AM62L SR1.1 firmware: ti_sci: Enable abort handling of entry to LPM soc: ti: pruss: don't use %pK through printk Link: https://lore.kernel.org/r/20250916175441.iehltsk2377rg5c6@alike Signed-off-by: Arnd Bergmann commit 833bb53d5ecf22a0f950da98712008f32f406991 Merge: 72af4030bef819 0454346d1c5f7f Author: Arnd Bergmann Date: Tue Sep 23 23:00:33 2025 +0200 Merge tag 'amlogic-drivers-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic Drivers changes for v6.18: - device leak at probe in meson_sm - fix compile-test default for meson_sm * tag 'amlogic-drivers-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: firmware: firmware: meson-sm: fix compile-test default firmware: meson_sm: fix device leak at probe Link: https://lore.kernel.org/r/003cb467-531d-4a8d-a97f-19d59154132f@linaro.org Signed-off-by: Arnd Bergmann commit a40282dd3c484e6c882e93f4680e0a3ef3814453 Author: Kees Cook Date: Sat Sep 20 16:45:23 2025 -0700 gcc-plugins: Remove TODO_verify_il for GCC >= 16 GCC now runs TODO_verify_il automatically[1], so it is no longer exposed to plugins. Only use the flag on GCC < 16. Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=9739ae9384dd7cd3bb1c7683d6b80b7a9116eaf8 [1] Suggested-by: Christopher Fore Link: https://lore.kernel.org/r/20250920234519.work.915-kees@kernel.org Signed-off-by: Kees Cook commit 72af4030bef819e49b9fae1d753a730d517d2abc Merge: 3783cdc1df6d4b 442816f97a4f84 Author: Arnd Bergmann Date: Tue Sep 23 22:59:16 2025 +0200 Merge tag 'apple-soc-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers Apple SoC driver updates for 6.18 Krzysztof Kozlowski asked us to move away from generic compatibles: - Adjust all dt-bindings to use apple,t8103-XXXX instead of apple,XXXX as fallback and add a comment that the old generic list should no longer be extended. - Add new fallback compatibles to pinctrl, pmdomain, spi, and mca drivers. These changes have been Acked by their subsystem maintainers to be merged through our tree together with the dt-bindings. Support for pre-M1 Apple Silicon: - SART and mailbox gain support for Apple's A11, which are both required for NVMe. - NVMe also gains support for Apple's A11 and the nvme maintainers prefer that we merge this through the soc tree together with the mailbox and SART changes. - SPMI compatibles for A11 and T2 have been added, also going through the soc tree due to conflicts with the generic compatible removal and because no driver change is required. Signed-off-by: Sven Peter * tag 'apple-soc-drivers-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: (32 commits) pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" dt-bindings: spmi: Add Apple A11 and T2 compatible spi: apple: Add "apple,t8103-spi" compatible ASoC: apple: mca: Add "apple,t8103-mca" compatible pinctrl: apple: Add "apple,t8103-pinctrl" as compatible spi: dt-bindings: apple,spi: Add t6020-spi compatible ASoC: dt-bindings: apple,mca: Add t6020-mca compatible dt-bindings: dma: apple,admac: Add t6020-admac compatible dt-bindings: clock: apple,nco: Add t6020-nco compatible dt-bindings: watchdog: apple,wdt: Add t6020-wdt compatible dt-bindings: spmi: apple,spmi: Add t6020-spmi compatible dt-bindings: mfd: apple,smc: Add t6020-smc compatible dt-bindings: net: bcm4329-fmac: Add BCM4388 PCI compatible dt-bindings: net: bcm4377-bluetooth: Add BCM4388 compatible dt-bindings: nvme: apple: Add apple,t6020-nvme-ans2 compatible dt-bindings: iommu: apple,sart: Add apple,t6020-sart compatible dt-bindings: gpu: apple,agx: Add agx-{g14s,g14c,g14d} compatibles dt-bindings: mailbox: apple,mailbox: Add t6020 compatible dt-bindings: pinctrl: apple,pinctrl: Add apple,t6020-pinctrl compatible dt-bindings: iommu: dart: Add apple,t6020-dart compatible ... Link: https://lore.kernel.org/r/20250920123028.49973-1-sven@kernel.org Signed-off-by: Arnd Bergmann commit 3783cdc1df6d4b4337865ceb6709f8f4efed4318 Merge: 9674bc8805cd7a 3f1707306b79ca Author: Arnd Bergmann Date: Tue Sep 23 22:56:29 2025 +0200 Merge tag 'qcom-drivers-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm device driver updates for v6.18 Introduce support for loading firmware into the QUP serial engines from Linux, which allows deferring selection of which protocol (uart, i2c, spi, etc) a given SE should have until the OS loads. Also introduce the "object invoke" interface in the SCM driver, to provide interface to the Qualcomm TEE driver. * tag 'qcom-drivers-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: serial: qcom-geni: Load UART qup Firmware from linux side spi: geni-qcom: Load spi qup Firmware from linux side i2c: qcom-geni: Load i2c qup Firmware from linux side soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem soc: qcom: geni-se: Cleanup register defines and update copyright dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus firmware: qcom: scm: add support for object invocation firmware: qcom: tzmem: export shm_bridge create/delete Link: https://lore.kernel.org/r/20250921020225.595403-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 2136c694a045c347b52366a297d107329796ffe5 Merge: 4a77e9ed4e277d cf0ed173d27a2a Author: Arnd Bergmann Date: Tue Sep 23 22:55:03 2025 +0200 Merge tag 'qcom-arm64-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v6.18 The Qualcomm X Plus platform gained GPU support, enable the required clock controller. The support for Qualcomm QCS615 platform improved, enable the multimedia-related clock controllers. * tag 'qcom-arm64-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable X1P42100 GPUCC driver arm64: defconfig: Enable QCS615 clock controllers Link: https://lore.kernel.org/r/20250921020612.596098-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 4a77e9ed4e277dfaa6455d9005993c6dc62ab917 Merge: 8193017c718201 3e23fc50890d3f Author: Arnd Bergmann Date: Tue Sep 23 22:54:10 2025 +0200 Merge tag 'qcom-arm32-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm32 defconfig updates for v6.18 Remove a bunch of orphaned options from the defconfigs. * tag 'qcom-arm32-defconfig-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: defconfig: Remove obsolete CONFIG_USB_EHCI_MSM ARM: defconfig: cleanup orphaned CONFIGs Link: https://lore.kernel.org/r/20250921020746.596400-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 0d4495122a5e0e7a32e68884c4037c969eb03764 Merge: 07d0eca0789657 fad32e8ac46019 Author: Arnd Bergmann Date: Tue Sep 23 22:49:41 2025 +0200 Merge tag 'cix-dt-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt CIX device tree changes for v6.18-rc1: - arm64: dts: cix: add DT nodes for all I2C and I3C ports for sky1 * tag 'cix-dt-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: arm64: dts: cix: add DT nodes for all I2C and I3C ports for sky1 Link: https://lore.kernel.org/r/aNIyhPSV6lJaZIvR@nchen-desktop Signed-off-by: Arnd Bergmann commit 07d0eca07896572b9aaa1ea5ed7a5143f1e38245 Merge: a08be517c450b7 c656932c3ece3e Author: Arnd Bergmann Date: Tue Sep 23 22:49:00 2025 +0200 Merge tag 'at91-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.18 This update includes: - sama7d65 and curiosity board: addition of gpio, leds and usart3 - sam9x75: qspi node - one cleanup * tag 'at91-dt-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sam9x7: Add qspi controller ARM: dts: microchip: sama7d65: add uart3 definition for flexcom3 peripheral ARM: dts: microchip: sama7d65: Add GPIO buttons and LEDs ARM: dts: microchip: Minor whitespace cleanup Link: https://lore.kernel.org/r/20250922170346.40876-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit a08be517c450b72ca9e9e3b14201b5cb18cf3bfe Merge: d1f862c0b960c0 07c7f4f4e9504d Author: Arnd Bergmann Date: Tue Sep 23 22:48:16 2025 +0200 Merge tag 'sunxi-dt-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner Device Tree changes for 6.18 - part 2 A new board, the Amediatech X96Q, was added. * tag 'sunxi-dt-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: h313: Add Amediatech X96Q dt-bindings: arm: sunxi: Add Amediatech X96Q Link: https://lore.kernel.org/r/aNFg7iuBtyWkCZg6@wens.tw Signed-off-by: Arnd Bergmann commit d1f862c0b960c0ed631ed3c631681f30ec1d77fd Merge: 5ab67bad49fa3f 93781211e9ad95 Author: Arnd Bergmann Date: Tue Sep 23 22:47:26 2025 +0200 Merge tag 'v6.18-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt One new board the ROC-RK3588-RT, gpu improvements for RK3328, frequency scaling for the RK3528 and the very first small steps for camera support on the RK3588 - with the CSI-DPHY support, with more hopefully to come soon'ish :-) . And apart from those bigger points, some more individual peripheral work on some boards. * tag 'v6.18-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Add devicetree for the ROC-RK3588-RT dt-bindings: arm: rockchip: Add Firefly ROC-RK3588-RT arm64: dts: rockchip: update pinctrl names for Radxa E52C arm64: dts: rockchip: remove vcc_3v3_pmu regulator for Radxa E52C arm64: dts: rockchip: Add USB and charger to Gameforce Ace arm64: dts: rockchip: enable the Mali GPU on RK3328 boards arm64: dts: rockchip: add GPU powerdomain, opps, and cooling to rk3328 arm64: dts: rockchip: Fix network on rk3576 evb1 board arm64: dts: rockchip: add mipi csi-2 dphy nodes to rk3588 dt-bindings: soc: rockchip: add rk3588 csidphy grf syscon arm64: dts: rockchip: Add rk3528 CPU frequency scaling support arm64: dts: rockchip: enable HDMI Receiver on NanoPC T6 Link: https://lore.kernel.org/r/2079092.kXSN5OTJKJ@diego Signed-off-by: Arnd Bergmann commit 5ab67bad49fa3f2a6b8fcab988e36f2e885ea0fa Merge: 8de446fd49c2de 2f695d3eac3660 Author: Arnd Bergmann Date: Tue Sep 23 22:46:00 2025 +0200 Merge tag 'qcom-arm64-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualocmm Arm64 DeviceTree updates for v6.18 Introduce the Hamoa IoT SOM and the Hamoa EVK board, the HP Omnibook X14, the Particle Tachyon board, and the Samsung Galaxy S22. On IPQ5018 another set of UART and I2C controllers are added. On Lemans SDHCI and the camera subsystem is introduced, the USB controllers are updated to the new flattened binding. The Lemans EVK gains Ethernet definition, more QUP controllers and their GPI DMA engines are defined. PCIe, SDHCI, remoteproc and iris video accelerator are added as well. On the Monaco platform GPU and GMU are introduced, the USB controller nodes are updated to the new flattened binding. The GPU is enabled on the EVK and the Ride boards. SDCC and MDSS resets are defined on MSM8916, MSM8939 also gets the MDSS reset. On QCM2290 the camera clock interface is added. On the QCS615 tsens and related thermal-zones are introduced. On SDM845 the OnePlus 6 gains notifications LED, and the sensor core (SLPI) is enabled on the Samsung Galaxy S9. WiFi and Bluetooth is enabled on the SM8750 MTP. The IRIS video accelerator is introduce for X Elite and enabled on a variety of laptops. DisplayPort controllers on a variety of boards are updated to describe additional pixel clocks, used for MST. * tag 'qcom-arm64-for-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (57 commits) arm64: dts: qcom: Add MST pixel streams for displayport arm64: dts: qcom: sm6350: correct DP compatibility strings arm64: dts: qcom: monaco-evk: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300-ride: Enable Adreno 623 GPU arm64: dts: qcom: qcs8300: Add gpu and gmu nodes dt-bindings: arm: qcom: sort sm8450 boards arm64: dts: qcom: Add base HAMOA-IOT-EVK board arm64: dts: qcom: Add HAMOA-IOT-SOM platform dt-bindings: arm: qcom: Document HAMOA-IOT-EVK board arm64: dts: qcom: sm8750-mtp: Add WiFi and Bluetooth arm64: dts: qcom: msm8953-xiaomi-daisy: fix cd-gpios arm64: dts: qcom: ipq5018: add QUP1 UART2 node arm64: dts: qcom: lemans: Flatten usb controller nodes arm64: dts: qcom: qcs615: Enable TSENS support for QCS615 SoC arm64: dts: qcom: sdm845-enchilada: Add notification LED arm64: dts: qcom: apq8016-sbc: Drop redundant HDMI bridge status arm64: dts: qcom: apq8016-sbc: Correct HDMI bridge #sound-dai-cells arm64: dts: qcom: lemans: Add PCIe lane equalization preset properties arm64: dts: qcom: sm8450: enable camera clock controller by default arm64: dts: qcom: qcm2290: Add CCI node ... Link: https://lore.kernel.org/r/20250921022346.598294-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 8de446fd49c2de7f3d766a80c32f039c6445b5c3 Merge: 26116b98d657b4 70fa521f4d5512 Author: Arnd Bergmann Date: Tue Sep 23 22:43:08 2025 +0200 Merge tag 'apple-soc-dt-6.18-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt Apple SoC DTS updates for 6.18, part 2 - New device trees for all M2 Pro, Max and Ultra models are added. This is responsible for most of the changed lines since we already need 2000+ lines just to describe all the power domains inside t602x-pmgr.dtsi for these SoCs. - Missing WiFi properties for t600x are added. - Bluetooth nodes are added for all t600x machines. - The PCIe ethernet iommu-map was fixed for the Apple M1 iMac to account for a disabled PCIe port. - SPMI, NVMe, SART and mailbox nodes for Apple's T2 and A11. * tag 'apple-soc-dt-6.18-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: t8015: Add SPMI node arm64: dts: apple: t8012: Add SPMI node arm64: dts: apple: Add J180d (Mac Pro, M2 Ultra, 2023) device tree arm64: dts: apple: Add J474s, J475c and J475d device trees arm64: dts: apple: Add J414 and J416 Macbook Pro device trees arm64: dts: apple: Add initial t6020/t6021/t6022 DTs arm64: dts: apple: Add ethernet0 alias for J375 template dt-bindings: arm: apple: Add t6020x compatibles arm64: dts: apple: t8015: Add NVMe nodes arm64: dts: apple: t8015: Fix PCIE power domains dependencies arm64: dts: apple: Add devicetreee for t8112-j415 dt-bindings: arm: apple: Add t8112 j415 compatible arm64: dts: apple: t600x: Add bluetooth device nodes arm64: dts: apple: t600x: Add missing WiFi properties arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map Signed-off-by: Arnd Bergmann commit 26116b98d657b4d0ddc4d101a60b6ab072d556dc Merge: 345518c00ba6bc 27322753c8b913 Author: Arnd Bergmann Date: Tue Sep 23 22:40:43 2025 +0200 Merge tag 'omap-for-v6.18/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt ARM: dts: ti: omap updates for v6.18 These are all minor corrections to the dts files. * tag 'omap-for-v6.18/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax ARM: dts: omap: Minor whitespace cleanup ARM: dts: omap: dm816x: Split 'reg' per entry ARM: dts: omap: dm814x: Split 'reg' per entry ARM: dts: am33xx-l4: fix UART compatible ARM: dts: ti: omap4: Use generic "ethernet" as node name Signed-off-by: Arnd Bergmann commit 345518c00ba6bc90c8c557157bc0a6e081e7b2a4 Author: Rob Herring (Arm) Date: Fri Sep 19 11:15:28 2025 -0500 arm64: dts: apm-shadowcat: Drop "apm,xgene2-pcie" compatible The "apm,xgene2-pcie" compatible is unused, undocumented, and in the wrong position in the compatible list. Given this is a mature and little used platform, just remove the compatible rather than fix the order and document it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250919161529.1293151-1-robh@kernel.org Signed-off-by: Arnd Bergmann commit 676af08386e44fd6ea42b43db4c130bf04f36d92 Author: Rob Herring (Arm) Date: Fri Sep 19 11:15:08 2025 -0500 arm64: dts: apm-shadowcat: Move slimpro nodes out of "simple-bus" node The slimpro nodes are not MMIO devices, so they don't belong under a "simple-bus" node. Move them to the top level. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250919161509.1292227-1-robh@kernel.org Signed-off-by: Arnd Bergmann commit 323302f54db92dc1c80ff5b114c20f19ec0adf81 Author: Amery Hung Date: Mon Sep 22 16:33:55 2025 -0700 selftests/bpf: Test bpf_xdp_pull_data Test bpf_xdp_pull_data() with xdp packets with different layouts. The xdp bpf program first checks if the layout is as expected. Then, it calls bpf_xdp_pull_data(). Finally, it checks the 0xbb marker at offset 1024 using directly packet access. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-8-ameryhung@gmail.com commit fe9544ed1a2e9217b2c5285c3a4ac0dc5a38bd7b Author: Amery Hung Date: Mon Sep 22 16:33:54 2025 -0700 bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN To test bpf_xdp_pull_data(), an xdp packet containing fragments as well as free linear data area after xdp->data_end needs to be created. However, bpf_prog_test_run_xdp() always fills the linear area with data_in before creating fragments, leaving no space to pull data. This patch will allow users to specify the linear data size through ctx->data_end. Currently, ctx_in->data_end must match data_size_in and will not be the final ctx->data_end seen by xdp programs. This is because ctx->data_end is populated according to the xdp_buff passed to test_run. The linear data area available in an xdp_buff, max_linear_sz, is alawys filled up before copying data_in into fragments. This patch will allow users to specify the size of data that goes into the linear area. When ctx_in->data_end is different from data_size_in, only ctx_in->data_end bytes of data will be put into the linear area when creating the xdp_buff. While ctx_in->data_end will be allowed to be different from data_size_in, it cannot be larger than the data_size_in as there will be no data to copy from user space. If it is larger than the maximum linear data area size, the layout suggested by the user will not be honored. Data beyond max_linear_sz bytes will still be copied into fragments. Finally, since it is possible for a NIC to produce a xdp_buff with empty linear data area, allow it when calling bpf_test_init() from bpf_prog_test_run_xdp() so that we can test XDP kfuncs with such xdp_buff. This is done by moving lower-bound check to callers as most of them already do except bpf_prog_test_run_skb(). The change also fixes a bug that allows passing an xdp_buff with data < ETH_HLEN. This can happen when ctx is used and metadata is at least ETH_HLEN. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-7-ameryhung@gmail.com commit 7eb83bff02ad5e82e8c456c58717ef181c220870 Author: Amery Hung Date: Mon Sep 22 16:33:53 2025 -0700 bpf: Make variables in bpf_prog_test_run_xdp less confusing Change the variable naming in bpf_prog_test_run_xdp() to make the overall logic less confusing. As different modes were added to the function over the time, some variables got overloaded, making it hard to understand and changing the code becomes error-prone. Replace "size" with "linear_sz" where it refers to the size of metadata and data. If "size" refers to input data size, use test.data_size_in directly. Replace "max_data_sz" with "max_linear_sz" to better reflect the fact that it is the maximum size of metadata and data (i.e., linear_sz). Also, xdp_rxq.frags_size is always PAGE_SIZE, so just set it directly instead of subtracting headroom and tailroom and adding them back. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-6-ameryhung@gmail.com commit 0e7a733ab3d7be8d745e8ee38d637ea7a9b24343 Author: Amery Hung Date: Mon Sep 22 16:33:52 2025 -0700 bpf: Clear packet pointers after changing packet data in kfuncs bpf_xdp_pull_data() may change packet data and therefore packet pointers need to be invalidated. Add bpf_xdp_pull_data() to the special kfunc list instead of introducing a new KF_ flag until there are more kfuncs changing packet data. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250922233356.3356453-5-ameryhung@gmail.com commit 4dce1a0d7cf39575a5880414ea882890edd8d26f Author: Amery Hung Date: Mon Sep 22 16:33:51 2025 -0700 bpf: Support pulling non-linear xdp data Add kfunc, bpf_xdp_pull_data(), to support pulling data from xdp fragments. Similar to bpf_skb_pull_data(), bpf_xdp_pull_data() makes the first len bytes of data directly readable and writable in bpf programs. If the "len" argument is larger than the linear data size, data in fragments will be copied to the linear data area when there is enough room. Specifically, the kfunc will try to use the tailroom first. When the tailroom is not enough, metadata and data will be shifted down to make room for pulling data. A use case of the kfunc is to decapsulate headers residing in xdp fragments. It is possible for a NIC driver to place headers in xdp fragments. To keep using direct packet access for parsing and decapsulating headers, users can pull headers into the linear data area by calling bpf_xdp_pull_data() and then pop the header with bpf_xdp_adjust_head(). Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250922233356.3356453-4-ameryhung@gmail.com commit dea1526fbafb55099a788cde0b659530ee5b1c66 Author: Amery Hung Date: Mon Sep 22 16:33:50 2025 -0700 bpf: Allow bpf_xdp_shrink_data to shrink a frag from head and tail Move skb_frag_t adjustment into bpf_xdp_shrink_data() and extend its functionality to be able to shrink an xdp fragment from both head and tail. In a later patch, bpf_xdp_pull_data() will reuse it to shrink an xdp fragment from head. Additionally, in bpf_xdp_frags_shrink_tail(), breaking the loop when bpf_xdp_shrink_data() returns false (i.e., not releasing the current fragment) is not necessary as the loop condition, offset > 0, has the same effect. Remove the else branch to simplify the code. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250922233356.3356453-3-ameryhung@gmail.com commit 8f12d1137c2382c80aada8e05d7cc650cd4e403c Author: Amery Hung Date: Mon Sep 22 16:33:49 2025 -0700 bpf: Clear pfmemalloc flag when freeing all fragments It is possible for bpf_xdp_adjust_tail() to free all fragments. The kfunc currently clears the XDP_FLAGS_HAS_FRAGS bit, but not XDP_FLAGS_FRAGS_PF_MEMALLOC. So far, this has not caused a issue when building sk_buff from xdp_buff since all readers of xdp_buff->flags use the flag only when there are fragments. Clear the XDP_FLAGS_FRAGS_PF_MEMALLOC bit as well to make the flags correct. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau Reviewed-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250922233356.3356453-2-ameryhung@gmail.com commit abfbfb98acfe6fd603d48424e32f8d99922e70b9 Merge: 9f1bbcc46ecdee 663bfe77b6f70b Author: Arnd Bergmann Date: Tue Sep 23 22:28:42 2025 +0200 Merge tag 'amlogic-arm64-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v6.18: - Add cache information to the Amlogic SoCs - Add RTC node for Amlogic C3 SoC - Fix PWM node for Amlogic C3 SoC - Remove UHS capability for Odroid-C2 SDCard * tag 'amlogic-arm64-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: gxbb-odroidc2: remove UHS capability for SD card dts: arm: amlogic: fix pwm node for c3 arm64: dts: amlogic: sm1-bananapi: lower SD card speed for stability arm64: dts: amlogic: Add cache information to the Amlogic T7 SoC arm64: dts: amlogic: Add cache information to the Amlogic S922X SoC arm64: dts: amlogic: Add cache information to the Amlogic S7 SoC arm64: dts: amlogic: Add cache information to the Amlogic C3 SoC arm64: dts: amlogic: Add cache information to the Amlogic A4 SoC arm64: dts: amlogic: Add cache information to the Amlogic A1 SoC arm64: dts: amlogic: Add cache information to the Amlogic GXM SoCS arm64: dts: amlogic: Add cache information to the Amlogic AXG SoCS arm64: dts: amlogic: Add cache information to the Amlogic G12A SoCS arm64: dts: amlogic: Add cache information to the Amlogic SM1 SoC arm64: dts: amlogic: Add cache information to the Amlogic GXBB and GXL SoC arm64: dts: amlogic: C3: Add RTC controller node Link: https://lore.kernel.org/r/d40e7e96-4a7c-4e4f-b36f-750c6525b95c@linaro.org Signed-off-by: Arnd Bergmann commit 9f1bbcc46ecdee8fa4fa10b31db839dcc750282f Merge: ec1ede181e16e5 0f860eef417df9 Author: Arnd Bergmann Date: Tue Sep 23 22:26:59 2025 +0200 Merge tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt Another missing supply and a wrong headphone gpio level. * tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6 arm64: dts: rockchip: fix second M.2 slot on ROCK 5T arm64: dts: rockchip: fix USB on RADXA ROCK 5T arm64: dts: rockchip: Add vcc-supply to SPI flash on Pinephone Pro arm64: dts: rockchip: fix es8388 address on rk3588s-roc-pc arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 arm64: dts: rockchip: correct network description on Sige5 arm64: dts: rockchip: Minor whitespace cleanup ARM: dts: rockchip: Minor whitespace cleanup arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 plus arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro arm64: dts: rockchip: mark eeprom as read-only for Radxa E52C commit ec1ede181e16e54f98f0eacbc6b6054677cbf7b8 Merge: 17752efeca0925 0f084b221e2c5b Author: Arnd Bergmann Date: Tue Sep 23 22:22:19 2025 +0200 Merge tag 'spacemit-dt-for-6.18-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.18 - Add OrangePi RV2 board support - Add reset support to UART driver - Add PDMA driver support - Remove sec_uart1 node * tag 'spacemit-dt-for-6.18-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: uart: remove sec_uart1 device node riscv: dts: spacemit: Enable PDMA on Banana Pi F3 and Milkv Jupiter riscv: dts: spacemit: Add PDMA node for K1 SoC riscv: dts: spacemit: add UART resets for Soc K1 riscv: dts: spacemit: Add OrangePi RV2 board device tree dt-bindings: riscv: spacemit: Add OrangePi RV2 board Link: https://lore.kernel.org/r/20250919055525-GYC5766558@gentoo.org Signed-off-by: Arnd Bergmann commit 17752efeca0925bf607fe55abe9eae3136a06d78 Merge: 83ae575d6f0e96 cca07ac2b5f783 Author: Arnd Bergmann Date: Tue Sep 23 22:17:46 2025 +0200 Merge tag 'sunxi-dt-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner Device Tree changes for 6.18 This tag contains two DT binding header changes that are shared with the clk tree. In this cycle we gained support for the MCU PRCM clock and reset controller on the A523/A527/T527 family of SoCs, the NPU which is a Vivante GC9000 IP block, and the NPU clock that was missing. The other PRCM clock controller gained default bus clock rate settings. These were not configured in the upstream U-boot bootloader, leading to them running at slower rates. The assigned rates are from the user manual. There is also a new board, the NetCube Systems Nagami SoM and two of its carrier boards. The A523 family development boards now have their internal RTC clocks configured correctly, so that the RTC does not drift wildly. The missing functions for the AXP717 on these boards are added. Missing reset GPIOs and delays for Ethernet PHYs are added. Last, the Cubie A5E now has its LEDs described and usable. An overlay for the Orange Pi Zero interface (addon) board was added. This can be used with the Orange Pi Zero and Zero Plus 2. Default audio routing for these two boards (to be used with the addon) were added to complement the overlay. * tag 'sunxi-dt-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: sun55i: Complete AXP717A sub-functions arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k crystal arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal arm64: dts: sun55i: a523: Assign standard clock rates to PRCM bus clocks ARM: dts: sunxi: add support for NetCube Systems Nagami Keypad Carrier ARM: dts: sunxi: add support for NetCube Systems Nagami Basic Carrier ARM: dts: sunxi: add support for NetCube Systems Nagami SoM riscv: dts: allwinner: d1s-t113: Add pinctrl's required by NetCube Systems Nagami SoM dt-bindings: arm: sunxi: Add NetCube Systems Nagami SoM and carrier board bindings ARM: dts: allwinner: Add Orange Pi Zero Interface Board overlay ARM: dts: allwinner: orangepi-zero-plus2: Add default audio routing ARM: dts: allwinner: orangepi-zero: Add default audio routing arm64: dts: allwinner: a523: Add NPU device node arm64: dts: allwinner: a523: Add MCU PRCM CCU node dt-bindings: clock: sun55i-a523-ccu: Add A523 MCU CCU clock controller dt-bindings: clock: sun55i-a523-ccu: Add missing NPU module clock arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset setting arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset setting arm64: dts: allwinner: a527: cubie-a5e: Add LEDs Link: https://lore.kernel.org/r/aMrtuZg8HlR--TAt@wens.tw Signed-off-by: Arnd Bergmann commit 83ae575d6f0e9636c16c62b6ef8980f969574005 Merge: 06510618555067 ffe6a5d1dd4d4d Author: Arnd Bergmann Date: Tue Sep 23 22:15:55 2025 +0200 Merge tag 'v6.17-next-dts64.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt mt8188: - change efuse compatible fallback to make GPU DVFS work - enable SCP core for video decoding and encoding mt8186: - add correct touchscreen compatible for tentacruel and krabby Fixes of DT warnings for many different SoCs and boards. * tag 'v6.17-next-dts64.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: (24 commits) arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes arm64: dts: mediatek: mt8195-cherry: Add missing regulators to rt5682 arm64: dts: mediatek: mt8195-cherry: Move VBAT-supply to Tomato R1/R2 arm64: dts: mediatek: mt8195: Fix ranges for jpeg enc/decoder nodes arm64: dts: mediatek: mt8183-kukui: Move DSI panel node to machine dtsis arm64: dts: mediatek: mt8183: Migrate to display controller OF graph arm64: dts: mediatek: mt8183-pumpkin: Add power supply for CCI arm64: dts: mediatek: pumpkin-common: Fix pinctrl node names arm64: dts: mediatek: mt8183: Fix pinctrl node names arm64: dts: mediatek: acelink-ew-7886cax: Remove unnecessary cells in spi-nand arm64: dts: mediatek: mt7986a-bpi-r3: Set interrupt-parent to mdio switch arm64: dts: mediatek: mt7986a-bpi-r3: Fix SFP I2C node names arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address arm64: dts: mediatek: Fix node name for SYSIRQ controller on all SoCs arm64: dts: mediatek: mt6795-sony-xperia-m5: Add pinctrl for mmc1/mmc2 arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value arm64: dts: mediatek: mt6795: Add mediatek,infracfg to iommu node arm64: dts: mediatek: mt6797: Remove bogus id property in i2c nodes arm64: dts: mediatek: mt6797: Fix pinctrl node names ... Link: https://lore.kernel.org/r/c0e2e902-2a10-44a7-9592-491ba7382df0@gmail.com Signed-off-by: Arnd Bergmann commit 065106185550677bb66231ab0cd0e69fb1d36408 Merge: 21a98498ae6eec 4d94abded400a5 Author: Arnd Bergmann Date: Tue Sep 23 22:15:15 2025 +0200 Merge tag 'riscv-sophgo-dt-for-v6.18' of https://github.com/sophgo/linux into soc/dt RISC-V Devicetrees for v6.18 Sophgo: Minor changes here only for SG2042. Enable numa and we can see significant performance improvements, for example in the STREAM test. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.18' of https://github.com/sophgo/linux: dts: sophgo: sg2042: added numa id description Link: https://lore.kernel.org/r/MAUPR01MB11072ABA02A18CC7AA9B88874FE17A@MAUPR01MB11072.INDPRD01.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 21a98498ae6eec28cf5c1cb54774edc7c41c1910 Merge: 57cff2159b4a06 20b3c9a403ee23 Author: Arnd Bergmann Date: Tue Sep 23 22:14:08 2025 +0200 Merge tag 'ti-keystone-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt Keystone2 device tree updates for v6.18 Cosmetic cleanups: * dt-bindings: Convert ti,keystone to DT schema * tag 'ti-keystone-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: dt-bindings: arm: Convert ti,keystone to DT schema Link: https://lore.kernel.org/r/20250916175415.o2zvkxsbiqdk5i7q@almost Signed-off-by: Arnd Bergmann commit 57cff2159b4a067097fb7aef471f1f9db54244d9 Merge: 2f5049f049a478 fcfedcb6804caa Author: Arnd Bergmann Date: Tue Sep 23 22:11:30 2025 +0200 Merge tag 'ti-k3-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.18 Generic fixes and cleanups: * k3-pinctrl: Fix incorrect macro usage, add missing DeepSleep/drive strength macros * k3: Rename rproc reserved-mem nodes to 'memory@addr' and add labels for reserved-memory * Long time pending major remoteproc firmware refactoring to allow flexibility for downstream variants: - am62x/am62ax: Move Mailbox/Remoteproc nodes to board-level DTS files - am64/am65/j721e/j721s2/j784s4/j742s2/j7200: Move Remoteproc enablement to board-level DTS - am62a/am62/am62p/j722s: Similarly restructure Mailbox/Remoteproc configs - am65/am64: Refactor IPC firmware carveouts/mailboxes into new SoC family-specific dtsi files - j721e/j721s2/j784s4/j742s2/am62/am62p/am62a/am64/am65/j7200/j722s: Refactor IPC firmware configs into new board-independent dtsi files - Various boards: Add missing or corrected carveouts/timers/mailbox configs for IPC firmware alignment * Multiple-boards: Bootph-all property added for USB PHYs to support DFU boot. New Boards/SoM/SiP: * Variscite VAR-SOM-AM62P SoM and carrier boards * AM6254atl SiP package and SK SoC specific changes: AM62P: * Update eMMC HS400 STRB tuning value * Split HS400 support away from J722S due to errata * Add Variscite VAR-SOM-AM62P SoM and Symphony carrier board support AM62: * Remove unused DeepSleep USB1 pin config on SK * Add CSI2 interrupts property on main CSI2RX * Enable Mailbox & Remoteproc at board level * PocketBeagle2 + Verdin variants: Add missing IPC firmware carveouts, enable R5F/M4F AM62A: * Fix padcfg length in pad configuration registers * Remove unused DeepSleep USB1 pin config on SK * Add CSI2 interrupts property * Add 1.4GHz OPP entry for phyCORE-AM62Ax * Enable Mailbox & Remoteproc at board level * Add missing IPC firmware carveouts for PocketBeagle2 and other boards AM62D2: * Add Octal SPI NOR flash (OSPI) support for EVM * Enable USB0/USB1 interface on EVM AM625: * Introduce AM6254atl SiP base SoC support * Add SK-AM6254atl board AM64: * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level * Add PA stats property for PEB-C-010 expansion Ethernet card * phyCORE SoM + SR SoM/Electra board: Add missing IPC firmware configs AM65: * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level AM69: * Switch SERDES0 config to PCIe Multilink + USB mode, enabling independent PCIe1 & PCIe3 link speeds J7200: * Refactor IPC firmware configs into new dtsi * Enable R5F Remoteproc at board level J721E: * Add DSI + DPHY-TX nodes * Add CSI2 interrupts property * BeagleBone AI64: Switch R5 clusters to split mode, add timer reserves for IPC FW, Correct carveouts (revert mistaken reordering of C6x carveouts) * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level J721S2: * Add DSI + DSI PHY nodes * Add USB0 Type-A overlay for EVM * Add CSI2 interrupts property * Ensure PCIe node has proper interrupt-controller #address-cells fixes dtbs_check warning. * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level * Common processor board: Add DisplayPort-1 enable, I2C4 instance for display connector J722S: * Add bootph-all to usb0_phy_ctrl node (DFU) * Add JPEG Encoder node (E5010) * Add CSI2 interrupts properties on main/J722S/AM62P common main * Refactor IPC firmware configs into new dtsi * Enable Remoteproc at board level J784S4/J742S2: * Add CSI2 interrupts properties on main-common * Add DSI & PHY support * Enable DisplayPort-1 on EVM * Refactor IPC firmware configs into new dtsi (common & SoC-specific) * Enable Remoteproc at board level * J742S2: Override MCU R5 firmware names in dedicated dtsi Board specific changes: AM62P Variscite Symphony Board: * Add support with USB, Eth, Camera, CAN, GPIO expander AM642-phyBOARD-Electra * Add PEB-C-010 Ethernet expansion board overlay * Add PA stats handle AM642-sr/phyCORE * Add missing IPC carveouts for R5F/M4F AM62-Verdin/AM62P-Verdin * Add missing IPC carveouts for R5F/M4F, mailboxes * tag 'ti-k3-dt-for-v6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (78 commits) arm64: dts: ti: k3-j721s2-evm: Add overlay to enable USB0 Type-A arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay arm64: dts: ti: var-som-am62p: Add support for Variscite Symphony Board arm64: dts: ti: Add support for Variscite VAR-SOM-AM62P dt-bindings: arm: ti: Add bindings for Variscite VAR-SOM-AM62P arm64: dts: ti: k3-j722s-evm: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62x-sk-common: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62p5-sk: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-am62a7-sk: Add bootph-all tag to usb0_phy_ctrl node arm64: dts: ti: k3-j721e-main: Add DSI and DPHY-TX arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros arm64: dts: ti: k3-pinctrl: Add the remaining macros arm64: dts: ti: k3-am62x-sk-common: Remove the unused cfg in USB1_DRVVBUS arm64: dts: ti: k3-am62p5-sk: Remove the unused cfg in USB1_DRVVBUS arm64: dts: ti: k3-am62d2-evm: Add support for OSPI flash arm64: dts: ti: k3-am62d2-evm: Enable USB support arm64: dts: ti: k3-am62a-main: Fix main padcfg length arm64: dts: ti: k3-am62p: Update eMMC HS400 STRB value arm64: dts: ti: k3-am62p/j722s: Remove HS400 support from common arm64: dts: ti: Add support for AM6254atl SiP SK ... Link: https://lore.kernel.org/r/20250916175349.pxg6gxd4vg5vfmhx@overvalue Signed-off-by: Arnd Bergmann commit 958e55f90a01451de77e22063d37b60388219b96 Author: Krzysztof Kozlowski Date: Thu Aug 21 10:32:06 2025 +0200 dt-bindings: i2c: spacemit,k1-i2c: Minor whitespace cleanup in example The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Troy Mitchell Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 8ab3bd59f9fc210a1a88b509f6931cf3f5ea229a Author: Ivaylo Ivanov Date: Sun Sep 14 16:16:20 2025 +0300 dt-bindings: i2c: exynos5: add samsung,exynos8890-hsi2c compatible Add samsung,exynos8890-hsi2c compatible, reusing the 8895 support since it's compatible with exynos8890's i2c controllers. Signed-off-by: Ivaylo Ivanov Acked-by: Rob Herring (Arm) Signed-off-by: Wolfram Sang commit 8b52d09a1dfe949851675b30b309865ade8ce457 Merge: 0d3bf643b41bc3 d0bf7cd5df1846 Author: Alexei Starovoitov Date: Tue Sep 23 12:29:04 2025 -0700 Merge branch 'riscv-bpf-fix-uninitialized-symbol-retval_off' Chenghao Duan says: ==================== riscv: bpf: Fix uninitialized symbol 'retval_off' v2: Adjust the commit log URL for version v1: https://lore.kernel.org/all/20250820062520.846720-1-duanchenghao@kylinos.cn/ ==================== Link: https://patch.msgid.link/20250922062244.822937-1-duanchenghao@kylinos.cn Signed-off-by: Alexei Starovoitov commit d0bf7cd5df18466d969bb60e8890b74cf96081ca Author: Chenghao Duan Date: Mon Sep 22 14:22:44 2025 +0800 riscv: bpf: Fix uninitialized symbol 'retval_off' In the __arch_prepare_bpf_trampoline() function, retval_off is only meaningful when save_ret is true, so the current logic is correct. However, in the original logic, retval_off is only initialized under certain conditions; for example, in the fmod_ret logic, the compiler is not aware that the flags of the fmod_ret program (prog) have set BPF_TRAMP_F_CALL_ORIG, which results in an uninitialized symbol compilation warning. So initialize retval_off unconditionally to fix it. Signed-off-by: Chenghao Duan Reviewed-by: Pu Lehui Link: https://lore.kernel.org/r/20250922062244.822937-2-duanchenghao@kylinos.cn Signed-off-by: Alexei Starovoitov commit 0d3bf643b41bc339a02562a4aa382542d046bd0a Author: Quentin Monnet Date: Tue Sep 23 11:38:02 2025 +0100 bpftool: Add bash completion for program signing options Commit 40863f4d6ef2 ("bpftool: Add support for signing BPF programs") added new options for "bpftool prog load" and "bpftool gen skeleton". This commit brings the relevant update to the bash completion file. We rework slightly the processing of options to make completion more resilient for options that take an argument. Signed-off-by: Quentin Monnet Link: https://lore.kernel.org/r/20250923103802.57695-1-qmo@kernel.org Signed-off-by: Alexei Starovoitov commit ebfd5226ec365d0901d3ddee4aba9c737137645c Merge: c0008a5632103e 55ed11b181c43d Author: Tejun Heo Date: Tue Sep 23 09:10:20 2025 -1000 sched_ext: Merge branch 'for-6.17-fixes' into for-6.18 Pull sched_ext/for-6.17-fixes to receive: 55ed11b181c4 ("sched_ext: idle: Handle migration-disabled tasks in BPF code") which conflicts with the following commit in for-6.18: 2407bae23d1e ("sched_ext: Add the @sch parameter to ext_idle helpers") The conflict is a simple context conflict which can be resolved by taking the updated parts from both commits. Signed-off-by: Tejun Heo commit f0b5c1490aa8af7a0fcface6cc99266cff1549be Merge: 2383e45f1da7ac 1c6686bf7fc161 Author: Alexei Starovoitov Date: Tue Sep 23 12:07:47 2025 -0700 Merge branch 'bpf-allow-union-argument-in-trampoline-based-programs' Leon Hwang says: ==================== bpf: Allow union argument in trampoline based programs While tracing 'release_pages' with bpfsnoop[0], the verifier reports: The function release_pages arg0 type UNION is unsupported. However, it should be acceptable to trace functions that have 'union' arguments. This patch set enables such support in the verifier by allowing 'union' as a valid argument type. Changes: v3 -> v4: * Address comments from Alexei: * Trim bpftrace output in patch #1 log. * Drop the referenced commit info and the test output in patch #2 log. v2 -> v3: * Address comments from Alexei: * Reuse the existing flag BTF_FMODEL_STRUCT_ARG. * Update the comment of the flag BTF_FMODEL_STRUCT_ARG. v1 -> v2: * Add 16B 'union' argument support in x86_64 trampoline. * Update selftests using bpf_testmod. * Add test case about 16-bytes 'union' argument. * Address comments from Alexei: * Study the patch set about 'struct' argument support. * Update selftests to cover more cases. v1: https://lore.kernel.org/bpf/20250905133226.84675-1-leon.hwang@linux.dev/ Links: [0] https://github.com/bpfsnoop/bpfsnoop ==================== Link: https://patch.msgid.link/20250919044110.23729-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 1c6686bf7fc161ed87b44b523a96c5ae4bfed351 Author: Leon Hwang Date: Fri Sep 19 12:41:10 2025 +0800 selftests/bpf: Add union argument tests using fexit programs Add test coverage for union argument support using fexit programs: * 8B union argument - verify that the verifier accepts it and that fexit programs can trace such functions. * 16B union argument - verify that the verifier accepts it and that fexit programs can access the argument, which is passed using two registers. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250919044110.23729-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit ccb4f5d91ec43c05ba165ccfc7ed889eb9cdfd05 Author: Leon Hwang Date: Fri Sep 19 12:41:09 2025 +0800 bpf: Allow union argument in trampoline based programs Currently, functions with 'union' arguments cannot be traced with fentry/fexit: bpftrace -e 'fentry:release_pages { exit(); }' -v The function release_pages arg0 type UNION is unsupported. The type of the 'release_pages' arg0 is defined as: typedef union { struct page **pages; struct folio **folios; struct encoded_page **encoded_pages; } release_pages_arg __attribute__ ((__transparent_union__)); This patch relaxes the restriction by allowing function arguments of type 'union' to be traced in verifier. Reviewed-by: Amery Hung Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250919044110.23729-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 6d74ed4c81470b7df89b6688a0a95adcebb4794f Merge: 6e3cb25e62f208 c7ec58c39b0252 Author: Wolfram Sang Date: Tue Sep 23 21:07:40 2025 +0200 Merge tag 'at24-updates-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-mergewindow at24 updates for v6.18-rc1 - add the compatible for Giantec GT24C256C to the device-tree bindings commit c0008a5632103eae31302e83d012e2d3b0cfad41 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Misc updates around scx_sched instance pointer In preparation for multiple scheduler support: - Add the @sch parameter to find_global_dsq() and refill_task_slice_dfl(). - Restructure scx_allow_ttwu_queue() and make it read scx_root into $sch. - Make RCU protection in scx_dsq_move() and scx_bpf_dsq_move_to_local() explicit. v2: Add scx_root -> sch conversion in scx_allow_ttwu_queue(). Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit d4f7d866667c32b097721a96ebf0b19e1c85a75a Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Drop scx_kf_exit() and scx_kf_error() The intention behind scx_kf_exit/error() was that when called from kfuncs, scx_kf_exit/error() would be able to implicitly determine the scx_sched instance being operated on and thus wouldn't need the @sch parameter passed in explicitly. This turned out to be unnecessarily complicated to implement and not have enough practical benefits. Replace scx_kf_exit/error() usages with scx_exit/error() which take an explicit @sch parameter. - Add the @sch parameter to scx_kf_allowed(), scx_kf_allowed_on_arg_tasks, mark_direct_dispatch() and other intermediate functions transitively. - In callers that don't already have @sch available, grab RCU, read $scx_root, verify it's not NULL and use it. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 4d9553fee3e278ca3d90c54c063ce2db01e93268 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to scx_dsq_insert_preamble/commit() In preparation for multiple scheduler support, add the @sch parameter to scx_dsq_insert_preamble/commit() and update the callers to read $scx_root and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 956f2b11a8a4fd2793aaa8a672c70206f0ce4655 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Drop kf_cpu_valid() The intention behind kf_cpu_valid() was that when called from kfuncs, kf_cpu_valid() would be able to implicitly determine the scx_sched instance being operated on and thus wouldn't need @sch passed in explicitly. This turned out to be unnecessarily complicated to implement and not have justifiable practical benefits. Replace kf_cpu_valid() usages with ops_cpu_valid() which takes explicit @sch. Callers which don't have $sch available in the context are updated to read $scx_root under RCU read lock, verify that it's not NULL and pass it in. scx_bpf_cpu_rq() is restructured to use guard(rcu)() instead of explicit rcu_read_[un]lock(). Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 2407bae23d1e93186afccb6a6a98d9bd6a7c8a74 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to ext_idle helpers In preparation for multiple scheduler support, add the @sch parameter to validate_node(), check_builtin_idle_enabled() and select_cpu_from_kfunc(), and update their callers to read $scx_root, verify that it's not NULL and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit fc6a93aa623f3e40bcddbacf5fc60d5aceda9cab Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add the @sch parameter to __bstr_format() In preparation for multiple scheduler support, add the @sch parameter to __bstr_format() and update the callers to read $scx_root, verify that it's not NULL and pass it in. The passed in @sch parameter is not used yet. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 9fc687edf205dbc45bbdec60ea31e934a05ab6bc Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Separate out scx_kick_cpu() and add @sch to it In preparation for multiple scheduler support, separate out scx_kick_cpu() from scx_bpf_kick_cpu() and add the @sch parameter to it. scx_bpf_kick_cpu() now acquires an RCU read lock, reads $scx_root, and calls scx_kick_cpu() with it if non-NULL. The passed in @sch parameter is not used yet. Internal uses of scx_bpf_kick_cpu() are converted to scx_kick_cpu(). Where $sch is available, it's used. In the pick_task_scx() path where no associated scheduler can be identified, $scx_root is used directly. Note that $scx_root cannot be NULL in this case. Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 7852e0fd1de05efadcd8b6f72140cd208c79ba56 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 tools/sched_ext: scx_qmap: Make debug output quieter by default scx_qmap currently outputs verbose debug messages including cgroup operations and CPU online/offline events by default, which can be noisy during normal operation. While the existing -P option controls DSQ dumps and event statistics, there's no way to suppress the other debug messages. Split the debug output controls to make scx_qmap quieter by default. The -P option continues to control DSQ dumps and event statistics (print_dsqs_and_events), while a new -M option controls debug messages like cgroup operations and CPU events (print_msgs). This allows users to run scx_qmap with minimal output and selectively enable debug information as needed. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit d452972858e5cfa4262320ab74fe8f016460b96f Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Make qmap dump operation non-destructive The qmap dump operation was destructively consuming queue entries while displaying them. As dump can be triggered anytime, this can easily lead to stalls. Add a temporary dump_store queue and modify the dump logic to pop entries, display them, and then restore them back to the original queue. This allows dump operations to be performed without affecting the scheduler's queue state. Note that if racing against new enqueues during dump, ordering can get mixed up, but this is acceptable for debugging purposes. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit f3aec2adce8dbe37dabff47a16bfb260b987e0b0 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Add SCX_EFLAG_INITIALIZED to indicate successful ops.init() ops.exit() may be called even if the loading failed before ops.init() finishes successfully. This is because ops.exit() allows rich exit info communication. Add SCX_EFLAG_INITIALIZED flag to scx_exit_info.flags to indicate whether ops.init() finished successfully. This enables BPF schedulers to distinguish between exit scenarios and handle cleanup appropriately based on initialization state. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit c7e739746dbde9ae401fd88824f5656c5e2361fc Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Use bitfields for boolean warning flags Convert warned_zero_slice and warned_deprecated_rq in scx_sched struct to single-bit bitfields. While this doesn't reduce struct size immediately, it prepares for future bitfield additions. v2: Update patch description. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit f75efc8f4c0d52f6fe53a0acd9629e3ac017fc3e Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Fix stray scx_root usage in task_can_run_on_remote_rq() task_can_run_on_remote_rq() takes @sch but it is using scx_root when incrementing SCX_EV_DISPATCH_LOCAL_DSQ_OFFLINE, which is inconsistent and gets in the way of implementing multiple scheduler support. Use @sch instead. As currently scx_root is the only possible scheduler instance, this doesn't cause any behavior changes. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit edf005fa274a0c224e550a52726aa7a426384e36 Author: Tejun Heo Date: Tue Sep 23 09:03:26 2025 -1000 sched_ext: Improve SCX_KF_DISPATCH comment The comment for SCX_KF_DISPATCH was incomplete and didn't explain that ops.dispatch() may temporarily release the rq lock, allowing ENQUEUE and SELECT_CPU operations to be nested inside DISPATCH contexts. Update the comment to clarify this nesting behavior and provide better context for when these operations can occur within dispatch. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit c8191ee8e64a8c5c021a34e32868f2380965e82b Author: Tejun Heo Date: Tue Sep 23 09:03:25 2025 -1000 sched_ext: Use rhashtable_lookup() instead of rhashtable_lookup_fast() The find_user_dsq() function is called from contexts that are already under RCU read lock protection. Switch from rhashtable_lookup_fast() to rhashtable_lookup() to avoid redundant RCU locking. Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 2383e45f1da7ac73683ac3494a205bc878a58cc9 Merge: 348f6117c16ae8 f6165491240415 Author: Alexei Starovoitov Date: Tue Sep 23 12:00:23 2025 -0700 Merge branch 'signed-loads-from-arena' Puranjay Mohan says: ==================== Signed loads from Arena Changelog: v3 -> v4: v3: https://lore.kernel.org/all/20250915162848.54282-1-puranjay@kernel.org/ - Update bpf_jit_supports_insn() in riscv jit to reject signed arena loads (Eduard) - Fix coding style related to braces usage in an if statement in x86 jit (Eduard) v2 -> v3: v2: https://lore.kernel.org/bpf/20250514175415.2045783-1-memxor@gmail.com/ - Fix encoding for the generated instructions in x86 JIT (Eduard) The patch in v2 was generating instructions like: 42 63 44 20 f8 movslq -0x8(%rax,%r12), %eax This doesn't make sense because movslq outputs a 64-bit result, but the destination register here is set to eax (32-bit). The fix it to set the REX.W bit in the opcode, that means changing EMIT2(add_3mod(0x40, ...)) to EMIT2(add_3mod(0x48, ...)) - Add arm64 support - Add selftests signed laods from arena. v1 -> v2: v1: https://lore.kernel.org/bpf/20250509194956.1635207-1-memxor@gmail.com - Use bpf_jit_supports_insn. (Alexei) Currently, signed load instructions into arena memory are unsupported. The compiler is free to generate these, and on GCC-14 we see a corresponding error when it happens. The hurdle in supporting them is deciding which unused opcode to use to mark them for the JIT's own consumption. After much thinking, it appears 0xc0 / BPF_NOSPEC can be combined with load instructions to identify signed arena loads. Use this to recognize and JIT them appropriately, and remove the verifier side limitation on the program if the JIT supports them. ==================== Link: https://patch.msgid.link/20250923110157.18326-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit f61654912404155e9097aaf88aa2445edf80f8d3 Author: Puranjay Mohan Date: Tue Sep 23 11:01:51 2025 +0000 selftests: bpf: Add tests for signed loads from arena Add tests for loading 8, 16, and 32 bits with sign extension from arena, also verify that exception handling is working correctly and correct assembly is being generated by the x86 and arm64 JITs. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit eab2a71f3a6a5c5f4d4acaffb962cb39c199421c Author: Puranjay Mohan Date: Tue Sep 23 11:01:50 2025 +0000 bpf, arm64: Add support for signed arena loads Add support for signed loads from arena which are internally converted to loads with mode set BPF_PROBE_MEM32SX by the verifier. The implementation is similar to BPF_PROBE_MEMSX and BPF_MEMSX but for BPF_PROBE_MEM32SX, arena_vm_base is added to the src register to form the address. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a91ae3c89311648cbaa9b46b860e4f76004a24b8 Author: Kumar Kartikeya Dwivedi Date: Tue Sep 23 11:01:49 2025 +0000 bpf, x86: Add support for signed arena loads Currently, signed load instructions into arena memory are unsupported. The compiler is free to generate these, and on GCC-14 we see a corresponding error when it happens. The hurdle in supporting them is deciding which unused opcode to use to mark them for the JIT's own consumption. After much thinking, it appears 0xc0 / BPF_NOSPEC can be combined with load instructions to identify signed arena loads. Use this to recognize and JIT them appropriately, and remove the verifier side limitation on the program if the JIT supports them. Co-developed-by: Puranjay Mohan Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250923110157.18326-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit e3f761be5a178bdd5cd80351c5ca0a0cf675ef7e Author: Kuan-Wei Chiu Date: Mon Aug 25 04:09:02 2025 +0800 tools/power/x86/amd_pstate_tracer: Fix python gnuplot package names The prerequisites section listed non-existent packages "phython-gnuplot" and "phython3-gnuplot", which may mislead users and cause installation failures. Update the names to the correct distribution package names "python-gnuplot" and "python3-gnuplot", helping users avoid confusion and saving time for those following the instructions. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello (AMD) commit d41e075b077142bb9ae5df40b9ddf9fd7821a811 Author: Zhen Ni Date: Tue Sep 23 19:21:09 2025 +0800 remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer. Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Link: https://lore.kernel.org/r/20250923112109.1165126-1-zhen.ni@easystack.cn Signed-off-by: Mathieu Poirier commit a890a2e339b929dbd843328f9a92a1625404fe63 Author: Al Viro Date: Tue Sep 16 17:22:45 2025 +0100 nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that. Signed-off-by: Al Viro Signed-off-by: Anna Schumaker commit 902893e3907620153a17fb40834ab6fba9f83fab Author: Trond Myklebust Date: Sat Sep 6 12:48:16 2025 -0400 NFS: Enable use of the RWF_DONTCACHE flag on the NFS client The NFS client needs to defer dropbehind until after any writes to the folio have been persisted on the server. Since this may be a 2 step process, use folio_end_writeback_no_dropbehind() to allow release of the writeback flag, and then call folio_end_dropbehind() once the COMMIT is done. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 010054a530aa266ee1711dfbe23fc06b6eb0fa48 Author: Trond Myklebust Date: Sat Sep 6 12:48:15 2025 -0400 filemap: Add a version of folio_end_writeback that ignores dropbehind Filesystems such as NFS may need to defer dropbehind until after their 2-stage writes are done. This adds a helper folio_end_writeback_no_dropbehind() that allows them to release the writeback flag without immediately dropping the folio. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 24bbd533f596a4544e17579e9f622918680e7bff Author: Trond Myklebust Date: Sat Sep 6 12:48:14 2025 -0400 filemap: Add a helper for filesystems implementing dropbehind Add a helper to allow filesystems to attempt to free the 'dropbehind' folio. Signed-off-by: Trond Myklebust Link: https://lore.kernel.org/all/5588a06f6d5a2cf6746828e2d36e7ada668b1739.1745381692.git.trond.myklebust@hammerspace.com/ Reviewed-by: Mike Snitzer Signed-off-by: Anna Schumaker commit cc6ac66f1c0946299b8f192026cff9a320aaad18 Author: Anna Schumaker Date: Tue Jul 1 10:46:50 2025 -0400 SUNRPC: Update gssx_accept_sec_context() to use xdr_set_scratch_folio() This was the last caller of xdr_set_scratch_page(), so I remove this function while I'm at it. Signed-off-by: Anna Schumaker commit d57e43b72bf2071caac90da323849c3983a695f0 Author: Anna Schumaker Date: Mon Jun 30 14:53:09 2025 -0400 SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio() The only snag here is that __folio_alloc_node() doesn't handle NUMA_NO_NODE, so I also need to update svc_pool_map_get_node() to return numa_mem_id() instead. I arrived at this approach by looking at what other users of __folio_alloc_node() do for this case. Signed-off-by: Anna Schumaker commit 4b7c3b4c673d40e4b98cdaf642495929f43787e6 Author: Anna Schumaker Date: Mon Jun 30 13:42:51 2025 -0400 NFS: Update the flexfilelayout driver to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 1a33b629af21a98fc1c85da7cc21c78bd1eb1030 Author: Anna Schumaker Date: Mon Jun 30 13:19:26 2025 -0400 NFS: Update the filelayout to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit cf289099ab8a1f4369415ea6c8fb4c39ab2173ca Author: Anna Schumaker Date: Mon Jun 30 12:56:33 2025 -0400 NFS: Update the blocklayout to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit c9cefd7ae86aa3463adfedca309696ba0946f9c5 Author: Anna Schumaker Date: Mon Jun 30 11:14:41 2025 -0400 NFS: Update listxattr to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 2f8416f23edf3b5c49ce8e08616d0071cda5c37b Author: Anna Schumaker Date: Mon Jun 30 10:32:29 2025 -0400 NFS: Update getacl to use xdr_set_scratch_folio() Signed-off-by: Anna Schumaker commit 670335c0f97b2f86c80e2ca5321c7f7e018884f6 Author: Anna Schumaker Date: Mon Jun 30 10:07:56 2025 -0400 NFS: Update readdir to use a scratch folio Signed-off-by: Anna Schumaker commit c8a127596edc026e5364a7a609986dcd3999914c Author: Anna Schumaker Date: Mon Jun 30 10:04:54 2025 -0400 SUNRPC: Introduce xdr_set_scratch_folio() This will replace xdr_set_scratch_page() when we switch pages to folios. Signed-off-by: Anna Schumaker commit 040058a8f7fd333d4159a09ae308145a393c8551 Author: Qianfeng Rong Date: Sun Aug 10 15:29:42 2025 +0800 SUNRPC: Remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Acked-by: Chuck Lever Signed-off-by: Anna Schumaker commit 301f3470273c89df3a933762b7495569f650e68b Author: Jeff Layton Date: Thu Aug 21 12:27:00 2025 -0400 nfs: remove NFS_WBACK_BUSY() Nothing calls this macro. Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker commit 62c0c0e7491211969d8d1c2a9ab0e112b34664cf Author: Chuck Lever Date: Wed Aug 20 10:27:28 2025 -0400 SUNRPC: Move the svc_rpcb_cleanup() call sites Clean up: because svc_rpcb_cleanup() and svc_xprt_destroy_all() are always invoked in pairs, we can deduplicate code by moving the svc_rpcb_cleanup() call sites into svc_xprt_destroy_all(). Signed-off-by: Chuck Lever Tested-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit c231cea10d418c9d2596bcb8f5a06e18b55c1435 Author: Chuck Lever Date: Wed Aug 20 10:27:27 2025 -0400 NFS: Remove rpcbind cleanup for NFSv4.0 callback The NFS client's NFSv4.0 callback listeners are created with SVC_SOCK_ANONYMOUS, therefore svc_setup_socket() does not register them with the client's rpcbind service. And, note that nfs_callback_down_net() does not call svc_rpcb_cleanup() at all when shutting down the callback server. Even if svc_setup_socket() were to attempt to register or unregister these sockets, the callback service has vs_hidden set, which shunts the rpcbind upcalls. The svc_rpcb_cleanup() error flow was introduced by commit c946556b8749 ("NFS: move per-net callback thread initialization to nfs_callback_up_net()"). It doesn't appear in the code that was relocated by that commit. Therefore, there is no need to call svc_rpcb_cleanup() when listener creation fails during callback server start-up. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker commit bf75ad096820fee5da40e671ebb32de725a1c417 Author: Anthony Iliopoulos Date: Wed Aug 13 11:00:47 2025 +0200 NFSv4.1: fix mount hang after CREATE_SESSION failure When client initialization goes through server trunking discovery, it schedules the state manager and then sleeps waiting for nfs_client initialization completion. The state manager can fail during state recovery, and specifically in lease establishment as nfs41_init_clientid() will bail out in case of errors returned from nfs4_proc_create_session(), without ever marking the client ready. The session creation can fail for a variety of reasons e.g. during backchannel parameter negotiation, with status -EINVAL. The error status will propagate all the way to the nfs4_state_manager but the client status will not be marked, and thus the mount process will remain blocked waiting. Fix it by adding -EINVAL error handling to nfs4_state_manager(). Signed-off-by: Anthony Iliopoulos Signed-off-by: Anna Schumaker commit 191512355e520dfc45c8bc3b56d4de59c3ade33e Author: Anthony Iliopoulos Date: Wed Aug 13 11:00:46 2025 +0200 NFSv4.1: fix backchannel max_resp_sz verification check When the client max_resp_sz is larger than what the server encodes in its reply, the nfs4_verify_back_channel_attrs() check fails and this causes nfs4_proc_create_session() to fail, in cases where the client page size is larger than that of the server and the server does not want to negotiate upwards. While this is not a problem with the linux nfs server that will reflect the proposed value in its reply irrespective of the local page size, other nfs server implementations may insist on their own max_resp_sz value, which could be smaller. Fix this by accepting smaller max_resp_sz values from the server, as this does not violate the protocol. The server is allowed to decrease but not increase proposed the size, and as such values smaller than the client-proposed ones are valid. Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks") Signed-off-by: Anthony Iliopoulos Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 64afd8783920d4f3e831fd1d99b46a65b1de95f9 Author: Xichao Zhao Date: Fri Aug 8 16:41:03 2025 +0800 NFSv4: fix "prefered"->"preferred" Trivial fix to spelling mistake in comment text. Signed-off-by: Xichao Zhao Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit be390f95242785adbf37d7b8a5101dd2f2ba891b Author: Olga Kornievskaia Date: Mon Aug 11 14:18:48 2025 -0400 NFSv4: handle ERR_GRACE on delegation recalls RFC7530 states that clients should be prepared for the return of NFS4ERR_GRACE errors for non-reclaim lock and I/O requests. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit ec7d8e68ef0ec5c635c8f9e93cd881673445a397 Author: Jeff Layton Date: Fri Aug 22 09:19:23 2025 -0400 sunrpc: add a Kconfig option to redirect dfprintk() output to trace buffer We have a lot of old dprintk() call sites that aren't going anywhere anytime soon. At the same time, turning them up is a serious burden on the host due to the console locking overhead. Add a new Kconfig option that redirects dfprintk() output to the trace buffer. This is more efficient than logging to the console and allows for proper interleaving of dprintk and static tracepoint events. Since using trace_printk() causes scary warnings to pop at boot time, this new option defaults to "n". Signed-off-by: Jeff Layton Reviewed-by: Chuck Lever Reviewed-by: Simon Horman Signed-off-by: Anna Schumaker commit 9082aae154be2d9e208b56e249cb886612f7c6cf Author: Jeff Layton Date: Fri Aug 22 09:19:22 2025 -0400 sunrpc: remove dfprintk_cont() and dfprintk_rcu_cont() KERN_CONT hails from a simpler time, when SMP wasn't the norm. These days, it doesn't quite work right since another printk() can always race in between the first one and the one being "continued". Nothing calls dprintk_rcu_cont(), so just remove it. The only caller of dprintk_cont() is in nfs_commit_release_pages(). Just use a normal dprintk() there instead, since this is not SMP-safe anyway. Signed-off-by: Jeff Layton Reviewed-by: Chuck Lever Reviewed-by: Simon Horman Signed-off-by: Anna Schumaker commit 64dd8022245038109826c0e2a778f16618d88600 Author: Leo Martins Date: Thu Aug 21 15:04:02 2025 -0700 nfs: cleanup tracepoint declarations Cleanup tracepoint declarations by replacing commas with semicolons to better match other tracepoint declarations. No functional changes introduced. Signed-off-by: Leo Martins Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker commit 83c47ef8aca0dc5e2159e884b2bfd3440948eed1 Author: Jeff Layton Date: Fri Aug 8 07:40:34 2025 -0400 nfs: add tracepoints to nfs_writepages() Show the inode info and requested range. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit b6ef079fd984930dcc42f4b247777f296528507e Author: Jeff Layton Date: Fri Aug 8 07:40:33 2025 -0400 nfs: more in-depth tracing of writepage events Add tracepoints to nfs_writepage_setup() and nfs_do_writepage(). Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4a2d81714d10e66dd7df50d32f9f30382b85fa43 Author: Jeff Layton Date: Fri Aug 8 07:40:32 2025 -0400 nfs: new tracepoints around write handling New start and done tracepoints for: nfs_update_folio() nfs_write_begin() nfs_write_end() nfs_try_to_update_request() Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4b62f0e4488ad9fece76f0f0e7df749d37d1c12e Author: Jeff Layton Date: Fri Aug 8 07:40:31 2025 -0400 nfs: add tracepoints to nfs_file_read() and nfs_file_write() Add some tracepoints to the I/O submission codepaths. Signed-off-by: Jeff Layton Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit d292035fb5d209b78beda356a2a9720154bd7c00 Author: Mathias Krause Date: Fri Sep 19 15:32:58 2025 -0700 KVM: VMX: Make CR4.CET a guest owned bit Make CR4.CET a guest-owned bit under VMX by extending KVM_POSSIBLE_CR4_GUEST_BITS accordingly. There's no need to intercept changes to CR4.CET, as it's neither included in KVM's MMU role bits, nor does KVM specifically care about the actual value of a (nested) guest's CR4.CET value, beside for enforcing architectural constraints, i.e. make sure that CR0.WP=1 if CR4.CET=1. Intercepting writes to CR4.CET is particularly bad for grsecurity kernels with KERNEXEC or, even worse, KERNSEAL enabled. These features heavily make use of read-only kernel objects and use a cpu-local CR0.WP toggle to override it, when needed. Under a CET-enabled kernel, this also requires toggling CR4.CET, hence the motivation to make it guest-owned. Using the old test from [1] gives the following runtime numbers (perf stat -r 5 ssdd 10 50000): * grsec guest on linux-6.16-rc5 + cet patches: 2.4647 +- 0.0706 seconds time elapsed ( +- 2.86% ) * grsec guest on linux-6.16-rc5 + cet patches + CR4.CET guest-owned: 1.5648 +- 0.0240 seconds time elapsed ( +- 1.53% ) Not only does not intercepting CR4.CET make the test run ~35% faster, it's also more stable with less fluctuation due to fewer VMEXITs. Therefore, make CR4.CET a guest-owned bit where possible. This change is VMX-specific, as SVM has no such fine-grained control register intercept control. If KVM's assumptions regarding MMU role handling wrt. a guest's CR4.CET value ever change, the BUILD_BUG_ON()s related to KVM_MMU_CR4_ROLE_BITS and KVM_POSSIBLE_CR4_GUEST_BITS will catch that early. Link: https://lore.kernel.org/kvm/20230322013731.102955-1-minipli@grsecurity.net/ [1] Reviewed-by: Chao Gao Signed-off-by: Mathias Krause Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-52-seanjc@google.com Signed-off-by: Sean Christopherson commit 947ab90c91983c965acb994455734aae19317596 Author: Sean Christopherson Date: Fri Sep 19 15:32:57 2025 -0700 KVM: selftests: Verify MSRs are (not) in save/restore list when (un)supported Add a check in the MSRs test to verify that KVM's reported support for MSRs with feature bits is consistent between KVM's MSR save/restore lists and KVM's supported CPUID. To deal with Intel's wonderful decision to bundle IBT and SHSTK under CET, track the "second" feature to avoid false failures when running on a CPU with only one of IBT or SHSTK. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-51-seanjc@google.com Signed-off-by: Sean Christopherson commit 3469fd203bac201ad67d9586041689c4c6a87882 Author: Sean Christopherson Date: Fri Sep 19 15:32:56 2025 -0700 KVM: selftests: Add coverage for KVM-defined registers in MSRs test Add test coverage for the KVM-defined GUEST_SSP "register" in the MSRs test. While _KVM's_ goal is to not tie the uAPI of KVM-defined registers to any particular internal implementation, i.e. to not commit in uAPI to handling GUEST_SSP as an MSR, treating GUEST_SSP as an MSR for testing purposes is a-ok and is a naturally fit given the semantics of SSP. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-50-seanjc@google.com Signed-off-by: Sean Christopherson commit 80c2b6d8e7bb194744f5fdfc4f0560e053ababda Author: Sean Christopherson Date: Fri Sep 19 15:32:55 2025 -0700 KVM: selftests: Add KVM_{G,S}ET_ONE_REG coverage to MSRs test When KVM_{G,S}ET_ONE_REG are supported, verify that MSRs can be accessed via ONE_REG and through the dedicated MSR ioctls. For simplicity, run the test twice, e.g. instead of trying to get MSR values into the exact right state when switching write methods. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-49-seanjc@google.com Signed-off-by: Sean Christopherson commit a8b9cca99cf454799ef799f8af9bdb55389cfd94 Author: Sean Christopherson Date: Fri Sep 19 15:32:54 2025 -0700 KVM: selftests: Extend MSRs test to validate vCPUs without supported features Add a third vCPUs to the MSRs test that runs with all features disabled in the vCPU's CPUID model, to verify that KVM does the right thing with respect to emulating accesses to MSRs that shouldn't exist. Use the same VM to verify that KVM is honoring the vCPU model, e.g. isn't looking at per-VM state when emulating MSR accesses. Link: https://lore.kernel.org/r/20250919223258.1604852-48-seanjc@google.com Signed-off-by: Sean Christopherson commit 27c41353064f9fdec9276e6b8e618b01110ef282 Author: Sean Christopherson Date: Fri Sep 19 15:32:53 2025 -0700 KVM: selftests: Add support for MSR_IA32_{S,U}_CET to MSRs test Extend the MSRs test to support {S,U}_CET, which are a bit of a pain to handled due to the MSRs existing if IBT *or* SHSTK is supported. To deal with Intel's wonderful decision to bundle IBT and SHSTK under CET, track the second feature, but skip only RDMSR #GP tests to avoid false failures when running on a CPU with only one of IBT or SHSTK (the WRMSR #GP tests are still valid since the enable bits are per-feature). Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-47-seanjc@google.com Signed-off-by: Sean Christopherson commit 9c38ddb3df94acdc86485c7073610f01655309f9 Author: Sean Christopherson Date: Fri Sep 19 15:32:52 2025 -0700 KVM: selftests: Add an MSR test to exercise guest/host and read/write Add a selftest to verify reads and writes to various MSRs, from both the guest and host, and expect success/failure based on whether or not the vCPU supports the MSR according to supported CPUID. Note, this test is extremely similar to KVM-Unit-Test's "msr" test, but provides more coverage with respect to host accesses, and will be extended to provide addition testing of CPUID-based features, save/restore lists, and KVM_{G,S}ET_ONE_REG, all which are extremely difficult to validate in KUT. If kvm.ignore_msrs=true, skip the unsupported and reserved testcases as KVM's ABI is a mess; what exactly is supposed to be ignored, and when, varies wildly. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-46-seanjc@google.com Signed-off-by: Sean Christopherson commit fddd07626baa419c259ad5f3537a57188b5bb415 Author: Sean Christopherson Date: Fri Sep 19 15:32:50 2025 -0700 KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors Add {HV,CP,SX}_VECTOR definitions for AMD's Hypervisor Injection Exception, VMM Communication Exception, and SVM Security Exception vectors, along with human friendly formatting for trace_kvm_inj_exception(). Note, KVM is all but guaranteed to never observe or inject #SX, and #HV is also unlikely to go unused. Add the architectural collateral mostly for completeness, and on the off chance that hardware goes off the rails. Link: https://lore.kernel.org/r/20250919223258.1604852-44-seanjc@google.com Signed-off-by: Sean Christopherson commit f2f5519aa4e3ec4e42b009338f773bebb0bfd8a3 Author: Sean Christopherson Date: Fri Sep 19 15:32:49 2025 -0700 KVM: x86: Define Control Protection Exception (#CP) vector Add a CP_VECTOR definition for CET's Control Protection Exception (#CP), along with human friendly formatting for trace_kvm_inj_exception(). Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-43-seanjc@google.com Signed-off-by: Sean Christopherson commit d37cc4819a489bfe32008e50e3a76eb967d95d42 Author: Sean Christopherson Date: Fri Sep 19 15:32:48 2025 -0700 KVM: x86: Add human friendly formatting for #XM, and #VE Add XM_VECTOR and VE_VECTOR pretty-printing for trace_kvm_inj_exception(). Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-42-seanjc@google.com Signed-off-by: Sean Christopherson commit 8db428fd5229ba509d515af10d7f33d7d4a54bfe Author: John Allen Date: Fri Sep 19 15:32:47 2025 -0700 KVM: SVM: Enable shadow stack virtualization for SVM Remove the explicit clearing of shadow stack CPU capabilities. Reviewed-by: Chao Gao Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-41-seanjc@google.com Signed-off-by: Sean Christopherson commit b5fa221f7b08ca145b0357b77b90dcc998278967 Author: Sean Christopherson Date: Fri Sep 19 15:32:46 2025 -0700 KVM: SEV: Synchronize MSR_IA32_XSS from the GHCB when it's valid Synchronize XSS from the GHCB to KVM's internal tracking if the guest marks XSS as valid on a #VMGEXIT. Like XCR0, KVM needs an up-to-date copy of XSS in order to compute the required XSTATE size when emulating CPUID.0xD.0x1 for the guest. Treat the incoming XSS change as an emulated write, i.e. validatate the guest-provided value, to avoid letting the guest load garbage into KVM's tracking. Simply ignore bad values, as either the guest managed to get an unsupported value into hardware, or the guest is misbehaving and providing pure garbage. In either case, KVM can't fix the broken guest. Explicitly allow access to XSS at all times, as KVM needs to ensure its copy of XSS stays up-to-date. E.g. KVM supports migration of SEV-ES guests and so needs to allow the host to save/restore XSS, otherwise a guest that *knows* its XSS hasn't change could get stale/bad CPUID emulation if the guest doesn't provide XSS in the GHCB on every exit. This creates a hypothetical problem where a guest could request emulation of RDMSR or WRMSR on XSS, but arguably that's not even a problem, e.g. it would be entirely reasonable for a guest to request "emulation" as a way to inform the hypervisor that its XSS value has been modified. Note, emulating the change as an MSR write also takes care of side effects, e.g. marking dynamic CPUID bits as dirty. Suggested-by: John Allen base-commit: 14298d819d5a6b7180a4089e7d2121ca3551dc6c Link: https://lore.kernel.org/r/20250919223258.1604852-40-seanjc@google.com Signed-off-by: Sean Christopherson commit 38c46bdbf99812a07a8a7ef48718f0a03acd8a8a Author: John Allen Date: Fri Sep 19 15:32:45 2025 -0700 KVM: SVM: Pass through shadow stack MSRs as appropriate Pass through XSAVE managed CET MSRs on SVM when KVM supports shadow stack. These cannot be intercepted without also intercepting XSAVE which would likely cause unacceptable performance overhead. MSR_IA32_INT_SSP_TAB is not managed by XSAVE, so it is intercepted. Reviewed-by: Chao Gao Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-39-seanjc@google.com Signed-off-by: Sean Christopherson commit c7586aa3bed4969cc7345940e5a331efd614f41d Author: John Allen Date: Fri Sep 19 15:32:44 2025 -0700 KVM: SVM: Update dump_vmcb with shadow stack save area additions Add shadow stack VMCB fields to dump_vmcb. PL0_SSP, PL1_SSP, PL2_SSP, PL3_SSP, and U_CET are part of the SEV-ES save area and are encrypted, but can be decrypted and dumped if the guest policy allows debugging. Reviewed-by: Maxim Levitsky Signed-off-by: John Allen Link: https://lore.kernel.org/r/20250919223258.1604852-38-seanjc@google.com Signed-off-by: Sean Christopherson commit c5ba49458513bd1ecd669d4ec7124e788b19347c Author: Sean Christopherson Date: Fri Sep 19 15:32:43 2025 -0700 KVM: nSVM: Save/load CET Shadow Stack state to/from vmcb12/vmcb02 Transfer the three CET Shadow Stack VMCB fields (S_CET, ISST_ADDR, and SSP) on VMRUN, #VMEXIT, and loading nested state (saving nested state simply copies the entire save area). SVM doesn't provide a way to disallow L1 from enabling Shadow Stacks for L2, i.e. KVM *must* provide nested support before advertising SHSTK to userspace. Link: https://lore.kernel.org/r/20250919223258.1604852-37-seanjc@google.com Signed-off-by: Sean Christopherson commit 48b2ec0d540c29cebb5119dd2b8e8e7369bc409c Author: John Allen Date: Fri Sep 19 15:32:42 2025 -0700 KVM: SVM: Emulate reads and writes to shadow stack MSRs Emulate shadow stack MSR access by reading and writing to the corresponding fields in the VMCB. Signed-off-by: John Allen [sean: mark VMCB_CET dirty/clean as appropriate] Link: https://lore.kernel.org/r/20250919223258.1604852-36-seanjc@google.com Signed-off-by: Sean Christopherson commit 42ae6448531b5106e9f29794992856e94a52b5cb Author: Chao Gao Date: Fri Sep 19 15:32:41 2025 -0700 KVM: nVMX: Advertise new VM-Entry/Exit control bits for CET state Advertise the LOAD_CET_STATE VM-Entry/Exit control bits in the nested VMX MSRS, as all nested support for CET virtualization, including consistency checks, is in place. Advertise support if and only if KVM supports at least one of IBT or SHSTK. While it's userspace's responsibility to provide a consistent CPU model to the guest, that doesn't mean KVM should set userspace up to fail. Note, the existing {CLEAR,LOAD}_BNDCFGS behavior predates KVM_X86_QUIRK_STUFF_FEATURE_MSRS, i.e. KVM "solved" the inconsistent CPU model problem by overwriting the VMX MSRs provided by userspace. Signed-off-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-35-seanjc@google.com Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit 62f7533a6b3aad9d39c6098dbc3d8e7daeda9399 Author: Chao Gao Date: Fri Sep 19 15:32:40 2025 -0700 KVM: nVMX: Add consistency checks for CET states Introduce consistency checks for CET states during nested VM-entry. A VMCS contains both guest and host CET states, each comprising the IA32_S_CET MSR, SSP, and IA32_INTERRUPT_SSP_TABLE_ADDR MSR. Various checks are applied to CET states during VM-entry as documented in SDM Vol3 Chapter "VM ENTRIES". Implement all these checks during nested VM-entry to emulate the architectural behavior. In summary, there are three kinds of checks on guest/host CET states during VM-entry: A. Checks applied to both guest states and host states: * The IA32_S_CET field must not set any reserved bits; bits 10 (SUPPRESS) and 11 (TRACKER) cannot both be set. * SSP should not have bits 1:0 set. * The IA32_INTERRUPT_SSP_TABLE_ADDR field must be canonical. B. Checks applied to host states only * IA32_S_CET MSR and SSP must be canonical if the CPU enters 64-bit mode after VM-exit. Otherwise, IA32_S_CET and SSP must have their higher 32 bits cleared. C. Checks applied to guest states only: * IA32_S_CET MSR and SSP are not required to be canonical (i.e., 63:N-1 are identical, where N is the CPU's maximum linear-address width). But, bits 63:N of SSP must be identical. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-34-seanjc@google.com [sean: have common helper return 0/-EINVAL, not true/false] Signed-off-by: Sean Christopherson commit 8060b2bd2dd05a19ad7ec248489d374f2bd2b057 Author: Chao Gao Date: Fri Sep 19 15:32:39 2025 -0700 KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET Add consistency checks for CR4.CET and CR0.WP in guest-state or host-state area in the VMCS12. This ensures that configurations with CR4.CET set and CR0.WP not set result in VM-entry failure, aligning with architectural behavior. Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-33-seanjc@google.com Signed-off-by: Sean Christopherson commit 625884996bff1b25a39834fa4935d695d71ef1b1 Author: Yang Weijiang Date: Fri Sep 19 15:32:38 2025 -0700 KVM: nVMX: Prepare for enabling CET support for nested guest Set up CET MSRs, related VM_ENTRY/EXIT control bits and fixed CR4 setting to enable CET for nested VM. vmcs12 and vmcs02 needs to be synced when L2 exits to L1 or when L1 wants to resume L2, that way correct CET states can be observed by one another. Please note that consistency checks regarding CET state during VM-Entry will be added later to prevent this patch from becoming too large. Advertising the new CET VM_ENTRY/EXIT control bits are also be deferred until after the consistency checks are added. Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Xin Li (Intel) Tested-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-32-seanjc@google.com Signed-off-by: Sean Christopherson commit 033cc166f02920b193f7ec989083bce1a20e9abf Author: Yang Weijiang Date: Fri Sep 19 15:32:37 2025 -0700 KVM: nVMX: Virtualize NO_HW_ERROR_CODE_CC for L1 event injection to L2 Per SDM description(Vol.3D, Appendix A.1): "If bit 56 is read as 1, software can use VM entry to deliver a hardware exception with or without an error code, regardless of vector" Modify has_error_code check before inject events to nested guest. Only enforce the check when guest is in real mode, the exception is not hard exception and the platform doesn't enumerate bit56 in VMX_BASIC, in all other case ignore the check to make the logic consistent with SDM. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-31-seanjc@google.com Signed-off-by: Sean Christopherson commit f7336d47be53d0da1e74143b8befea8c0176f3cc Author: Sean Christopherson Date: Fri Sep 19 15:32:36 2025 -0700 KVM: VMX: Configure nested capabilities after CPU capabilities Swap the order between configuring nested VMX capabilities and base CPU capabilities, so that nested VMX support can be conditioned on core KVM support, e.g. to allow conditioning support for LOAD_CET_STATE on the presence of IBT or SHSTK. Because the sanity checks on nested VMX config performed by vmx_check_processor_compat() run _after_ vmx_hardware_setup(), any use of kvm_cpu_cap_has() when configuring nested VMX support will lead to failures in vmx_check_processor_compat(). While swapping the order of two (or more) configuration flows can lead to a game of whack-a-mole, in this case nested support inarguably should be done after base support. KVM should never condition base support on nested support, because nested support is fully optional, while obviously it's desirable to condition nested support on base support. And there's zero evidence the current ordering was intentional, e.g. commit 66a6950f9995 ("KVM: x86: Introduce kvm_cpu_caps to replace runtime CPUID masking") likely placed the call to kvm_set_cpu_caps() after nested setup because it looked pretty. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-30-seanjc@google.com Signed-off-by: Sean Christopherson commit e140467bbdafff84f1f346a7c59f404cd9782b82 Author: Yang Weijiang Date: Fri Sep 19 15:32:35 2025 -0700 KVM: x86: Enable CET virtualization for VMX and advertise to userspace Add support for the LOAD_CET_STATE VM-Enter and VM-Exit controls, the CET XFEATURE bits in XSS, and advertise support for IBT and SHSTK to userspace. Explicitly clear IBT and SHSTK onn SVM, as additional work is needed to enable CET on SVM, e.g. to context switch S_CET and other state. Disable KVM CET feature if unrestricted_guest is unsupported/disabled as KVM does not support emulating CET, as running without Unrestricted Guest can result in KVM emulating large swaths of guest code. While it's highly unlikely any guest will trigger emulation while also utilizing IBT or SHSTK, there's zero reason to allow CET without Unrestricted Guest as that combination should only be possible when explicitly disabling unrestricted_guest for testing purposes. Disable CET if VMX_BASIC[bit56] == 0, i.e. if hardware strictly enforces the presence of an Error Code based on exception vector, as attempting to inject a #CP with an Error Code (#CP architecturally has an Error Code) will fail due to the #CP vector historically not having an Error Code. Clear S_CET and SSP-related VMCS on "reset" to emulate the architectural of CET MSRs and SSP being reset to 0 after RESET, power-up and INIT. Note, KVM already clears guest CET state that is managed via XSTATE in kvm_xstate_reset(). Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: move some bits to separate patches, massage changelog] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-29-seanjc@google.com Signed-off-by: Sean Christopherson commit 343acdd158a55dab1cfb0d209cd1d70b0cabb8b2 Author: Sean Christopherson Date: Fri Sep 19 15:32:34 2025 -0700 KVM: x86: Disable support for IBT and SHSTK if allow_smaller_maxphyaddr is true Make IBT and SHSTK virtualization mutually exclusive with "officially" supporting setups with guest.MAXPHYADDR < host.MAXPHYADDR, i.e. if the allow_smaller_maxphyaddr module param is set. Running a guest with a smaller MAXPHYADDR requires intercepting #PF, and can also trigger emulation of arbitrary instructions. Intercepting and reacting to #PFs doesn't play nice with SHSTK, as KVM's MMU hasn't been taught to handle Shadow Stack accesses, and emulating arbitrary instructions doesn't play nice with IBT or SHSTK, as KVM's emulator doesn't handle the various side effects, e.g. doesn't enforce end-branch markers or model Shadow Stack updates. Note, hiding IBT and SHSTK based solely on allow_smaller_maxphyaddr is overkill, as allow_smaller_maxphyaddr is only problematic if the guest is actually configured to have a smaller MAXPHYADDR. However, KVM's ABI doesn't provide a way to express that IBT and SHSTK may break if enabled in conjunction with guest.MAXPHYADDR < host.MAXPHYADDR. I.e. the alternative is to do nothing in KVM and instead update documentation and hope KVM users are thorough readers. Go with the conservative-but-correct approach; worst case scenario, this restriction can be dropped if there's a strong use case for enabling CET on hosts with allow_smaller_maxphyaddr. Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-28-seanjc@google.com Signed-off-by: Sean Christopherson commit f705de12a22c945f55d51baec4ea495aedc5ebd7 Author: Sean Christopherson Date: Mon Sep 22 11:47:43 2025 -0700 KVM: x86: Initialize allow_smaller_maxphyaddr earlier in setup Initialize allow_smaller_maxphyaddr during hardware setup as soon as KVM knows whether or not TDP will be utilized. To avoid having to teach KVM's emulator all about CET, KVM's upcoming CET virtualization support will be mutually exclusive with allow_smaller_maxphyaddr, i.e. will disable SHSTK and IBT if allow_smaller_maxphyaddr is enabled. In general, allow_smaller_maxphyaddr should be initialized as soon as possible since it's globally visible while its only input is whether or not EPT/NPT is enabled. I.e. there's effectively zero risk of setting allow_smaller_maxphyaddr too early, and substantial risk of setting it too late. Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250922184743.1745778-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 1f6f68fcfe43cf26fc0a98fe14e0454cc5c75416 Author: Sean Christopherson Date: Fri Sep 19 15:32:33 2025 -0700 KVM: x86: Disable support for Shadow Stacks if TDP is disabled Make TDP a hard requirement for Shadow Stacks, as there are no plans to add Shadow Stack support to the Shadow MMU. E.g. KVM hasn't been taught to understand the magic Writable=0,Dirty=1 combination that is required for Shadow Stack accesses, and so enabling Shadow Stacks when using shadow paging will put the guest into an infinite #PF loop (KVM thinks the shadow page tables have a valid mapping, hardware says otherwise). Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-27-seanjc@google.com Signed-off-by: Sean Christopherson commit 69cc3e886582891f9c4d5830f18a2664a7f7cf7c Author: Yang Weijiang Date: Fri Sep 19 15:32:32 2025 -0700 KVM: x86: Add XSS support for CET_KERNEL and CET_USER Add CET_KERNEL and CET_USER to KVM's set of supported XSS bits when IBT *or* SHSTK is supported. Like CR4.CET, XFEATURE support for IBT and SHSTK are bundle together under the CET umbrella, and thus prone to virtualization holes if KVM or the guest supports only one of IBT or SHSTK, but hardware supports both. However, again like CR4.CET, such virtualization holes are benign from the host's perspective so long as KVM takes care to always honor the "or" logic. Require CET_KERNEL and CET_USER to come as a pair, and refuse to support IBT or SHSTK if one (or both) features is missing, as the (host) kernel expects them to come as a pair, i.e. may get confused and corrupt state if only one of CET_KERNEL or CET_USER is supported. Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: split to separate patch, write changelog, add XFEATURE_MASK_CET_ALL] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 19e6e083f3f9e4ac1794273d72dfb59d19a0fc69 Author: Sean Christopherson Date: Fri Sep 19 15:32:31 2025 -0700 KVM: nVMX: Always forward XSAVES/XRSTORS exits from L2 to L1 Unconditionally forward XSAVES/XRSTORS VM-Exits from L2 to L1, as KVM doesn't utilize the XSS-bitmap (KVM relies on controlling the XSS value in hardware to prevent unauthorized access to XSAVES state). KVM always loads vmcs02 with vmcs12's bitmap, and so any exit _must_ be due to vmcs12's XSS-bitmap. Drop the comment about XSS never being non-zero in anticipation of enabling CET_KERNEL and CET_USER support. Opportunistically WARN if XSAVES is not enabled for L2, as the CPU is supposed to generate #UD before checking the XSS-bitmap. Reviewed-by: Xiaoyao Li Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-25-seanjc@google.com Signed-off-by: Sean Christopherson commit b3744c59ebc5f2697d62844149c1a1c0e274ead0 Author: Yang Weijiang Date: Fri Sep 19 15:32:30 2025 -0700 KVM: x86: Allow setting CR4.CET if IBT or SHSTK is supported Drop X86_CR4_CET from CR4_RESERVED_BITS and instead mark CET as reserved if and only if IBT *and* SHSTK are unsupported, i.e. allow CR4.CET to be set if IBT or SHSTK is supported. This creates a virtualization hole if the CPU supports both IBT and SHSTK, but the kernel or vCPU model only supports one of the features. However, it's entirely legal for a CPU to have only one of IBT or SHSTK, i.e. the hole is a flaw in the architecture, not in KVM. More importantly, so long as KVM is careful to initialize and context switch both IBT and SHSTK state (when supported in hardware) if either feature is exposed to the guest, a misbehaving guest can only harm itself. E.g. VMX initializes host CET VMCS fields based solely on hardware capabilities. Signed-off-by: Yang Weijiang Signed-off-by: Mathias Krause Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: split to separate patch, write changelog] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-24-seanjc@google.com Signed-off-by: Sean Christopherson commit 843af0f2e4617db197034b27a9a658a59271f19f Author: Sean Christopherson Date: Fri Sep 19 15:32:29 2025 -0700 KVM: x86/mmu: Pretty print PK, SS, and SGX flags in MMU tracepoints Add PK (Protection Keys), SS (Shadow Stacks), and SGX (Software Guard Extensions) to the set of #PF error flags handled via kvm_mmu_trace_pferr_flags. While KVM doesn't expect PK or SS #PFs in particular, pretty print their names instead of the raw hex value saves the user from having to go spelunking in the SDM to figure out what's going on. Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 296599346c671f31854d674db2891ff2e1654b6a Author: Sean Christopherson Date: Fri Sep 19 15:32:28 2025 -0700 KVM: x86/mmu: WARN on attempt to check permissions for Shadow Stack #PF Add PFERR_SS_MASK, a.k.a. Shadow Stack access, and WARN if KVM attempts to check permissions for a Shadow Stack access as KVM hasn't been taught to understand the magic Writable=0,Dirty=1 combination that is required for Shadow Stack accesses, and likely will never learn. There are no plans to support Shadow Stacks with the Shadow MMU, and the emulator rejects all instructions that affect Shadow Stacks, i.e. it should be impossible for KVM to observe a #PF due to a shadow stack access. Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-22-seanjc@google.com Signed-off-by: Sean Christopherson commit d4c03f63957c66bc95f5f33052f8b4be804631c3 Author: Sean Christopherson Date: Fri Sep 19 15:32:27 2025 -0700 KVM: x86: Emulate SSP[63:32]!=0 #GP(0) for FAR JMP to 32-bit mode Emulate the Shadow Stack restriction that the current SSP must be a 32-bit value on a FAR JMP from 64-bit mode to compatibility mode. From the SDM's pseudocode for FAR JMP: IF ShadowStackEnabled(CPL) IF (IA32_EFER.LMA and DEST(segment selector).L) = 0 (* If target is legacy or compatibility mode then the SSP must be in low 4GB *) IF (SSP & 0xFFFFFFFF00000000 != 0); THEN #GP(0); FI; FI; FI; Note, only the current CPL needs to be considered, as FAR JMP can't be used for inter-privilege level transfers, and KVM rejects emulation of all other far branch instructions when Shadow Stacks are enabled. To give the emulator access to GUEST_SSP, special case handling MSR_KVM_INTERNAL_GUEST_SSP in emulator_get_msr() to treat the access as a host access (KVM doesn't allow guest accesses to internal "MSRs"). The ->get_msr() API is only used for implicit accesses from the emulator, i.e. is only used with hardcoded MSR indices, and so any access to MSR_KVM_INTERNAL_GUEST_SSP is guaranteed to be from KVM, i.e. not from the guest via RDMSR. Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-21-seanjc@google.com Signed-off-by: Sean Christopherson commit 82c0ec02825814e1ef332d635d3441b07c05b1c9 Author: Sean Christopherson Date: Fri Sep 19 15:32:26 2025 -0700 KVM: x86: Don't emulate task switches when IBT or SHSTK is enabled Exit to userspace with KVM_INTERNAL_ERROR_EMULATION if the guest triggers task switch emulation with Indirect Branch Tracking or Shadow Stacks enabled, as attempting to do the right thing would require non-trivial effort and complexity, KVM doesn't support emulating CET generally, and it's extremely unlikely that any guest will do task switches while also utilizing CET. Defer taking on the complexity until someone cares enough to put in the time and effort to add support. Per the SDM: If shadow stack is enabled, then the SSP of the task is located at the 4 bytes at offset 104 in the 32-bit TSS and is used by the processor to establish the SSP when a task switch occurs from a task associated with this TSS. Note that the processor does not write the SSP of the task initiating the task switch to the TSS of that task, and instead the SSP of the previous task is pushed onto the shadow stack of the new task. Note, per the SDM's pseudocode on TASK SWITCHING, IBT state for the new privilege level is updated. To keep things simple, check both S_CET and U_CET (again, anyone that wants more precise checking can have the honor of implementing support). Reported-by: Binbin Wu Closes: https://lore.kernel.org/all/819bd98b-2a60-4107-8e13-41f1e4c706b1@linux.intel.com Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-20-seanjc@google.com Signed-off-by: Sean Christopherson commit 57c3db7e2e26970ee3630a25913368f849ea803a Author: Sean Christopherson Date: Fri Sep 19 15:32:25 2025 -0700 KVM: x86: Don't emulate instructions affected by CET features Don't emulate branch instructions, e.g. CALL/RET/JMP etc., that are affected by Shadow Stacks and/or Indirect Branch Tracking when said features are enabled in the guest, as fully emulating CET would require significant complexity for no practical benefit (KVM shouldn't need to emulate branch instructions on modern hosts). Simply doing nothing isn't an option as that would allow a malicious entity to subvert CET protections via the emulator. To detect instructions that are subject to IBT or affect IBT state, use the existing IsBranch flag along with the source operand type to detect indirect branches, and the existing NearBranch flag to detect far JMPs and CALLs, all of which are effectively indirect. Explicitly check for emulation of IRET, FAR RET (IMM), and SYSEXIT (the ret-like far branches) instead of adding another flag, e.g. IsRet, as it's unlikely the emulator will ever need to check for return-like instructions outside of this one specific flow. Use an allow-list instead of a deny-list because (a) it's a shorter list and (b) so that a missed entry gets a false positive, not a false negative (i.e. reject emulation instead of clobbering CET state). For Shadow Stacks, explicitly track instructions that directly affect the current SSP, as KVM's emulator doesn't have existing flags that can be used to precisely detect such instructions. Alternatively, the em_xxx() helpers could directly check for ShadowStack interactions, but using a dedicated flag is arguably easier to audit, and allows for handling both IBT and SHSTK in one fell swoop. Note! On far transfers, do NOT consult the current privilege level and instead treat SHSTK/IBT as being enabled if they're enabled for User *or* Supervisor mode. On inter-privilege level far transfers, SHSTK and IBT can be in play for the target privilege level, i.e. checking the current privilege could get a false negative, and KVM doesn't know the target privilege level until emulation gets under way. Note #2, FAR JMP from 64-bit mode to compatibility mode interacts with the current SSP, but only to ensure SSP[63:32] == 0. Don't tag FAR JMP as SHSTK, which would be rather confusing and would result in FAR JMP being rejected unnecessarily the vast majority of the time (ignoring that it's unlikely to ever be emulated). A future commit will add the #GP(0) check for the specific FAR JMP scenario. Note #3, task switches also modify SSP and so need to be rejected. That too will be addressed in a future commit. Suggested-by: Chao Gao Originally-by: Yang Weijiang Cc: Mathias Krause Cc: John Allen Cc: Rick Edgecombe Reviewed-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 584ba3ffb9843fd12d3b4a33cfe056e2264392a0 Author: Yang Weijiang Date: Fri Sep 19 15:32:24 2025 -0700 KVM: VMX: Set host constant supervisor states to VMCS fields Save constant values to HOST_{S_CET,SSP,INTR_SSP_TABLE} field explicitly. Kernel IBT is supported and the setting in MSR_IA32_S_CET is static after post-boot(The exception is BIOS call case but vCPU thread never across it) and KVM doesn't need to refresh HOST_S_CET field before every VM-Enter/ VM-Exit sequence. Host supervisor shadow stack is not enabled now and SSP is not accessible to kernel mode, thus it's safe to set host IA32_INT_SSP_TAB/SSP VMCS field to 0s. When shadow stack is enabled for CPL3, SSP is reloaded from PL3_SSP before it exits to userspace. Check SDM Vol 2A/B Chapter 3/4 for SYSCALL/ SYSRET/SYSENTER SYSEXIT/RDSSP/CALL etc. Prevent KVM module loading if host supervisor shadow stack SHSTK_EN is set in MSR_IA32_S_CET as KVM cannot co-exit with it correctly. Suggested-by: Sean Christopherson Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: snapshot host S_CET if SHSTK *or* IBT is supported] Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 25f3840483e6c69e4d1a689cf3edc70f93604f2a Author: Yang Weijiang Date: Fri Sep 19 15:32:23 2025 -0700 KVM: VMX: Set up interception for CET MSRs Disable interception for CET MSRs that can be accessed via XSAVES/XRSTORS, and exist accordingly to CPUID, as accesses through XSTATE aren't subject to MSR interception checks, i.e. can't be intercepted without intercepting and emulating XSAVES/XRSTORS, and KVM doesn't support emulating XSAVE/XRSTOR instructions. Don't condition interception on the guest actually having XSAVES as there is no benefit to intercepting the accesses (when the MSRs exist). The MSRs in question are either context switched by the CPU on VM-Enter/VM-Exit or by KVM via XSAVES/XRSTORS (KVM requires XSAVES to virtualization SHSTK), i.e. KVM is going to load guest values into hardware irrespective of guest XSAVES support. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 1a61bd0d126abbf01c384c44b46bcdd4ef495850 Author: Yang Weijiang Date: Fri Sep 19 15:32:22 2025 -0700 KVM: x86: Save and reload SSP to/from SMRAM Save CET SSP to SMRAM on SMI and reload it on RSM. KVM emulates HW arch behavior when guest enters/leaves SMM mode,i.e., save registers to SMRAM at the entry of SMM and reload them at the exit to SMM. Per SDM, SSP is one of such registers on 64-bit Arch, and add the support for SSP. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 8b59d0275c964bcbe573dde46bd3c1f20ed2d2bd Author: Yang Weijiang Date: Fri Sep 19 15:32:21 2025 -0700 KVM: VMX: Emulate read and write to CET MSRs Add emulation interface for CET MSR access. The emulation code is split into common part and vendor specific part. The former does common checks for MSRs, e.g., accessibility, data validity etc., then passes operation to either XSAVE-managed MSRs via the helpers or CET VMCS fields. SSP can only be read via RDSSP. Writing even requires destructive and potentially faulting operations such as SAVEPREVSSP/RSTORSSP or SETSSBSY/CLRSSBSY. Let the host use a pseudo-MSR that is just a wrapper for the GUEST_SSP field of the VMCS. Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: drop call to kvm_set_xstate_msr() for S_CET, consolidate code] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 9d6812d415358372aaaf1dfe95bc30d11e4e95db Author: Yang Weijiang Date: Fri Sep 19 15:32:20 2025 -0700 KVM: x86: Enable guest SSP read/write interface with new uAPIs Add a KVM-defined ONE_REG register, KVM_REG_GUEST_SSP, to let userspace save and restore the guest's Shadow Stack Pointer (SSP). On both Intel and AMD, SSP is a hardware register that can only be accessed by software via dedicated ISA (e.g. RDSSP) or via VMCS/VMCB fields (used by hardware to context switch SSP at entry/exit). As a result, SSP doesn't fit in any of KVM's existing interfaces for saving/restoring state. Internally, treat SSP as a fake/synthetic MSR, as the semantics of writes to SSP follow that of several other Shadow Stack MSRs, e.g. the PLx_SSP MSRs. Use a translation layer to hide the KVM-internal MSR index so that the arbitrary index doesn't become ABI, e.g. so that KVM can rework its implementation as needed, so long as the ONE_REG ABI is maintained. Explicitly reject accesses to SSP if the vCPU doesn't have Shadow Stack support to avoid running afoul of ignore_msrs, which unfortunately applies to host-initiated accesses (which is a discussion for another day). I.e. ensure consistent behavior for KVM-defined registers irrespective of ignore_msrs. Link: https://lore.kernel.org/all/aca9d389-f11e-4811-90cf-d98e345a5cc2@intel.com Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-14-seanjc@google.com Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit d6c387fc396b3d2c5aa00cb5b46f6401fb86bb43 Author: Yang Weijiang Date: Fri Sep 19 15:32:19 2025 -0700 KVM: VMX: Introduce CET VMCS fields and control bits Control-flow Enforcement Technology (CET) is a kind of CPU feature used to prevent Return/CALL/Jump-Oriented Programming (ROP/COP/JOP) attacks. It provides two sub-features(SHSTK,IBT) to defend against ROP/COP/JOP style control-flow subversion attacks. Shadow Stack (SHSTK): A shadow stack is a second stack used exclusively for control transfer operations. The shadow stack is separate from the data/normal stack and can be enabled individually in user and kernel mode. When shadow stack is enabled, CALL pushes the return address on both the data and shadow stack. RET pops the return address from both stacks and compares them. If the return addresses from the two stacks do not match, the processor generates a #CP. Indirect Branch Tracking (IBT): IBT introduces instruction(ENDBRANCH)to mark valid target addresses of indirect branches (CALL, JMP etc...). If an indirect branch is executed and the next instruction is _not_ an ENDBRANCH, the processor generates a #CP. These instruction behaves as a NOP on platforms that have no CET. Several new CET MSRs are defined to support CET: MSR_IA32_{U,S}_CET: CET settings for {user,supervisor} CET respectively. MSR_IA32_PL{0,1,2,3}_SSP: SHSTK pointer linear address for CPL{0,1,2,3}. MSR_IA32_INT_SSP_TAB: Linear address of SHSTK pointer table, whose entry is indexed by IST of interrupt gate desc. Two XSAVES state bits are introduced for CET: IA32_XSS:[bit 11]: Control saving/restoring user mode CET states IA32_XSS:[bit 12]: Control saving/restoring supervisor mode CET states. Six VMCS fields are introduced for CET: {HOST,GUEST}_S_CET: Stores CET settings for kernel mode. {HOST,GUEST}_SSP: Stores current active SSP. {HOST,GUEST}_INTR_SSP_TABLE: Stores current active MSR_IA32_INT_SSP_TAB. On Intel platforms, two additional bits are defined in VM_EXIT and VM_ENTRY control fields: If VM_EXIT_LOAD_CET_STATE = 1, host CET states are loaded from following VMCS fields at VM-Exit: HOST_S_CET HOST_SSP HOST_INTR_SSP_TABLE If VM_ENTRY_LOAD_CET_STATE = 1, guest CET states are loaded from following VMCS fields at VM-Entry: GUEST_S_CET GUEST_SSP GUEST_INTR_SSP_TABLE Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 6a11c860d8a4aa1c7351246bd1ee7b41f26399b6 Author: Yang Weijiang Date: Fri Sep 19 15:32:18 2025 -0700 KVM: x86: Report KVM supported CET MSRs as to-be-saved Add CET MSRs to the list of MSRs reported to userspace if the feature, i.e. IBT or SHSTK, associated with the MSRs is supported by KVM. Suggested-by: Chao Gao Signed-off-by: Yang Weijiang Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250919223258.1604852-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 586ef9dcbb28fc0bc6beb496e6dc8a54276e7a32 Author: Yang Weijiang Date: Fri Sep 19 15:32:17 2025 -0700 KVM: x86: Add fault checks for guest CR4.CET setting Check potential faults for CR4.CET setting per Intel SDM requirements. CET can be enabled if and only if CR0.WP == 1, i.e. setting CR4.CET == 1 faults if CR0.WP == 0 and setting CR0.WP == 0 fails if CR4.CET == 1. Signed-off-by: Yang Weijiang Reviewed-by: Chao Gao Reviewed-by: Maxim Levitsky Reviewed-by: Xiaoyao Li Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919223258.1604852-11-seanjc@google.com Signed-off-by: Sean Christopherson commit e44eb58334bbc28d790ed2851385cc86ea76dc12 Author: Sean Christopherson Date: Fri Sep 19 15:32:16 2025 -0700 KVM: x86: Load guest FPU state when access XSAVE-managed MSRs Load the guest's FPU state if userspace is accessing MSRs whose values are managed by XSAVES. Introduce two helpers, kvm_{get,set}_xstate_msr(), to facilitate access to such kind of MSRs. If MSRs supported in kvm_caps.supported_xss are passed through to guest, the guest MSRs are swapped with host's before vCPU exits to userspace and after it reenters kernel before next VM-entry. Because the modified code is also used for the KVM_GET_MSRS device ioctl(), explicitly check @vcpu is non-null before attempting to load guest state. The XSAVE-managed MSRs cannot be retrieved via the device ioctl() without loading guest FPU state (which doesn't exist). Note that guest_cpuid_has() is not queried as host userspace is allowed to access MSRs that have not been exposed to the guest, e.g. it might do KVM_SET_MSRS prior to KVM_SET_CPUID2. The two helpers are put here in order to manifest accessing xsave-managed MSRs requires special check and handling to guarantee the correctness of read/write to the MSRs. Co-developed-by: Yang Weijiang Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao [sean: drop S_CET, add big comment, move accessors to x86.c] Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Reviewed-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250919223258.1604852-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 779ed05511f2931b89fcd0087aba2fcca8890715 Author: Yang Weijiang Date: Fri Sep 19 15:32:15 2025 -0700 KVM: x86: Initialize kvm_caps.supported_xss Set original kvm_caps.supported_xss to (host_xss & KVM_SUPPORTED_XSS) if XSAVES is supported. host_xss contains the host supported xstate feature bits for thread FPU context switch, KVM_SUPPORTED_XSS includes all KVM enabled XSS feature bits, the resulting value represents the supervisor xstates that are available to guest and are backed by host FPU framework for swapping {guest,host} XSAVE-managed registers/MSRs. [sean: relocate and enhance comment about PT / XSS[8] ] Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 9622e116d0d25f1ddc47bf0328612cc7d87d20f2 Author: Yang Weijiang Date: Fri Sep 19 15:32:14 2025 -0700 KVM: x86: Refresh CPUID on write to guest MSR_IA32_XSS Update CPUID.(EAX=0DH,ECX=1).EBX to reflect current required xstate size due to XSS MSR modification. CPUID(EAX=0DH,ECX=1).EBX reports the required storage size of all enabled xstate features in (XCR0 | IA32_XSS). The CPUID value can be used by guest before allocate sufficient xsave buffer. Note, KVM does not yet support any XSS based features, i.e. supported_xss is guaranteed to be zero at this time. Opportunistically skip CPUID updates if XSS value doesn't change. Suggested-by: Sean Christopherson Co-developed-by: Zhang Yi Z Signed-off-by: Zhang Yi Z Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Reviewed-by: Xiaoyao Li Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 338543cbe033e56dcc8c13adcdf6c228953c0829 Author: Chao Gao Date: Fri Sep 19 15:32:13 2025 -0700 KVM: x86: Check XSS validity against guest CPUIDs Maintain per-guest valid XSS bits and check XSS validity against them rather than against KVM capabilities. This is to prevent bits that are supported by KVM but not supported for a guest from being set. Opportunistically return KVM_MSR_RET_UNSUPPORTED on IA32_XSS MSR accesses if guest CPUID doesn't enumerate X86_FEATURE_XSAVES. Since KVM_MSR_RET_UNSUPPORTED takes care of host_initiated cases, drop the host_initiated check. Signed-off-by: Chao Gao Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-7-seanjc@google.com Signed-off-by: Sean Christopherson commit c0a5f298912222f3bb4e8f5dc67c6a1f0e93d83f Author: Sean Christopherson Date: Fri Sep 19 15:32:12 2025 -0700 KVM: x86: Report XSS as to-be-saved if there are supported features Add MSR_IA32_XSS to list of MSRs reported to userspace if supported_xss is non-zero, i.e. KVM supports at least one XSS based feature. Before enabling CET virtualization series, guest IA32_MSR_XSS is guaranteed to be 0, i.e., XSAVES/XRSTORS is executed in non-root mode with XSS == 0, which equals to the effect of XSAVE/XRSTOR. Signed-off-by: Yang Weijiang Reviewed-by: Maxim Levitsky Reviewed-by: Chao Gao Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Reviewed-by: Xiaoyao Li Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250919223258.1604852-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 06f2969c6a1237f05f8ba4324b6ddc2570a808d0 Author: Yang Weijiang Date: Fri Sep 19 15:32:11 2025 -0700 KVM: x86: Introduce KVM_{G,S}ET_ONE_REG uAPIs support Enable KVM_{G,S}ET_ONE_REG uAPIs so that userspace can access MSRs and other non-MSR registers through them, along with support for KVM_GET_REG_LIST to enumerate support for KVM-defined registers. This is in preparation for allowing userspace to read/write the guest SSP register, which is needed for the upcoming CET virtualization support. Currently, two types of registers are supported: KVM_X86_REG_TYPE_MSR and KVM_X86_REG_TYPE_KVM. All MSRs are in the former type; the latter type is added for registers that lack existing KVM uAPIs to access them. The "KVM" in the name is intended to be vague to give KVM flexibility to include other potential registers. More precise names like "SYNTHETIC" and "SYNTHETIC_MSR" were considered, but were deemed too confusing (e.g. can be conflated with synthetic guest-visible MSRs) and may put KVM into a corner (e.g. if KVM wants to change how a KVM-defined register is modeled internally). Enumerate only KVM-defined registers in KVM_GET_REG_LIST to avoid duplicating KVM_GET_MSR_INDEX_LIST, and so that KVM can return _only_ registers that are fully supported (KVM_GET_REG_LIST is vCPU-scoped, i.e. can be precise, whereas KVM_GET_MSR_INDEX_LIST is system-scoped). Suggested-by: Sean Christopherson Signed-off-by: Yang Weijiang Link: https://lore.kernel.org/all/20240219074733.122080-18-weijiang.yang@intel.com [1] Tested-by: Mathias Krause Tested-by: John Allen Tested-by: Rick Edgecombe Signed-off-by: Chao Gao Reviewed-by: Binbin Wu Reviewed-by: Xiaoyao Li Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919223258.1604852-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 1f2bbbbbda57f1939d757f5021ec0e3ea782ccf6 Merge: 5dca3808b2fc5e df1f294013da71 Author: Sean Christopherson Date: Tue Sep 23 09:00:18 2025 -0700 KVM: x86: Merge 'selftests' into 'cet' to pick up ex_str() Merge the queue of KVM selftests changes for 6.18 to pick up the ex_str() helper so that it can be used to pretty print expected versus actual exceptions in a new MSR selftest. CET virtualization will add support for several MSRs with non-trivial semantics, along with new uAPI for accessing the guest's Shadow Stack Pointer (SSP) from userspace. commit 5dca3808b2fc5ebf6f202fca8dc38e439f8a3f5b Merge: 86bcd23df9cec9 4135a9a8ccba2b Author: Sean Christopherson Date: Tue Sep 23 08:59:49 2025 -0700 KVM: x86: Merge 'svm' into 'cet' to pick up GHCB dependencies Merge the queue of SVM changes for 6.18 to pick up the KVM-defined GHCB helpers so that kvm_ghcb_get_xss() can be used to virtualize CET for SEV-ES+ guests. commit ca2967de5a5b098b43c5ad665672945ce7e7d4f7 Author: Naveen N Rao Date: Fri Sep 19 14:59:34 2025 -0700 KVM: SVM: Enable AVIC by default for Zen4+ if x2AVIC is support AVIC and x2AVIC are fully functional since Zen 4, with no known hardware errata. Enable AVIC and x2AVIC by default on Zen4+ so long as x2AVIC is supported (to avoid enabling partial support for APIC virtualization by default). Internally, convert "avic" to an integer so that KVM can identify if the user has asked to explicitly enable or disable AVIC, i.e. so that KVM doesn't override an explicit 'y' from the user. Arbitrarily use -1 to denote auto-mode, and accept the string "auto" for the module param in addition to standard boolean values, i.e. continue to allow the user to configure the "avic" module parameter to explicitly enable/disable AVIC. To again maintain backward compatibility with a standard boolean param, set KERNEL_PARAM_OPS_FL_NOARG, which tells the params infrastructure to allow empty values for %true, i.e. to interpret a bare "avic" as "avic=y". Take care to check for a NULL @val when looking for "auto"! Lastly, always print "avic" as a boolean, since auto-mode is resolved during module initialization, i.e. the user should never see "auto" in sysfs. Signed-off-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250919215934.1590410-8-seanjc@google.com Signed-off-by: Sean Christopherson commit b14665353162db70e445aacdd18b0566edba00c2 Author: Sean Christopherson Date: Fri Sep 19 14:59:33 2025 -0700 KVM: SVM: Move global "avic" variable to avic.c Move "avic" to avic.c so that it's colocated with the other AVIC specific globals and module params, and so that avic_hardware_setup() is a bit more self-contained, e.g. similar to sev_hardware_setup(). Deliberately set enable_apicv in svm.c as it's already globally visible (defined by kvm.ko, not by kvm-amd.ko), and to clearly capture the dependency on enable_apicv being initialized (svm_hardware_setup() clears several AVIC-specific hooks when enable_apicv is disabled). Alternatively, clearing of the hooks (and enable_ipiv) could be moved to avic_hardware_setup(), but that's not obviously better, e.g. it's helpful to isolate the setting of enable_apicv when reading code from the generic x86 side of the world. No functional change intended. Acked-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-7-seanjc@google.com Signed-off-by: Sean Christopherson commit ad65dca2ca4cf8c377135362c0c1e031ad92019d Author: Sean Christopherson Date: Fri Sep 19 14:59:32 2025 -0700 KVM: SVM: Don't advise the user to do force_avic=y (when x2AVIC is detected) Don't advise the end user to try to force enable AVIC when x2AVIC is reported as supported in CPUID, as forcefully enabling AVIC isn't something that should be done lightly. E.g. some Zen4 client systems hide AVIC but leave x2AVIC behind, and while such a configuration is indeed due to buggy firmware in the sense the reporting x2AVIC without AVIC is nonsensical, KVM has no idea _why_ firmware disabled AVIC in the first place. Suggesting that the user try to run with force_avic=y is sketchy even if the user explicitly tries to enable AVIC, and will be downright irresponsible once KVM starts enabling AVIC by default. Alternatively, KVM could print the message only when the user explicitly asks for AVIC, but running with force_avic=y isn't something that should be encouraged for random users. force_avic is a useful knob for developers and perhaps even advanced users, but isn't something that KVM should advertise broadly. Opportunistically append a newline to the pr_warn() so that it prints out immediately, and tweak the message to say that AVIC is unsupported instead of disabled (disabled suggests that the kernel/KVM is somehow responsible). Suggested-by: Naveen N Rao (AMD) Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-6-seanjc@google.com Signed-off-by: Sean Christopherson commit ce4253e21fa8a4468474e26884196770cb560eae Author: Sean Christopherson Date: Fri Sep 19 14:59:31 2025 -0700 KVM: SVM: Always print "AVIC enabled" separately, even when force enabled Print the customary "AVIC enabled" informational message even when AVIC is force enabled on a system that doesn't advertise supported for AVIC in CPUID, as not printing the standard message can confuse users and tools. Opportunistically clean up the scary message when AVIC is force enabled, but keep it as separate message so that it is printed at level "warn", versus the standard message only being printed for level "info". Suggested-by: Naveen N Rao (AMD) Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-5-seanjc@google.com Signed-off-by: Sean Christopherson commit a9095e4fc4368052593c84472a8d374fefd3df71 Author: Sean Christopherson Date: Fri Sep 19 14:59:30 2025 -0700 KVM: SVM: Update "APICv in x2APIC without x2AVIC" in avic.c, not svm.c Set the "allow_apicv_in_x2apic_without_x2apic_virtualization" flag as part of avic_hardware_setup() instead of handling in svm_hardware_setup(), and make x2avic_enabled local to avic.c (setting the flag was the only use in svm.c). Tag avic_hardware_setup() with __init as necessary (it should have been tagged __init long ago). No functional change intended (aside from the side effects of tagging avic_hardware_setup() with __init). Acked-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-4-seanjc@google.com Signed-off-by: Sean Christopherson commit eb44ea6a7aace13becd8d99905284ad272b3bd98 Author: Sean Christopherson Date: Fri Sep 19 14:59:29 2025 -0700 KVM: SVM: Move x2AVIC MSR interception helper to avic.c Move svm_set_x2apic_msr_interception() to avic.c as it's only relevant when x2AVIC is enabled/supported and only called by AVIC code. In addition to scoping AVIC code to avic.c, this will allow burying the global x2avic_enabled variable in avic. Opportunistically rename the helper to explicitly scope it to "avic". No functional change intended. Reviewed-by: Naveen N Rao (AMD) Tested-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250919215934.1590410-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 44bfe1f0490d5620c7962ab7384797672b4c4293 Author: Sean Christopherson Date: Fri Sep 19 14:59:28 2025 -0700 KVM: SVM: Make svm_x86_ops globally visible, clean up on-HyperV usage Make svm_x86_ops globally visible in anticipation of modifying the struct in avic.c, and clean up the KVM-on-HyperV usage, as declaring _and using_ a local variable in a header that's only defined in one specific .c-file is all kinds of ugly. Opportunistically make svm_hv_enable_l2_tlb_flush() local to svm_onhyperv.c, as the only reason it was visible was due to the aforementioned shenanigans in svm_onhyperv.h. Alternatively, svm_x86_ops could be explicitly passed to svm_hv_hardware_setup() as a parameter. While that approach is slightly safer, e.g. avoids "hidden" updates, for better or worse, the Intel side of KVM has already chosen to expose vt_x86_ops (and vt_init_ops). Given that svm_x86_ops is only truly consumed by kvm_ops_update, the odds of a "hidden" update causing problems are extremely low. So, absent a strong reason to rework the VMX/TDX code, make svm_x86_ops visible, as having all updates use exactly "svm_x86_ops." is advantageous in its own right. No functional change intended. Link: https://lore.kernel.org/r/20250919215934.1590410-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 29da8c823abffdacb71c7c07ec48fcf9eb38757c Author: Hou Wenlong Date: Tue Sep 23 08:37:38 2025 -0700 KVM: SVM: Re-load current, not host, TSC_AUX on #VMEXIT from SEV-ES guest Prior to running an SEV-ES guest, set TSC_AUX in the host save area to the current value in hardware, as tracked by the user return infrastructure, instead of always loading the host's desired value for the CPU. If the pCPU is also running a non-SEV-ES vCPU, loading the host's value on #VMEXIT could clobber the other vCPU's value, e.g. if the SEV-ES vCPU preempted the non-SEV-ES vCPU, in which case KVM expects the other vCPU's TSC_AUX value to be resident in hardware. Note, unlike TDX, which blindly _zeroes_ TSC_AUX on TD-Exit, SEV-ES CPUs can load an arbitrary value. Stuff the current value in the host save area instead of refreshing the user return cache so that KVM doesn't need to track whether or not the vCPU actually enterred the guest and thus loaded TSC_AUX from the host save area. Opportunistically tag tsc_aux_uret_slot as read-only after init to guard against unexpected modifications, and to make it obvious that using the variable in sev_es_prepare_switch_to_guest() is safe. Fixes: 916e3e5f26ab ("KVM: SVM: Do not use user return MSR support for virtualized TSC_AUX") Cc: stable@vger.kernel.org Suggested-by: Lai Jiangshan Signed-off-by: Hou Wenlong [sean: handle the SEV-ES case in sev_es_prepare_switch_to_guest()] Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250923153738.1875174-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 9bc366350734246301b090802fc71f9924daad39 Author: Hou Wenlong Date: Tue Sep 23 08:37:37 2025 -0700 KVM: x86: Add helper to retrieve current value of user return MSR In the user return MSR support, the cached value is always the hardware value of the specific MSR. Therefore, add a helper to retrieve the cached value, which can replace the need for RDMSR, for example, to allow SEV-ES guests to restore the correct host hardware value without using RDMSR. Cc: stable@vger.kernel.org Signed-off-by: Hou Wenlong [sean: drop "cache" from the name, make it a one-liner, tag for stable] Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250923153738.1875174-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 5b66e335ead6472f336b4d7d9cbf14488b844f27 Author: Sean Christopherson Date: Fri Sep 19 14:16:49 2025 -0700 KVM: SEV: Reject non-positive effective lengths during LAUNCH_UPDATE Check for an invalid length during LAUNCH_UPDATE at the start of snp_launch_update() instead of subtly relying on kvm_gmem_populate() to detect the bad state. Code that directly handles userspace input absolutely should sanitize those inputs; failure to do so is asking for bugs where KVM consumes an invalid "npages". Keep the check in gmem, but wrap it in a WARN to flag any bad usage by the caller. Note, this is technically an ABI change as KVM would previously allow a length of '0'. But allowing a length of '0' is nonsensical and creates pointless conundrums in KVM. E.g. an empty range is arguably neither private nor shared, but LAUNCH_UPDATE will fail if the starting gpa can't be made private. In practice, no known or well-behaved VMM passes a length of '0'. Note #2, the PAGE_ALIGNED(params.len) check ensures that lengths between 1 and 4095 (inclusive) are also rejected, i.e. that KVM won't end up with npages=0 when doing "npages = params.len / PAGE_SIZE". Cc: Thomas Lendacky Cc: Michael Roth Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919211649.1575654-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 4135a9a8ccba2b685f2301429ea765fa0f78eb89 Author: Sean Christopherson Date: Fri Sep 19 15:32:10 2025 -0700 KVM: SEV: Validate XCR0 provided by guest in GHCB Use __kvm_set_xcr() to propagate XCR0 changes from the GHCB to KVM's software model in order to validate the new XCR0 against KVM's view of the supported XCR0. Allowing garbage is thankfully mostly benign, as kvm_load_{guest,host}_xsave_state() bail early for vCPUs with protected state, xstate_required_size() will simply provide garbage back to the guest, and attempting to save/restore the bad value via KVM_{G,S}ET_XCRS will only harm the guest (setting XCR0 will fail). However, allowing the guest to put junk into a field that KVM assumes is valid is a CVE waiting to happen. And as a bonus, using the proper API eliminates the ugly open coding of setting arch.cpuid_dynamic_bits_dirty. Simply ignore bad values, as either the guest managed to get an unsupported value into hardware, or the guest is misbehaving and providing pure garbage. In either case, KVM can't fix the broken guest. Note, using __kvm_set_xcr() also avoids recomputing dynamic CPUID bits if XCR0 isn't actually changing (relatively to KVM's previous snapshot). Cc: Tom Lendacky Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-4-seanjc@google.com Signed-off-by: Sean Christopherson commit bd5f500d23170e5bde59ce97da523048b66a8183 Author: Sean Christopherson Date: Fri Sep 19 15:32:09 2025 -0700 KVM: SEV: Read save fields from GHCB exactly once Wrap all reads of GHCB save fields with READ_ONCE() via a KVM-specific GHCB get() utility to help guard against TOCTOU bugs. Using READ_ONCE() doesn't completely prevent such bugs, e.g. doesn't prevent KVM from redoing get() after checking the initial value, but at least addresses all potential TOCTOU issues in the current KVM code base. To prevent unintentional use of the generic helpers, take only @svm for the kvm_ghcb_get_xxx() helpers and retrieve the ghcb instead of explicitly passing it in. Opportunistically reduce the indentation of the macro-defined helpers and clean up the alignment. Fixes: 4e15a0ddc3ff ("KVM: SEV: snapshot the GHCB before accessing it") Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-3-seanjc@google.com Signed-off-by: Sean Christopherson commit e0ff302b79c54567eb6b8f609e76c633978ff06d Author: Sean Christopherson Date: Fri Sep 19 15:32:08 2025 -0700 KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() to make it clear that KVM is getting the cached value, not reading directly from the guest-controlled GHCB. More importantly, vacating kvm_ghcb_get_sw_exit_code() will allow adding a KVM-specific macro-built kvm_ghcb_get_##field() helper to read values from the GHCB. No functional change intended. Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250919223258.1604852-2-seanjc@google.com Signed-off-by: Sean Christopherson commit df1f294013da715f32521b3d0a69773e660a1af5 Author: Sean Christopherson Date: Fri Sep 19 15:32:51 2025 -0700 KVM: selftests: Add ex_str() to print human friendly name of exception vectors Steal exception_mnemonic() from KVM-Unit-Tests as ex_str() (to keep line lengths reasonable) and use it in assert messages that currently print the raw vector number. Co-developed-by: Chao Gao Signed-off-by: Chao Gao Link: https://lore.kernel.org/r/20250919223258.1604852-45-seanjc@google.com Signed-off-by: Sean Christopherson commit ff86b48d4ce3bdd8d2353c166e4c905f92cddd78 Author: Sukrut Heroorkar Date: Mon Sep 8 23:05:46 2025 +0200 selftests/kvm: remove stale TODO in xapic_state_test The TODO about using the number of vCPUs instead of vcpu.id + 1 was already addressed by commit 376bc1b458c9 ("KVM: selftests: Don't assume vcpu->id is '0' in xAPIC state test"). The comment is now stale and can be removed. Signed-off-by: Sukrut Heroorkar Link: https://lore.kernel.org/r/20250908210547.12748-1-hsukrut3@gmail.com Signed-off-by: Sean Christopherson commit c435978e4ffe87c6baee1290118039187eafc698 Author: dongsheng Date: Fri Sep 19 14:46:48 2025 -0700 KVM: selftests: Handle Intel Atom errata that leads to PMU event overcount Add a PMU errata framework and use it to relax precise event counts on Atom platforms that overcount "Instruction Retired" and "Branch Instruction Retired" events, as the overcount issues on VM-Exit/VM-Entry are impossible to prevent from userspace, e.g. the test can't prevent host IRQs. Setup errata during early initialization and automatically sync the mask to VMs so that tests can check for errata without having to manually manage host=>guest variables. For Intel Atom CPUs, the PMU events "Instruction Retired" or "Branch Instruction Retired" may be overcounted for some certain instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD and complex SGX/SMX/CSTATE instructions/flows. The detailed information can be found in the errata (section SRF7): https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/ For the Atom platforms before Sierra Forest (including Sierra Forest), Both 2 events "Instruction Retired" and "Branch Instruction Retired" would be overcounted on these certain instructions, but for Clearwater Forest only "Instruction Retired" event is overcounted on these instructions. Signed-off-by: dongsheng Co-developed-by: Dapeng Mi Signed-off-by: Dapeng Mi Tested-by: Yi Lai Co-developed-by: Sean Christopherson Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 2922b595886575ebef46e65a0d4c8a857c5cd464 Author: Dapeng Mi Date: Fri Sep 19 14:46:47 2025 -0700 KVM: selftests: Validate more arch-events in pmu_counters_test Add support for 5 new architectural events (4 topdown level 1 metrics events and LBR inserts event) that will first show up in Intel's Clearwater Forest CPUs. Detailed info about the new events can be found in SDM section 21.2.7 "Pre-defined Architectural Performance Events". Signed-off-by: Dapeng Mi Tested-by: Yi Lai [sean: drop "unavailable_mask" changes] Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 1fcd3053aa1a6d4c417450c92ddb960b9edb1bf1 Author: Sean Christopherson Date: Fri Sep 19 14:46:46 2025 -0700 KVM: selftests: Reduce number of "unavailable PMU events" combos tested Reduce the number of combinations of unavailable PMU events masks that are testing by the PMU counters test. In reality, testing every possible combination isn't all that interesting, and certainly not worth the tens of seconds (or worse, minutes) of runtime. Fully testing the N^2 space will be especially problematic in the near future, as 5! new arch events are on their way. Use alternating bit patterns (and 0 and -1u) in the hopes that _if_ there is ever a KVM bug, it's not something horribly convoluted that shows up only with a super specific pattern/value. Reported-by: Dapeng Mi Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 571fc2833ed0195d016c96e003b3611e95e40f09 Author: Sean Christopherson Date: Fri Sep 19 14:46:45 2025 -0700 KVM: selftests: Track unavailable_mask for PMU events as 32-bit value Track the mask of "unavailable" PMU events as a 32-bit value. While bits 31:9 are currently reserved, silently truncating those bits is unnecessary and asking for missed coverage. To avoid running afoul of the sanity check in vcpu_set_cpuid_property(), explicitly adjust the mask based on the non-reserved bits as reported by KVM's supported CPUID. Opportunistically update the "all ones" testcase to pass -1u instead of 0xff. Reviewed-by: Dapeng Mi Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 210b09fa428c078c44951170fe69234c880a05f6 Author: Dapeng Mi Date: Fri Sep 19 14:46:44 2025 -0700 KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test A new bit PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added to indicated if PEBS supports to record timing information in a new "Retried Latency" field. Since KVM requires user can only set host consistent PEBS capabilities, otherwise the PERF_CAPABILITIES setting would fail, add pebs_timing_info into the "immutable_caps" to block host inconsistent PEBS configuration and cause errors. Opportunistically drop the anythread_deprecated bit. It isn't and likely never was a PERF_CAPABILITIES flag, the test's definition snuck in when the union was copy+pasted from the kernel's definition. Signed-off-by: Dapeng Mi Tested-by: Yi Lai [sean: call out anythread_deprecated change] Tested-by: Dapeng Mi Link: https://lore.kernel.org/r/20250919214648.1585683-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 66e2d96b1c5875122bfb94239989d832ccf51477 Author: Steven Rostedt Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Move kvm_iocsr tracepoint out of generic code The tracepoint kvm_iocsr is only used by the loongarch architecture. As trace events can take up to 5K of memory, move this tracepoint into the LoongArch specific tracing file so that it doesn't waste memory for all other architectures. Reviewed-by: Bibo Mao Signed-off-by: Steven Rostedt (Google) Signed-off-by: Huacai Chen commit 77336b918f59b9c715d1f752149557a05e0bc0bc Author: Yury Norov (NVIDIA) Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Rework pch_pic_update_batch_irqs() Use proper bitmap API and drop all the housekeeping code. Reviewed-by: Bibo Mao Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Huacai Chen commit f851fdd895dea69e23acc80262da0b8f9e4d04ad Author: Bibo Mao Date: Tue Sep 23 23:37:26 2025 +0800 LoongArch: KVM: Add different length support in loongarch_pch_pic_write() With function loongarch_pch_pic_write(), currently there is only four bytes register write support. But in theory, all length 1/2/4/8 should be supported for all the registers, here add different length support about register write emulation in function loongarch_pch_pic_write(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f8a73df503f5145317de992b94df603ed97e2f86 Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Add different length support in loongarch_pch_pic_read() With function loongarch_pch_pic_read(), currently it is hardcoded length for different registers, and the length comes from exising linux pch_pic driver code. But in theory, all length 1/2/4/8 should be supported for all the registers, here add different length support about register read emulation in function loongarch_pch_pic_read(). Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit eb626c7704dc9dbc2eee2c2bee281992d36de6da Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Add IRR and ISR register read emulation With LS7A user manual, there are registers PCH_PIC_INT_IRR_START and PCH_PIC_INT_ISR_START. So add read access emulation in function loongarch_pch_pic_read() here. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 2f412eb7650c369744420cc2d06404fe3f1fb79f Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Set version information at initial stage Register PCH_PIC_INT_ID constains version and supported irq number information, and it is a read only register. The detailed value can be set at initial stage, rather than read callback. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 3da2b0d439aa4eccc2a65e87f0bb280595d91ffe Author: Bibo Mao Date: Tue Sep 23 23:37:09 2025 +0800 LoongArch: KVM: Access mailbox directly in mail_send() With function mail_send(), it is to write mailbox of other VCPUs. Existing simple APIs read_mailbox()/write_mailbox() can be used directly rather than send command on IOCSR address. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1cf7b2881d832f05b31ec06484774604676189e2 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add implementation with IOCSR_IPI_SET IPI IOCSR register IOCSR_IPI_SET can send ipi interrupt to other vCPUs, but it can also send an interrupt to vCPU itself. Indeed there are such operations on Linux as arch_irq_work_raise() which will send ipi message to vCPU itself. Here add implementation of write operation with IOCSR_IPI_SET register. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 44598fe77663da1fdd59c2b01fc317afcb7bc753 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add sign extension with kernel IOCSR read emulation Function kvm_complete_iocsr_read() is to add sign extension with IOCSR read emulation, it is used in user space IOCSR read completion now. Also it should be used in kernel IOCSR read emulation. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 80edf90831a2c129db478b1e72b27839602b72ea Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add sign extension with kernel MMIO read emulation Function kvm_complete_mmio_read() is to add sign extension with MMIO read emulation, it is used in user space MMIO read completion now. Also it should be used in kernel MMIO read emulation. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 7109f51bcc80b79a8f31e50fa5c96a20c54197d9 Author: Bibo Mao Date: Tue Sep 23 23:37:08 2025 +0800 LoongArch: KVM: Add PTW feature detection on new hardware With new Loongson-3A6000/3C6000 hardware platforms (or later), hardware page table walking (PTW) feature is supported on host. So here add this feature detection on KVM host. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9a1aa642c1fb5a3776447182aaf37dfaafb36134 Author: Zihuan Zhang Date: Tue Sep 23 15:55:53 2025 +0800 cpufreq: Replace pointer subtraction with iteration macro The cpufreq documentation suggests avoiding direct pointer subtraction when working with entries in driver_freq_table, as it is relatively costly. Instead, the recommended approach is to use the provided iteration macros, like cpufreq_for_each_valid_entry_idx(). Use cpufreq_for_each_entry_idx() instead of pointer subtraction in cpufreq_frequency_table_cpuinfo() which improves code clarity and follows the established cpufreq coding style. While at it, remove redundant local variable initialization from cpufreq_table_index_unsorted(). No functional change intended. Signed-off-by: Zihuan Zhang Link: https://patch.msgid.link/20250923075553.45532-1-zhangzihuan@kylinos.cn [ rjw: Subject tweak, changelog edits, local variable definition tweak ] Signed-off-by: Rafael J. Wysocki commit 67600ccfc4f38ebd331b9332ac94717bfbc87ea7 Author: Duoming Zhou Date: Tue Sep 23 13:13:57 2025 +0800 thunderbolt: Fix use-after-free in tb_dp_dprx_work The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed if it was already running. This leads to use-after-free scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while tunnel->dprx_work remains active and attempts to dereference tb_tunnel in tb_dp_dprx_work(). A typical race condition is illustrated below: CPU 0 | CPU 1 tb_dp_tunnel_active() | tb_deactivate_and_free_tunnel()| tb_dp_dprx_start() tb_tunnel_deactivate() | queue_delayed_work() tb_dp_activate() | tb_dp_dprx_stop() | tb_dp_dprx_work() //delayed worker cancel_delayed_work() | tb_tunnel_put(tunnel); | | tunnel = container_of(...); //UAF | tunnel-> //UAF Replacing cancel_delayed_work() with cancel_delayed_work_sync() is not feasible as it would introduce a deadlock: both tb_dp_dprx_work() and the cleanup path acquire tb->lock, and cancel_delayed_work_sync() would wait indefinitely for the work item that cannot proceed. Instead, implement proper reference counting: - If cancel_delayed_work() returns true (work is pending), we release the reference in the stop function. - If it returns false (work is executing or already completed), the reference is released in delayed work function itself. This ensures the tb_tunnel remains valid during work item execution while preventing memory leaks. This bug was found by static analysis. Fixes: d6d458d42e1e ("thunderbolt: Handle DisplayPort tunnel activation asynchronously") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Signed-off-by: Mika Westerberg commit 340de1f673ceb0ab46470cb19b7c773e3359a3e5 Author: Andrea Righi Date: Tue Sep 23 11:16:34 2025 +0200 sched_ext: Verify RCU protection in scx_bpf_cpu_curr() scx_bpf_cpu_curr() has been introduced to retrieve the current task of a given runqueue, allowing schedulers to interact with that task. The kfunc assumes that it is always called in an RCU context, but this is not always guaranteed and some BPF schedulers can trigger the following warning: WARNING: suspicious RCU usage sched_ext: BPF scheduler "cosmos_1.0.2_gd0e71ca_x86_64_unknown_linux_gnu_debug" enabled 6.17.0-rc1 #1-NixOS Not tainted ----------------------------- kernel/sched/ext.c:6415 suspicious rcu_dereference_check() usage! ... Call Trace: dump_stack_lvl+0x6f/0xb0 lockdep_rcu_suspicious.cold+0x4e/0x96 scx_bpf_cpu_curr+0x7e/0x80 bpf_prog_c68b2b6b6b1b0ff8_sched_timerfn+0xce/0x1dc bpf_timer_cb+0x7b/0x130 __hrtimer_run_queues+0x1ea/0x380 hrtimer_run_softirq+0x8c/0xd0 handle_softirqs+0xc9/0x3b0 __irq_exit_rcu+0x96/0xc0 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x73/0x80 To address this, mark the kfunc with KF_RCU_PROTECTED, so the verifier can enforce its usage only inside RCU-protected sections. Note: this also requires commit 1512231b6cc86 ("bpf: Enforce RCU protection for KF_RCU_PROTECTED"), currently in bpf-next, to enforce the proper KF_RCU_PROTECTED. Fixes: 20b158094a1ad ("sched_ext: Introduce scx_bpf_cpu_curr()") Cc: Christian Loehle Cc: Kumar Kartikeya Dwivedi Signed-off-by: Andrea Righi Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo commit 7aada81cd75ad844c84fb1dcdce2d67ec41763f8 Author: Ivaylo Ivanov Date: Sun Sep 14 16:18:48 2025 +0300 dt-bindings: mmc: samsung,exynos-dw-mshc: add specific compatible for exynos8890 Add samsung,exynos8890-dw-mshc-smu specific compatible to the bindings documentation. Since Samsung, as usual, likes reusing devices from older designs, use the samsung,exynos7-dw-mshc-smu compatible. Signed-off-by: Ivaylo Ivanov Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 70bd70c303ad4a00b299cb2468bc6475ff90b5b1 Author: Marco Crivellari Date: Fri Sep 5 11:10:40 2025 +0200 tracing: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. queue_work() / queue_delayed_work() mod_delayed_work() will now use the new per-cpu wq: whether the user still stick on the old name a warn will be printed along a wq redirect to the new one. This patch add the new system_percpu_wq except for mm, fs and net subsystem, whom are handled in separated patches. The old wq will be kept for a few release cylces. Cc: Lai Jiangshan Cc: Frederic Weisbecker Cc: Sebastian Andrzej Siewior Cc: Michal Hocko Cc: Masami Hiramatsu Link: https://lore.kernel.org/20250905091040.109772-2-marco.crivellari@suse.com Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Steven Rostedt (Google) commit 4c709ccc478b4b711ee071146aae98eb7fa9f625 Author: Jesse.Zhang Date: Mon Sep 22 09:40:51 2025 +0800 drm/amd/pm: Add VCN reset message support for SMU v13.0.12 This commit adds support for VCN reset functionality in SMU v13.0.12 by: 1. Adding two new PPSMC messages in smu_v13_0_12_ppsmc.h: - PPSMC_MSG_ResetVCN (0x5E) - Updates PPSMC_Message_Count to 0x5F to account for new messages 2. Adding message mapping for ResetVCN in smu_v13_0_12_ppt.c: - Maps SMU_MSG_ResetVCN to PPSMC_MSG_ResetVCN These changes enable proper VCN reset handling through the SMU firmware interface for compatible AMD GPUs. v2: Added fw version check to support vcn queue reset. Acked-by: Alex Deucher Reviewed-by: Yang Wang Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 5886090032ec891ccd6bf3c7e9d1ae3fe43ecc34 Author: Jesse.Zhang Date: Fri Aug 15 23:44:11 2025 +0800 drm/amdgpu: Move VCN reset mask setup to late_init for VCN 5.0.1 This patch moves the initialization of the VCN supported_reset mask from sw_init to a new late_init function for VCN 5.0.1. The change ensures that all necessary hardware and firmware initialization is complete before determining the supported reset types. Key changes: - Added vcn_v5_0_1_late_init() function to handle late initialization - Moved supported_reset mask setup from sw_init to late_init - Added check for per-queue reset support via amdgpu_dpm_reset_vcn_is_supported() - Updated ip_funcs to use the new late_init function This change helps ensure proper reset behavior by waiting until all dependencies are initialized before determining available reset types. Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit dc704458dd31ba45bf9cac3fe3e3ab546dabed20 Author: Jesse.Zhang Date: Wed Aug 6 16:20:28 2025 +0800 drm/amdgpu: Add ring reset support for VCN v5.0.1 Implement the ring reset callback for VCN v5.0.1 to properly handle hardware recovery when encountering GPU hangs. The new functionality: 1. Adds vcn_v5_0_1_ring_reset() function that: - Prepares for reset using amdgpu_ring_reset_helper_begin() - Performs VCN instance reset via amdgpu_dpm_reset_vcn() - Re-initializes hardware through vcn_v5_0_1_hw_init_inst() - Restarts DPG mode with vcn_v5_0_1_start_dpg_mode() - Completes reset with amdgpu_ring_reset_helper_end() 2. Hooks the reset function into the unified ring functions via: - Adding .reset = vcn_v5_0_1_ring_reset to vcn_v5_0_1_unified_ring_vm_funcs 3. Maintains existing behavior for SR-IOV VF cases by checking RRMT status This provides proper hardware recovery capabilities for VCN 5.0.1 IP block during fault conditions, matching functionality available in other VCN versions. v2: Remove the RRMT_ENABLED cap setting in the reset function and replace adev->vcn.inst[ring->me].indirect_sram with vinst->indirect_sram (Lijo) Reviewed-by: Sonny Jiang Suggested-by: Lijo Lazar Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit eb6910cdaa8a1b5af11df6fd2e9a0b2b9f72a028 Author: Jesse.Zhang Date: Wed Aug 6 16:03:13 2025 +0800 drm/amdgpu: Refactor VCN v5.0.1 HW init into separate instance function Split the per-instance initialization code from vcn_v5_0_1_hw_init() into a new vcn_v5_0_1_hw_init_inst() function. This improves code organization by: 1. Separating the instance-specific initialization logic 2. Making the main init function more readable 3. Following the pattern used in queue reset The SR-IOV specific initialization remains in the main function since it has different requirements. Reviewed-by: Sonny Jiang Signed-off-by: Jesse Zhang Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit 0c1f3fe9a5f899ac95114e68959a35454af1523d Author: Alex Deucher Date: Fri May 2 16:22:45 2025 -0400 Documentation: add initial documenation for user queues Add an initial documentation page for user mode queues. Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 752e6f283ec59ae007aa15a93d5a4b2eefa8cec9 Author: Melissa Wen Date: Mon Sep 1 18:51:05 2025 -0300 drm/amd/display: remove output_tf_change flag Remove this flag as the driver stopped managing it individually since commit a4056c2a6344 ("drm/amd/display: use HW hdr mult for brightness boost"). After some back and forth it was reintroduced as a condition to `set_output_transfer_func()` in [1]. Without direct management, this flag only changes value when all surface update flags are set true on UPDATE_TYPE_FULL with no output TF status meaning. Fixes: bb622e0c0044 ("drm/amd/display: program output tf when required") [1] Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 43f06e8165c4f6e16ab32ede845171ac66d4eaaa Author: Kuan-Wei Chiu Date: Tue Sep 9 17:20:57 2025 +0800 drm/amd/display: Optimize remove_duplicates() from O(N^2) to O(N) Replace the previous O(N^2) implementation of remove_duplicates() with a O(N) version using a fast/slow pointer approach. The new version keeps only the first occurrence of each element and compacts the array in place, improving efficiency without changing functionality. Signed-off-by: Kuan-Wei Chiu Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 51cb93aa0c4a9bb126b76f6e9fd640d88de25cee Author: Melissa Wen Date: Thu Sep 11 14:21:20 2025 -0300 drm/amd/display: change dc stream color settings only in atomic commit Don't update DC stream color components during atomic check. The driver will continue validating the new CRTC color state but will not change DC stream color components. The DC stream color state will only be programmed at commit time in the `atomic_setup_commit` stage. It fixes gamma LUT loss reported by KDE users when changing brightness quickly or changing Display settings (such as overscan) with nightlight on and HDR. As KWin can do a test commit with color settings different from those that should be applied in a non-test-only commit, if the driver changes DC stream color state in atomic check, this state can be eventually HW programmed in commit tail, instead of the respective state set by the non-blocking commit. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4444 Reported-by: Xaver Hugl Signed-off-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 2330437da0994321020777c605a2a8cb0ecb7001 Author: YiPeng Chai Date: Mon Mar 24 15:10:44 2025 +0800 drm/amd/ras: Add rascore status definition Add rascore status definition. V5: Merge the previous empty files. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 86a54e45fd91953e2b0e1aa15932112f135e4821 Author: Rahul Kumar Date: Thu Sep 18 12:42:00 2025 +0530 drm/amdgpu: Use kmalloc_array() instead of kmalloc() Documentation/process/deprecated.rst recommends against the use of kmalloc with dynamic size calculations due to the risk of overflow and smaller allocation being made than the caller was expecting. Replace kmalloc() with kmalloc_array() in amdgpu_amdkfd_gfx_v10.c, amdgpu_amdkfd_gfx_v10_3.c, amdgpu_amdkfd_gfx_v11.c and amdgpu_amdkfd_gfx_v12.c to make the intended allocation size clearer and avoid potential overflow issues. Suggested-by: Felix Kuehling Signed-off-by: Rahul Kumar Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit de023206fc27e1e848e3dd54ee6fbcdc78dba6bb Merge: 64581f41f4c4aa 5fc4ab3269dea6 Author: Ulf Hansson Date: Tue Sep 23 16:35:23 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.17-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.18. Signed-off-by: Ulf Hansson commit 2f9c63883730a0bfecb086e6e59246933f936ca1 Author: Melissa Wen Date: Thu Sep 11 14:21:19 2025 -0300 drm/amd/display: update color on atomic commit time Use `atomic_commit_setup` to change the DC stream state. It's a preparation to remove from `atomic_check` changes in CRTC color components of DC stream state and prevent DC to commit TEST_ONLY changes. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4444 Reviewed-by: Harry Wentland Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit cceb54222ea00cec4960ad346a918920c24e75c5 Author: Taimur Hassan Date: Fri Sep 12 18:23:48 2025 -0500 drm/amd/display: Promote DC to 3.2.351 - Disable stutter when programming watermarks on dcn32 - Improve brightness calculations - Fix saving vbios clocks during init for DCN314 - Enable DTM 3 on DCN3.1+ dGPUs - Add new ultra sleep field in DMUB - Isolate DCN401 SMU functions - Refactor and add logging of SMU functions. - Add dccg logging - Fix DCN35 clocks initialization Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit dff184cdba518cef0c0eb6ac8ed115cb83cd26a8 Author: Taimur Hassan Date: Fri Sep 12 16:15:44 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.28.0 Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 348f6117c16ae89a06f53ec6dc893bd7b7a724b4 Merge: 58a5820582e4c8 c6ae18e0af5e7c Author: Alexei Starovoitov Date: Tue Sep 23 07:34:39 2025 -0700 Merge branch 'bpf-introduce-deferred-task-context-execution' Mykyta Yatsenko says: ==================== bpf: Introduce deferred task context execution From: Mykyta Yatsenko This patch introduces a new mechanism for BPF programs to schedule deferred execution in the context of a specific task using the kernel’s task_work infrastructure. The new bpf_task_work interface enables BPF use cases that require sleepable subprogram execution within task context, for example, scheduling sleepable function from the context that does not allow sleepable, such as NMI. Introduced kfuncs bpf_task_work_schedule_signal() and bpf_task_work_schedule_resume() for scheduling BPF callbacks correspond to different modes used by task_work (TWA_SIGNAL or TWA_RESUME). The implementation manages scheduling state via metadata objects (struct bpf_task_work_context). Pointers to bpf_task_work_context are stored in BPF map values. State transitions are handled via an atomic state machine (bpf_task_work_state) to ensure correctness under concurrent usage and deletion, lifetime is guarded by refcounting and RCU Tasks Trace. Kfuncs call task_work_add() indirectly via irq_work to avoid locking in potentially NMI context. Changelog: --- v7 -> v8 v7: https://lore.kernel.org/bpf/20250922232611.614512-1-mykyta.yatsenko5@gmail.com/ * Fix unused variable warning in patch 1 * Decrease stress test time from 2 to 1 second * Went through CI warnings, other than unused variable, there are just 2 new in kernel/bpf/helpers.c related to newly introduced kfuncs, these look expected. v6 -> v7 v6: https://lore.kernel.org/bpf/20250918132615.193388-1-mykyta.yatsenko5@gmail.com/ * Added stress test * Extending refactoring in patch 1 * Changing comment and removing one check for map->usercnt in patch 7 v5 -> v6 v5: https://lore.kernel.org/bpf/20250916233651.258458-1-mykyta.yatsenko5@gmail.com/ * Fixing readability in verifier.c:check_map_field_pointer() * Removing BUG_ON from helpers.c v4 -> v5 v4: https://lore.kernel.org/all/20250915201820.248977-1-mykyta.yatsenko5@gmail.com/ * Fix invalid/null pointer dereference bug, reported by syzbot * Nits in selftests v3 -> v4 v3: https://lore.kernel.org/all/20250905164508.1489482-1-mykyta.yatsenko5@gmail.com/ * Modify async callback return value processing in verifier, to allow non-zero return values. * Change return type of the callback from void to int, as verifier expects scalar value. * Switched to void* for bpf_map API kfunc arguments to avoid casts. * Addressing numerous nits and small improvements. v2 -> v3 v2: https://lore.kernel.org/all/20250815192156.272445-1-mykyta.yatsenko5@gmail.com/ * Introduce ref counting * Add patches with minor verifier and btf.c refactorings to avoid code duplication * Rework initiation of the task work scheduling to handle race with map usercnt dropping to zero ==================== Link: https://patch.msgid.link/20250923112404.668720-1-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit c6ae18e0af5e7c809ac26350043924e062dbb76f Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:04 2025 +0100 selftests/bpf: add bpf task work stress tests Add stress tests for BPF task-work scheduling kfuncs. The tests spawn multiple threads that concurrently schedule task_work callbacks against the same and different map values to exercise the kfuncs under high contention. Verify callbacks are reliably enqueued and executed with no drops. Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20250923112404.668720-10-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 39fd74dfd5d2ea9d1e94b2e03076284616798551 Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:03 2025 +0100 selftests/bpf: BPF task work scheduling tests Introducing selftests that check BPF task work scheduling mechanism. Validate that verifier does not accepts incorrect calls to bpf_task_work_schedule kfunc. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-9-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 38aa7003e369802f81a078f6673d10d97013f04f Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:02 2025 +0100 bpf: task work scheduling kfuncs Implementation of the new bpf_task_work_schedule kfuncs, that let a BPF program schedule task_work callbacks for a target task: * bpf_task_work_schedule_signal() - schedules with TWA_SIGNAL * bpf_task_work_schedule_resume() - schedules with TWA_RESUME Each map value should embed a struct bpf_task_work, which the kernel side pairs with struct bpf_task_work_kern, containing a pointer to struct bpf_task_work_ctx, that maintains metadata relevant for the concrete callback scheduling. A small state machine and refcounting scheme ensures safe reuse and teardown. State transitions: _______________________________ | | v | [standby] ---> [pending] --> [scheduling] --> [scheduled] ^ |________________|_________ | | | v | [running] |_______________________________________________________| All states may transition into FREED state: [pending] [scheduling] [scheduled] [running] [standby] -> [freed] A FREED terminal state coordinates with map-value deletion (bpf_task_work_cancel_and_free()). Scheduling itself is deferred via irq_work to keep the kfunc callable from NMI context. Lifetime is guarded with refcount_t + RCU Tasks Trace. Main components: * struct bpf_task_work_context – Metadata and state management per task work. * enum bpf_task_work_state – A state machine to serialize work scheduling and execution. * bpf_task_work_schedule() – The central helper that initiates scheduling. * bpf_task_work_acquire_ctx() - Attempts to take ownership of the context, pointed by passed struct bpf_task_work, allocates new context if none exists yet. * bpf_task_work_callback() – Invoked when the actual task_work runs. * bpf_task_work_irq() – An intermediate step (runs in softirq context) to enqueue task work. * bpf_task_work_cancel_and_free() – Cleanup for deleted BPF map entries. Flow of successful task work scheduling 1) bpf_task_work_schedule_* is called from BPF code. 2) Transition state from STANDBY to PENDING, mark context as owned by this task work scheduler 3) irq_work_queue() schedules bpf_task_work_irq(). 4) Transition state from PENDING to SCHEDULING (noop if transition successful) 5) bpf_task_work_irq() attempts task_work_add(). If successful, state transitions to SCHEDULED. 6) Task work calls bpf_task_work_callback(), which transition state to RUNNING. 7) BPF callback is executed 8) Context is cleaned up, refcounts released, context state set back to STANDBY. Signed-off-by: Mykyta Yatsenko Reviewed-by: Andrii Nakryiko Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250923112404.668720-8-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5e8134f50d3041a9922a732f24d705a238b61aad Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:01 2025 +0100 bpf: extract map key pointer calculation Calculation of the BPF map key, given the pointer to a value is duplicated in a couple of places in helpers already, in the next patch another use case is introduced as well. This patch extracts that functionality into a separate function. Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-7-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5c8fd7e2b5b0a527cf88740da122166695382a78 Author: Mykyta Yatsenko Date: Tue Sep 23 12:24:00 2025 +0100 bpf: bpf task work plumbing This patch adds necessary plumbing in verifier, syscall and maps to support handling new kfunc bpf_task_work_schedule and kernel structure bpf_task_work. The idea is similar to how we already handle bpf_wq and bpf_timer. verifier changes validate calls to bpf_task_work_schedule to make sure it is safe and expected invariants hold. btf part is required to detect bpf_task_work structure inside map value and store its offset, which will be used in the next patch to calculate key and value addresses. arraymap and hashtab changes are needed to handle freeing of the bpf_task_work: run code needed to deinitialize it, for example cancel task_work callback if possible. The use of bpf_task_work and proper implementation for kfuncs are introduced in the next patch. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-6-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit d2699bdb6ebad4fecd0f8765f35bd32a4a142b16 Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:59 2025 +0100 bpf: verifier: permit non-zero returns from async callbacks The verifier currently enforces a zero return value for all async callbacks—a constraint originally introduced for bpf_timer. That restriction is too narrow for other async use cases. Relax the rule by allowing non-zero return codes from async callbacks in general, while preserving the zero-return requirement for bpf_timer to maintain its existing semantics. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-5-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit acc3a0d2506c1b8186e9190adcd5bee4a1932abc Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:58 2025 +0100 bpf: htab: extract helper for freeing special structs Extract the cleanup of known embedded structs into the dedicated helper. Remove duplication and introduce a single source of truth for freeing special embedded structs in hashtab. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250923112404.668720-4-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 5eab266b801f4b938fea6d112c560c84ab489627 Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:57 2025 +0100 bpf: extract generic helper from process_timer_func() Refactor the verifier by pulling the common logic from process_timer_func() into a dedicated helper. This allows reusing process_async_func() helper for verifying bpf_task_work struct in the next patch. Signed-off-by: Mykyta Yatsenko Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Tested-by: syzbot@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20250923112404.668720-3-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit f90213261681268b6dc4c944503ddcc20e15f8fe Author: Mykyta Yatsenko Date: Tue Sep 23 12:23:56 2025 +0100 bpf: refactor special field-type detection Reduce code duplication in detection of the known special field types in map values. This refactoring helps to avoid copying a chunk of code in the next patch of the series. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20250923112404.668720-2-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit d43cc4ea1f9d720ab4bf06806f79260bfe981508 Author: Leo Li Date: Fri Sep 12 11:01:50 2025 -0400 drm/amd/display: Init DCN35 clocks from pre-os HW values [Why] We did not initialize dc clocks with boot-time hw values during init. This lead to incorrect clock values in dc, causing `dcn35_update_clocks` to make incorrect updates. [How] Correctly initialize DC with pre-os clk values from HW. s/dump/save/ as that accurately reflects the purpose of the functions. Fixes: 8774029f76b9 ("drm/amd/display: Add DCN35 CLK_MGR") Reviewed-by: Aurabindo Pillai Signed-off-by: Leo Li Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 550038edef7f933591e10e32f94a5e9557b023b8 Author: Charlene Liu Date: Fri Sep 12 12:37:30 2025 -0400 drm/amd/display: Revert "correct sw cache timing to ensure dispclk ramping" [why] Need consider SSC enabled case This reverts commit f1fd8a9ac2aa5118f76baf28e6ca4d6962a485be. Reviewed-by: Ovidiu (Ovi) Bunea Reviewed-by: Chris Park Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f1fd8a9ac2aa5118f76baf28e6ca4d6962a485be Author: Charlene Liu Date: Thu Sep 11 19:20:45 2025 -0400 drm/amd/display: Correct sw cache timing to ensure dispclk ramping [why] Current driver will cache the dispclk right after send cmd to pmfw, but actual clock not reached yet. Change to only cache the dispclk setting after HW reached to the real clock. Also give some range as it might be in bypass clock setting. Reviewed-by: Yihan Zhu Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d943fa61aeebac13a0ddfbd2407f135c84405996 Merge: fc3e44e4925ab4 54c67740fff736 Author: Greg Kroah-Hartman Date: Tue Sep 23 16:32:18 2025 +0200 Merge tag 'mhi-for-v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Add support for all Foxconn T99W696 SKU variants - Fix accessing the uninitialized 'dev' pointer in mhi_init_irq_setup() - Notify the MHI Execution Environment (EE) change to userspace using uevent - Add support for Virtual Functions (VFs) in SR-IOV capable QDU100 device from Qualcomm. For adding SR-IOV support, MHI pci_generic driver has been modified to apply different configurations for PFs and VFs. MHI Endpoint ============ - Fix the handling of chained transfers in EP MHI driver that leads to reading past the host transfer buffers causing IOMMU faults in the host and other issues. * tag 'mhi-for-v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Set DMA mask for VFs bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state bus: mhi: host: pci_generic: Reset QDU100 while the MHI driver is removed bus: mhi: host: pci_generic: Add SRIOV support bus: mhi: host: pci_generic: Read SUBSYSTEM_VENDOR_ID for VF's to check status bus: mhi: host: Add support for separate controller configurations for VF and PF bus: mhi: ep: Fix chained transfer handling in read path bus: mhi: host: Notify EE change via uevent bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU variants commit 35bcc9168f3ce6416cbf3f776758be0937f84cb3 Author: Charlene Liu Date: Thu Sep 11 17:52:11 2025 -0400 drm/amd/display: Insert dccg log for easy debug [why] Log for sequence tracking Reviewed-by: Ovidiu (Ovi) Bunea Reviewed-by: Yihan Zhu Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 19d8f3192f78ce38e710da2df8bad2bc972a7a5a Author: Dillon Varone Date: Thu Sep 11 13:52:52 2025 -0400 drm/amd/display: Remove wm_optimized_required [WHY&HOW] This is a redundant field that is identically to optimized_required, so just replace it. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c480d074b3ff27a8d582505dfd53c9b091b63d57 Author: Dillon Varone Date: Wed Sep 10 16:55:23 2025 -0400 drm/amd/display: Set wm_pending when disable stutter w/a used [WHY&HOW] When stutter is disabled prior to watermark programming due to a w/a, wm_pending should be returned as true. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit adb441ca64a2f3972eb2919e2e340c83a3212479 Author: Dillon Varone Date: Wed Sep 10 10:55:48 2025 -0400 drm/amd/display: Refactor SMU tracing [WHY&HOW] Add new tracing and performance measurements for SMU messaging. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d19f570cdf94caa5fad0f1403466e01a7c430b8f Author: Dillon Varone Date: Fri Aug 22 13:23:18 2025 -0400 drm/amd/display: Isolate dcn401 SMU functions [WHY&HOW] SMU interfaces are not backwards and forwards compatible, so they should be isolated per version. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b65cf4baeb24bdb5fee747679ee88f1ade5c1d6c Author: Allen Li Date: Fri Sep 5 16:58:38 2025 +0800 drm/amd/display: Add fast sync field in ultra sleep more for DMUB [Why&How] We need to inform DMUB whether fast sync in ultra sleep mode is supported, so that it can disable desync error detection when the it is not enabled. This helps prevent unexpected desync errors when transitioning out of ultra sleep mode. Add fast sync in ultra sleep mode field in replay copy setting command. Reviewed-by: Robin Chen Reviewed-by: Nicholas Kazlauskas Signed-off-by: Allen Li Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8613a55ac57baf40e54633eab00c820515196113 Author: Liao Yuanhong Date: Mon Aug 25 20:31:59 2025 +0800 tracing: Remove redundant 0 value initialization The saved_cmdlines_buffer struct is already zeroed by memset(). It's redundant to initialize s->cmdline_idx to 0. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250825123200.306272-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Signed-off-by: Steven Rostedt (Google) commit 9e5d4a5e27c6dc4e1b4fc9d654d13de12b8ce156 Author: Alvin Lee Date: Tue Sep 9 16:03:08 2025 -0400 drm/amd/display: Use mpc.preblend flag to indicate preblend [Description] Modifications in per asic capability means mpc.preblend flag should be used to indicate preblend. Update relevant paths to use this flag. Fixes: 39923050615c ("drm/amd/display: Clear DPP 3DLUT Cap") Reviewed-by: Dillon Varone Signed-off-by: Alvin Lee Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0bf6b216d4783cb51f9af05a49d3cce4fc22dc24 Author: Sridevi Arvindekar Date: Wed Sep 10 11:04:07 2025 -0400 drm/amd/display: Fix for test crash due to power gating [Why/How] Call power gating routine only if it is defined. Reviewed-by: Alvin Lee Signed-off-by: Sridevi Arvindekar Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 3451021a9e153e3f3067c90429c8317c126e159e Author: Ivan Lipski Date: Tue Sep 9 14:15:05 2025 -0400 drm/amd/display: Enable DTM v3 on dGPUs with DCN 3.1+ [Why&How] Right now, only selected APUs have enabled DTM v3, which allows to use newer firmware for content protection. We want to enable it on the dGPUs starting with DCN 3.2 Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f082daf08f2ff313bdf9cf929a28f6d888117986 Author: Lo-an Chen Date: Mon Aug 25 18:16:24 2025 +0800 drm/amd/display: Init dispclk from bootup clock for DCN314 [Why] Driver does not pick up and save vbios's clocks during init clocks, the dispclk in clk_mgr will keep 0 until the first update clocks. In some cases, OS changes the timing in the second set mode (lower the pixel clock), causing the driver to lower the dispclk in prepare bandwidth, which is illegal and causes grey screen. [How] 1. Dump and save the vbios's clocks, and init the dispclk in dcn314_init_clocks. 2. Fix the condition in dcn314_update_clocks, regarding a 0kHz value. Reviewed-by: Charlene Liu Signed-off-by: Lo-an Chen Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 6cec25f5b5660602b1953038cf40968b2d71c403 Author: Mario Limonciello Date: Thu Sep 4 13:49:35 2025 -0500 drm/amd/display: Handle interpolation for first data point [Why] If the first data point for a custom brightness curve is not 0% luminance then the first few luminance values will be ignored. [How] Check signal is below first data point and if so do linear interpolation to 0 instead. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 74d70e309d155550c9bd8bce74812875df47fb7b Author: Paul Hsieh Date: Fri Sep 5 11:38:21 2025 +0800 drm/amd/display: Add monitor patch to read psr cap again [Why & How] According to the vendor’s requirement, after each OUI write, the PSR cap must be read; otherwise, the vendor will default to using PSRSU. But its PSR cap indicates that it only supports PSR1. Reviewed-by: Wenjing Liu Signed-off-by: Paul Hsieh Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 Author: Karthi Kandasamy Date: Wed Sep 3 14:16:27 2025 +0200 drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream [WHY] Ensure AVI infoframe updates from stream updates are applied to the active stream so OS overrides are not lost. [HOW] Copy avi_infopacket to stream when valid flag is set. Follow existing infopacket copy pattern and perform a basic validity check before assignment. Reviewed-by: Aric Cyr Signed-off-by: Karthi Kandasamy Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 54980f3c63ed3e5cca3d251416581193c90eae76 Author: Dillon Varone Date: Mon Sep 15 11:35:37 2025 -0400 drm/amd/display: Add missing post flip calls [WHY&HOW] dc_post_update_surfaces_to_stream needs to be called after a full update completes in order to optimize clocks and watermarks for power. Add missing calls before idle entry is requested to ensure optimal power. Reviewed-by: Aurabindo Pillai Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c82b8f96eb972eb313e20ede5eb6617bc393c490 Author: Dillon Varone Date: Mon Sep 15 11:22:52 2025 -0400 drm/amd/display: Disable stutter when programming watermarks on dcn32 [WHY&HOW] Reprogramming watermarks with stutter allowed can cause instability on some ASICs. Disable it prior to raising watermarks (prepare bandwidth), then re-enable after lowering (optimize bandwidth). Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 854b9ab637d72bad8afe8f11cf6edd9aab0d1cf9 Author: Sonny Jiang Date: Thu Sep 18 12:34:48 2025 -0400 drm/amdgpu: Update amdgpu_vcn5_fw_shared for vcn_5_0_1 Align vcn5_fw_shared structure with FW Signed-off-by: Sonny Jiang Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 1fb710793ce2619223adffaf981b1ff13cd48f17 Author: Mario Limonciello Date: Thu Sep 18 19:48:00 2025 -0500 drm/amdgpu: Enable MES lr_compute_wa by default The MES set resources packet has an optional bit 'lr_compute_wa' which can be used for preventing MES hangs on long compute jobs. Set this bit by default. Co-developed-by: Yifan Zhang Signed-off-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit c5b3cc417b0260abc74ed32f6baa626c9de917c0 Author: Sunil Khatri Date: Wed Sep 17 20:12:43 2025 +0530 drm/amdgpu: use hmm_pfns instead of array of pages we dont need to allocate local array of pages to hold the pages returned by the hmm, instead we could use the hmm_range structure itself to get to hmm_pfn and get the required pages directly. This avoids call to alloc/free quite a lot. Signed-off-by: Sunil Khatri Suggested-by: Christian König Reviewed-by: Christian König Acked-by: Felix Kuehling Signed-off-by: Alex Deucher commit ae4d627e43ccecc403e7378811289b33de38e67d Author: Yang Wang Date: Fri Sep 19 09:44:25 2025 +0800 drm/amd/pm: place the smu 13.0.0 pptable header into the correct folder Place the smu 13.0.0 pptable header in the correct folder Signed-off-by: Yang Wang Reviewed-by: Mangesh Gadre Signed-off-by: Alex Deucher commit b29c22b8dafd951664a491bf629e615d81513197 Author: Lijo Lazar Date: Thu Sep 18 17:52:04 2025 +0530 drm/amdgpu: Fix vbios build number parsing logic It's not necessary that the build string and atom header section has a difference of 32 bytes. Use the remaining bytes in the section as copy limit. Fixes: d6fa80266178 ("drm/amdgpu: Add vbios build number interface") Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 496f9372eae14775e0524e83e952814691fe850a Author: Amir Mohammad Jahangirzad Date: Tue Sep 23 05:01:13 2025 +0330 ACPI: debug: fix signedness issues in read/write helpers In the ACPI debugger interface, the helper functions for read and write operations use "int" as the length parameter data type. When a large "size_t count" is passed from the file operations, this cast to "int" results in truncation and a negative value due to signed integer representation. Logically, this negative number propagates to the min() calculation, where it is selected over the positive buffer space value, leading to unexpected behavior. Subsequently, when this negative value is used in copy_to_user() or copy_from_user(), it is interpreted as a large positive value due to the unsigned nature of the size parameter in these functions, causing the copy operations to attempt handling sizes far beyond the intended buffer limits. Address the issue by: - Changing the length parameters in acpi_aml_read_user() and acpi_aml_write_user() from "int" to "size_t", aligning with the expected unsigned size semantics. - Updating return types and local variables in acpi_aml_read() and acpi_aml_write() to "ssize_t" for consistency with kernel file operation conventions. - Using "size_t" for the "n" variable to ensure calculations remain unsigned. - Using min_t() for circ_count_to_end() and circ_space_to_end() to ensure type-safe comparisons and prevent integer overflow. Signed-off-by: Amir Mohammad Jahangirzad Link: https://patch.msgid.link/20250923013113.20615-1-a.jahangirzad@gmail.com [ rjw: Changelog tweaks, local variable definitions ordering adjustments ] Fixes: 8cfb0cdf07e2 ("ACPI / debugger: Add IO interface to access debugger functionalities") Cc: 4.5+ # 4.5+ Signed-off-by: Rafael J. Wysocki commit ade2105e748f85eb026d26701091213855aea633 Author: Elijah Wright Date: Wed Aug 20 22:39:07 2025 -0700 tracing: Move buffer in trace_seq to end of struct TRACE_SEQ_BUFFER_SIZE is dependent on the architecture for its size. on 64-bit systems, it is 8148 bytes. forced 8-byte alignment in size_t and seq_buf means that trace_seq is 8200 bytes on 64-bit systems. moving the buffer to the end of the struct fixes the issue. there shouldn't be any side effects, i.e. pointer arithmetic on trace_seq Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250821053917.23301-1-git@elijahs.space Signed-off-by: Elijah Wright Signed-off-by: Steven Rostedt (Google) commit 1d67d67a8c88db99ebf5b1323c238929c5fa8483 Author: Fushuai Wang Date: Mon Aug 11 14:41:58 2025 +0800 tracing/osnoise: Use for_each_online_cpu() instead of for_each_cpu() Replace the opencoded for_each_cpu(cpu, cpu_online_mask) loop with the more readable and equivalent for_each_online_cpu(cpu) macro. Link: https://lore.kernel.org/20250811064158.2456-1-wangfushuai@baidu.com Signed-off-by: Fushuai Wang Signed-off-by: Steven Rostedt (Google) commit 559f2eacc8a23c7f44daac09d4f3efd958d497f2 Author: Huisong Li Date: Tue Sep 23 11:24:28 2025 +0800 ACPI: processor: Do not expose global variable acpi_idle_driver Move the cpuidle driver check from __acpi_processor_start() to acpi_processor_power_init() which allows variable acpi_idle_driver to become static. No intentional functional impact. Signed-off-by: Huisong Li Link: https://patch.msgid.link/20250923032428.2656329-2-lihuisong@huawei.com [ rjw: Subject tweak, new changelog, adjustment of a new comment ] Signed-off-by: Rafael J. Wysocki commit 09da59344a5a2abb5b2f209cf149421d7d105ebc Author: Qianfeng Rong Date: Sun Aug 17 16:47:25 2025 +0800 tracing: Use vmalloc_array() to improve code Remove array_size() calls and replace vmalloc() with vmalloc_array() in tracing_map_sort_entries(). vmalloc_array() is optimized better, uses fewer instructions, and handles overflow more concisely[1]. [1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250817084725.59477-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Signed-off-by: Steven Rostedt (Google) commit 3add2d34bdfb1caab1d3f28ba0160f52dcff9353 Author: Steven Rostedt Date: Tue Sep 23 09:04:59 2025 -0400 tracing: Have syscall trace events show "0x" for values greater than 10 Currently the syscall trace events show each value as hexadecimal, but without adding "0x" it can be confusing: sys_write(fd: 4, buf: 0x55c4a1fa9270, count: 44) Looks like the above write wrote 44 bytes, when in reality it wrote 68 bytes. Add a "0x" for all values greater or equal to 10 to remove the ambiguity. For values less than 10, leave off the "0x" as that just adds noise to the output. Also change the iterator to check if "i" is nonzero and print the ", " delimiter at the start, then adding the logic to the trace_seq_printf() at the end. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Peter Zijlstra Cc: Namhyung Kim Cc: Takaya Saeki Cc: Tom Zanussi Cc: Thomas Gleixner Cc: Ian Rogers Cc: Douglas Raillard Link: https://lore.kernel.org/20250923130713.764558957@kernel.org Signed-off-by: Steven Rostedt (Google) commit 17a1a107d0e96c1b7eef875de46f1d953c557f88 Author: Steven Rostedt Date: Tue Sep 23 09:04:58 2025 -0400 tracing: Replace syscall RCU pointer assignment with READ/WRITE_ONCE() The syscall events are pseudo events that hook to the raw syscalls. The ftrace_syscall_enter/exit() callback is called by the raw_syscall enter/exit tracepoints respectively whenever any of the syscall events are enabled. The trace_array has an array of syscall "files" that correspond to the system calls based on their __NR_SYSCALL number. The array is read and if there's a pointer to a trace_event_file then it is considered enabled and if it is NULL that syscall event is considered disabled. Currently it uses an rcu_dereference_sched() to get this pointer and a rcu_assign_ptr() or RCU_INIT_POINTER() to write to it. This is unnecessary as the file pointer will not go away outside the synchronization of the tracepoint logic itself. And this code adds no extra RCU synchronization that uses this. Replace these functions with a simple READ_ONCE() and WRITE_ONCE() which is all they need. This will also allow this code to not depend on preemption being disabled as system call tracepoints are now allowed to fault. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Peter Zijlstra Cc: Namhyung Kim Cc: Takaya Saeki Cc: Tom Zanussi Cc: Thomas Gleixner Cc: Ian Rogers Cc: Douglas Raillard Link: https://lore.kernel.org/20250923130713.594320290@kernel.org Reviewed-by: Paul E. McKenney Signed-off-by: Steven Rostedt (Google) commit 01f96b812526a2c8dcd5c0e510dda37e09ec8bcd Author: Mao Jinlong Date: Sat Aug 16 00:25:29 2025 -0700 coresight: Add label sysfs node support For some coresight components like CTI and TPDM, there could be numerous of them. From the node name, we can only get the type and register address of the component. We can't identify the HW or the system the component belongs to. Add label sysfs node support for showing the intuitive name of the device. Signed-off-by: Mao Jinlong Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250816072529.3716968-3-quic_jinlmao@quicinc.com commit 1ad38ef4dbccee28b9b50e315a2d4d9ca5f7ee09 Author: Mao Jinlong Date: Sat Aug 16 00:25:28 2025 -0700 dt-bindings: arm: Add label in the coresight components Current name of coresight component's folder consists of prefix of the device and the id in the device list. When run 'ls' command, we can get the register address of the device. Take CTI for example, if we want to set the config for modem CTI, but we can't know which CTI is modem CTI from all current information. cti_sys0 -> ../../../devices/platform/soc@0/138f0000.cti/cti_sys0 cti_sys1 -> ../../../devices/platform/soc@0/13900000.cti/cti_sys1 Add label to show hardware context information of each coresight device. There will be a sysfs node label in each device folder. cat /sys/bus/coresight/devices/cti_sys0/label Signed-off-by: Mao Jinlong Reviewed-by: Krzysztof Kozlowski Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250816072529.3716968-2-quic_jinlmao@quicinc.com commit 28a272d8eb9fb8a1fa3ef27f665c04d47d74e037 Author: Yuanfang Zhang Date: Thu Aug 14 02:00:13 2025 -0700 coresight: tnoc: add new AMBA ID to support Trace Noc V2 Add the new AMBA ID 0x001f0c00 to support Trace Noc V2 instances. Signed-off-by: Yuanfang Zhang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250814-tnoc_v2-v1-1-3285e37280c9@oss.qualcomm.com commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 Author: Lin Yujun Date: Mon Sep 8 20:20:22 2025 +0800 coresight: Fix incorrect handling for return value of devm_kzalloc The return value of devm_kzalloc could be an null pointer, use "!desc.pdata" to fix incorrect handling return value of devm_kzalloc. Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE") Signed-off-by: Lin Yujun Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 Author: Jie Gan Date: Sat Sep 6 07:53:04 2025 +0800 coresight: tpda: fix the logic to setup the element size Some TPDM devices support both CMB and DSB datasets, requiring the system to enable the port with both corresponding element sizes. Currently, the logic treats tpdm_read_element_size as successful if the CMB element size is retrieved correctly, regardless of whether the DSB element size is obtained. This behavior causes issues when parsing data from TPDM devices that depend on both element sizes. To address this, the function should explicitly fail if the DSB element size cannot be read correctly. Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element") Reviewed-by: James Clark Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d Author: Leo Yan Date: Thu Sep 4 15:13:52 2025 +0100 coresight: trbe: Return NULL pointer for allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etm_setup_aux() only checks for a NULL pointer, so it misses the error. As a result, the driver continues and eventually causes a kernel panic. Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on allocation failures. This allows that the callers can properly handle the failure. Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver") Reported-by: Tamas Zsoldos Signed-off-by: Leo Yan Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com commit dc783892cca69e721f81d54293dac6286134abfe Author: Leo Yan Date: Thu Jul 31 13:23:46 2025 +0100 coresight: Refactor runtime PM The validation for driver data pointers and clock pointers are redundant in the runtime PM callbacks. After a driver's probing, its driver data and clocks have been initialized successfully, this ensures it is safe to access driver data and clocks in the runtime PM callbacks. A corner case is a clock pointer is NULL, in this case, the clock core layer can handle it properly. So remove these redundant checking. In runtime resume, respect values returned from clock function and add error handling. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-10-1dfe10bb3f6f@arm.com commit 7b20a4fac7c82c0aed6beb22a8523df28361b1ad Author: Leo Yan Date: Thu Jul 31 13:23:45 2025 +0100 coresight: Make clock sequence consistent Since atclk is enabled after pclk during the probe phase, this commit maintains the same sequence for the runtime resume flow. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-9-1dfe10bb3f6f@arm.com commit ba6b61fa21aa44a5634f2dbf78ee6817d3196fc4 Author: Leo Yan Date: Thu Jul 31 13:23:44 2025 +0100 coresight: Refactor driver data allocation The driver data no longer needs to be allocated separately in the static and dynamic probes. Moved the allocation into the low-level functions to avoid code duplication. Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-8-1dfe10bb3f6f@arm.com commit fbe7514a7912959e384acf108931ac1bfbb16466 Author: Leo Yan Date: Thu Jul 31 13:23:43 2025 +0100 coresight: Consolidate clock enabling CoreSight drivers enable pclk and atclk conditionally. For example, pclk is only enabled in the static probe, while atclk is an optional clock that it is enabled for both dynamic and static probes, if it is present. In the current CoreSight drivers, these two clocks are initialized separately. This causes complex and duplicate codes. CoreSight drivers are refined so that clocks are initialized in one go. For this purpose, this commit renames coresight_get_enable_apb_pclk() to coresight_get_enable_clocks() and encapsulates clock initialization logic: - If a clock is initialized successfully, its clock pointer is assigned to the double pointer passed as an argument. - For ACPI devices, clocks are controlled by firmware, directly bail out. - Skip enabling pclk for an AMBA device. - If atclk is not found, the corresponding double pointer is set to NULL. The function returns Success (0) to guide callers can proceed with no error. - Otherwise, an error number is returned for failures. The function became complex, move it from the header to the CoreSight core layer and the symbol is exported. Added comments for recording details. Suggested-by: Suzuki K Poulose Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-7-1dfe10bb3f6f@arm.com commit d091c6312561821f216ced63a7ad17c946b6d335 Author: Leo Yan Date: Thu Jul 31 13:23:42 2025 +0100 coresight: Avoid enable programming clock duplicately The programming clock is enabled by AMBA bus driver before a dynamic probe. As a result, a CoreSight driver may redundantly enable the same clock. To avoid this, add a check for device type and skip enabling the programming clock for AMBA devices. The returned NULL pointer will be tolerated by the drivers. Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 Author: Leo Yan Date: Thu Jul 31 13:23:41 2025 +0100 coresight: Appropriately disable trace bus clocks Some CoreSight components have trace bus clocks 'atclk' and are enabled using clk_prepare_enable(). These clocks are not disabled when modules exit. As atclk is optional, use devm_clk_get_optional_enabled() to manage it. The benefit is the driver model layer can automatically disable and release clocks. Check the returned value with IS_ERR() to detect errors but leave the NULL pointer case if the clock is not found. And remove the error handling codes which are no longer needed. Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com commit 1abc1b212effe920f4729353880c8e03f1d76b4b Author: Leo Yan Date: Thu Jul 31 13:23:40 2025 +0100 coresight: Appropriately disable programming clocks Some CoreSight components have programming clocks (pclk) and are enabled using clk_get() and clk_prepare_enable(). However, in many cases, these clocks are not disabled when modules exit and only released by clk_put(). To fix the issue, this commit refactors programming clock by replacing clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled() for enabling APB clock. If the "apb_pclk" clock is not found, a NULL pointer is returned, and the function proceeds to attempt enabling the "apb" clock. Since ACPI platforms rely on firmware to manage clocks, returning a NULL pointer in this case leaves clock management to the firmware rather than the driver. This effectively avoids a clock imbalance issue during module removal - where the clock could be disabled twice: once during the ACPI runtime suspend and again during the devm resource release. Callers are updated to reuse the returned error value. With the change, programming clocks are managed as resources in driver model layer, allowing clock cleanup to be handled automatically. As a result, manual cleanup operations are no longer needed and are removed from the Coresight drivers. Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices") Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce Author: Leo Yan Date: Thu Jul 31 13:23:39 2025 +0100 coresight: etm4x: Support atclk The atclk is an optional clock for the CoreSight ETMv4, but the driver misses to initialize it. This change enables atclk in probe of the ETMv4 driver, and dynamically control the clock during suspend and resume. No need to check the driver data and clock pointer in the runtime suspend and resume, so remove checks. And add error handling in the resume function. Add a minor fix to the comment format when adding the atclk field. Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com commit 5483624effea2e893dc0df6248253a6a2a085451 Author: Leo Yan Date: Thu Jul 31 13:23:38 2025 +0100 coresight: catu: Support atclk The atclk is an optional clock for the CoreSight CATU, but the driver misses to initialize it. This change enables atclk in probe of the CATU driver, and dynamically control the clock during suspend and resume. The checks for driver data and clocks in suspend and resume are not needed, remove them. Add error handling in the resume function. Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e Author: Leo Yan Date: Thu Jul 31 13:23:37 2025 +0100 coresight: tmc: Support atclk The atclk is an optional clock for the CoreSight TMC, but the driver misses to initialize it. In most cases, TMC shares the atclk clock with other CoreSight components. Since these components enable the clock before the TMC device is initialized, the TMC continues properly, which is why we don’t observe any lockup issues. This change enables atclk in probe of the TMC driver. Given the clock is optional, it is possible to return NULL if the clock does not exist. IS_ERR() is tolerant for this case. Dynamically disable and enable atclk during suspend and resume. The clock pointers will never be error values if the driver has successfully probed, and the case of a NULL pointer case will be handled by the clock core layer. The driver data is always valid after probe. Therefore, remove the related checks. Also in the resume flow adds error handling. Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver") Reviewed-by: Anshuman Khandual Reviewed-by: Yeoreum Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 Author: Yuanfang Zhang Date: Tue Aug 12 01:24:45 2025 -0700 coresight-etm4x: Conditionally access register TRCEXTINSELR The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0. To avoid invalid accesses, introduce a check on numextinsel (derived from TRCIDR5[11:9]) before reading or writing to this register. Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") Signed-off-by: Yuanfang Zhang Reviewed-by: James Clark Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 Author: Yeoreum Yun Date: Wed Jun 11 11:30:25 2025 +0100 coresight: fix indentation error in cscfg_remove_owned_csdev_configs() Fix wrong indentation in cscfg_remove_owned_csdev_configs() Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/ Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev") Signed-off-by: Yeoreum Yun Reviewed-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com commit 7fdd04e15ad79cc2294b9e722d6282357da0b53a Author: Dan Carpenter Date: Wed Jul 16 14:38:30 2025 -0500 coresight: tnoc: Fix a NULL vs IS_ERR() bug in probe The devm_ioremap_resource() function returns error pointers on error. It never returns NULL. Update the error checking to match. Fixes: e54a52a28a36 ("coresight: add coresight Trace Network On Chip driver") Signed-off-by: Dan Carpenter Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/7bd9fae8-a15f-412a-8800-ce47acf0b5ce@sabinyo.mountain commit c91d38b57f2c4784d885c874b2a1234a01361afd Author: Dave Chinner Date: Thu Sep 18 08:12:54 2025 +1000 xfs: rework datasync tracking and execution Jan Kara reported that the shared ILOCK held across the journal flush during fdatasync operations slows down O_DSYNC DIO on unwritten extents significantly. The underlying issue is that unwritten extent conversion needs the ILOCK exclusive, whilst the datasync operation after the extent conversion holds it shared. Hence we cannot be flushing the journal for one IO completion whilst at the same time doing unwritten extent conversion on another IO completion on the same inode. This means that IO completions lock-step, and IO performance is dependent on the journal flush latency. Jan demonstrated that reducing the ifdatasync lock hold time can improve O_DSYNC DIO to unwritten extents performance by 2.5x. Discussion on that patch found issues with the method, and we came to the conclusion that separately tracking datasync flush sequences was the best approach to solving the problem. The fsync code uses the ILOCK to serialise against concurrent modifications in the transaction commit phase. In a transaction commit, there are several disjoint updates to inode log item state that need to be considered atomically by the fsync code. These operations are all done under ILOCK_EXCL context: 1. ili_fsync_flags is updated in ->iop_precommit 2. i_pincount is updated in ->iop_pin before it is added to the CIL 3. ili_commit_seq is updated in ->iop_committing, after it has been added to the CIL In fsync, we need to: 1. check that the inode is dirty in the journal (ipincount) 2. check that ili_fsync_flags is set 3. grab the ili_commit_seq if a journal flush is needed 4. clear the ili_fsync_flags to ensure that new modifications that require fsync are tracked in ->iop_precommit correctly The serialisation of ipincount/ili_commit_seq is needed to ensure that we don't try to unnecessarily flush the journal. The serialisation of ili_fsync_flags being set in ->iop_precommit and cleared in fsync post journal flush is required for correctness. Hence holding the ILOCK_SHARED in xfs_file_fsync() performs all this serialisation for us. Ideally, we want to remove the need to hold the ILOCK_SHARED in xfs_file_fsync() for best performance. We start with the observation that fsync/fdatasync() only need to wait for operations that have been completed. Hence operations that are still being committed have not completed and datasync operations do not need to wait for them. This means we can use a single point in time in the commit process to signal "this modification is complete". This is what ->iop_committing is supposed to provide - it is the point at which the object is unlocked after the modification has been recorded in the CIL. Hence we could use ili_commit_seq to determine if we should flush the journal. In theory, we can already do this. However, in practice this will expose an internal global CIL lock to the IO path. The ipincount() checks optimise away the need to take this lock - if the inode is not pinned, then it is not in the CIL and we don't need to check if a journal flush at ili_commit_seq needs to be performed. The reason this is needed is that the ili_commit_seq is never cleared. Once it is set, it remains set even once the journal has been committed and the object has been unpinned. Hence we have to look that journal internal commit sequence state to determine if ili_commit_seq needs to be acted on or not. We can solve this by clearing ili_commit_seq when the inode is unpinned. If we clear it atomically with the last unpin going away, then we are guaranteed that new modifications will order correctly as they add a new pin counts and we won't clear a sequence number for an active modification in the CIL. Further, we can then allow the per-transaction flag state to propagate into ->iop_committing (instead of clearing it in ->iop_precommit) and that will allow us to determine if the modification needs a full fsync or just a datasync, and so we can record a separate datasync sequence number (Jan's idea!) and then use that in the fdatasync path instead of the full fsync sequence number. With this infrastructure in place, we no longer need the ILOCK_SHARED in the fsync path. All serialisation is done against the commit sequence numbers - if the sequence number is set, then we have to flush the journal. If it is not set, then we have nothing to do. This greatly simplifies the fsync implementation.... Signed-off-by: Dave Chinner Tested-by: Jan Kara Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit bc7d684fea18cc48c3630d2b7f1789000ff2df5b Author: Dave Chinner Date: Thu Sep 18 08:12:53 2025 +1000 xfs: rearrange code in xfs_inode_item_precommit There are similar extsize checks and updates done inside and outside the inode item lock, which could all be done under a single top level logic branch outside the ili_lock. The COW extsize fixup can potentially miss updating the XFS_ILOG_CORE in ili_fsync_fields, so moving this code up above the ili_fsync_fields update could also be considered a fix. Further, to make the next change a bit cleaner, move where we calculate the on-disk flag mask to after we attach the cluster buffer to the the inode log item. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 55dcfdf8af9c38cce6f5b2058d3b58dde25e5020 Author: Heinz Mauelshagen Date: Thu Sep 18 15:48:40 2025 +0200 dm raid: use proper md_ro_state enumerators The dm-raid code was using hardcoded integer values to represent the read-only/read-write state of RAID arrays instead of the proper enumeration constants defined in the md_ro_state enumerator type. Changes: - Replace hardcoded integers with the appropriate md_ro_state enumerator values - Add the missing MD_RDONLY setting in the post_suspend function (no failures have been attributed to this inconsistency, the fix ensures correct state transitions for completeness) This improves code clarity and maintainability by using the defined enumeration constants rather than magic numbers, ensuring the code properly conforms to the established API interface. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mikulas Patocka commit 1cd83fb79083a2431f513956afca92b690ef11ad Author: Mikulas Patocka Date: Wed Sep 17 17:52:09 2025 +0200 dm-integrity: prefer synchronous hash interface The previous patch preferred async interface for the purpose of testing. However, the synchronous interface is faster, so it should be preferred. Signed-off-by: Mikulas Patocka commit 5076d4599ce1702ab3615c7600504ba68df02168 Author: Mikulas Patocka Date: Wed Sep 17 17:51:56 2025 +0200 dm-integrity: enable asynchronous hash interface This commit enables the asynchronous hash interface in dm-integrity. Signed-off-by: Mikulas Patocka commit e8a052ee1fb570b8e07f05f65752646eaac74355 Author: Mikulas Patocka Date: Wed Sep 17 17:51:36 2025 +0200 dm-integrity: rename internal_hash Rename "internal_hash" to "internal_shash" and introduce a boolean value "internal_hash". Signed-off-by: Mikulas Patocka commit e3de0a36409011cb630571cfe7c9e0f5394988b6 Author: Mikulas Patocka Date: Wed Sep 17 17:51:20 2025 +0200 dm-integrity: add the "offset" argument Make sure that the "data" argument passed to integrity_sector_checksum is always page-aligned and add an "offset" argument that specifies the offset from the start of the page. This will enable us to use the asynchronous hash interface later. Signed-off-by: Mikulas Patocka commit e7151e225c043106c745b7eeb1370255ac8eb048 Author: Mikulas Patocka Date: Wed Sep 17 17:49:59 2025 +0200 dm-integrity: allocate the recalculate buffer with kmalloc Allocate the recalculate buffer with kmalloc rather than vmalloc. This will be needed later, for the simplification of the asynchronous hash interface. Signed-off-by: Mikulas Patocka commit fc3e44e4925ab4ab2e1c9d2f8ebb1e4c1594dc34 Merge: cbcd30ae37a9aa 561285d048053f Author: Greg Kroah-Hartman Date: Tue Sep 23 14:15:25 2025 +0200 Merge tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features and cleanup for 6.18 New device support ================== ad,ade9000 - New driver for this complex energy and power monitoring ADC. infineon,tlv493d - New driver for this 3D magnetic sensor. intel,dollar - New driver for this TI PMIC (part number unknown) marvel,88pm886 - Driver for this PMIC ADC. microchip,mcp9600 - Add explicit support for the mcp9601 which has some additional features over the mcp9600. rohm,bd79112 - New driver for this ADC / GPIO Chip. Features ======== Core - New helper to multiply data expressed in IIO types. - Add KUnit tests. - New IIO_ALTCURRENT type, similar to existing IIO_ALTVOLTAGE - Add some channel modifiers related to energy and power, such as reactive. adi,ad7124 - Support external clocks sources and output of the internal clocks. - Filter control. adi,ad7173 - Add filter support. Some fiddly interactions with other parameters on this device. adi,ad7779 - Add backend support which required control of the number of lanes used. liteon,ltr390 - Add runtime PM support. microchip,mcp9600 - Add support for different thermocouple types. Cleanup and minor fixes ======================= core - Switch info_mask fields to be unsigned. Not clear why they were ever signed. - Fix handling of negative channel scale in iio_convert_raw_to_processed() - Fix offset handling for channels without a scale attribute. - Improve the precision of scaling slightly. - Drop apparent handling of IIO_CHAN_INFO_PROCESSED for devices that don't have any such channels. various - Drop many pm_runtime_mark_last_busy() calls now pm_runtime_put_autosuspend() calls it internally. - Drop dev_err_probe() calls where the error code is hard coded as -ENOMEM as they don't do anything. - Drop dev_err() calls where the error code is -ENOMEM. This will reduce error prints, but memory failures generate a lot of messages anyway so unlikely we need these prints. current-sense-amplifier - Add #io-channels property this channel to be used by a consumer driver. adi,ad7124 - Fix incorrect clocks dt-binding property. - Make the mclk clock optional in DT - this is internal to the ADC so should never have been in he binding. - Fix up sample rate to comply with ABI. - Use read_avail() callback rather than opencoding similar. - Deploy guard() to clean up some lock handling. adi,ad7768 - Use devm_regulator_get_enable_read_voltage() to replace similar code. adi,ad7816 - Drop an unnecessary dev_set_drvdata() call as nothing uses the data. ad,adxl345 - Fix missing blank line before bullet list in documentation. arm,scmi - Use devm_kcalloc() for an array allocation rather than devm_kzalloc(). bosch,bmi270 - Match an ACPI ID seen in the wild. It is not spec compliant but we can't do much about that. bosch,bmp280 - Drop overly noisy dev_info() - Allow for sleeping gpio controllers. gogle,cros-ec - Drop unused location attribute that has been replaced by label. invense,icm42600 - Simplify the power management. - Use guard() to simplify some locking. maxim,max1238 - Add io-channel-cells property to dt-binding as there is an in tree consumer. microchip,mcp9600 - Specify a default value in dt-binding for the thermocouple type - General whitespace cleanup. samsung,exynos - Drop support for the S3C2410 including bindings, and touchscreen support as nothing else uses that. - Drop platform ID based binding as not used. st,vl53l0x - Fix returning the wrong variable in an error path. ti,pac1934 - Replace open coded devm_mutex_init(). xilinx,ams - Update maintainers entry. * tag 'iio-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (178 commits) MAINTAINERS: Support ROHM BD79112 ADC iio: adc: Support ROHM BD79112 ADC/GPIO dt-bindings: iio: adc: ROHM BD79112 ADC/GPIO iio: pressure: bmp280: Use gpiod_set_value_cansleep() iio: pressure: bmp280: Remove noisy dev_info() iio: ABI: add filter types for ad7173 iio: adc: ad7173: support changing filter type iio: adc: ad7173: rename odr field iio: adc: ad7173: rename ad7173_chan_spec_ext_info iio: adc: Add driver for Marvell 88PM886 PMIC ADC dt-bindings: mfd: 88pm886: Add #io-channel-cells iio: ABI: document "sinc4+rej60" filter_type iio: adc: ad7124: add filter support iio: adc: ad7124: support fractional sampling_frequency iio: adc: ad7124: use guard(mutex) to simplify return paths iio: adc: ad7124: use read_avail() for scale_available iio: adc: ad7124: use clamp() iio: adc: ad7124: fix sample rate for multi-channel use Documentation: ABI: iio: add sinc4+lp docs: iio: add documentation for ade9000 driver ... commit cbcd30ae37a9aa9c03607f597e7fdea3a6ebd816 Merge: eafedbc7c050c4 bcdf7a064c3c73 Author: Greg Kroah-Hartman Date: Tue Sep 23 14:11:59 2025 +0200 Merge tag 'icc-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.18 This pull request contains the interconnect changes for the 6.18-rc1 merge window. It contains new driver and a minor core cleanup. Core change: - Use device_match_of_node() instead of open coding it Driver changes: - Add new driver for the Qualcomm Glymur SoC - Enable OSM L3 support for the QCS615 SoC Signed-off-by: Georgi Djakov * tag 'icc-6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: dt-bindings: interconnect: Add OSM L3 compatible for QCS615 SoC interconnect: core: Use device_match_of_node() interconnect: qcom: add glymur interconnect provider driver interconnect: qcom: icc-rpmh: increase MAX_PORTS to support four QoS ports dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Glymur SoC commit 0c4932f6ddf815618fa34f7403df682aed7862b5 Author: LiangCheng Wang Date: Mon Sep 22 10:57:34 2025 +0800 drm/tiny: pixpaper: Fix missing dependency on DRM_GEM_SHMEM_HELPER The driver uses drm_gem_shmem_prime_import_no_map() and drm_gem_shmem_dumb_create(), but the Kconfig currently selects DRM_GEM_DMA_HELPER instead of DRM_GEM_SHMEM_HELPER. This causes link failures when DRM_GEM_SHMEM_HELPER is not enabled. Select DRM_GEM_SHMEM_HELPER to fix the build. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509220320.gfFZjmyg-lkp@intel.com/ Fixes: c9e70639f591 ("drm: tiny: Add support for Mayqueen Pixpaper e-ink panel") Reviewed-by: Thomas Zimmermann Signed-off-by: LiangCheng Wang Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250922-bar-v1-1-b2a1f54ace82@gmail.com commit 5d726c4dbeeddef612e6bed27edd29733f4d13af Author: Yu Kuai Date: Tue Sep 23 15:55:20 2025 +0800 blk-cgroup: fix possible deadlock while configuring policy Following deadlock can be triggered easily by lockdep: WARNING: possible circular locking dependency detected 6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted ------------------------------------------------------ check/1334 is trying to acquire lock: ff1100011d9d0678 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180 but task is already holding lock: ff1100011d9d00e0 (&q->q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&q->q_usage_counter(queue)#3){++++}-{0:0}: blk_queue_enter+0x40b/0x470 blkg_conf_prep+0x7b/0x3c0 tg_set_limit+0x10a/0x3e0 cgroup_file_write+0xc6/0x420 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #1 (&q->rq_qos_mutex){+.+.}-{4:4}: __mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 wbt_init+0x17e/0x280 wbt_enable_default+0xe9/0x140 blk_register_queue+0x1da/0x2e0 __add_disk+0x38c/0x5d0 add_disk_fwnode+0x89/0x250 device_add_disk+0x18/0x30 virtblk_probe+0x13a3/0x1800 virtio_dev_probe+0x389/0x610 really_probe+0x136/0x620 __driver_probe_device+0xb3/0x230 driver_probe_device+0x2f/0xe0 __driver_attach+0x158/0x250 bus_for_each_dev+0xa9/0x130 driver_attach+0x26/0x40 bus_add_driver+0x178/0x3d0 driver_register+0x7d/0x1c0 __register_virtio_driver+0x2c/0x60 virtio_blk_init+0x6f/0xe0 do_one_initcall+0x94/0x540 kernel_init_freeable+0x56a/0x7b0 kernel_init+0x2b/0x270 ret_from_fork+0x268/0x4c0 ret_from_fork_asm+0x1a/0x30 -> #0 (&q->sysfs_lock){+.+.}-{4:4}: __lock_acquire+0x1835/0x2940 lock_acquire+0xf9/0x450 __mutex_lock+0xd8/0xf50 mutex_lock_nested+0x2b/0x40 blk_unregister_queue+0x53/0x180 __del_gendisk+0x226/0x690 del_gendisk+0xba/0x110 sd_remove+0x49/0xb0 [sd_mod] device_remove+0x87/0xb0 device_release_driver_internal+0x11e/0x230 device_release_driver+0x1a/0x30 bus_remove_device+0x14d/0x220 device_del+0x1e1/0x5a0 __scsi_remove_device+0x1ff/0x2f0 scsi_remove_device+0x37/0x60 sdev_store_delete+0x77/0x100 dev_attr_store+0x1f/0x40 sysfs_kf_write+0x65/0x90 kernfs_fop_write_iter+0x189/0x280 vfs_write+0x256/0x490 ksys_write+0x83/0x190 __x64_sys_write+0x21/0x30 x64_sys_call+0x4608/0x4630 do_syscall_64+0xdb/0x6b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e other info that might help us debug this: Chain exists of: &q->sysfs_lock --> &q->rq_qos_mutex --> &q->q_usage_counter(queue)#3 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->q_usage_counter(queue)#3); lock(&q->rq_qos_mutex); lock(&q->q_usage_counter(queue)#3); lock(&q->sysfs_lock); Root cause is that queue_usage_counter is grabbed with rq_qos_mutex held in blkg_conf_prep(), while queue should be freezed before rq_qos_mutex from other context. The blk_queue_enter() from blkg_conf_prep() is used to protect against policy deactivation, which is already protected with blkcg_mutex, hence convert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile, consider that blkcg_mutex is held after queue is freezed from policy deactivation, also convert blkg_alloc() to use GFP_NOIO. Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit d3906d8f3cee0279d459dc88b5a871fcdcd4b236 Author: Darrick J. Wong Date: Mon Sep 15 17:26:09 2025 -0700 fuse: enable FUSE_SYNCFS for all fuseblk servers Turn on syncfs for all fuseblk servers so that the ones in the know can flush cached intermediate data and logs to disk. Signed-off-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 0c617a3f62100ff25c291735ff907a7ca1c084ae Author: Niklas Söderlund Date: Wed Sep 10 16:26:56 2025 +0200 clocksource/drivers/sh_cmt: Split start/stop of clock source and events The CMT do a housekeeping such as dealing with runtime PM and enable/disable clocks when either a clock source is enabled, or when a new clock event is registered. Doing this type of housekeeping for when a clock event is registered is not always possible as it can happen in contexts where holding spinlocks is not possible. However doing it when registering a clock source is possible. As a first step to address this design break apart the CMT start and stop functions. The path for clock sources need not change, while the one for clock events need to be reworked in future work. There is no indented functional change, just breaking the two use-cases controlled by a flag into two distinct functions. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250910142657.1148696-2-niklas.soderlund+renesas@ragnatech.se commit cd32e596f02fc981674573402c1138f616df1728 Author: Zhen Ni Date: Thu Aug 14 20:33:24 2025 +0800 clocksource/drivers/clps711x: Fix resource leaks in error paths The current implementation of clps711x_timer_init() has multiple error paths that directly return without releasing the base I/O memory mapped via of_iomap(). Fix of_iomap leaks in error paths. Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error") Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support") Signed-off-by: Zhen Ni Signed-off-by: Daniel Lezcano Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn commit 1c4b87c921fb158d853adcb8fd48c2dc07fc6f91 Author: Markus Schneider-Pargmann Date: Tue Aug 19 09:52:41 2025 +0200 clocksource/drivers/arm_global_timer: Add auto-detection for initial prescaler values am43xx has a clock tree where the global timer clock is an indirect child of the CPU clock used for frequency scaling: dpll_mpu_ck -- CPU/cpufreq | v dpll_mpu_m2_ck -- divider | v mpu_periphclk -- fixed divider by 2 used for global timer When CPU frequency changes, the global timer's clock notifier rejects the change because the hardcoded prescaler (1 or 2) cannot accommodate the frequency range across all CPU OPPs (300, 600, 720, 800, 1000 MHz). Add platform-specific prescaler auto-detection to solve this issue: - am43xx: prescaler = 50 (calculated as initial_freq/GCD of all OPP freqs) This allows the timer to work across all CPU frequencies after the fixed divider by 2. Tested on am4372-idk-evm. - zynq-7000: prescaler = 2 (preserves previous Kconfig default) - Other platforms: prescaler = 1 (previous default) The Kconfig option now defaults to 0 (auto-detection) but can still override the auto-detected value when set to a non-zero value, preserving existing customization workflows. Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Daniel Lezcano Tested-by: Kevin Hilman Tested-by: Patrice Chotard Tested-by: Judith Mendez Reviewed-by: Kevin Hilman Link: https://lore.kernel.org/r/20250819-topic-am43-arm-global-timer-v6-16-v2-1-6d082e2a5161@baylibre.com commit 21b8a635f3b3d6a165fa257808ed381c13c72e9b Author: Brian Masney Date: Sun Aug 10 18:37:10 2025 -0400 clocksource/drivers/ingenic-sysost: Convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. While changes are being made to 'struct clk_ops', let's also go ahead and fix the formatting of set_rate so that everything lines up as expected. Signed-off-by: Brian Masney Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250810-clocksource-round-rate-v1-1-486ef53e45eb@redhat.com commit 764d0654114b5ce52aafabdb2bf9ccee0e998651 Author: Wolfram Sang Date: Wed Aug 13 21:06:58 2025 +0200 clocksource/drivers/timer-tegra186: Don't print superfluous errors The watchdog core will handle error messages already. Signed-off-by: Wolfram Sang Signed-off-by: Daniel Lezcano Reviewed-by: Mikko Perttunen Link: https://lore.kernel.org/r/20250813190657.3628-2-wsa+renesas@sang-engineering.com commit 931bd9273848aca9dc40dd5cad3fcfe5d0818972 Author: Markus Stockhausen Date: Mon Aug 4 04:03:28 2025 -0400 clocksource/drivers/timer-rtl-otto: Simplify documentation While the main SoC PLL is responsible for the lexra bus frequency it has no implications on the the timer divisior. Update the comments accordingly. Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804080328.2609287-5-markus.stockhausen@gmx.de commit c445bffbf28f721e05d0ce06895045fc62aaff7c Author: Markus Stockhausen Date: Mon Aug 4 04:03:27 2025 -0400 clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts During normal operation the timers are reprogrammed including an interrupt acknowledgement. This has no effect as the whole timer is setup from scratch afterwards. Especially in an interrupt this has already been done by rttm_timer_interrupt(). Change the behaviour as follows: - Use rttm_disable_timer() during reprogramming - Keep rttm_stop_timer() for all other use cases. Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-4-markus.stockhausen@gmx.de commit 4f5ea5aa0dcdd3c7487fbabad5b86b3cd7d2b8c4 Merge: 8f5ae30d69d754 0a2c70594704b1 Author: Christian Brauner Date: Tue Sep 23 12:37:42 2025 +0200 Merge patch series "vfs: preparatory changes to centralize locking of create/remove/rename" NeilBrown says: This is a re-re-revised selection of cleanups and API renaming which continues my work to centralise locking of create/remove/rename operations. * patches from https://lore.kernel.org/20250922043121.193821-2-neilb@ownmail.net: debugfs: rename start_creating() to debugfs_start_creating() VFS: rename kern_path_locked() and related functions. VFS/audit: introduce kern_path_parent() for audit VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata VFS: discard err2 in filename_create() VFS/ovl: add lookup_one_positive_killable() Signed-off-by: Christian Brauner commit 0a2c70594704b199849e8add59263fc98e057a63 Author: NeilBrown Date: Mon Sep 22 14:29:53 2025 +1000 debugfs: rename start_creating() to debugfs_start_creating() start_creating() is a generic name which I would like to use for a function similar to simple_start_creating(), only not quite so simple. debugfs is using this name which, though static, will cause complaints if then name is given a different signature in a header file. So rename it to debugfs_start_creating(). Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 3d18f80ce181ba27f37d0ec1c550b22acb01dd49 Author: NeilBrown Date: Mon Sep 22 14:29:52 2025 +1000 VFS: rename kern_path_locked() and related functions. kern_path_locked() is now only used to prepare for removing an object from the filesystem (and that is the only credible reason for wanting a positive locked dentry). Thus it corresponds to kern_path_create() and so should have a corresponding name. Unfortunately the name "kern_path_create" is somewhat misleading as it doesn't actually create anything. The recently added simple_start_creating() provides a better pattern I believe. The "start" can be matched with "end" to bracket the creating or removing. So this patch changes names: kern_path_locked -> start_removing_path kern_path_create -> start_creating_path user_path_create -> start_creating_user_path user_path_locked_at -> start_removing_user_path_at done_path_create -> end_creating_path and also introduces end_removing_path() which is identical to end_creating_path(). __start_removing_path (which was __kern_path_locked) is enhanced to call mnt_want_write() for consistency with the start_creating_path(). Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 76a53de6f7ff0641570364234fb4489f4d4fc8e9 Author: NeilBrown Date: Mon Sep 22 14:29:51 2025 +1000 VFS/audit: introduce kern_path_parent() for audit audit_alloc_mark() and audit_get_nd() both need to perform a path lookup getting the parent dentry (which must exist) and the final target (following a LAST_NORM name) which sometimes doesn't need to exist. They don't need the parent to be locked, but use kern_path_locked() or kern_path_locked_negative() anyway. This is somewhat misleading to the casual reader. This patch introduces a more targeted function, kern_path_parent(), which returns not holding locks. On success the "path" will be set to the parent, which must be found, and the return value is the dentry of the target, which might be negative. This will clear the way to rename kern_path_locked() which is otherwise only used to prepare for removing something. It also allows us to remove kern_path_locked_negative(), which is transformed into the new kern_path_parent(). Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit d7fb2c410240348edee7867c29b60688175dcc11 Author: NeilBrown Date: Mon Sep 22 14:29:50 2025 +1000 VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata A rename operation can only rename within a single mount. Callers of vfs_rename() must and do ensure this is the case. So there is no point in having two mnt_idmaps in renamedata as they are always the same. Only one of them is passed to ->rename in any case. This patch replaces both with a single "mnt_idmap" and changes all callers. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit e66ccd30dcdc2053388bd2ec20bd53e9897248d5 Author: NeilBrown Date: Mon Sep 22 14:29:49 2025 +1000 VFS: discard err2 in filename_create() Since 204a575e91f3 "VFS: add common error checks to lookup_one_qstr_excl()" filename_create() does not need to stash the error value from mnt_want_write() into a separate variable - the logic that used to clobber 'error' after the call of mnt_want_write() has migrated into lookup_one_qstr_excl(). So there is no need for two different err variables. This patch discards "err2" and uses "error' throughout. Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit 17eb98d6b517b6e7faaebed496fd688dbb1771d9 Author: NeilBrown Date: Mon Sep 22 14:29:48 2025 +1000 VFS/ovl: add lookup_one_positive_killable() ovl wants a lookup which won't block on a fatal signal. It currently uses down_write_killable() and then repeatedly calls to lookup_one() The lock may not be needed if the name is already in the dcache and it aids proposed future changes if the locking is kept internal to namei.c So this patch adds lookup_one_positive_killable() which is like lookup_one_positive() but will abort in the face of a fatal signal. overlayfs is changed to use this. Note that instead of always getting an exclusive lock, ovl now only gets a shared lock, and only sometimes. The exclusive lock was never needed. However down_read_killable() was only added in v4.15 but overlayfs started using down_write_killable() here in v4.7. Note that the linked list ->first_maybe_whiteout ->next_maybe_white is local to the thread so there is no concurrency in that list which could be threatened by removing the locking. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Signed-off-by: Christian Brauner commit ca90147e55a78441794aef5cb4a8d1cf8d0e209f Author: Markus Stockhausen Date: Mon Aug 4 04:03:26 2025 -0400 clocksource/drivers/timer-rtl-otto: Drop set_counter function The current counter value is a read only register. It will be reset when writing a new target timer value with rttm_set_period(). rttm_set_counter() is essentially a noop. Drop it. While this makes rttm_start_timer() and rttm_enable_timer() the same functions keep both to make the established abstraction layers for register and control functions active. Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-3-markus.stockhausen@gmx.de commit e7a25106335041aeca4fdf50a84804c90142c886 Author: Markus Stockhausen Date: Mon Aug 4 04:03:25 2025 -0400 clocksource/drivers/timer-rtl-otto: Work around dying timers The OpenWrt distribution has switched from kernel longterm 6.6 to 6.12. Reports show that devices with the Realtek Otto switch platform die during operation and are rebooted by the watchdog. Sorting out other possible reasons the Otto timer is to blame. The platform currently consists of 4 targets with different hardware revisions. It is not 100% clear which devices and revisions are affected. Analysis shows: A more aggressive sched/deadline handling leads to more timer starts with small intervals. This increases the bug chances. See https://marc.info/?l=linux-kernel&m=175276556023276&w=2 Focusing on the real issue a hardware limitation on some devices was found. There is a minimal chance that a timer ends without firing an interrupt if it is reprogrammed within the 5us before its expiration time. Work around this issue by introducing a bounce() function. It restarts the timer directly before the normal restart functions as follows: - Stop timer - Restart timer with a slow frequency. - Target time will be >5us - The subsequent normal restart is outside the critical window Downstream has already tested and confirmed a patch. See https://github.com/openwrt/openwrt/pull/19468 https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875/3788 Signed-off-by: Markus Stockhausen Signed-off-by: Daniel Lezcano Tested-by: Stephen Howell Tested-by: Bjørn Mork Link: https://lore.kernel.org/r/20250804080328.2609287-2-markus.stockhausen@gmx.de commit 0494fc345b377d1207c2cbfef67dc51f6ec874c0 Author: Gokul Praveen Date: Tue Aug 12 16:23:46 2025 +0530 clocksource/drivers/timer-ti-dm : Capture functionality for OMAP DM timer Add PWM capture function in DM timer driver. OMAP DM timer hardware supports capture feature.It can be used to timestamp events (falling/rising edges) detected on input signal. Signed-off-by: Gokul Praveen Signed-off-by: Daniel Lezcano Reviewed-by: Neha Malcom Francis Link: https://lore.kernel.org/r/20250812105346.203541-1-g-praveen@ti.com commit 4e9bfe6969a768ef40c669fd100c9be70fb78a1f Author: Marc Zyngier Date: Thu Aug 14 16:46:22 2025 +0100 clocksource/drivers/arm_arch_timer_mmio: Add MMIO clocksource The MMIO driver can also double as a clocksource, something that was missing in its previous incarnation. Add it for completeness. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-5-maz@kernel.org commit 0f67b56d84b4c49adfd61f19f81f84ec613ab51a Author: Marc Zyngier Date: Thu Aug 14 16:46:21 2025 +0100 clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver Remove all the MMIO support from the per-CPU timer driver, and switch over to the standalove driver. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-4-maz@kernel.org commit 4891f01527bbbb0cf0e515c803ade67a17e247bb Author: Marc Zyngier Date: Thu Aug 14 16:46:20 2025 +0100 clocksource/drivers/arm_arch_timer: Add standalone MMIO driver Add a new driver for the MMIO side of the ARM architected timer. Most of it has been lifted from the existing arch timer code, massaged, and finally rewritten. It supports both DT and ACPI as firmware descriptions. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250814154622.10193-3-maz@kernel.org commit 5669d92f3efa449c3906cbf15e676768a8f4d502 Author: Marc Zyngier Date: Thu Aug 14 16:46:19 2025 +0100 ACPI: GTDT: Generate platform devices for MMIO timers In preparation for the MMIO timer support code becoming an actual driver, mimic what is done for the SBSA watchdog and expose a synthetic device for each MMIO timer block. Signed-off-by: Marc Zyngier Signed-off-by: Daniel Lezcano Tested-by: Sudeep Holla Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250807160243.1970533-2-maz@kernel.org commit bee33f22d7c30626e711b4900e3f460b6e0e104f Author: Daniel Lezcano Date: Mon Aug 4 17:23:38 2025 +0200 clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support The previous changes put in place the encapsulation of the code in order to allow multiple instances of the driver. The S32G platform has two Periodic Interrupt Timer (PIT). The IP is exactly the same as the VF platform. Each PIT has four channels which are 32 bits wide and counting down. The two first channels can be chained to implement a 64 bits counter. The channel usage is kept unchanged with the original driver, channel 2 is used as a clocksource, channel 3 is used as a clockevent. Other channels are unused. In order to support the S32G platform which has two PIT, we initialize the timer and bind it to a CPU. The S32G platforms can have 2, 4 or 8 CPUs and this kind of configuration can appear unusual as we may endup with two PIT used as a clockevent for the two first CPUs while the other CPUs use the architected timers. However, in the context of the automotive, the platform can be partioned to assign 2 CPUs for Linux and the others CPUs to third party OS. The PIT is then used with their specifities like the ability to freeze the time which is needed for instance for debugging purpose. The setup found for this platform is each timer instance is bound to CPU0 and CPU1. A counter is incremented when a timer is successfully initialized and assigned to a CPU. This counter is used as an index for the CPU number and to detect when we reach the maximum possible instances for the platform. That in turn triggers the CPU hotplug callbacks to achieve the per CPU setup. It is the exact same mechanism found in the NXP STM driver. If the timers must be bound to different CPUs, it would require an additionnal mechanism which is not part of these changes. Tested on a s32g274a-rdb2. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-21-daniel.lezcano@linaro.org commit adaf5b248ff38f98ea1b3696b9a793db270f8c3e Author: Daniel Lezcano Date: Mon Aug 4 17:23:37 2025 +0200 dt: bindings: fsl,vf610-pit: Add compatible for s32g2 and s32g3 The Vybrid Family is a NXP (formerly Freescale) platform having a Programmable Interrupt Timer (PIT). This timer is an IP found also on the NXP Automotive platform S32G2 and S32G3. Add the compatible for those platforms to describe the timer. Signed-off-by: Daniel Lezcano Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250804152344.1109310-20-daniel.lezcano@linaro.org commit fc346a155fe910a1cf4639b00b131f9a10284bdd Author: Daniel Lezcano Date: Mon Aug 4 17:23:36 2025 +0200 clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT The PIT acronym stands for Periodic Interrupt Timer which is found on different NXP platforms not only on the Vybrid Family. Change the name to be more generic for the NXP platforms in general. That will be consistent with the NXP STM driver naming convention. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-19-daniel.lezcano@linaro.org commit 3c34321e9b5965fdbf51fd407a35322a64c9e9c6 Author: Daniel Lezcano Date: Mon Aug 4 17:23:35 2025 +0200 clocksource/drivers/vf-pit: Unify the function name for irq ack Most the function are under the form pit_timer_*, let's change the interrupt acknowledgment function name to have the same format. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-18-daniel.lezcano@linaro.org commit 5ba405c719ce68a86308dd3bd90aeea59959030d Author: Daniel Lezcano Date: Mon Aug 4 17:23:34 2025 +0200 clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable The difference between the pit_clocksource_enable() and pit_clocksource_disable() is only setting the TIF flag for the clockevent. Let's group them and pass the TIF flag parameter to the function so we save some lines of code. But as the base address is different regarding if it is a clocksource or a clockevent, we pass the base address in parameter instead of the struct pit_timer. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-17-daniel.lezcano@linaro.org commit 46e83e4afc05c87b5edc2b0b4765283f101af0c6 Author: Daniel Lezcano Date: Mon Aug 4 17:23:33 2025 +0200 clocksource/drivers/vf-pit: Encapsulate set counter function Encapsulate the writel() calls to set the counter into a self-explainatory function. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-16-daniel.lezcano@linaro.org commit 13cea8527c95e1359191347abe5d94cccc47a311 Author: Daniel Lezcano Date: Mon Aug 4 17:23:32 2025 +0200 clocksource/drivers/vf-pit: Enable and disable module on error Encapsulate the calls to writel to enable and disable the PIT module and make use of them. Add the missing module disablement in case of error. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-15-daniel.lezcano@linaro.org commit fcf25b4427c7d1edb91dd02753d6153fb25da094 Author: Daniel Lezcano Date: Mon Aug 4 17:23:31 2025 +0200 clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable For the sake of lisibility, let's encapsulate the writel calls to enable and disable the timer into a function with a self-explainatory name. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-14-daniel.lezcano@linaro.org commit ad1423922781e6552f18d055a5742b1cff018cdc Author: Amir Goldstein Date: Wed Aug 27 19:55:26 2025 +0200 ovl: make sure that ovl_create_real() returns a hashed dentry e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity check of !d_unhashed(child) to try to verify that child dentry was not unlinked while parent dir was unlocked. This "was not unlink" check has a false positive result in the case of casefolded parent dir, because in that case, ovl_create_temp() returns an unhashed dentry after ovl_create_real() gets an unhashed dentry from ovl_lookup_upper() and makes it positive. To avoid returning unhashed dentry from ovl_create_temp(), let ovl_create_real() lookup again after making the newdentry positive, so it always returns a hashed positive dentry (or an error). This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout() after ovl_create_temp() and allows mount of overlayfs with casefolding enabled layers. Reported-by: André Almeida Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@igalia.com/ Suggested-by: Neil Brown Reviewed-by: Neil Brown Signed-off-by: Amir Goldstein commit 16754d61dc69cb4550225a967a2639809226de42 Author: André Almeida Date: Thu Aug 14 14:22:20 2025 -0300 ovl: Support mounting case-insensitive enabled layers Drop the restriction for casefold dentries lookup to enable support for case-insensitive layers in overlayfs. Support case-insensitive layers with the condition that they should be uniformly enabled across the stack and (i.e. if the root mount dir has casefold enabled, so should all the dirs bellow for every layer). Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit dfc7da402ccc92d6e4b01a4778a3f15f2496b9af Author: André Almeida Date: Thu Aug 14 14:22:19 2025 -0300 ovl: Check for casefold consistency when creating new dentries In a overlayfs with casefold enabled, all new dentries should have casefold enabled as well. Check this at ovl_create_real(). Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit f9377faaeae0473ea45f2b6d3ff758e192f3f01d Author: André Almeida Date: Thu Aug 14 14:22:18 2025 -0300 ovl: Add S_CASEFOLD as part of the inode flag to be copied To keep ovl's inodes consistent with their real inodes, create a new mask for inode file attributes that needs to be copied. Add the S_CASEFOLD flag as part of the flags that need to be copied along with the other file attributes. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 8a78f189756ac3bc8c1c326994ad7261885227bb Author: André Almeida Date: Thu Aug 14 14:22:17 2025 -0300 ovl: Set case-insensitive dentry operations for ovl sb For filesystems with encoding (i.e. with case-insensitive support), set the dentry operations for the super block as ovl_dentry_ci_operations. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 1f7168b28f667c0920fd83151ae35ce593950663 Author: André Almeida Date: Thu Aug 14 14:22:16 2025 -0300 ovl: Ensure that all layers have the same encoding When merging layers from different filesystems with casefold enabled, all layers should use the same encoding version and have the same flags to avoid any kind of incompatibility issues. Also, set the encoding and the encoding flags for the ovl super block as the same as used by the first valid layer. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit ee95c5fc86ddd10c354da554442582a2d12a1b90 Author: André Almeida Date: Fri Aug 22 11:17:07 2025 -0300 ovl: Create ovl_casefold() to support casefolded strncmp() To add overlayfs support casefold layers, create a new function ovl_casefold(), to be able to do case-insensitive strncmp(). ovl_casefold() allocates a new buffer and stores the casefolded version of the string on it. If the allocation or the casefold operation fails, fallback to use the original string. The case-insentive name is then used in the rb-tree search/insertion operation. If the name is found in the rb-tree, the name can be discarded and the buffer is freed. If the name isn't found, it's then stored at struct ovl_cache_entry to be used later. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Signed-off-by: Amir Goldstein commit 5fbf73c7f13ddd5d30dde6760955e644ceffe2ee Author: André Almeida Date: Thu Aug 14 14:22:14 2025 -0300 ovl: Prepare for mounting case-insensitive enabled layers Prepare for mounting layers with case-insensitive dentries in order to supporting such layers in overlayfs, while enforcing uniform casefold layers. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 7201c95c258936e32c950f447c59875780046848 Author: Daniel Lezcano Date: Mon Aug 4 17:23:30 2025 +0200 clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names In order to differentiate from userspace the pit timer given the device tree, let's use the node name for the interrupt and the timer names. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-13-daniel.lezcano@linaro.org commit d8629b9b2c17a458ca504b10b604b8cfe95df3ab Author: Daniel Lezcano Date: Mon Aug 4 17:23:29 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro Pass the channel and the base address to the PITLCVAL macro so it is possible to use multiple instances of the timer with the macro. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-12-daniel.lezcano@linaro.org commit 1ba63930e72356315e1a664952f52ee340edbbd3 Author: Daniel Lezcano Date: Mon Aug 4 17:23:28 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the macros Pass the base address to the macro, so we can use the macro with multiple instances of the timer because we deal with different base address. At the same time, change writes to the register to the existing corresponding functions. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-11-daniel.lezcano@linaro.org commit c106b698ab8d1899d62de880d73dd99edb319849 Author: Daniel Lezcano Date: Mon Aug 4 17:23:27 2025 +0200 clocksource/drivers/vf-pit: Register the clocksource from the driver The function clocksource_mmio_init() uses its own global static clocksource variable making no possible to have several instances of a clocksource using this function. In order to support that, let's add the clocksource structure to the pit structure and use the clocksource_register_hz() function instead. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-10-daniel.lezcano@linaro.org commit 0c063c9afc1b5243adde544637e273c1ac0a31d9 Author: Daniel Lezcano Date: Mon Aug 4 17:23:26 2025 +0200 clocksource/drivers/vf-pit: Convert raw values to BIT macros Use the BIT macros instead of the shifting syntax. No functional change intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-9-daniel.lezcano@linaro.org commit 375fbfc66ca23873c3d9b1c5f6739bf0e2875a57 Author: Daniel Lezcano Date: Mon Aug 4 17:23:25 2025 +0200 clocksource/drivers/vf-pit: Allocate the struct timer at init time Instead of having a static global structure for a timer, let's allocate it dynamically so we can create multiple instances in the future to support multiple timers. At the same time, add the rollbacking code in case of error. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-8-daniel.lezcano@linaro.org commit 23253e278a4574114d4c2729ed70f70b4ec7a30e Author: André Almeida Date: Thu Aug 14 14:22:13 2025 -0300 fs: Create sb_same_encoding() helper For cases where a file lookup can look in different filesystems (like in overlayfs), both super blocks must have the same encoding and the same flags. To help with that, create a sb_same_encoding() function. Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 8b0795e0fc0cf181ecab59d3a9a1618886ea995b Author: Daniel Lezcano Date: Mon Aug 4 17:23:24 2025 +0200 clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy Move the cycles_per_jiffy initialization to the same place where the other pit timer fields are initialized. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-7-daniel.lezcano@linaro.org commit 9095d207417477eb50e84fd0652895db77ec584e Author: André Almeida Date: Thu Aug 14 14:22:12 2025 -0300 fs: Create sb_encoding() helper Filesystems that need to deal with the super block encoding need to use a if IS_ENABLED(CONFIG_UNICODE) around it because this struct member is not declared otherwise. In order to move this if/endif guards outside of the filesytem code and make it simpler, create a new function that returns the s_encoding member of struct super_block if Unicode is enabled, and return NULL otherwise. Suggested-by: Amir Goldstein Reviewed-by: Amir Goldstein Signed-off-by: André Almeida Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Amir Goldstein commit 995ebf16043392d131bd22ed8484c9c952bfb45f Author: Daniel Lezcano Date: Mon Aug 4 17:23:23 2025 +0200 clocksource/drivers/vf-pit: Pass the cpu number as parameter In order to initialize the timer with a cpumask tied to a cpu, let's pass it as a parameter instead of hardwiring it in the init function. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-6-daniel.lezcano@linaro.org commit 361580317976ff25ce4eddbf207d06b0aca9ab22 Author: Daniel Lezcano Date: Mon Aug 4 17:23:22 2025 +0200 clocksource/drivers/vf-pit: Rework the base address usage This change passes the base address to the clockevent and clocksource initialization functions in order to use different base address in the next changes. No functional changes intended. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-5-daniel.lezcano@linaro.org commit 3996232e6e7e34a1f783c778f6c7075293912365 Author: Daniel Lezcano Date: Mon Aug 4 17:23:21 2025 +0200 clocksource/drivers/vf-pit: Set the scene for multiple timers The driver is implemented as using a single timer and a single clocksource. In order to take advantage of the multiple timers supported in the PIT hardware and introduce different setup for a new platform, let's encapsulate the data into a structure and pass this structure around in the function parameter. The structure will be a per timer instansiation in the next changes. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-4-daniel.lezcano@linaro.org commit 2decd0b63eb0a6773e9a5541300cd92e469f541b Author: Daniel Lezcano Date: Mon Aug 4 17:23:20 2025 +0200 clocksource/drivers/vf-pit: Add COMPILE_TEST option The VF PIT driver is a silent koption. In order to allow a better compilation test coverage, let's add the COMPILE_TEST option so it can be selected on other platforms than the Vybrid Family. Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20250804152344.1109310-3-daniel.lezcano@linaro.org commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c Author: Daniel Lezcano Date: Mon Aug 4 17:23:19 2025 +0200 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel The driver uses the raw_readl() and raw_writel() functions. Those are