The driver sets acpi_device_name() and acpi_device_class() which are
never read afterward, so make it stop doing that.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/12951216.O9o76ZdvQC@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_class() which is never read afterward, so
make it stop doing that and drop the two symbols defined specifically
for this purpose.
Likewise, acpi_device_name() set by the driver is only used for input
class device name initialization and the "EBook Switch" string literal
may as well be used directly for that, so make the driver do so and
stop setting acpi_device_name(), which allows the symbol defined
specifically for this purpose to be dropped.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/2731795.Lt9SDvczpP@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The pnp.device_class string in the ACPI companion of the platform
device used for binding the driver is never initialized, so passing
it to acpi_bus_generate_netlink_event() is effectively equivalent to
passing an empty string literal to that function.
Accordingly, make the driver do the latter instead of doing the former.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/1987644.CQOukoFCf9@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The pnp.device_class string in the ACPI companion of the platform
device used for binding the driver is never initialized, so passing
it to acpi_bus_generate_netlink_event() is effectively equivalent to
passing an empty string literal to that function.
Accordingly, make the driver do the latter instead of doing the former.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/3642854.QJadu78ljV@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Since acpi_device_class() set by the driver is only used for generating
ACPI netlink events and the "sony/hotkey" string literal may as well be
used directly for this purpose, make the driver do so and stop setting
acpi_device_class() in it.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/9664323.CDJkKcVGEf@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_name() and acpi_device_class() which are
never read afterward, so make it stop doing that and drop the symbols
defined specifically for this purpose.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/3979672.kQq0lBPeGt@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
To facilitate the removal of device_class from struct acpi_device_pnp
in the future, make the driver store the device class string used for
generating ACPI netlink events in a new device_class field in struct
ibm_struct.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/23182921.EfDdHjke4D@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_class() which is never read afterward,
so make it stop doing that and drop the symbol defined specifically
for this purpose.
For consistency, also make it stop setting acpi_device_name() and add
a name field to the "fujitsu" structure for storing the name string
used during input class device initialization.
While at it, use scnprintf() instead of snprintf() for populating the
name and phys fields of the "fujitsu" structure.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/2378407.iZASKD2KPV@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_name() that are only used for printing
messages and initializing input class device names. Since
ACPI_FUJITSU_BL_DEVICE_NAME and ACPI_FUJITSU_LAPTOP_DEVICE_NAME can
be used directly in all of those cases, make the driver do so and
stop setting acpi_device_name() in it.
Likewise, acpi_device_class() set by the driver are never read
afterward, so make the driver stop setting it and drop the symbol
defined specifically for this purpose.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Jonathan Woithe <jwoithe@just42.net>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/3441919.aeNJFYEL58@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_name() which is never read afterward,
so make it stop doing that and drop the symbol defined specifically
for this purpose.
Likewise, acpi_device_class() set by the driver is only used for
generating ACPI netlink events, but the "hotkey" string literal may
as well be used directly for that, so make the driver do so and stop
setting acpi_device_class(), and drop the symbol defined specifically
for this purpose.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/2291726.irdbgypaU6@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The driver sets acpi_device_name() which is never read afterward,
so make it stop doing that and drop the symbol defined specifically
for this purpose.
Likewise, acpi_device_class() set by the driver is only used for
generating ACPI netlink events, but the "hotkey" string literal may
as well be used directly for that, so make the driver do so and stop
setting acpi_device_class(), and drop the symbol defined specifically
for this purpose.
No intentional functional impact.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/5106055.GXAFRqVoOG@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
hsmp_parse_acpi_table() published sock->dev before hsmp_read_acpi_crs()
had mapped virt_base_addr. sock->dev is the readiness gate for the
lock-free data plane, so on a multi-socket system - where socket 0
exposes /dev/hsmp before later sockets finish probing - an ioctl aimed
at a socket still in bring-up could pass the gate and dereference a NULL
virt_base_addr.
Publish sock->dev last with smp_store_release() once virt_base_addr, the
mailbox offsets and the semaphore are initialized, and read it with
smp_load_acquire() in hsmp_send_message() so a non-NULL dev guarantees
the rest of the socket state is visible.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260629155634.1807598-5-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
hsmp_read_acpi_crs() and hsmp_read_acpi_dsd() read the ACPI handle and
emit error messages via sock->dev. Pass the struct device explicitly to
both helpers instead of reading it back from sock->dev.
This is a pure refactor with no functional change; it prepares for
publishing sock->dev as the data-plane readiness gate only after the
socket has been fully initialized, so the parsers must not depend on
sock->dev already being set.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260629155634.1807598-4-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
hsmp_read_acpi_dsd() dereferenced elements[0] and elements[1] of each
mailbox sub-package before confirming the package actually held two
elements, allowing an out-of-bounds read on a malformed _DSD.
Verify package.count >= 2 first, then fetch the string and integer
objects.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260625123337.886435-3-muralidhara.mk@amd.com
Link: https://patch.msgid.link/20260629155634.1807598-3-muralidhara.mk@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
hsmp_get_uid() passed the device UID directly to kstrtou16(uid + 2)
without checking it. A NULL UID or one shorter than three characters
would dereference a NULL pointer or read past the end of the string.
Reject such UIDs with -EINVAL before stripping the "ID" prefix.
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/20260625123337.886435-3-muralidhara.mk@amd.com
Link: https://patch.msgid.link/20260629155634.1807598-2-muralidhara.mk@amd.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Use an existing label once more so that a bit of exception handling can be
better reused at the end of this function implementation.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Link: https://patch.msgid.link/fa7a5865-6dda-4305-ab48-e0c9310520c8@web.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The .driver_data member of the the two struct ssam_device_id arrays were
initialized by list expressions. This isn't easily readable if you don't
work with the Surface System Aggregator core regularily. Using named
initializers is more explicit and thus easier to parse and also more
robust to changes of the struct definition. This robustness is relevant
for a planned change to struct ssam_device_id replacing .driver_data
by an anonymous union.
While touching these arrays, also drop the comma after the list
terminators.
This change doesn't introduce changes to the compiled ssam_device_id
arrays.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Link: https://patch.msgid.link/bc8eff03b2f36c82af5a75fc7114c277228921db.1781526433.git.u.kleine-koenig@baylibre.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The .driver_data member of the the two struct ssam_device_id arrays were
initialized by list expressions. This isn't easily readable if you don't
work with the Surface System Aggregator core regularily. Using named
initializers is more explicit and thus easier to parse and also more
robust to changes of the struct definition. This robustness is relevant
for a planned change to struct ssam_device_id replacing .driver_data
by an anonymous union.
This change doesn't introduce changes to the compiled ssam_device_id
arrays.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
Link: https://patch.msgid.link/4421c8c959452d8a717ebc7cc905ad9c2912680c.1781522576.git.u.kleine-koenig@baylibre.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
On newer Lenovo Yoga devices like the "Yoga 9 2-in-1 14IPH11 - Type 83SE",
the hinge switch WMI query returns extra data in the upper bits
(e.g. 0x50001 laptop mode, 0x50002 tablet mode, ect.).
The driver previously checked for exact matches (0x01 laptop, 0x02 tablet,
ect.) causing newer switches to not work.
Mask the WMI query result to only match the lower byte and ignore upper
bits.
Signed-off-by: Julian Haarmann <julian.haarmann@student.kit.edu>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260614203235.235724-1-julian.haarmann@student.kit.edu
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
set_attribute() populates the security area of the BIOS attribute request
buffer with the current admin password via populate_security_buffer(), then
dumps the whole request buffer with print_hex_dump_bytes(). This can expose
the plaintext admin password in the kernel log.
The same issue was fixed for the password attribute path by
commit d1a196e0a6 ("platform/x86: dell-wmi-sysman: Don't hex dump
plaintext password data"). Remove the remaining dump from the BIOS
attribute path.
Fixes: e8a60aa740 ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260614045353.143500-1-sammiee5311@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
MSI Claw devices produce WMI events through the MSI WMI hotkeys GUID for
some of their buttons. When pressed, these cause spam in the kernel. For
the majority of devices these events can be safely ignored as they are
duplicated by the AT Translated Set 2 Keyboard device exposed as an
evdev. For the MSI Claw A8 BZ2EM model's M-Center Menu button (left of
the screen) there is no associated keyboard event, so this event must be
exposed. Map this button to the same scancode produced by the AT
Keyboard device on other models. This does cause double F15 events on
the A1M, 7 AI+ A2VM, and 8 AI+ A2VM, but it appears to be harmless in my
testing.
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260613021654.933618-3-derekjohn.clark@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reformats msi_wmi_notify() to use a switch statement that reduces nesting
and prepares the function to support additional ACPI types.
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Reviewed-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260613021654.933618-2-derekjohn.clark@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Use no_free_ptr() inside dell_wmi_ddv_query_buffer() in order to
be able to use __free() with the result of the WMI call.
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The commit message of commit 5fbd827eb9 ("platform/x86: dell-wmi: Recognise or support new switches")
states that the ultra performance key contains additional data
after the type and code fields. The event data passed to
dell_wmi_process_key() is already parsed, so "buffer" already
starts after those two fields.
Use the correct index for accessing the first data field to avoid
a potential buffer overread.
Fixes: 5fbd827eb9 ("platform/x86: dell-wmi: Recognise or support new switches")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
We need to properly clean up the SMBIOS request and the privacy driver
when the module load fails.
Fixes: 8af9fa37b8 ("platform/x86: dell-privacy: Add support for Dell hardware privacy")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-3-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Accessing priv->features_present needs to happen with the list mutex
being held, otherwise priv can be freed at any moment.
Fixes: 8af9fa37b8 ("platform/x86: dell-privacy: Add support for Dell hardware privacy")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260612173451.467629-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
HP Victus 15-fb0xxx board 8A3D exposes the Victus fan table and accepts
the existing Victus fan-speed WMI control path. Add a DMI match using the
Victus S thermal-profile and fan-control data.
Signed-off-by: Radhey Kalra <radheykalra901@gmail.com>
Link: https://patch.msgid.link/20260615091034.987029-4-radheykalra901@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Use the board-specific .driver_data to describe fan-control support and
fan-speed read callbacks. Existing boards keep the same Victus
fan-control path, but the hwmon code no longer hardcodes that decision
through is_victus_s_thermal_profile().
No functional changes intended.
Signed-off-by: Radhey Kalra <radheykalra901@gmail.com>
Link: https://patch.msgid.link/20260615091034.987029-3-radheykalra901@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The hp_wmi DMI table is about to carry more than thermal-profile data.
Replace the direct thermal_profile_params .driver_data pointers with
hp_wmi_board_params and rename the table/setup helper accordingly.
No functional changes intended.
Signed-off-by: Radhey Kalra <radheykalra901@gmail.com>
Link: https://patch.msgid.link/20260615091034.987029-2-radheykalra901@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The LAPQC71A and LAPQC71B both feature a RGB lightbar with 36
brightness levels per color component. Extend the device descriptor
to supply the maximum brightness of the lightbar and whitelist
both models for UNIWILL_FEATURE_LIGHTBAR.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-8-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
A user has reported that the driver works on the AiStone X4SP4NAL.
Add the necessary device descriptor and DMI entry to allow the driver
to automatically load on this device.
Reported-by: Michael Seifert <m.seifert@digitalernachschub.de>
Closes: https://github.com/Wer-Wolf/uniwill-laptop/pull/10
Tested-by: Michael Seifert <m.seifert@digitalernachschub.de>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-7-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
A user has reported that the driver works on the MACHENIKE L16 Pro.
Add the necessary device descriptor and DMI entry to allow the driver
to automatically load on this device.
Reported-by: zatrit <zatrit@gmail.com>
Closes: https://github.com/Wer-Wolf/uniwill-laptop/pull/11
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-6-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Some devices support a "USB powershare" feature where the system will
continue to provide power via the USB ports when hibernating or
powered off.
Add support for this feaure.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Some devices support a "AC auto boot" feature where the system will
automatically boot when being connected to a power source.
Add support for this feature.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The EC will report event 0xCC on some devices when the screen
has been enabled/disabled during resume/suspend. Ignore this
event because it is currently unused by the driver.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-3-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Many Uniwill-based devices support either a white-only or fully
features RGB keyboard backlight. Add support for this feature
and handle the associated WMI events.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260530170813.10166-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Add support for EC firmware 182LIMS1.111, found on the
MSI Raider A18 HX A9WJG.
The out-of-tree msi-ec driver probes successfully on this
machine and exports the msi-ec platform device. Without this
entry, the in-tree driver rejects the EC firmware as
unsupported.
Tested on MSI Raider A18 HX A9WJG with BIOS E182LAMS.31A.
Signed-off-by: David Glushkov <david.glushkov@sntiq.com>
Link: https://patch.msgid.link/20260528183358.552782-1-david.glushkov@sntiq.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
On models flagged with requires_fan_curve in the DMI power_data table
(30 entries), the BIOS ACPI method SPLX only writes PPT values to the
EC when the fan mode is set to Manual (FANM=4). FANM is set to 4 by
the DEFC method when a custom fan curve is written. Without an active
custom fan curve, the WMI DEVS call returns success but the firmware
silently ignores the PPT value, so userspace observes no effect from
its write.
Gate writes to ASUS_WMI_DEVID_PPT_{PL1_SPL,PL2_SPPT,PL3_FPPT,APU_SPPT,
PLAT_SPPT} on a check of asus_wmi_custom_fan_curve_is_enabled(), and
return -EBUSY with a pr_warn_once() when no fan curve is active on an
affected model. Export the helper from asus-wmi so asus-armoury can
call it across module boundaries.
Signed-off-by: Ahmed Yaseen <yaseen@ghoul.dev>
Reviewed-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20260519181155.46044-2-yaseen@ghoul.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
(Reinette Chatre)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKEsURHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gcWhAApp+w5vUx0FXlou1Mzvn63bXey9/CMXyX
rrUeWA+ic7PpNvImuwixdyPyS1CnF2l7lMcmOtiNE4wnRvCf+0rsrwgYy4m4qd/2
aLAftFDp9WhKKH3Bb6gnVfMXiXmYb4eCQO0pRhJY26QtVJ2RGkbenW/TdTnAAAwS
KO8bJGsllufiF0+k4G5YMgiVcgZFByn/nuqmzvIc+oKQt5LSMvkKijoM7ozX9q5g
c1ABWvag3KWU2gFI00GfvzuQ7n7ckGhBVRwtO9DMox68liOlKOHedEFF0A0+KiDt
fk6b2LFbqm6hB7TpWRQqQ+rPusbDdAVxKG8ehIkjR8BD49VwzZUcr5kiWS5/xplm
a9F7cJpAJiuSiTi2HYtQVOlrCujonmjt11qqj3cCCjkton+IC9twhDkrj6+Kxygq
W3oc8Gia2JWoFBNt/6l0iKRJjluqgPJ8crPHpnDr4C5KEnsEIqCQsSPsVjoYM5mY
+xwS9jMJM7Dhrw3OZ6b5D8jY9oonBM/BB+jMomQ9ncDijUwKybgqp0JXB/3ydIw3
ci69tewFdVD+9EyNAz+dqANuhNyF1JTFza/5QxAU88E1wp2O2WjahSPvkNU/ekNK
jDGLf8VyiI08bH2pyYIhEhcvmTZ5Ocyuj9zA4Ufi2V3gaDMkvMXRipxm50dAhaWG
CMoZ+wTnI/8=
=mae/
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Prevent OOB access in the resctrl code while offlining
CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
(Reinette Chatre)
* tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
- Fix a perf_event_attr::remove_on_exec bug for group
events (Taeyang Lee)
- Fix uprobes CALL emulation interaction with shadow stacks,
and add a testcase for this (David Windsor)
- Fix uprobes unregister bug (Jiri Olsa)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCX8RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hwJRAAne1HniwuV9PV2GQHNKipeKV320tod2iR
WY9yy9ez5WJbPttS7Fy28NobQKxuTanNWnAJqqM3TJF0tPPSrrYqkhAGrpEb2ab0
G7gl4KlrO//5kKTZnnI86t/quSV5BDt00UUdMBFp+hbNYXNul5/AeUxqMhNoGqB6
DpJHrV+7kNQZ4I7tjatYWL11hZHpEhrx4QWLUsnd+nDwddpmdsRNXVZwpGh9+Dh4
+XXcgLD7M8FqNFN3GCVfhJKO8x8HRaBWv3FHeGqbCUL9k5viWcn+N91IbrcPVat1
HBk0JDtpLK286WHLFy7uROafCA59AlYp5DX7mobXi0VF1FdMqPtjaXEsZM7Ng/P5
/tpbV5P4irrUnMSCEDSDzqZJWXbcBSqCJ9p6z5/Tjzo3VegHyrXe29wjVoqvXjLx
og/9OnPZv/2QEsE37rBRwNC889ihFMUDZh3T+uUc1YKUEwYWFXwtUECTg+0Oi+lL
mLTdK05j/6NmVkcY77mFjQfTMFAZeD78g6cPY3yDHiHRFtxPOIhknCKBeLD5BjXD
tz08x3MN0ItVEBXfuKAlkb1KPhHy8x02IrpdfVojoQ7lUBRH/JqLvnSGgvVsRM+0
v9D3N9BAuB3s8DmxEdh0wyRzISl6jzBHJDJ83+uWSfZWLlEW+RVn9NbH2ubNU/jt
FO3U81r1MvE=
=Mb4z
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix a perf_event_attr::remove_on_exec bug for group events
(Taeyang Lee)
- Fix uprobes CALL emulation interaction with shadow stacks, and
add a testcase for this (David Windsor)
- Fix uprobes unregister bug (Jiri Olsa)
* tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
selftests/x86: Add shadow stack uprobe CALL test
x86/uprobes: Keep shadow stack in sync for emulated CALLs
perf/core: Detach event groups during remove_on_exec
- Fix a resource leak in the RISC-V imsic-early driver
(Haoxiang Li)
- Fix an OF node reference leak in the ARM gic-v3-its driver
(Yuho Choi)
- Fix a dangling handler function on module removal bug in
the TS-4800 ARM board irqchip driver (Qingshuang Fu)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKBtQRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1jUjRAAjiQDEcEdOsNtx7WEmi077EX32qv6ZQ2L
rn15M3sJyFS/XlZNYhgNa5DQ+8BsmHxZY5FjUW/VvQ6tQop+KbH83WjUDG3wnZYz
TZzZHR2I3k6tjJc3eAccJphn/2e4jDfkMcBy+Ao4Zbgxc6ntpXKxMRTNAFDd1p+1
OHPk7P7e4YJ4YcskJNxcbQ1zeg8d07NQa4tAoIEGrAx0LPcKW61jp7DW+AL/y/dc
MjAmNL7e+pMfGOQHKBk2iXS7oX9OiNf4oWbHQA60GQsrngRb41sF1SJ9kcKbb4vl
K/Pe8s0uH68g9bYARTFUbh2zuIEK36PmLNvF0lIhm3QEmaT57a+n4b3AzSCFOlLD
WnLWpRAog5aEw6RNu/WHTnhwV2FZMY9ivwVncL75GDlepCzMiGHGNLnv2hDs3Dqz
ogiZ1BseAnFKWXbhjuaYJApv+Z3pUqIhGvbQ0TmMa6K1f8O2cWaCWJedJ7tK1C1F
jj2ijSkKP1+3DM1yOZ8cLJ5g+Ci4bRtUDWjA3TzJ1q6eI4Fys3YpHWzF4to9qbqH
8wtGgI7CH8aXr4wWwUYxWEljhc8t+El7mE4ZndFMbMX6m0LsYP6eYRipDJefa2BR
L0IcxiW+FtAq9A6iqdH2nVdldVrIGAZ0yIwDlkSOxb46ac/mlNVIOafs319wci1K
LU9T/ZT8p5w=
=aWLS
-----END PGP SIGNATURE-----
Merge tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Ingo Molnar:
"Misc irqchip driver fixes:
- Fix a resource leak in the RISC-V imsic-early driver (Haoxiang Li)
- Fix an OF node reference leak in the ARM gic-v3-its driver (Yuho
Choi)
- Fix a dangling handler function on module removal bug in the
TS-4800 ARM board irqchip driver (Qingshuang Fu)"
* tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/ts4800: Fix missing chained handler cleanup on remove
irqchip/gic-v3-its: Fix OF node reference leak
irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
A standard set of driver-specific fixes and quirks accumulated since
the merge window:
ASoC:
- SOF: Sanity check to prevent OOB reads
- rsnd: Fix clock leak and double-disable issues with PM
- tas675x: Misc fixes for register fields, etc
- lpass-va-macro: Correct codec version for Qualcomm SC7280
- amd-yc: DMIC quirk for Alienware m15 R7 AMD
Others:
- us144mkii: Fix a UAF on disconnect and anchor list corruption
- HD-audio: Realtek quirks for HP models
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpKCqgOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+lgBAAk83zPbT+2y7L7GewxT2QTwOj5WMudl6q9RBp
sDfT8sabkVGs68IoWBVijn6H8n7Jy9V9OVqm+I1j/53mcQl4haLiW+Uk0hcOlN1N
UOySZLQusv+UOM7eVOpfvfb+rdx0MiGOr3NZeFD5tyIfhcMjhJ0NRDFHUDu1W3YU
7BRCOqX1xchsYAnGEdI/otb1d2rEHlg4bRUYMqanfOO1mAayfd2kw3RkVlEF4dW9
+8SoVdxWNOueIuq1WWU3DI/nE5Lq0la3ZsHulKTVkfKW3wlBsFhbk5tbWPBC123o
odz71gpoM1wNM10ANWniJoZ3FlUSvKc2N3gJfKgYVp/EWSzFAp01BYpqm4JA8Iq7
EAX7vNj+4wA4HMZYg20vGaj9dekZ15jrro9Xy8sg1+8TSC377xIpXBo1WA470YrS
/B1UCvhhaYmao0tTTsChaDEcBI0OWgS+OagWDijPz8ASwskNOczVeBhE4HxgHidd
eq4IqXcK+qakTcNc6d8AdFdOog8PekUqE+ZaSPkrW7P/QIYKgWEAXfpu0f2IaK8k
3S15xQAg4dvkGAz4+vOWvZfJSP1P1xRabuSNftEgZk8UvlAoIwMZSuoB7uazt61n
4La6BdPHiY//qmco9rV310YHYQE6uISFEPgs0xxKAHWYeTNRfhACDClm8U905Jo2
LZH9c5g=
=eXcj
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A standard set of driver-specific fixes and quirks accumulated since
the merge window:
ASoC:
- SOF: Sanity check to prevent OOB reads
- rsnd: Fix clock leak and double-disable issues with PM
- tas675x: Misc fixes for register fields, etc
- lpass-va-macro: Correct codec version for Qualcomm SC7280
- amd-yc: DMIC quirk for Alienware m15 R7 AMD
Others:
- us144mkii: Fix a UAF on disconnect and anchor list corruption
- HD-audio: Realtek quirks for HP models"
* tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume
Documentation: sound: tas675x: Fix temperature range and impedance documentation
ASoC: codecs: tas675x: Fix CHx temperature range register bit fields
ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently
ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent
ASoC: SOF: validate probe info element counts
ALSA: usx2y: us144mkii: fix work UAF on disconnect
ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware
ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
A small set of fixes that came in since -rc1, we have one core fix for
shutting down target mode properly if the system suspends while it's
running plus a small set of fairly unremarkable device specific fixes.
There's also a couple of pure DT binding changes for Renesas SoCs, the
power domains one allows some SoCs to be correctly described with
existing code.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpKRNUACgkQJNaLcl1U
h9DGTAf9GNwul6yPo0ybe0uwbkuymsUhkf6oWz8qVPY4nFiQfP+pGiFae7gJrST7
gCeyTlqPT2549MpxgsJwxCdsAaX4VuJbdwY1U8OVeg5VCtVmv/geDweJBXax5uHR
EKayi1W8wGrdt+xReDvbcqS9T+kwyRWxrrWRi7HIz7P4Lbziq8naQaPQ6LODnHnT
h5/M9nr4VjQh+kSHIIOyHlN10hQR256XRHoZY6e7yQmJfzxayN9NTw7MmIw7kE3P
ZztQT8VcqaT4hlsJYZKLC9anSeWz03aTnJ3lPpKy935Od1PktElGEV6SLgbX/hEZ
QI6rjVNbe3UT5fiy+PjMDSl67II+DA==
=wCwg
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A small set of fixes that came in since -rc1, we have one core fix for
shutting down target mode properly if the system suspends while it's
running plus a small set of fairly unremarkable device specific fixes.
There's also a couple of pure DT binding changes for Renesas SoCs, the
power domains one allows some SoCs to be correctly described with
existing code"
* tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption
spi: dt-bindings: snps,dw-apb-ssi: add 'power-domains' property
spi: dt-bindings: snps,dw-apb-ssi: drop superfluous RZ/N1 entry
spi: dw: use the correct error msg if request_irq() fails
spi: dw: fix first spi transfer with dma always fallback to PIO
spi: core: Abort active target transfer on controller suspend
spi: sh-msiof: abort transfers when reset times out
- Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
key-length based type check with its wrong bit-size calculation,
and leaving protected key verification to the pkey handler
- Fix monwriter buffer reuse by rejecting records that change the data
length, preventing out of bounds user copy into the kernel buffer
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpJMw4ACgkQjYWKoQLX
FBg7mwf/V8AKr7uPTvCMEvPUrgFPz1NWE0Eg4UZb5WYoToP6HwMMJpkkBcuWDcpT
L7UVkXczlzhd4QqjftmVSVd8ea3MT+IZQ8W6TVEM+zgu3kYuLT0JC2POUTwIS5D+
boYruqFfH4Cn2DRacOEV8dRfHNVyrZ4MdWEQnHTtJ0n6dxT1O93aH4YfAPhRrT57
LEf4PnnWTza/xWF5Huyk5pXmNjrwsF63djwh7YSHIOxMfG4mK3h/cQzu/sEwKMWs
Q5wPqhl8U20WG8fc8bi+VpfEI/v7ajjZm7mIYC09t2ymVSqz85wzaDk9igeSvv7i
bsy26udNG4XjmwFNbJSz8JOyaph8LA==
=AWqj
-----END PGP SIGNATURE-----
Merge tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
key-length based type check with its wrong bit-size calculation, and
leaving protected key verification to the pkey handler
- Fix monwriter buffer reuse by rejecting records that change the data
length, preventing out of bounds user copy into the kernel buffer
* tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/monwriter: Reject buffer reuse with different data length
pkey: Move keytype check from pkey api to handler
-----BEGIN PGP SIGNATURE-----
iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmpIu3UaHHRzYm9nZW5k
QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHC8MRAAmzNvYJhYC+4wnvzTv3q0
kzsVgAkQaYQT5mwRjRBjZ4dX396s+zvFtXKJ3/DBZ/cluBOAOCf9sXCpVbKHKCq3
y2n8kxTMT1Z4w1blbpK0BXLbJec2Kij5tnqLewWfg+Q08sodmBaahX0/41VBjLkl
ldvtOaWwrW1vKY/67WS9GOA8W+YcmuMIPZFvEXHxWZ/kEGo0Te5jPD595FF5LENe
G1c9W6tmlYuQnbwJHbTAnpLhVzeDuXVbVf6zpvnqqakAYEhA15f/FO1AiFLIlCUT
Eimbc+MXpYmOfN1I+pDCxt6BMQDZ4jFhfmbtonFUnmRZ4B7nB4OlUHjz1gK8ipMZ
yWu2NQRXXsb5ABJY2MWFvQEkMiyMHWOmjvtT8Ptfj7mnztSuXZLTXTbECz3OBIXr
KqHK/9j2CLVLs8/RorDLh0VGuPJ2TtVryMGMQ5SSV3KvkLPrDLBgpxL5z3uPLoC6
Vrh13Zb/TDLubAiKvIepbB31sWECLS12d+btvKfFBChIkKsAhAlYtcjp5yfg9UgP
Rj95UGwPgnNmQ8I0B0Wa+dNIA6pDHFp5x0ZHHLYfUcjPgf9GL1NhEYD1N43/bOi0
TqrPgsBKWRwDpLAmojnIpgJrUC3P6KL04jRhhDBWTRoYkQ55lrTH22Sb3QNo2xLN
CLg/1pGpdAiWUV8FmssP140=
=fR8s
-----END PGP SIGNATURE-----
Merge tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS fixes from Thomas Bogendoerfer.
* tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: configs: Enable the current Ingenic USB PHY symbol
MIPS: loongson64: add IRQ work based on self-IPI
MIPS: mm: Add check for highmem before removing memory block
mips: Add build salt to the vDSO
MIPS: DEC: Ensure RTC platform device deregistration upon failure
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpIIEQACgkQiiy9cAdy
T1F7/Qv+JNKEjHIO4ckW44iuX9FC435P9A0hNI41ILqPwAkPFr3nbJFlFGiHQXRr
zCwsxOUDBNtvleJczata8b6hcHR+6d00w6k5MKTZn/h59MJx21I7ukZd6RLy9saV
KtndptFrfUw1ZR+BWohVUknpEFzt8lU9Ai2V1Rq8zvb9GtckkArR5sapF38Y3Cbr
F7bu3uDlyXM9uGBDNoU58o0qA7en7FfISR6S3YC7ToZPsOUZUFMmu/7LtbUFv1WH
EMKaCdFKKKqJbBrqDC0AnLQW8N6js5yOJ2KXc1+eG1t1sBQizYf8x3yy94YECVkI
sXppz7s9aDYoWMAMD9ofDq+fBQQhI9zyRULNZIVCtLy09WDoXYoibbTWzID7nrd/
ufW7H91s9t4s+yTFKigN3vzY3A8JEqEA04TscJw7rLi/LaovcVvgLvm33A5mrxOS
kjcjoha7Rz2kac7A8KxAIHK4CCLMS7bG028sLS0vY2lBW2KrDjzKiANJqMeSuB1m
9IM0u7eK
=waBr
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
- Fix several use-after-free races in durable handle reconnect,
supersede, and oplock handling
- Avoid holding the inode oplock lock while waiting for a lease break
acknowledgement. This removes delays of up to 35 seconds when cifs.ko
closes a deferred handle in response to a lease break
- Fix malformed security descriptor handling, including an undersized
DACL allocation issue and an out-of-bounds ACE SID read
- Fix memory leaks in security descriptor and DOS attribute xattr
encoding/decoding error paths
- Fix outstanding SMB2 credit leaks on aborted requests and correct the
QUERY_INFO credit charge calculation
- Fix hard-link creation without replacement being incorrectly rejected
when the handle lacks DELETE access
- Avoid unnecessary zeroing of large SMB2 read buffers
- Add an oplock list lockdep annotation and update the documented
support status for durable handles and SMB3.1.1 compression
- Durable handle fixes to address ownership and lifetime races during
reconnect, session teardown, oplock handling, and superseding opens,
preventing stale session and file references from being used by
concurrent operations
* tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: fix app-instance durable supersede session UAF
ksmbd: snapshot previous oplock state before durable checks
ksmbd: close superseded durable handles through refcount handoff
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
smb/server: do not require delete access for non-replacing links
ksmbd: don't hold ci->m_lock while waiting for a lease break ack
ksmbd: doc: update feature support status for durable handles and compression
ksmbd: annotate oplock list traversals under m_lock
ksmbd: fix outstanding credit leak on abort and error paths
ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
ksmbd: avoid zeroing the read buffer in smb2_read()
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
ksmbd: reject undersized DACLs before parsing ACEs
ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
core:
- kernel doc fix
- include types.h in drm_ras.h
dma-fence:
- fix NULL ptr dereference
- use correct callback
- make dma_fence_dedup_array more robust
dp:
- handle torn down topology gracefully
- fix kernel doc
i915:
- Input validation fixes for BIOS and EDID
- Fix HDCP code buffer overflow and seq_num_v monotonic increase check
- Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion
xe:
- Wedge from the timeout handler only after releasing the queue
- Fix a NULL pointer dereference
- Remove redundant exec_queue_suspended
- RTP / OA whitelist fixes
- Return error on non-migratable faults requiring devmem
- Skip FORCE_WC and vm_bound check for external dma-bufs
- Hold notifier lock for write on inject test path
- Drop bogus static from finish in force_invalidate
- Fix double-free of managed BO in error path
- Don't attempt to process FAST_REQ or EVENT relays
- Fix NPD in bo_meminfo
- Prevent invalid cursor access for purged BOs
- Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG
amdgpu:
- Soc24 aborted suspend fix
- Drop unecessary BUG() and BUG_ON() from error paths
- SCPM fix
- Power reporting fix
- DCE HDR fix
- UVD boundary checks
- VCN boundary checks
- VCE boundary checks
- DCN 4.2 fixes
- Large stack allocation fixes
- Fix aperture mapping leak
- UserQ fixes
- Ignore_damage_clips fix
- ACP fixes
- DC boundary checks
- GPUVM fixes
- JPEG idle check fixes
- Userptr fix
- GC 11.7 updates
- Non-4K page fix
- SMU 13 fixes
- DP alt mode fix
amdkfd:
- Boundary checks
- CRIU fixes
amdxdna:
- fix device removal issues
- fix use after free in debug BO
imagination:
- fix double call to scheduler fini
- fix ioctl return values
- fix user array stride
virtio:
- handle EDIDs better
panthor:
- irq safe fence lock fix
- reset work fix
- fix invalid pointer
- fix iomem access in suspended state
- sched resume fix
- unplug suspend fix
- drop needless check
- eviction leak fix
- bail on group start/resume fix
- keep irqs masked
malidp:
- use clock bulk API
komeda:
- clock prepare fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpILLYACgkQDHTzWXnE
hr4jBw/7Bhh6wdPLs2lqdFecpMikm3icmyQylayY8f67TiHhsg93FNgmjHlkjnkH
VfblnRR5jB5VNwOdzeMPKivR5X2wP2ruvjRWUIfN1dZiHoI6cf+1ClR1ZJD1aWPH
kJkE35bbufGldjiztwGmuUjfiOl/8b58DzJdWYs5BJXbNTDn8XMGQp0ai+ye2yco
PwHEDlD576k40BRPUVQk8fjPNd/YZw7t/zdmUQJxKVqVnT1GtgkJabdfje/QtqVw
PU3diSmT/tYHZ4H0AIyYvneXFDHPKrvTBm7T1ADTnK2QbLxEcBaidgcGHYmncbFX
nB/KP30ordTWf23LtsFYMfzB/yM+b0n/XiyzsZhm1XP9C2uPe4YJsmf+mPCH3KVI
tAoSBpsPI9LQEkywf8Vu/QjiiWdO5b25SlkJy1AlNfLBZ2XX+TjgOCwjD62sUzer
gfanrUl+viIUOBvT9oRMMTiR37g7+U2JoBJWLLB+pnTkZylJdLcK5J/tquEnjOdN
uw/feReG221NJqJvxh7i1plfZTIx08E99gmH3OhVIvNOQbKSdSRGkCN9qON33XbA
GovE+RoF5Zzl4MU1RlbfCOmG56Yez8VW2loSZwpX6r1JyJa/Mld6UjSp+/tkI00r
e+LLdbQ/LeB/ARGGPf3ctS5/PZRvPNNGJiVtYpwN2ZvPz8lL1d8=
=bXRh
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly fixes for drm. This is large for rc2 but it's just a lot of
small fixes across a bunch of drivers, xe, amdgpu as usual, plus some
sashiko-inspired fixes for panthor, and some dma-fence updates.
core:
- kernel doc fix
- include types.h in drm_ras.h
dma-fence:
- fix NULL ptr dereference
- use correct callback
- make dma_fence_dedup_array more robust
dp:
- handle torn down topology gracefully
- fix kernel doc
i915:
- Input validation fixes for BIOS and EDID
- Fix HDCP code buffer overflow and seq_num_v monotonic increase check
- Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion
xe:
- Wedge from the timeout handler only after releasing the queue
- Fix a NULL pointer dereference
- Remove redundant exec_queue_suspended
- RTP / OA whitelist fixes
- Return error on non-migratable faults requiring devmem
- Skip FORCE_WC and vm_bound check for external dma-bufs
- Hold notifier lock for write on inject test path
- Drop bogus static from finish in force_invalidate
- Fix double-free of managed BO in error path
- Don't attempt to process FAST_REQ or EVENT relays
- Fix NPD in bo_meminfo
- Prevent invalid cursor access for purged BOs
- Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG
amdgpu:
- Soc24 aborted suspend fix
- Drop unecessary BUG() and BUG_ON() from error paths
- SCPM fix
- Power reporting fix
- DCE HDR fix
- UVD boundary checks
- VCN boundary checks
- VCE boundary checks
- DCN 4.2 fixes
- Large stack allocation fixes
- Fix aperture mapping leak
- UserQ fixes
- Ignore_damage_clips fix
- ACP fixes
- DC boundary checks
- GPUVM fixes
- JPEG idle check fixes
- Userptr fix
- GC 11.7 updates
- Non-4K page fix
- SMU 13 fixes
- DP alt mode fix
amdkfd:
- Boundary checks
- CRIU fixes
amdxdna:
- fix device removal issues
- fix use after free in debug BO
imagination:
- fix double call to scheduler fini
- fix ioctl return values
- fix user array stride
virtio:
- handle EDIDs better
panthor:
- irq safe fence lock fix
- reset work fix
- fix invalid pointer
- fix iomem access in suspended state
- sched resume fix
- unplug suspend fix
- drop needless check
- eviction leak fix
- bail on group start/resume fix
- keep irqs masked
malidp:
- use clock bulk API
komeda:
- clock prepare fixes"
* tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel: (105 commits)
drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
drm/xe/pt: prevent invalid cursor access for purged BOs
drm/xe: fix NPD in bo_meminfo()
drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
drm/xe/hw_engine: Fix double-free of managed BO in error path
drm/xe/userptr: Drop bogus static from finish in force_invalidate
drm/xe/userptr: Hold notifier_lock for write on inject test path
drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
drm/xe: Return error on non-migratable faults requiring devmem
drm/xe/rtp: Ensure locking/ref counting for OA whitelists
drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
drm/xe/rtp: Generalize whitelist_apply_to_hwe
drm/xe/rtp: Keep track of non-OA nonpriv slots
drm/xe/rtp: Maintain OA whitelists separately
drm/xe/rtp: Fix build error with clang < 21 and non-const initializers
drm/imagination: Fix user array stride in pvr_set_uobj_array()
drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
...
- Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake to
the ACPI TAD driver (Xu Rao)
- Define acpi_ut_safe_strncpy() as an alias for strscpy_pad() which is
viable because that function is only called from kernel code (Rafael
Wysocki)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmpIAfgSHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1BrsH/j1RgYp/hU3ws2RFCw7Cs2ap8vbidedB
XtcliFxVfvy4NI5Xlw+YNHW2lyjCcF1lcInumkW1yG5KFkqyOevX6YmnykOJkDON
7alv7rt/W7qLT3BDvZdzUm+zCflm8ieapohpFMEtaJTgguJKwP+0HS3XCQ1eSorH
4mou0SI1qkjqllXZB7PKTPEgcD0ji3dkusjtcp3qvZrgeO9qsZ6C2GABeQwDRIPU
BZhIdjf1jwX/T7Qn5llQHGMWCM78zHSGIRDA6zXnqn7jse5pntbQOwYL/6jRc0QA
kj+9akgDe1YnEAAvIm5cMAygBuqGDCH4S4XEBtQeTc9XwJaDC0g1Hzc=
=ffMf
-----END PGP SIGNATURE-----
Merge tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support fixes from Rafael Wysocki:
"These fix a coding mistake in the ACPI TAD (Time and Alarm
Device) driver introduced by one of its previous updates and
get rid of the ugly #ifdef __KERNEL__ conditional compilation
in acpi_ut_safe_strncpy() by redefining that function as an
alias for strscpy_pad():
- Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake
to the ACPI TAD driver (Xu Rao)
- Define acpi_ut_safe_strncpy() as an alias for strscpy_pad()
which is viable because that function is only called from kernel
code (Rafael Wysocki)"
* tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias
ACPI: TAD: Check AC wake capability before enabling wakeup
