Put the arguments of ksmbd_transport_ops ->writev() into a struct.
This makes the function call shorter and easier to read.
Add __ksmbd_conn_write() for the common write code. A later patch will use
it for another write helper.
No functional change.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
When the last request in a compound request becomes async, ksmbd sends a
STATUS_PENDING response for it. But the responses for previous requests in
the same compound request are still kept in the same response buffer.
Send these previous responses first. Clear NextCommand for the last
response in this part, sign it again if needed, and reset the iov state.
After that, the async request sends STATUS_PENDING first, and sends the
real response later. Both are separate responses.
Example:
smbtorture //${server_ip}/export -U${username}%${password} smb2.compound_async.write_write
Client request:
Write Request Len:64 Off:0, File: compound_async_write_write; Write Request Len:64 Off:64
Before this patch, STATUS_PENDING Write Response is the first of
several responses:
Write Response, Error: STATUS_PENDING
Write Response, File: compound_async_write_write; Write Response
But STATUS_PENDING Write Response should be in the middle of several
responses, after this patch:
Write Response, File: compound_async_write_write
Write Response
SMB2, STATUS_PENDING, Write Response, MessageId 7
SMB2, Write Response, MessageId 7
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Unknown RPC pipe names and malformed CREATE parameters both use
-EINVAL. Mapping that errno to STATUS_OBJECT_NAME_NOT_FOUND therefore
also hides invalid request parameters as a missing pipe.
Return -ENOENT when RPC method lookup cannot find a supported pipe and
map only that error to STATUS_OBJECT_NAME_NOT_FOUND. Preserve
STATUS_INVALID_PARAMETER for -EINVAL returned by request validation.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
smb2_update_xattrs() copies the DOS SPARSE attribute bit verbatim from
the stored xattr into the in-memory file attributes, without checking
whether the share is currently advertising FILE_SUPPORTS_SPARSE_FILES.
A file whose xattr has a stale SPARSE bit (set by a previous client,
or from before the share was reconfigured) would keep reporting as
sparse even after sparse-file support is turned off for the share.
This matters for Time Machine: sparsebundle band files rely on
accurate sparse-file status being reported, since macOS decides
whether to issue FSCTL_SET_SPARSE based on it. Mask the bit out when
the share doesn't currently advertise sparse-file support.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
macOS routinely probes the mdssvc RPC pipe to check for Spotlight
search support. __rpc_method() already falls through to returning 0
(unsupported) for it via the default case, but that path also logs
"Unsupported RPC: mdssvc" via pr_err on every single probe -- which
happens often enough during normal macOS browsing/backup activity to
spam the kernel log. Add an explicit case that returns the same value
without the log line; behavior is unchanged, this only removes noise
for an expected, routine client behavior.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
create_smb2_pipe() maps ksmbd_session_rpc_open() failing with -EINVAL
(pipe name not recognized/supported) to STATUS_INVALID_PARAMETER.
macOS Time Machine's backupd treats STATUS_INVALID_PARAMETER on a
pipe open as a fatal error and aborts the backup immediately, whereas
STATUS_OBJECT_NAME_NOT_FOUND is handled gracefully -- the client just
treats that particular pipe as unavailable and continues.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
fp->stream.size holds the byte length of the mangled xattr *name*
string (it's used as the attr_name_len argument when looking up the
xattr), not the size of the stream's actual data. CREATE and every
QUERY_INFO handler that reports EndOfFile/AllocationSize for a stream
handle used fp->stream.size directly, so clients received a bogus
size derived from the internal xattr key name length instead of the
stream's real content length.
Add ksmbd_stream_eof() to query the xattr's actual value length via
ksmbd_vfs_casexattr_len(), and use it at every site that reports a
stream handle's size: the CREATE response, get_file_standard_info(),
get_file_all_info(), get_file_network_open_info(), and
find_file_posix_info().
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
set_file_disposition_info() calls ksmbd_set_inode_pending_delete() /
ksmbd_clear_inode_pending_delete() unconditionally, which always sets
S_DEL_PENDING on the whole inode (ci->m_flags), regardless of whether
the handle being closed is a regular file or an alternate data stream.
Requesting delete-pending on a single stream handle (e.g. deleting
just an alternate data stream some clients keep alongside a file)
would therefore incorrectly schedule deletion of the entire file's
data, not just the stream.
Add ksmbd_fd_set_delete_pending()/ksmbd_fd_clear_delete_pending(),
following the same stream-vs-whole-file routing pattern already used
by ksmbd_fd_set_delete_on_close() for the CREATE-time DeleteOnClose
option, and switch set_file_disposition_info() to use them.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The FSCTL_COPYCHUNK/FSCTL_COPYCHUNK_WRITE input length check uses
in_buf_len <= sizeof(struct copychunk_ioctl_req), which rejects a
buffer that is exactly sizeof(struct copychunk_ioctl_req) bytes -- the
minimal, valid request containing only the fixed header with
ChunkCount=0 and no chunk entries, used by clients to query the
server's copy limits before issuing a real copychunk.
Since copychunk_ioctl_req ends in a flexible array member, the correct
minimum is that the buffer covers the fixed header, so use
offsetof(..., Chunks) with '<' instead of '<=' against sizeof(): same
value, but the boundary case is now correctly accepted.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Gael Blivet <gael.blivet@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
macOS can reuse the main file's chunk list when issuing a copychunk
request for alternate data streams. The requested source range can
therefore exceed the length of the xattr-backed stream and currently
fails with STATUS_INVALID_VIEW_SIZE.
For AAPL connections copying between two streams, limit the actual copy
to the available source data while reporting the requested chunk length
as written. Keep the source range validation unchanged for non-AAPL
connections and requests involving a regular file.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Copychunk rejects requests when either handle refers to an alternate
data stream. These streams are stored in extended attributes and cannot
be passed directly to vfs_copy_file_range().
Use the bounded buffered copy path when a source or destination is a
stream. Obtain the source length from the stream extended attribute and
perform I/O through the existing stream-aware read and write helpers.
Keep vfs_copy_file_range() and its fallback for regular files only.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The copychunk error mapping handles -EACCES in an independent if
statement. The following error chain therefore reaches its final else
clause and overwrites STATUS_ACCESS_DENIED with
STATUS_UNEXPECTED_IO_ERROR.
Join the -EACCES check to the remaining error chain so an access failure
is returned as STATUS_ACCESS_DENIED.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Copying an overlapping range within the same file through
do_splice_direct() can overwrite source data that has not yet been
read. This corrupts the destination when the target range starts
inside and after the source range.
Handle overlapping ranges with a bounded temporary buffer. Copy from
the end when the destination follows the source and from the beginning
otherwise, providing memmove semantics without allocating the entire
copy length.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The FSCTL_SRV_REQUEST_RESUME_KEY response contains a mandatory
four-byte context field after ContextLength.
Defining the context as a flexible array excludes it from
sizeof(struct resume_key_ioctl_rsp), so ksmbd sends only 28 bytes
instead of the required 32 bytes. The truncated response cannot be
decoded and results in an NDR buffer size error.
Define the reserved context as a fixed four-byte field. This makes the
response size match the wire format and ensures the field is zeroed and
included in OutputCount.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
FSCTL_SRV_ENUM_SNAPS is currently unimplemented, causing clients to
treat shadow-copy enumeration as unsupported even when the share simply
has no snapshots.
Handle the count-only SRV_SNAPSHOT_ARRAY request and return a valid
empty snapshot list after validating the file handle and minimum output
buffer size. Report a two-byte empty UTF-16 MULTI_SZ array and zero
snapshot counts.
This allows smb2.ioctl.shadow_copy to run without a snapshot backend.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
SMB2 QUERY_INFO security requests currently return owner, group, and DACL
information without checking the access granted to the opened handle. A
handle opened with only SYNCHRONIZE or READ_ATTRIBUTES can consequently
read the security descriptor.
Require READ_CONTROL when OWNER_SECINFO, GROUP_SECINFO, or DACL_SECINFO
is requested and return STATUS_ACCESS_DENIED otherwise.
This fixes smb2.getinfo.getinfo_access.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
FILE_NORMALIZED_NAME_INFORMATION is not handled and is returned as
STATUS_INVALID_INFO_CLASS. SMB 3.1.1 clients use this information class
to obtain the share-relative path with the on-disk name casing.
Build the normalized path from the opened dentry, remove the leading
share-relative separator, and recover the canonical named-stream casing
from its backing xattr. Return an empty name for the share root and
STATUS_NOT_SUPPORTED for dialects older than SMB 3.1.1.
Also distinguish a named $DATA stream on a directory from the unnamed
data stream so that directory:stream:$DATA can be opened normally.
This fixes smb2.getinfo.normalized.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
SMB2 QUERY_INFO security requests with an output buffer too small for
the self-relative security descriptor header can fall through descriptor
construction and be reported as STATUS_INVALID_INFO_CLASS.
After validating the file handle, reject buffers shorter than struct
smb_ntsd with STATUS_BUFFER_TOO_SMALL before building the descriptor.
This fixes smb2.getinfo.qsec_buffercheck.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Variable-length file information handlers use the client output length
while constructing the response. FILE_ALL_INFORMATION can consequently
return -EINVAL before the common buffer check, while stream information
can stop building the complete result too early.
Build the complete response within the available server response buffer
and apply the client output length only when selecting the final status
and transmitted length. Use the protocol-defined fixed sizes for all,
alternate-name, and stream information to distinguish
STATUS_INFO_LENGTH_MISMATCH from STATUS_BUFFER_OVERFLOW.
This fixes smb2.getinfo.qfile_buffercheck.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
check_lock_range() uses inclusive ranges. Its callers pass the end
offset as start + length - 1, so start == end represents a valid
single-byte range rather than an empty range.
The start == end shortcut therefore skips mandatory byte-range lock
checks for one-byte reads, writes, copychunk operations and one-byte
truncate ranges. A conflicting lock covering that byte is not checked
and the operation is allowed to proceed.
Remove the shortcut. The truncate size == inode->i_size case is already
handled by only calling check_lock_range() when the new size differs
from the current file size.
Fixes: 5d510ac316 ("ksmbd: skip lock-range check on equal size to avoid size==0 underflow")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The query-info buffer check returns STATUS_INFO_LENGTH_MISMATCH for
every output buffer smaller than the complete response. Variable-length
filesystem information instead requires STATUS_BUFFER_OVERFLOW when the
fixed portion fits but the complete data does not.
Pass the fixed size for each filesystem information class to the buffer
checker. Keep INFO_LENGTH_MISMATCH for buffers below that size, and
return BUFFER_OVERFLOW with a response truncated to the requested length
for larger partial buffers.
This fixes smb2.getinfo.qfs_buffercheck.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Named streams are stored as extended attributes on the base inode. The
VFS read and write helpers reject directory inodes before or together
with checking whether the handle represents a stream.
Permit read and write operations when a directory-backed handle is a
named stream. Continue rejecting direct I/O on ordinary directory
handles.
This fixes creation of the directory stream in smb2.getinfo.complex.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
SMB clients can currently create an EA named NTACL because SMB EAs are
mapped into the user namespace while the ksmbd security descriptor is
stored as security.NTACL. Allowing the reserved logical name makes the
server-private ACL metadata appear writable through the SMB EA API.
Reject NTACL, DOSATTRIB, and DosStream-prefixed EA names without regard
to case. Filter the same private names from EA query results so stale or
externally-created user namespace attributes cannot be exposed.
This fixes smb2.ea.acl_xattr when acl_xattr_name is configured as
NTACL.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
DELETE_ON_CLOSE is currently accepted for files carrying the read-only
DOS attribute. The server consequently creates or opens the file and
marks it for deletion instead of returning STATUS_CANNOT_DELETE.
Reject creation of a new read-only file with DELETE_ON_CLOSE. For an
existing file, load the stored DOS attributes before accepting the
create option. Also reject FileDispositionInformation when the opened
file has the read-only attribute.
Preserve the explicit STATUS_CANNOT_DELETE value while unwinding the
CREATE request.
This fixes smb2.delete-on-close-perms.READONLY.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The SMB2 create maximal-access context is currently calculated from
POSIX mode bits when the client does not request MAXIMUM_ALLOWED. This
overwrites the access granted by a stored Windows DACL.
Calculate the create-context result with the DACL permission checker.
Recognize the S-1-3-4 Owner Rights SID as applying to the object owner
and process its allow and deny ACEs in ACL order.
When an Owner Rights ACE is present, do not add the owner implicit
READ_CONTROL and WRITE_DAC rights. The Owner Rights ACE replaces those
implicit grants as required by Windows access-check semantics.
Without an Owner Rights ACE, preserve the existing implicit owner grants,
including FILE_READ_ATTRIBUTES and DELETE.
This fixes smb2.acls.OWNER-RIGHTS and its deny variants without regressing
smb2.acls.GENERIC.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
SMB shares can advertise access-based directory enumeration. ksmbd does
not currently provide a share option or filter inaccessible directory
entries.
Add a hide-unreadable share flag and advertise
SMB2_SHAREFLAG_ACCESS_BASED_DIRECTORY_ENUM when it is enabled. During
QUERY_DIRECTORY, omit entries unless the connected user has
FILE_READ_DATA, FILE_READ_EA, and FILE_READ_ATTRIBUTES access according
to the Windows ACL.
Keep the existing implicit access allowances for normal CREATE
permission checks while using strict access-mask matching for directory
enumeration.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
The DACL permission check looks for an ACE matching the current user and
falls back to the Everyone ACE. It does not consider an Authenticated
Users ACE, even though an authenticated session is a member of that
well-known group.
As a result, opening a file whose access is granted through S-1-5-11 can
incorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users
ACE as a fallback entry alongside Everyone.
The maximal access calculation also combines access masks from every ACE,
regardless of whether its SID applies to the current user. This can grant
rights belonging to an unrelated principal. Process only ACEs applying to
the user, Everyone, or Authenticated Users, and accumulate allowed and
denied masks in ACL order. Preserve explicitly requested access bits so
they are validated against the resulting maximal mask.
When ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD
instead of the generic STATUS_ACCESS_DENIED. Access to the system ACL
requires a security privilege that ksmbd does not grant.
For regular files, include FILE_EXECUTE in maximal access when the client
requested GENERIC_EXECUTE and the DACL grants the complete file-read set.
Keep a direct FILE_EXECUTE request subject to the explicit DACL bit. This
matches the POSIX file ACL mapping without broadening specific execute
requests.
Do not replace rights from an applicable NT ACE with a POSIX ACL entry.
The POSIX ACL is only a fallback when no user, Everyone, or Authenticated
Users ACE applies; otherwise it can incorrectly broaden the stored DACL.
This fixes smb2.maximum_allowed.maximum_allowed.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
An SMB2 WRITE request with a negative offset returns -EINVAL directly
from smb2_write(). This bypasses the common error response path, leaving
the client waiting until the request times out.
ksmbd also allows nonempty writes at or beyond MAXFILESIZE as defined by
[MS-FSA]. Writes beyond the limit must fail with
STATUS_INVALID_PARAMETER. Writes ending at the limit fail with
STATUS_DISK_FULL, while a zero-length write remains valid.
Route negative offsets through the common error path and validate the end
offset of nonempty writes against MAXFILESIZE.
This fixes smb2.rw.invalid.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
SMB3.1.1 multichannel connections belonging to the same session must use
the same negotiated encryption cipher.
ksmbd validates the dialect and client GUID during session binding, but
does not compare the cipher negotiated by the new connection with the
cipher used by the existing session channels. This allows a channel
negotiated with AES-128-CCM to bind to a session using AES-128-GCM.
Compare the new connection's cipher with an existing session channel and
return STATUS_INVALID_PARAMETER when they differ.
This fixes smb2.session.bind_negative_smb3encGtoCs.
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
time so that it receives the proper lag compensation
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB/CQACgkQEsHwGGHe
VUq4Eg//ZeldqtFqUxohjcy5ZrgJ9dhdxwRfqZgYhZCSqTJHVLqAxWVAHnJZWfiz
Vh63rnt78rIPpVX6E/lZLnYm2VwhEO6P6piMzG4CVlh2pMySjhoRIQ3ufNAQRt0o
P79Y29rLhDhHkOaL+jjgSr+ePiDzerrkBfYHK0wJ+BAjphjWxML1wYyCGwhWk/Lu
KuXN/jzbEbAn2QWEwEy9KyxztzJlTYTE+l8jiGfRywAeZOBo8HaXg0HhuCwLnaXb
yPmarhof2/7XUdW/CBGYggLaXF+mW6VeMaiqdhxSKl48KMpIfPnBC99/YCJy6vmQ
pD+kOiysGSFy+3vMbTvjwOYV8T3g7LOpeVkY8KkVmAHUFVF9wBSyPULyooNuxGS9
2pBv6Uz2ojm3wMVk+gggt2VU5uVNLsn9IKpNObyuBRDkt3My4Jej3cQ89LeqyS8Z
q49JbAhEwCRfGpxq92WW6izMWjOnduhiTd9TXF/WoXVtcT9ZSbyxJ3sCxbTBrJxd
na7xln2xsR8w9+G91DmmNPRnBtBkBOJ6xRGacKDeV8dcfKcZGGH6/sRMN9mIhP8v
huCVazSwNCVWDaHn8o/ORBJ0dEJ/536a806ysYfB6MdNzZYtU8iepCj5Lr+uAG/Q
W49ftqYFst9o22wT2i4ZdTfrDrkbekVU67BLv9yu8VcmoQJgt90=
=bK3W
-----END PGP SIGNATURE-----
Merge tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fix from Borislav Petkov:
- Make sure a delayed sched entity's runtime stats are updated at the
right time so that it receives the proper lag compensation
* tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched: Update time before requeueing delayed entities
fallback to the physical one instead
- Fix a build error with ARM rpc_defconfig and function tracer enabled
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+qQACgkQEsHwGGHe
VUr7zQ//d2p80ASoa/3p6qzDs5FiySg2tWEfdRp6PoWDeonu5xVcXHs4GJyFFunP
X7pu4kZ+gXq5RoWuk/ClFschaakeij0XtNCjMrpA7ZZpqwBwx387nv3v/9KecU3n
IGqS6bz22d/99te9cMo+1vj3gm/PBIE3SOEnwQQ7oD2pAc2TzdLeoXo554EE5zZu
tBpgdCz4fDcvmpr9sXzw9fDjgJgPjlVJYq/+juCtxXAWQtGJnHWCqGdMxbOtzHHo
E2lLQhZNgC3Vi+jbTYB7mpa70R9iS8TmjuosjKpan3uxakQZnE/+pqN6xFpDh3Ho
090dtBFOUYxx7LDcX6RjXrbddIaHwZNCP1W6OB0EKPUntcpD6MMo4GMBURUxJ4mO
TT0gCtd1bsgYhNwZDVBUxhwoqM1e+EtL44ndT26E0HnIIT0gqr4QE6ODvFpeUQmj
2sNdnBSslrLYeHYypBFRRo3aiDmfYCrML2z/OWEdRmAOYvUssJP4euXrBbInobd5
VtBxjjQmBCSiV7nD0vor9eU5kJ4y6VNfiDDBuByNBzIWliMznLNgN92zAGPn7uwR
IZ1wBWSbMYoc2C8h0CIPax1J+S517G17WVhMbJnYNlg9SzMAxttBWoHHvrdGMfW8
Nua9plybvDVa+SRgCgJl7fiY19/UtXh/9NxHFQtcJnqR0eQfxJs=
=IlDf
-----END PGP SIGNATURE-----
Merge tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Borislav Petkov:
- Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5)
and fallback to the physical one instead
- Fix a build error with ARM rpc_defconfig and function tracer enabled
* tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
tick: Include ktime.h and jiffies.h in linux/tick.h
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+IQACgkQEsHwGGHe
VUoLoA//UiK75T3O49g7pPmQh3lOqoadcvFduoGPVulWr9MqMYb9la+XRAPTO2aX
lMldJhHoQBdL4chQU/2r1LgcM9i2GF753ssqO+MhAQHrDUMhZD87fRkQt+0e1jEc
iAfjQCWVV7+abzsgKbZOlvXeYBFY6Bcy/EwGr9OhNPn1Zg6yGT73gV/ihgc1KYtj
gyUCNjgu5n5UWLZOsAfy0JpSxdeHqCaydYKRRIWbQrbjlp+fauRPtbyOXua3mwNt
gCnBpXnB3rD3R98KGr9C1GHg4DhwTSWZIQj67KMSnEKLco3fzhzq1PW1GwY3UFqn
81OKGIqKHP+VDJTNsk4F0zrXLqG3NWaKwCu9jLV5yhA1z3/4GXNAE3iOT8DT3lmp
upDnQ85aNkPSruF/ZjFxeNT3qrPOLCyMz0p/6qhZN7A3V/4R+B9vRYpvWZunvzvC
k5hqeV1NyeRSoqvEp8ySH++v7Ifny2LbltIcuL+9wWUvRCb45ACQTgsjfIIRrm8F
5mGBRyZs53lU7NthyE1FScNrVUFw7HaWAIapzaZPZIqhNh2+MAOODclTggYp0Y2A
tIEGLohrsuEiPDA3xwa+6a+826M7Uan0lfIVV39BwTM2axuMOuapn/Ou5GmPSvx6
guE0WRugo7TN5st8e+Go0ZrUMXzcQ61G3fdNJOR7UIbQROmrgEo=
=7htY
-----END PGP SIGNATURE-----
Merge tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull rseq fix from Borislav Petkov:
- Prevent a lockup when rseq grants a timeslice extension
* tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
rseq: Prevent hard lockup on granted time slice extension
Split mt7921_mcu_regd_update() into two functions to prevent recursive
mutex acquisition. Introduce __mt7921_mcu_regd_update() as the internal
implementation that assumes the mutex is already held by the caller,
while mt7921_mcu_regd_update() remains as the external interface that
handles mutex acquisition and release.
This fixes a deadlock issue when mt7921_regd_set_6ghz_power_type() is
called with the device mutex already held. Without this change, calling
mt7921_mcu_regd_update() would attempt to acquire the same mutex again,
causing a recursive lock deadlock.
The __mt7921_mcu_regd_update() function can be safely called when the
caller has already acquired the device mutex, avoiding the deadlock
while maintaining proper synchronization for regulatory domain updates.
Fixes: dc2608cf5224 ("wifi: mt76: mt7921: refactor regulatory notifier flow")
Signed-off-by: Charlie-cy Wu <Charlie-cy.Wu@mediatek.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This reverts commit 0a4bb2abc3.
This was reported to break the touchpad on at least some Thinkpads, and
while the revert has hit the i2c tree, it hasn't hit mine. So I'm
reverting it directly just to have this resolved for the imminent 7.2
release.
Reported-by: Thorsten Leemhuis <linux@leemhuis.info>
Link: https://lore.kernel.org/all/b4a4eadb-282f-464c-843a-19d415a34d0c@leemhuis.info/
Cc: Mario Limonciello <mario.limonciello@amd.com>
CC: Hardik Prakash <hardikprakash.official@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
- Avoid use-after-free of an event's group leader by promoting detached
sibling events to standalone entities and correct related accounting and
state transitions
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB6xQACgkQEsHwGGHe
VUpWFQ/+KyU6R2DC48ifpChzgTFmQ2gmIjy1IIsWSGmdSbyD5CEWar8hHDRq1X9r
peuQizTXTQ2Ze75atTMIBExR6eUFYb2sKA1HpobcGnB96cpK8e2vmxhvXoHgB3IZ
TYDXQ1RMPnbyTn2rCQwr5cgSq2Qe7w2tMXMQKzfmDxP1r7cE81zJVFAsRdVVZP75
kvlcCL43pIwzxzP7sDb9bU9lTkW2Sw83dLIp3jBd3iiUpIQpwqV+UG3/fkInV58n
L56cYFsovLbvWdxq4oj6cFwRBmvyrYKV0zkT+zW0SO2AzlVhfwCD/o74hxLwrN//
Gas0d51uQfWt+5M7s6T0KFQYBfClG4uoIi2yh7zXxWEXyhcNuvmAVrY3xiQxReIi
m88+ByWHfBc/mYTHKWJAqb8sHhJiktU52T55ktOJaPNGczA5+O/4alnOg3Kxvw7d
CXp1raxJLqDxvd7Ubu/LVjWY96ds+fAaC15ydC6Lh08b9LPhA8rRCavf7NeSOzOD
E1NA3QLS3TwbrTboaGqLMmzOLPkBBZ+28PUASg1ZpyfGnw91Ggv/gOVNUgr5PvMU
D/gzRCwEYfDdhOrIHzGrfJ1fwj4qFsZ6HSge3sHDj8/BCcQYj/zmlTKe0CHKbaiy
D7bkLNwdBc0z+eh5T7UfCYodUu0qiiek5Y0G3q8FVad0mFDYtUA=
=moR8
-----END PGP SIGNATURE-----
Merge tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Borislav Petkov:
- Prevent the use of exited events as group leaders
- Avoid use-after-free of an event's group leader by promoting detached
sibling events to standalone entities and correct related accounting
and state transitions
* tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf/core: Fix group leader use-after-free after sibling detach
perf: Reject exited events as group leaders
x86 prompted mainly by a recent finding on AMD related to INVLPGB/TYLBSYNC
invalidations. Having the command line option is simply another way to
alleviate the situation short-term
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB44wACgkQEsHwGGHe
VUqKSRAAgQKrFw3mH29qsNGjS0GH1m1B6DShBB6/BwJb716gGNfFV/EmYrcwRM4+
GTSA+LGLkKrb45gR+PkKkyoiXDPB/OzfmSlNvD+VCt1t78RdHCXLByye7SxxFjV/
smboswwphQJPLJ8iTeJn+I1jbfC45Wla1hlMgCdHC7tTyyBOPfg32JdQ37cnd2PE
8igsVVhMbEvszhbDrjVAWWUUjlWEjax8ix4rEKMV9J9zETgurK6Vy/G4QNTePSQU
cc31FFUp+z+iBNWjCv1jhsuxUbxsH4u7SM3x18cTmgfKz03DQwVnCafkGPy8Rs2o
nIdgojAnDginPQ0CsGvB1la7zHQ2MFtBRbNabW+m6WGs2OdwHs1+ATcm0/bFuQBh
UqXic8fZ9jYsoGwRfqy/Nsg1ywkrm+IJ5RxSD1+wreGgYPPpEk5tzs5tx4vPFemX
dm2ZizKr+kDxZThdTutwV0WY1A/xaix8M5y2poXb929zMy6E+sMwe7fjdnFSZph4
I84PzW4vlH5BTnEK96ROl+ZB4tTMLGBGM/3ymtlmeXAkLiyrj10f+QdKCF1GPHsO
Ljv0LVtVL6h4/AJzoV6mYNLCOQUmooMkwwvTYWoHZ3yoqjHGWjGlWDyx7b5uL6BY
mFv81rxp0TWcFKLxv8g737NLKH95JAbP9/bKbldc9rmMl/tBOKE=
=1btz
-----END PGP SIGNATURE-----
Merge tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Borislav Petkov:
- Add a proper kernel cmdline option to control the TLB invalidation
method on x86 prompted mainly by a recent finding on AMD related to
INVLPGB/TYLBSYNC invalidations.
Having the command line option is simply another way to alleviate
the situation short-term
* tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU: Add a tlbi= cmdline switch
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqBJfoQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpnZvEAC5y7aQuMkr++q00K/+gkRF2mef/kZPyySR
N7alVJW69FgAluun+2MD9Sg1SXNXKlJ+8WAouKwhwbo/LuzzxdrJhJ8FO+94JTqn
Dnf01ZCsbSU2KU1/D5Nk81vJTJMHTAmaefvejdJ1X0R8arBNLJ+8TZRRtuxixyez
6kt5HZTEY4n7WtkJs1sDUrbUCYt3jGXRz+sE+bNSzNFOCaTDBqCEquucZpa5QGRl
Z7uVdHmpl8aQBCPNJq3H9l3HCav3FYCP8j+6DOzw8wNamlFdBj7ALldEz6uX1Kr9
EySUjW5MT9WwkN6dbSGOmF5bNQYuO8Umv0VsWTnIxXmEb34Jsz7PwVKZ+lJydsp5
Lm1JN9qT0uvN0CHyAL4ni3FnsTZnWDiTozBrZ4+vEPO8jRhTHg52eWtF4kfpaMxJ
h2gw0MmPW+TaMQ13EiJ6fqppm/BrqtsX7WBKyKyflZIDXTy+KOoXxaiMO/IDMV0i
ttS3yc6qLtvTR9BacLKlGc6YkiP4R9/1xSLWpOjNh18qljzgFFYjxOuszbcCE0/p
vrefCd8J14HcCt5Qlw2XGYBptowbsNkEJ/k6L8Og36RAnyYzE84kbfVpiWddk0EU
WqwAFWKc1J+1Ujf0TvmiprU1OfCPPeNp2xbDMMCGMRgLb6WSDUgUwBTiM9Hl2TmN
N59eL2LfxA==
=jmZj
-----END PGP SIGNATURE-----
Merge tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fix from Jens Axboe:
"A single fix for a regression in this cycle, where drbd would leak
shared secrets over netlink. This restores the behavior to match
what we had before"
* tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
drbd: don't leak the shared secret to unprivileged netlink dumps
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqA/oQQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpj4ND/9OYcaM9+R/w7sv5+gefzm0omHhlLeg1nZ9
RCUKvG86yq2PaNQfL4Tu+xJAiAMoW1maL0BIhLITzB4Q7X+L6MA6ddEi7180YvoH
J3vimltNwJRdwRwQVFgjMI+L5DpBbM864s8Uk53Dj8nYl6pNh/0rcVxxjEfy/6Mz
XyT5lijBXSHieL5qynLxPnHyz5jLq0Y/Y9uVWhPxRuYYwrOjWNVPugsnrg17vNpC
3m9OwDzYldsAvoJehd8d6jrDGU/yxRynvP9NV8UfMnwg9k3F+C1f0PdbUrVwQlHh
KqmpGluSpYyPuoyL82nS3WUpZ3iTpCvzPEl6g3HpKK3xo2DutaohrqLFt0q/oJd0
B1LoMuIs7nO486ZoodtyvzWWevkEFbKtYlOleLYhYX9N+oOPRczsO64ZL3lyT2MG
FsNWaiyN6F5VlI4UAZyxg1PNqtTFutcU6WZjrsWVhOOEvq+rf5on1RgXH/i6LR4n
DxEBTXeVrBUWOT0+Y2txxHz6T1UbcWkqdpk781dOZY+HCTg1MVCha20x3YttASBd
9JY03+JSolbBFzocaFXF/mWR1MGJdATWu3mutrdNoboeUiy5R/Kb3E81+a0CCR2K
fI0TQ9RhQ+UxI8XW7IkxlTK/6bSyxiEIudgv0sYmKEZgH9O8SNY6ZTD8MeuA1fVN
YgbVYoS8eA==
=vArh
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix for a potential issue on 32-bit x86 with PAE"
* tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/rsrc: reject overflowing regvec bvec byte counts
The conversion to explicit netlink serialization dropped the
exclude_sensitive parameter from net_conf_to_skb(), so each caller has
to sanitize by hand. Two dump paths were missed:
drbd_nl_get_connections_dumpit() and the volume-less connection branch
of get_one_status(). Neither op carries GENL_ADMIN_PERM, so any
unprivileged local user could read the CRAM-HMAC secret.
Add a net_conf_to_skb_sanitized() wrapper and route all three callers
through it.
Fixes: 8098eeb693 ("drbd: replace genl_magic with explicit netlink serialization")
Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Link: https://patch.msgid.link/20260814151617.73752-1-christoph.boehmwalder@linbit.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
These are three last-minute fixes for the 7.2 release,
though nothing alarming:
- one error handling fix for optee firmware
- incorrect i2c data for the apple M3 that was added in 7.2
- a boot time warning fix for nvidia tegra
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp/kkEACgkQmmx57+YA
GNn0sRAAnDh3M8YkrmeGdU4aLCEIFDa+SB4+5OF2ANtjunGy3kUlPj1f9y9Sk7aq
CEA2foLgAOThE7anz3VrV5RC+OHBqfe3OD39kMqdlTJlqZNLpVEbqFsyoMr8owAw
zpfwDl8n1u9ROjGEyQ7t6QAE512ZLbwZ3wducoQPFGXZfjTpiuF4P00lpXa729xF
H+Pb0WOMz3zytIfGKvKx4RWkiH0/xatiLoy0AO+73b2lCQgkJF4bhdkM+G5XAIvG
XBhzO488Pu9vuoXpNnY0lizE2xZiJdhBJkR8/Ad0KrTlaLsjwJkF237ozWQ89F8U
/00wS8zE9FXsEQNw9uJj7EjW7nKItxTloq3MELjoXbGV7xW5sEsjWZM3xsvFX5rD
uJo4laNmjp7LZgTvlOZ9T5HM3XIMes3MNTqa4qx0bmrpxwy8BiaTuED9ugrUAIkv
xR2xejKQdFEIEfJRga9YSVbVhF1fDH0dFG+8BVchx6npFWwFRk/RI0JycFGqUul7
8CNXuweWNaVb0Q/zfwWz99pVNqdDySJpAMh4Pl4GKB++jYRvnHU4sCSqDYrkqWRo
UGMpZhuXHpwzVWu3B/gPdk2YW/Mo1jfGN6dPFP3JsfdQx1BaUx/2j4ggJn20nTUw
v7bBU2i0ljMvNkClCqY8sIfgWDxiI1vsFzabW5o2PRzm8R+jm94=
=xgY+
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"These are three last-minute fixes for the 7.2 release, though nothing
alarming:
- one error handling fix for optee firmware
- incorrect i2c data for the apple M3 that was added in 7.2
- a boot time warning fix for nvidia tegra"
* tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
arm64: dts: apple: t8122: Fix I2C resources
optee: ffa: Add NULL check in optee_ffa_lend_protmem
A bug fix found by researchers.
* Ensure to mask all privileged bits when restoring the supervisor
register from sigreturn.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqABmQACgkQw7McLV5m
J+TL9A/7BmXvg+A5KT0xKxYrC//OCvD5dGwwKVhc5tEtNhpcWZU4fQo9WioRUpcz
OfbBcKN4RGrpm9Do685mqc2+nOGFcK9SId6eN47ri2G1ZJ1+wXE1IVKLIddlpBzp
rBJJyStBAKG2ICQfgoKM26JGbRttH19hJWSDITLzA2vAMp2gxpV7I1tSiLMrbOym
e/fKuclQ2tlH3DX+CJrRia/azeKRMjhlTCsSCH+FQSG+oegtCd6PP+rWi+i7cIas
pdSrDes+ES6LcGncK+uaNQfIi4D9tm37POYOK1zq4cyQknl4yl0mCWzHDegHocM3
EMAeZXgIxWR2sDn/xGl42gXsEjsIxgwUn9eufvAaNNVomFKOE8cVTsTAI7sgOCsj
9eiLLTCAQdGt8wiKYZLfnSm/tkIrtUs+Uc0v1OWslWUN9pVOuhiE5RYVwt6oOgyf
/16K0OFVggElHSyCkk9WPWryER1fg2n/eaOHflyOCO7YaQj9LL2e6TkVae7jQ+re
vZ1ZgNuSO9ZchcemvtQ0gH28sceRy+R2ICQV7ytuR+7Isxk1kQwXuKFhjNkKcy35
pTVFaFY1d/PwrtgUglk45/9ITFLJZNiz4ToE8jrP8P9+DlQhdp7tmZ2gNmtPb3Ll
H0fOU2Bh4QeAQm4T0XDGlm1U2eGA5gy3HFUUNMXomLdNfpT2vIU=
=p9Ll
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC fix from Stafford Horne:
"A bug fix found by researchers:
- mask all privileged bits when restoring the supervisor register
from sigreturn"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space. All
other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way. The ptrace GPR regset
already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.
Fixes: ac689eb7f9 ("OpenRISC: Signal handling")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
- A couple of fixes to the sur40 touchscreen driver to correct
registration and teardown ordering, and to fix error path unwinding
when video device registration fails.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCan/qAgAKCRBAj56VGEWX
nIwLAQCryq8oWRzTY1H7QurNDJ89vSwdRJ8CxiLqQgJmWCzgzQD/Vr9SJmWacfn1
TEtDiqHoRSk2wOrZaSDRgsWTH2BOYQI=
=RCXW
-----END PGP SIGNATURE-----
Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- A couple of fixes to the sur40 touchscreen driver to correct
registration and teardown ordering, and to fix error path
unwinding when video device registration fails.
* tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: sur40 - fix V4L error path cleanup
Input: sur40 - fix input device registration ordering
scheduler:
- revert fair scheduler patches due to regression
- mark fair as experimental
connector:
- fix OOB read in hdmi audio infoframe
log:
- fix divide by 0 if module param is set to 0
- fix OOB read on empty message
- fix infinite loop for too large scale
xe:
- Fix DPT Allocation paths
- Fixes around UM queue BO
- Order ring writes before ring tail updates
- Add termination on resume for PXP
- Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe
- Fix sync entry leak on OA config emit failure
- Check managed mutex initilization errors
- Fix min frequency setting
- Fix xe_device_probe error path
amdgpu:
- Bounds checking fix in CS IOCTL
- Bounds checking fix in GEM IOCTL
- Display fixes
- GPUVM fix
- ASPM fix
- UVD bounds checking fixes
- VCE 3 fix
- BT.2020 fixes
- NBIF 6.3.1 fix
- IP discovery fix
radeon:
- Runtime pm fix
amdxdna:
- skip attempting to populate unmapped pages
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmp/eCcACgkQDHTzWXnE
hr4BoA/7By6sGa+PelN5D3XzzJCHWd8/G/A3TFAFLrtpVK6M84qzNHenGFTNO1SF
3stK9CANA5GmXTudR3UJ4/ZagTde2ZU2hI0tHwOlldRvV91+Ed4lTcr6Kf4xzSnP
R+Z3KZ/ggvGpKb628Z7hbwhNBkbkTY4TgotY0vCGK59t1M9Is0b3rMDB9ok7Z9ET
B2nQr6UQ/3rb7aoOm0cYik2vTplTI7P1pchq0yKaXwZLNGlmuf556u/t3zsb2+3T
E2ouifY82di75Fq+mQFhr4IP9SnFukxeXZw0mkykg2TUlPNRosHHYifdBWZztVLn
ZVICunIDuzBb/bSgCeC3qM1nhNW3IBse9xTwpcNIm6zA7qantoCB83t8MPbR6d/C
C1NVGcWC89AP7sKT5s15Yzpk7Ink1CJ8GReDV87g0NGFQKCihb4MnW8AkF4nRR5O
CZuIwEE3M8MDncDBErL+9K1KmHO5UnIy0FEV3lEgSmoRqgG9m/6BAMwzNXbVU3W4
CwlgcKyeFS23f++GW02OMWJVAp4VV7S7b4pxllL0zoL2ZPQZ827BYwpnKBtiOrJp
Sb0U0dIKxgho+nA6R2XvdCZItN0OvjyvQK6OCNYAMtC7XEGboJJ3jBf+rkvgM4jo
rpumV+1lI/urWO9rhhg2Ri318N9mWIWqIbmKYPIMrGojG3MiKBw=
=rauR
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"While this is large for rc8 time but also AI driven fixes is a lot of
it, we had a more traditional screw up, and a regression was just
found in the fair scheduling patches that went in back in rc1. This
reverts the fair scheduler back to an option and sets the default back
to what it should have been. We might have been a bit overly zealous
in switching over, but at least it feels more normal than the AI
driven fixes.
Apart from the scheduler, it's mostly amdgpu and xe fixes, with some
misc fixes to the log code and connector code.
scheduler:
- revert fair scheduler patches due to regression
- mark fair as experimental
connector:
- fix OOB read in hdmi audio infoframe
log:
- fix divide by 0 if module param is set to 0
- fix OOB read on empty message
- fix infinite loop for too large scale
xe:
- Fix DPT Allocation paths
- Fixes around UM queue BO
- Order ring writes before ring tail updates
- Add termination on resume for PXP
- Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe
- Fix sync entry leak on OA config emit failure
- Check managed mutex initilization errors
- Fix min frequency setting
- Fix xe_device_probe error path
amdgpu:
- Bounds checking fix in CS IOCTL
- Bounds checking fix in GEM IOCTL
- Display fixes
- GPUVM fix
- ASPM fix
- UVD bounds checking fixes
- VCE 3 fix
- BT.2020 fixes
- NBIF 6.3.1 fix
- IP discovery fix
radeon:
- Runtime pm fix
amdxdna:
- skip attempting to populate unmapped pages"
* tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits)
drm/log: Fix infinite loop when scale is too large for display
drm/log: Fix out-of-bounds read on empty message length
drm/log: Fix division by zero when scale module parameter is 0
drm/xe: Fix xe_device_probe() failure
drm/xe: Fix a bug in pc_adjust_freq_bounds()
drm/xe/oa: Check managed mutex initialization errors
drm/xe/oa: Fix sync entry leak on OA config emit failure
drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
drm/xe/pxp: add termination on resume
drm/xe: Order ring writes before ring tail updates
drm/xe/guc_ads: use uncached mapping for UM queue BO
drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
drm/xe/guc_ads: allocate UM queues in a separate BO
drm/xe: Fix DPT allocation paths.
accel/amdxdna: Skip unmapped range in aie2_populate_range()
drm/amdgpu: Prefer default discovery offset
drm/amdgpu: Reject UVD message with invalid number of h265 refs
drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
...
- Keep audio working on Rockchip rk3588 by skipping disabling
unused clks
- Fix SpacemiT USB2 clk data so they actually work and keep the
HDMA bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert
a patch that breaks PCIe on some Qualcomm platforms
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp/RRMUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUNJw/9H0FynE4W1JnI5G4KMWJ5g3DUI+BH
y8r/Z+RiCtuwSx7rnu7rKI8Exsg6P1pT2s6Gj4CZN+xBtjDbVIC3hXty99d2VhC6
VwEvUW2/fxTYT2B0UwUNCjvxboWtVLP10DrvVrFSYF7AhYZhRNrq1XygqfXpCF5E
/v1duwPQoYsFrjCbV9eC55IL6rka7CNk1Yqm5scmGG+musPy9x/RaP1wdQbotSI/
Q/oFkNsRcM1/jo/QDVYCP4cZDPgbc+bfydj0a0dGqknW/PIueGu7dOZUIT/q+RoA
9GIcM4jEkBUHb6IVbDKPXvJClirF3kFKmjm3sAnD38MCbiA2D/pdUK6I5GFS2ieB
I1//j6qG08chWzq94HLKJ5Xpkn/L+R6btErwNmodHPgJ/+JnKJHkWWrNVmxR+Txm
YfDK2bP9fPp3Lj8bUDFAHFpWZHSbSNoGHsDrlkHyTA4qt076KGR0XxQfNMJWiVkz
oqctmn9pUJAX5bFFSlxQVs/vQAO87wIijTrIdrRLbhyHR1gu6rDBB+TvCKFokkvR
087zTihEeumyl2P/SrQl8UCXiJm98869SrvsCbfJ4Xvf0C5wwTejhjoOLJoIAJwC
UOJ1Pdi5XsLTbGXheFofeZy09UPzBWzGRxsXkYh8KGtLxi0kov2PULAPYuTMfwga
hLo5q75jO3OWxVA=
=Vc/s
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers:
- Keep audio working on Rockchip rk3588 by skipping disabling unused
clks
- Fix SpacemiT USB2 clk data so they actually work and keep the HDMA
bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert a
patch that breaks PCIe on some Qualcomm platforms"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: spacemit: k3: set hdma clock as critical
clk: spacemit: k3: fix USB2 bus clock
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
clk: rockchip: rk3588: don't disable unused I2S MCLK output gates
A couple of relatively minor (but as ever important if you're hitting
them) and straightforward driver specific fixes, plus one new device ID
documented in the DT bindings for the DesignWare controller.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/Vl4ACgkQJNaLcl1U
h9Af0Af+J2MqcGcVuUFYO6NG9agqkqZkylfW5rPNPeEL63GqPjo2jh1YTaIiOO1X
pOvWxt6Ihf0WQF7MD6WJu7N+wWe2nkVR5AIvLe9HzD5xDBYv8xLd3JQi1O4LsrjL
/8aINGhuhizY+PSVQXf5mps0POGX8sb5vE9Q12bE6FCxmUgFSRMISs/dCend8qQl
p7YWIQkxkpEj5OWX95iG7wz5Yt0d8JGns+1cCdRaibdKKTG6SlfaQNX0vEV7n1Dx
tN3aJyOggSNS4ADed1S/pd1cZyv3663fRvYpya5nL84ynFJFKdHZvElo8AjOuUaO
up15wJ4SPnabI5wepnVlNCleLluK/Q==
=mKW0
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A couple of relatively minor (but as ever important if you're hitting
them) and straightforward driver specific fixes, plus one new device
ID documented in the DT bindings for the DesignWare controller"
* tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: virtio: mark device ready before registering the controller
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005
There's one fix here for a data entry error in the voltage mapping in
the fp9931 driver, and a device ID addition for a LDO in the Qualcomm
PM8350b that's just a trivial quirk.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VZAACgkQJNaLcl1U
h9BIiwf+OhrDj0zdVbufHV+m1+Nb8EP+UyfHfluhopSJi3dq1tY1P2Z0patUZdhU
gHMizes0lq0e1xce5H4W0cqSRJGylVR9NEDYmrO+c7sePKzVWmb0lznSIrQBg6MA
fMtaSfRxn1DjR78oms1h2O1qKHxFuHfIF0mKXEKYJKyKa48l3zU782xgXsXIIeXE
xB+4j5DVAW4aPROT/BCsJEmfjCwLw7lwf5o1tsfgtgKO520hdJ7L6wlrHnnmSZFr
g9YZDb4J9CDwHbbsBc9FCCJZw4u8rXm/fNQkVYF4DFCfodWQqPvdrB25JBYZM+Lf
rOabFiJ99+29qn22bhvg80FdFQAwog==
=y4W7
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"There's one fix here for a data entry error in the voltage mapping in
the fp9931 driver, and a device ID addition for a LDO in the Qualcomm
PM8350b that's just a trivial quirk"
* tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: fp9931: Fix VPOS/VNEG voltage selector table
regulator: qcom-rpmh: Add support for PM8350B
regulator: dt-bindings: qcom,rpmh: Add support for PM8350B
A couple more fixes for regmap, this time for the SoundWire MBQ support.
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that.
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VQkACgkQJNaLcl1U
h9B47Qf7BRh4U/G5/UZqHworvgBB+CUqdc/PdEzPlB7u8VmlEDixRID8tvJv4vX5
oG6dduuNnR/Op9SWD91lU0aicFQgeCPArMKYxsl9A4DRJBcYws70897yJgNdIly+
2sdTxpRhl80bL0FIBaUYOMI9Gg0LD/OuudVaLzEwyYde8M+xfQEBFEjRTPbe68Vr
yg/aAVVsefID3P0fGzbNhuiCLbhUT29K5sXxSM+LDtPk2Bz9Rrt8tBiYGtDmTBxj
J6CGe6wF7kLxLW/PPF4/eNMtnU8oGfq/X2L9G57b9q3QwHV8PcrHFKqH5GuXl1wJ
13QpamimMfyqKmcOUF5GqVbyFG7mww==
=jwlB
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"A couple more fixes for regmap, this time for the SoundWire MBQ
support:
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq"
* tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: sdw-mbq: don't call an unset readable_reg callback
regmap: sdw-mbq: Fix swap of timeout and retry times
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci: Make tuning_err a signed int
- sdhci: Unmap the bounce buffer before device release
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/I6EQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKfYNEAC51HDTsIkN0SWfsxC0YT1jeo/90MViAoSm
j8HIXfdueeiV6iJcb2g9oYUKvfdstxWd4Q7Nx5rM6vRwOJqc/gPY9sTbSW/wnyqR
LdJoGSxV88dwmnk3Pc2r2SlB9pbNhFGcGime+RQ/Ri2G1pNpu5FDiFLLAI1c/Rko
5s2kuGOn8LHeezZZdVr5mPDq5Ya+SYZkUmPbdqfJO2NdxZm/XGFcV7V/vAqYizCX
UlgjbFtsSJ6lxhW7cG6IcmDZro2i8hxMZhbdip6qsnY9sazgeG7EkWqDBcqGfAhF
VbgXwk2v/kXvIbN0ygpsoUxA1LTw+Xg09h4gXx6EisQkhUJWiLpipZBNMCcezbEl
HtdfYq/omUfA3ZhvxXTJPFuaT3OqSimYHJs7FF0fbAYpVqS49ep6JeVp0zYH6tjH
Y5ydsDYj31e4e+nuBCvibIfhL3vusXGk9ehXO4kboFSe8YVd6rCz6iJYcNFYKq+B
Hif9bY6FORI1//5nnhFGCSNzyysdeO6mVtDvv08/+1JfNmtGEFQQJQmsTv4W51r+
crlONm41WfNaPFgWtNh6cEyNHJk+tVd6FlotiQnKu3QSWu6FG7vuXrRyuVyOzHYb
G5YEwFyQR1iIrgRsAm9YH084tR7pZLmFwcjXSt/LxNnTw4tGq9RjtLxGBH2GsRtt
UnyQXxL3bA==
=Ihe4
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci:
- Make tuning_err a signed int
- Unmap the bounce buffer before device release
* tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: loongson2: Fix sg iteration in data reorder functions
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
mmc: sdhci: unmap the bounce buffer before device release
mmc: sdhci: make tuning_err a signed int
