Commit Graph

1398499 Commits

Author SHA1 Message Date
Linus Torvalds
2eba5e05d9 LoongArch fixes for v6.18-rc7
-----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmkgH58WHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImetIQD/90qm0rkEhYnciXeSR+yuqSKk1e
 YDyXkNiVjwazAUGBo0vdTvCkLa9xs2rbxXbA4cUsRYKB8lW0fRWlNlj+DxOxAroQ
 0rVsgWvp5ZHzB6ppIdNEY2PF2bwk7vTdffQXlwYKoTDt95MAqxKercQX5isPe17t
 S4N23hIMiNzqM9kshxi5xxm27PvJvEpdRYRoFh9zmZBrW98pLhhc668JEGautzra
 dAjm7uzdeDb/f5AQFdiB+NGlYt2fRr24EPmEqyqXJAHtL9wI2t1HHUs4lb+FUILf
 ZiUfJHmYbz1v6GInPbPB3Xqi5EJrrSa0+8SmnqlUr3trEQ6whqjGoV2n5v38Ppr6
 PTL+fv7ACEDbr+APgWajsLCjbSzu6LDUay+vVFLLDJSxl7eYjWMZwFS5Rzr+pAc3
 UJHCG8sNXyLqiwxbwRMPR/w/YTxCaULHfBuCmxQpnhU6qHsjIzpFdztycpgcuF3B
 YcvZ0rAGbq+Q3glhqIe19WhswDUB94j4+Nrz80pXqJgumK42xtIbx5K4WLYFdHFo
 Wxi6mW9VGPDZVysbDry2aFVVoymlYpv7p3N/txOrYuxmrr6YUyEeued3mW+99Zjj
 FbdPfCOJU1sTBZcg8AiSG3nUuStKKLFu56e8oaW5kzOOAxjHsFqo3vL0JdjjeJX/
 +1pRdJ/1i9k9la4/rQ==
 =rVXC
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch fixes from Huacai Chen:
 "Use UAPI types in ptrace UAPI header to fix nolibc ptrace.

  Fix CPU name display, NUMA node parsing, kexec/kdump, PCI init and BPF
  trampoline"

* tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  LoongArch: BPF: Disable trampoline for kernel module function trace
  LoongArch: Don't panic if no valid cache info for PCI
  LoongArch: Mask all interrupts during kexec/kdump
  LoongArch: Fix NUMA node parsing with numa_memblks
  LoongArch: Consolidate CPU names in /proc/cpuinfo
  LoongArch: Use UAPI types in ptrace UAPI header
2025-11-21 11:16:14 -08:00
Linus Torvalds
e3fe48f9bd three smb3 client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmkf728ACgkQiiy9cAdy
 T1EgHAwAskeR4845ddwfkcrOWktFyjxhkaQ2n9A5c5caDxbLsVSc8MOBl40GnQEZ
 8EmGw3I7TWxmv92dzEt8fA7VWhBYxqj/cNVH5vnU8TYT9mS6cu6mXI5/Jbx14f2U
 DooQpjJmOGV4/fFDc9mY7uLx9rX64HsVposvfkblk0cbAsbzoJciaB/Dn+0RBIKs
 xSYkY1RaXhEDa1yJrYxKY8bIbXJo9bfi8socJFl3O2hRJt/kU6L6XqGcGBqUwjk7
 JI65UHfVrcEWIzk0FfdI8gVqGlZjHWcY8bg/hSTq3QSGJ7s1kCmRwsREm6CS+a2D
 Gt4RXVZdNua6WLez3ItUQVvz1iYqiOfpsceZ/Qp8zInaSyKr0GUnT2ZPYJ8NkdfI
 TAYYnrFKSgaUhMsyA3GaURPu3nJPSIHLgJPOJTlxvSobtZlPArpYIny78L+6gYbR
 K6mnkBJPbTbTrn7fx8OXKSycFU3bMwJAuB9NFzf/I1Vl1nyVSv4sKErCaDeertzE
 uOGyrYVE
 =fBmC
 -----END PGP SIGNATURE-----

Merge tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Fix potential memory leak in mount

 - Add some missing read tracepoints

 - Fix locking issue with directory leases

* tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Add the smb3_read_* tracepoints to SMB1
  cifs: fix memory leak in smb3_fs_context_parse_param error path
  smb: client: introduce close_cached_dir_locked()
2025-11-21 11:14:21 -08:00
Linus Torvalds
a07a003ce6 io_uring-6.18-20251120
-----BEGIN PGP SIGNATURE-----
 
 iQJDBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkfngUQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgppNrD/iFobqiPSgoIO703YfN2aS74itKMuKuJfJL
 7gmLwwNYx1F78l7mfvQz5vOetHcIM2xZzRENvlgeh5UBz0537zDcaXeWjILUCdSw
 UxaQgnyHjJN8a5C07FfAXVTLT38133iMVCWT9OjOffPGVFtaVE4JsNI7YLziCGBc
 3W69b/uob1KBzSpcWYMl1mA8ZAIoNXk0//qUdcrYuJVeeR5Gp9Cwf09g+axERYYw
 OCVf0ykWeIr6B7qhKcoV95a+BsbSwKnO8n3o5bo8/nJ/dexr+ofHbf5YhtJaPhbr
 o8/CZIYcfdDaYXC2z9KVZrePjinYXYiEwZkvzfoAgbE6Kd88v62ZgHbC8LcYboQ+
 w+caLJ1TuEt7aHrLJAN/HbzpAEvMgmZ8Msr26RkKEp1XkiShjAmA+MEqD6zwbZ2i
 DgYMetXgQm03Iso0ZseOE3nbnimI2oWWNIyFG2Wx8etmLKR6jAwP72OZumlKZweX
 ZXuEWp3Kxoy6buERnR6hWM6MbMK7dIVMVXvKAjbhgbCN2Biy32nbPhW/xj6W3Foa
 /0ixGv9pPp6gBA90JmVm5CxuL35wAdScnCIlrAuaBmLlJfeciwXOH5+3ymRvqe2D
 k+r8Ng6rqiv6kIoje7bZvuq+i6ZvWnMtpfTanECBnFIQtCjPQyuUJqyhqiL/6puQ
 hjn50LHg
 =CgZ0
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fix from Jens Axboe:
 "Just a single fix for a mixup of arguments for the skb_queue_splice()
  call, in the io_uring timestamp retrieval code"

* tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
2025-11-21 11:09:57 -08:00
Linus Torvalds
a4165ffc83 block-6.18-20251120
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkfnhkQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpgxoEACH4Pqtied7cbgVLQ+EZl/BDHMiFQLgTywq
 fNPBaQFTPXR3UjUJyZBelqCxIZsuJjElHyjOqh4zQO66WJ0Ba6s9HG5irTWIFwjb
 iOuCL88P2rmdfOUDvYTZS7oGTJEgBUcHzBwSheTGIljSrV0ztKAkiuLvDivzvzSG
 uwxzjZYzlfixWm0dTolgzKLzgKfRKrZlOF2i/RPFRld/9q3gAmDFRaKv3ht4i3hC
 lBuRHj9c8LnLY/aaEEjXRFEgca3ceMcO0m9YvWQUpCKXp5pztRENOLUKW1xmuDho
 04IB8iSPHMJMgbm6U2JKhVcAHfIYW2PBLaHbx0RQYceG/16wqOAFGuXmcglQ8JYt
 bb8V+xu1KhDFmAPcEn29a837GpYaqQ4J+p5f15HeiLLX0l/cO/8dqG6cY0vqH3zr
 V/ir973hxtSl5nljGWwf3JRUiSUFqNCHGdrCBnvsZ6jtOWqiyzRNx54qLJjhTOza
 p1QYHaagDMMzwIpTnFmJWAcyHolROXmvCrJ+gxuYTN45i6ok0MOzDueonPWaQ2Us
 eBb9oQelmpKLgXYrdZB6s6ujkY/IRvHFsUDEekPRAOaOJVJKQyVfIOYsz5wMD+aK
 b8UQSvkTkZViMtjpxjS7fNihONjguVthGSaw9G851ithHW77wMBuNYiPq+O2OFF2
 5/jSrvIGSQ==
 =X6HU
 -----END PGP SIGNATURE-----

Merge tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:
 "NVMe pull request via Keith:

   - Admin queue use-after-free fix (Keith)

   - Target authentication fix (Alistar)

   - Multipath lockdeup fix (Shin'ichiro)

   - FC transport teardown fixes (Ewan)"

* tag 'block-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
  nvme-multipath: fix lockdep WARN due to partition scan work
  nvmet-auth: update sc_c in target host hash calculation
  nvme: fix admin request_queue lifetime
2025-11-21 10:59:35 -08:00
Linus Torvalds
317c4d8a2a ata fixes for 6.18-rc7
- Add a missing refcount decrement in ata_scsi_dev_rescan() when
    the device or its queue is not running. In the case where the
    device is running, the recount is already decremented properly
    (Yihang Li)
 
  - Generate the proper sense code for a Security locked device.
    There was a regression caused by a recent change of how sense
    data is generated for commands that did not provide any sense
    data. This broke system suspend for Security locked devices.
    Generate the sense data that the SCSI disk driver expects for
    a Security locked device so that system supend works again
    (me)
 
  - Set capacity to zero for a Security locked device.
    All I/O commands will be aborted by a Security locked device.
    Thus, the block layer disk partition scanning will result in
    a bunch of, for the user, confusing I/O errors in dmesg during
    boot. Since a Security locked device is unusable anyway, set
    the capacity to zero, to avoid the disk partition scanning
    during boot. We still create the block device in /dev such
    that the user may unlock the device using e.g. hdparm (me)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCaSB/+AAKCRDJZDGjmcZN
 cswtAP4l1Ui8d6PwHnxVvOlv1cWO/K+7XboiGZNFphf7QDZhPQD+J41BG/YNyNcB
 Ma716tdF1UVayUB2OItsX0gSmmz9KgI=
 =0b5E
 -----END PGP SIGNATURE-----

Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Niklas Cassel:

 - Add a missing refcount decrement in ata_scsi_dev_rescan() when
   the device or its queue is not running.

   In the case where the device is running, the recount is already
   decremented properly (Yihang Li)

 - Generate the proper sense code for a Security locked device.

   There was a regression caused by a recent change of how sense
   data is generated for commands that did not provide any sense
   data. This broke system suspend for Security locked devices.

   Generate the sense data that the SCSI disk driver expects for a
   Security locked device so that system suspend works again (me)

 - Set capacity to zero for a Security locked device.

   All I/O commands will be aborted by a Security locked device.
   Thus, the block layer disk partition scanning will result in
   a bunch of, for the user, confusing I/O errors in dmesg during
   boot.

   Since a Security locked device is unusable anyway, set the capacity
   to zero, to avoid the disk partition scanning during boot. We still
   create the block device in /dev such that the user may unlock the
   device using e.g. hdparm (me)

* tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-core: Set capacity to zero for a security locked drive
  ata: libata-scsi: Fix system suspend for a security locked drive
  ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
2025-11-21 10:53:23 -08:00
Linus Torvalds
68d804c64a Pin control fixes for the v6.18 series:
- Fix register naming in the Mediatek mt8189 driver.
 
 - Select REGMAP_MMIO for the Realtek RTD driver.
 
 - Fix the number of items in groups in the Toshiba
   Visconti driver.
 
 - Fix a memory leak in the Cirrus CS42L43 driver.
 
 - Fix a deadlock (!) in Qualcomm pinmux configuration.
 
 - Fix use of uninitialized memory and list initialization
   in the S32CC pin controller.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmkgkXUACgkQQRCzN7AZ
 XXNxZxAAn7JgQd+ec2G8NtCXDd9CklEgnj8nrAp5k2DxdIfgmumrUWnuk0sFg5gR
 r9bHZXTucbFEhSXzZklMsYY3fIBDAFc4pcZe3+T3dwvLuP9eNT9WAKCxKrZol8b4
 5x/D6nqfOMbYPBGwoR/tK1QUbbWxyC/LgjgUXr7GV5jKFZSDponWqOE50JdG3g8K
 ykJZFTZb++NLoBCW5IKPoKR+p2z5eyO0oiSrsgsFJvHsNy3ID6/L1lab9udJ1VdD
 TNLtnGuB3FEpUOUycx/Y4OyuMoVe2ySr2mqsSAVEWXB8+reAIZF3v5Y1uYYkn7j3
 TwJ4qUTm7DtOlcCuH0GfyPuA0NLwFteTBVQl1w43i2Zcuy2prpZ0sYjMLPmwZTbX
 YiZgjo7lz2CxhGKkhOlcgrvxhoembEhD9Z8YL7CLn04dykjjnzTD7O1Hr2NA+ZwD
 ttbc5+2adyfaewIbo1zJNwP81x1wBVzPCDQVS+/h4lQB5AAxZpcYC8pz/zx84fTO
 Qg+nRk9hSjWjGqi9JGpsJRtNR04Q58qThDg3xuumq+17TtYUPTE7BCzpuV2jyodE
 UV1cHwjULp9e/f3dumDG15V733xUUtHEGNkk9AFD+F5X+QtChK1uDSbYlybsr/qc
 UbhoYHA+jQz5L3I4MIuU41ekVdVYlH5PKzDI5jTJOQUra9M/sag=
 =dfY2
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Fix register naming in the Mediatek mt8189 driver

 - Select REGMAP_MMIO for the Realtek RTD driver

 - Fix the number of items in groups in the Toshiba Visconti driver

 - Fix a memory leak in the Cirrus CS42L43 driver

 - Fix a deadlock (!) in Qualcomm pinmux configuration

 - Fix use of uninitialized memory and list initialization in the S32CC
   pin controller

* tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes
  pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
  pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
  pinctrl: qcom: msm: Fix deadlock in pinmux configuration
  pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
  dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
  pinctrl: realtek: Select REGMAP_MMIO for RTD driver
  pinctrl: mediatek: mt8189: align register base names to dt-bindings ones
  pinctrl: mediatek: mt8196: align register base names to dt-bindings ones
2025-11-21 10:47:24 -08:00
Linus Torvalds
2c26574cc4 gpio fixes for v6.18-rc7
- fix a use-after-free bug in GPIO character device code
 - update MAINTAINERS
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmkgdpIACgkQBZ0uy/82
 hMMt3Q/9E7I9oc89DFy9yZ6YXM8k2EpiIWvfygTMdVEx91i16L2591XFlrc6oQjQ
 c7Aaw6CWDVe20VlrWNMYxUQH2TUmROeQr3DJol8DUBRshLeVOEpWU6G0hvdFSucl
 lrDCS2ZkhNUswf0PLT+787OvdUhIvXGbvZv+Rcd5N+P7wxUwZkMStArl7PaAHVKt
 pNlUE6R0BtwPDWhi0wgag/RAmGo8TEdBcSinak9Ph9rdQg3GSPA1AsssFPqd1a13
 j2MdcWJQAEUKm6ecEcBSFeBR62LhhgIEo7iybHAtLml/qiGzz5sAj3gOBG4filLi
 YLhTLxKOiGzkpg+MqYioj42JCpCobEhIkPV+/W9jmZePFH2pyKEdHnI4dF0xcp/8
 +1WQo6xaZtTwADkyG3d0ardJdgZ0fc4AxQcSck29O+1NG0hd1Z+dL1cffdyJ8fxi
 OHucAlO/P/k7/T83eSZhRZaxdTWXCieWEJ1VzgwOsu/DnNvIcwhbyKGeFuS7z3Xj
 Gs1AFfh6GpFkK6ueZDz0ipBvtHqQTdzu1IwvosWMhmmPz/QdcxOywNK+UArvt6lg
 P5Tj6Wes0/ymZTKiPHicSx8UaqC8MliMKpJAWybePox6KieirXiht+a/qJvEXsbm
 ekPXH3RwsHNBlzB+dP+fa3aJWvd0F/2YVnug4T6a/QEVuNvJx7U=
 =nTA4
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix a use-after-free bug in GPIO character device code

 - update MAINTAINERS

* tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  MAINTAINERS: update my email address
  gpio: cdev: make sure the cdev fd is still active before emitting events
2025-11-21 10:43:58 -08:00
Linus Torvalds
c6d732c3bd drm fixes for 6.18-rc7
atomic:
 - Return error codes on failed blob creation for planes
 
 nouveau:
 - Fix memory leak
 
 tegra:
 - Fix device ref counting
 - Fix pid ref counting
 - Revert booting on Pixel C
 
 xe:
 - Fix out-of-bounds access with BIT()
 - Fix kunit test checking wrong condition
 - Drop duplicate kconfig select
 - Fix guc2host irq handler with MSI-X
 
 i915:
 - Wildcat Lake and Panther Lake detangled for display fixes
 
 amdgpu:
 - DTBCLK gating fix
 - EDID fetching retry improvements
 - HDMI HPD debounce filtering
 - DCN 2.0 cursor fix
 - DP MST PBN fix
 - VPE fix
 - GC 11 fix
 - PRT fix
 - MMIO remap page fix
 - SR-IOV fix
 
 radeon:
 - Fence deadlock fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmkgKwsACgkQDHTzWXnE
 hr5I7w//ZJ/IZjVOvkj53Z0+Nt/HO0Jg+tM+5Q0fldhMlvnh+c7WpcyWRivi5hLV
 JgOJJagu6CrXNKGwdghDRbV4fOW+LsqHTFim2JnxA2k/6est3ZaWfiwo6e0kza2W
 whRLUcC0G0zoIYESAgzEr2Th52vYRR6SHj/HGLs00EUx8zdIUnbzQd1LqQb9RjCo
 zHdbuig9ZInCDpp4bRSgrlOrIgBC1ysWWHLYK5cF1K54/7a/PqqHHZBl29dXizCt
 +n4hQfkpHPPGDcy1Bm1cI3RclfQ0j+XxiWaMNw8z7eSZbUVhnkqm3xVJbhvr6eg7
 FiJMYvo4JMSMFBkcjwu8UPpVy1Bkpeebq61RvFlX7tDdMPJI5WO7wNN9iCyKZRIo
 YhCa+JVZ8quLcDHlxWVjhsdnN3r0/YpsNF3FbGzfPbSdZ97+dh33oSa+p035hhgD
 JxRBGA7yNtg9t9SJ2/1L66WbxSRP3tNVSOQlifKoJ51wwtF5OReZ/+wecCXsoWRo
 ic8LDEx3/KwmgsIALyTRRlw/dj9slqvtQhlZtEp9SAYm+0DsD7+dR61mrRsNcoTg
 d7j/S/zyWGZf4qMlktMfSuHPqqLQkVy4ExW+oMygk7g2P5jx2IiHOgrdg7HcVPWA
 KPrj+UCdUbTFm7pb9D+huIAwgmThkL9K+e0etm3c72rDR6j8JDk=
 =HgqB
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "A range of small fixes across the board, the i915 display
  disambiguation is probably the biggest otherwise amdgpu and xe as
  usual with tegra, nouveau, radeon and a core atomic fix.

  Looks mostly normal.

  atomic:
   - Return error codes on failed blob creation for planes

  nouveau:
   - Fix memory leak

  tegra:
   - Fix device ref counting
   - Fix pid ref counting
   - Revert booting on Pixel C

  xe:
   - Fix out-of-bounds access with BIT()
   - Fix kunit test checking wrong condition
   - Drop duplicate kconfig select
   - Fix guc2host irq handler with MSI-X

  i915:
   - Wildcat Lake and Panther Lake detangled for display fixes

  amdgpu:
   - DTBCLK gating fix
   - EDID fetching retry improvements
   - HDMI HPD debounce filtering
   - DCN 2.0 cursor fix
   - DP MST PBN fix
   - VPE fix
   - GC 11 fix
   - PRT fix
   - MMIO remap page fix
   - SR-IOV fix

  radeon:
   - Fence deadlock fix"

* tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel: (25 commits)
  drm/amdgpu: Add sriov vf check for VCN per queue reset support.
  drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags
  drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag
  drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
  drm/amd: Skip power ungate during suspend for VPE
  drm/plane: Fix create_in_format_blob() return value
  drm/xe/irq: Handle msix vector0 interrupt
  drm/xe: Remove duplicate DRM_EXEC selection from Kconfig
  drm/xe/kunit: Fix forcewake assertion in mocs test
  drm/xe: Prevent BIT() overflow when handling invalid prefetch region
  drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  drm/amd/display: Fix pbn to kbps Conversion
  drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
  drm/amd/display: Add an HPD filter for HDMI
  drm/amd/display: Increase DPCD read retries
  drm/amd/display: Move sleep into each retry for retrieve_link_cap()
  drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
  drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A
  drm/i915/display: Add definition for wcl as subplatform
  drm/pcids: Split PTL pciids group to make wcl subplatform
  ...
2025-11-21 09:55:55 -08:00
Linus Torvalds
a48f822908 samples: work around glibc redefining some of our defines wrong
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
and some of the other flags for renameat2() and friends in <stdio.h>.

Which would all be fine, except for inexplicable reasons glibc decided
to define them _differently_ from the kernel definitions, which then
makes some of our sample code that includes both kernel headers and user
space headers unhappy, because the compiler will (correctly) complain
about redefining things.

Now, mixing kernel headers and user space headers is always a somewhat
iffy proposition due to namespacing issues, but it's kind of inevitable
in our sample and selftest code.  And this is just glibc being stupid.

Those defines come from the kernel, glibc is exposing the kernel
interfaces, and glibc shouldn't make up some random new expressions for
these values.

It's not like glibc headers changed the actual result values, but they
arbitrarily just decided to use a different expression to describe those
values.  The kernel just does

    #define AT_RENAME_NOREPLACE  0x0001

while glibc does

    # define RENAME_NOREPLACE (1 << 0)
    # define AT_RENAME_NOREPLACE RENAME_NOREPLACE

instead.  Same value in the end, but very different macro definition.

For absolutely no reason.

This has since been fixed in the glibc development tree, so eventually
we'll end up with the canonical expressions and no clashes.  But in the
meantime the broken headers are in the glibc-2.42 release and have made
it out into distributions.

Do a minimal work-around to make the samples build cleanly by just
undefining the affected macros in between the user space header include
and the kernel header includes.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-11-21 09:29:02 -08:00
Dave Airlie
40b53db87c Driver Changes:
- Fix out-of-bounds access with BIT() (Shuicheng Lin)
  - Fix kunit test checking wrong condition (Matt Roper)
  - Drop duplicate kconfig select (Shuicheng Lin)
  - Fix guc2host irq handler with MSI-X (Venkata Ramana Nayana)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmkgA6UACgkQm6KlpjDL
 6lNQOQ/7BvIs0E5pAMxlxYq+O5Oyt9roX39ud1ilq2zSrBwxWEQ4n1eWXoveZ1AR
 lTdlhJij1bwEesgHQ59znoLCqIdvqIQpMAAjYnDVcCVDzDFRyrPfL6/PG7tw2gMw
 dyKlF5K2BPCqSL9wPVBNu9mUiPj8PytK8kR/uoJqI7ddBIQjQBt1dOqU+3perp8n
 e6MrfK5cKg9BYQewgky3rkAgt2P/ZIgsQkVoVk58D+OoX3Ot9I4kAfzsRklVwKZS
 2CAqKooqhUrcNRk0u5PCg9NG4N/pmkjYL0MJWKk7MR0YcHhpvUN3AOJ/EtsNrP+6
 oUJAlI3qptJUkGYSwD9WNweNPpISIqIktOhmkKW5SNMKzoAIAUvLbL45GodCeBRw
 FU7zHd9ELcZK9cevI/+0ARwdlBqj+UWArX0PLQ5hT7y3xW6soZeIQlvdsqKABamG
 NEslQsClOoDQrI8U8VxC/QHVvEIoDcFRKb6TbV2N9to0FhhyG8DSg5fct/9lCt9U
 cIl+O/PVq98raUf/DK1pvIzwJxaXQvAh/q1jE9627be9QxytEpdbph5FVMm8QAgT
 ae4OzlbElCGgrnxxCw1JVr0w/+Cj8uud9AV2FNgZC1CGO1uh3HmsFz596YwKFnV8
 AHuyWr6w9pLMSYwOZf4k0Shv12rSLIMb2bXxLnoO7ZRMrDrZpHU=
 =8bu9
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
 - Fix out-of-bounds access with BIT() (Shuicheng Lin)
 - Fix kunit test checking wrong condition (Matt Roper)
 - Drop duplicate kconfig select (Shuicheng Lin)
 - Fix guc2host irq handler with MSI-X (Venkata Ramana Nayana)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/uadbrmftcud3wg32c6tje7mmfcr7wgmpnkzxwubk6fletahje2@coek2ciunkvz
2025-11-21 18:33:07 +10:00
Dave Airlie
4e9fd472d1 amd-drm-fixes-6.18-2025-11-20:
amdgpu:
 - DTBCLK gating fix
 - EDID fetching retry improvements
 - HDMI HPD debounce filtering
 - DCN 2.0 cursor fix
 - DP MST PBN fix
 - VPE fix
 - GC 11 fix
 - PRT fix
 - MMIO remap page fix
 - SR-IOV fix
 
 radeon:
 - Fence deadlock fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaR9DIQAKCRC93/aFa7yZ
 2GLlAP479q32wC9h370R3ezgV9JfOH1SFgTaxdaJo/08SbEaXQD/Y2fe6YFrxZOF
 1uxETAgq8LOGIZ4hMov1dMpaMczv5AY=
 =1VyU
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.18-2025-11-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.18-2025-11-20:

amdgpu:
- DTBCLK gating fix
- EDID fetching retry improvements
- HDMI HPD debounce filtering
- DCN 2.0 cursor fix
- DP MST PBN fix
- VPE fix
- GC 11 fix
- PRT fix
- MMIO remap page fix
- SR-IOV fix

radeon:
- Fence deadlock fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20251120164110.1077973-1-alexander.deucher@amd.com
2025-11-21 18:20:10 +10:00
Dave Airlie
201a32e61b Short summary of fixes pull:
atomic:
 - Return error codes on failed blob creation for planes
 
 nouveau:
 - Fix memory leak
 
 tegra:
 - Fix device ref counting
 - Fix pid ref counting
 - Revert booting on Pixel C
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmkfL84bFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJEGgNwR1TC3ojl+8H/RZmSovRsDwqCaaf8/rK
 ilXw840DmmkYbTKwlDjSd/F9NTMVtGZoVyqAUkuwfRrVXRfRPH391E5/FQnejOSF
 8llrWQXYUg8VuIVHZx/LRNJyChEdCR3XdaaNbBKqETGB6ioUGwgUEEh3UcJV9VU8
 WN7uQMpcCM7vM09di8PWEDUUTt0WU2m54/btLVi4Tdwl/ckyHlbxughycNiGg50v
 moWAxHt9/L7RC0aj4I+PiYMhknfY6DCh++ZCZ61yKg8dPCVkAXKNN+n0jQEmQgBK
 c03ZmLUBvvNYpmutL2TlEQXwF2cJiNXFJKYkxYWF69/Ln5gG7Pz98BIsiviLZZ+H
 fNE=
 =O22s
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

atomic:
- Return error codes on failed blob creation for planes

nouveau:
- Fix memory leak

tegra:
- Fix device ref counting
- Fix pid ref counting
- Revert booting on Pixel C

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251120151308.GA589436@linux.fritz.box
2025-11-21 17:51:19 +10:00
Dave Airlie
9b571b3231 - Wildcat Lake and Panther Lake detangled for display fixes (Dnyaneshwar)
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmkfIkcACgkQ+mJfZA7r
 E8r+sAf8CaMlam0xIFVqn/EnmxDbRefP2TuamFPU6KzJ6rLNwNRjeTNQtJ2qxL/d
 igQ8YxSvSDBsuH+Xw6IE0fZN8JryiIpUDB8i+GiU3cOqmTijDYBpHYgXN07LT5Z1
 8SbCX2yc/g+brDOjJKP6XZOtJVKHkNJ9fLawwkbGVU8ULDWKp16mry077E7Jalo3
 66BnVL4DMVGM0bxVy9qvHHWRPmzkpgnoJKN/OVop5n8xE6vb+LcKeibVL6nd5jLQ
 b/aHUFxKkMfzjRrcIfnryuH4hv+2Og/fhqXQDGuCRocA0vDfocadv3N0PoGwWFv7
 aA4GgXGzuWnnm/JT2HBIDYjnrXfDlA==
 =+Woe
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2025-11-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes

- Wildcat Lake and Panther Lake detangled for display fixes (Dnyaneshwar)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/aR8jByCwjIThpnpk@intel.com
2025-11-21 17:12:20 +10:00
Linus Torvalds
fd95357fd8 sched_ext: Fixes for v6.18-rc6
One low risk and obvious fix:
 
 - scx_enable() was dereferencing error pointer on helper kthread creation
   failure. Fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaR9kwQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGUOOAPwKO8inQ9NceKv+7hJomt1IErwqe/S5w5ZHtGa4
 knn/vgD9EEDou5QN1iM6VXd7p1T/R7A0lqAfWAtzjpA9lEOCjAA=
 =8v1T
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fix from Tejun Heo:
 "One low risk and obvious fix: scx_enable() was dereferencing an error
  pointer on helper kthread creation failure. Fixed"

* tag 'sched_ext-for-6.18-rc6-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Fix scx_enable() crash on helper kthread creation failure
2025-11-20 11:04:37 -08:00
Linus Torvalds
c966813ea1 slab fix for 6.18-rc7
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmkfYFEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJELvgsHXSRYiaLtEIAKDAXWXlwCO3CVDb5USk
 t1KFTpmQ3UCPDd48eTRbeC6D0B3Jh7+JOa/f96yxQrQOABm2P3xuU30HcqLsWbfV
 D08MB2u/eyjcghBAqZ95WzdKUcMdzx90qlCnwUE/tDbcFhEc3FutPjqRUQ2iJcyu
 dk3K6yNl+LiQiw+BVLu+WgQD1fFStuSQ4H3oDHSL2ep0C+vv6jVBEKoiybHFvexQ
 okrVVBgL7RlPbz+n6t4bsaR64jGa+P9DeiGDGU9gM+kOdP5dYKcmOq0q5dliNOVw
 6Bnf9T+zykU6NdQZjwx32eZZoocCg+DT2K+NDvLqeg8PsAGktwQWYDEKnM0yoRMk
 7nY=
 =Lmv8
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab fix from Vlastimil Babka:

 - Fix mempool poisoning order>0 pages with CONFIG_HIGHMEM (Vlastimil Babka)

* tag 'slab-for-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  mm/mempool: fix poisoning order>0 pages with HIGHMEM
2025-11-20 10:49:12 -08:00
Saket Kumar Bhaskar
7b6216baae sched_ext: Fix scx_enable() crash on helper kthread creation failure
A crash was observed when the sched_ext selftests runner was
terminated with Ctrl+\ while test 15 was running:

NIP [c00000000028fa58] scx_enable.constprop.0+0x358/0x12b0
LR [c00000000028fa2c] scx_enable.constprop.0+0x32c/0x12b0
Call Trace:
scx_enable.constprop.0+0x32c/0x12b0 (unreliable)
bpf_struct_ops_link_create+0x18c/0x22c
__sys_bpf+0x23f8/0x3044
sys_bpf+0x2c/0x6c
system_call_exception+0x124/0x320
system_call_vectored_common+0x15c/0x2ec

kthread_run_worker() returns an ERR_PTR() on failure rather than NULL,
but the current code in scx_alloc_and_add_sched() only checks for a NULL
helper. Incase of failure on SIGQUIT, the error is not handled in
scx_alloc_and_add_sched() and scx_enable() ends up dereferencing an
error pointer.

Error handling is fixed in scx_alloc_and_add_sched() to propagate
PTR_ERR() into ret, so that scx_enable() jumps to the existing error
path, avoiding random dereference on failure.

Fixes: bff3b5aec1 ("sched_ext: Move disable machinery into scx_sched")
Cc: stable@vger.kernel.org # v6.16+
Reported-and-tested-by: Samir Mulani <samir@linux.ibm.com>
Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Reviewed-by: Vishal Chourasia <vishalc@linux.ibm.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2025-11-20 08:45:43 -10:00
Jens Axboe
46447367a5 io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
If timestamp retriving needs to be retried and the local list of
SKB's already has entries, then it's spliced back into the socket
queue. However, the arguments for the splice helper are transposed,
causing exactly the wrong direction of splicing into the on-stack
list. Fix that up.

Cc: stable@vger.kernel.org
Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-462435176@google.com>
Fixes: 9e4ed359b8 ("io_uring/netcmd: add tx timestamping cmd support")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-20 11:40:15 -07:00
Linus Torvalds
07e09c3233 Power management fix for 6.18-rc7
Fix a regression introduced during the 6.16 development cycle that
 may cause runtime PM to be enabled by mistake for devices that do not
 support it (which may lead to some serious trouble) if there is a
 system wakeup event during the "late suspend" phase of system suspend.
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmkfS9ASHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1cKQH/RbZZcC/4q3lUgMfk0+C/6Y+4Nv7MxDR
 jT4fxYinFVSAVpcAIomB838C4PBuIilNKu2JUR62Rw2Pa5PSvVMZcpIHWMdb/QXn
 7V5f0CQIGeWdzOBuXlzMWzko6D3CBBBHQMOBPFWD1w5DeT04DRDBAyqW+Osb6NEU
 aywA+qFkSSg+m+IzkNZGiIgKW9y6oponKetGTuB5b4C0c6WhMg9abc+isKC4yLXY
 NufuHokqSRn19RoKpzz1IBnHDE6yVoy9/O9QNY8yfKvLOr8MCRN6rbPwbMF3tcSk
 RQ+jASuIlEgExe0fsP+K1KTPh++EUOottirM9b1B6rj4UwHN+Yq95dk=
 =7MZg
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fix from Rafael Wysocki:
 "Fix a regression introduced during the 6.16 development cycle that may
  cause runtime PM to be enabled by mistake for devices that do not
  support it (which may lead to some serious trouble) if there is a
  system wakeup event during the "late suspend" phase of system suspend"

* tag 'pm-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  PM: sleep: core: Fix runtime PM enabling in device_resume_early()
2025-11-20 09:46:52 -08:00
Linus Torvalds
1753d40dce ACPI support fix for 6.18-rc7
This fixes EINJV2 support introduced during the 6.17 cycle by unbreaking
 the initialization broken by a previous attempted fix, adding sanity
 checks for data coming from the platform firmware, and updating the code
 to handle injecting legacy error types on an EINJV2 capable systems
 properly (Tony Luck).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmkfTbkSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1sW0H/1hrZXwWMnevTKSrjEgcfCu7Bj2JHTNl
 DqkjMOgU4uX+F6cO/Vitfs3j2N4FM6DCQpEvXBFso8jPkUjp0Ekw/zYoePcecdTd
 JPD/IIOcJJBrmbHMkEHwHNiaXEqNxKlvAYvdsVLGPZxut+ysiOqYYRjtYDwSFcjr
 F9FliIDn0HUDBYwV3ItiIZupUjkmficmiLO7AFAZddbugtCSEcdtQw207iq5NSN3
 zfdVyGv0DOVwub3KEcRQOmMr8orUho5Z62/ms4RUl6b8jpIo8S57Yoxp9/J9cfDt
 1eU2q8XnkKy/GbhEGehvRt3D/pTUUGdrgfEM40FUgROR1hI+b5MFE1w=
 =NauX
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "This fixes EINJV2 support introduced during the 6.17 cycle by
  unbreaking the initialization broken by a previous attempted fix,
  adding sanity checks for data coming from the platform firmware, and
  updating the code to handle injecting legacy error types on an EINJV2
  capable systems properly (Tony Luck)"

* tag 'acpi-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI: APEI: EINJ: Fix EINJV2 initialization and injection
2025-11-20 09:44:27 -08:00
Linus Torvalds
6ba3bb3348 platform-drivers-x86 for v6.18-4
Fixes
 
 - acer-wmi: Ignore backlight event
 
 - alienware-wmi-wmax: Fix quirk match table order & drop redundant entries
 
 - amd/pmc:
   - Add Xbox Ally to spurious 8042 quirk list
   - Quirk list Lenovo Legion Go 2 NVMe resume
 
 - msi-wmi-platform:
   - Correct GUID to uppercase
   - GUID is uncleverly copy-pasted from an example so add a DMI whitelist
 
 - intel/speed_select_if: PCIBIOS_* return code conversion
 
 - intel-uncore-freq & ISST: Fix kernel doc warnings
 
 New HW support
 
 - alienware-wmi-wmax:
   - Alienware 16 Aurora support
   - Alienware M support
   - Alienware X support
   - Dell G support
 
 - amd/pmc:
   - ROG Xbox Ally (non-X) support
 
 - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys
 
 - hp-wmi:
   - Omen 16-wf1xxx fan support
   - Omen MAX 16-ah0xx fan + thermal profile support
   - Victus 16-r0 and 16-s0 fan + thermal profile support
 
 - intel/hid: Intel Nova Lake support
 
 - intel-uncore-freq:
   - Intel Panther Lake support
   - Intel Wildcat Lake support
   - Intel Nova Lake support
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  Ignore backlight event
 
 alienware-wmi-wmax:
  -  Add AWCC support to Alienware 16 Aurora
  -  Add support for the whole "G" family
  -  Add support for the whole "M" family
  -  Add support for the whole "X" family
  -  Drop redundant DMI entries
  -  Fix "Alienware m16 R1 AMD" quirk order
 
 amd: pmc:
  -  Add Lenovo Legion Go 2 to pmc quirk list
 
 amd/pmc:
  -  Add spurious_8042 to Xbox Ally
  -  Add support for Van Gogh SoC
 
 hp-wmi:
  -  Add Omen 16-wf1xxx fan support
  -  Add Omen MAX 16-ah0xx fan support and thermal profile
  -  mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support
 
 huawei-wmi:
  -  add keys for HONOR models
 
 intel/hid:
  -  Add Nova Lake support
 
 intel/speed_select_if:
  -  Convert PCIBIOS_* return codes to errnos
 
 intel-uncore-freq:
  -  Add additional client processors
  -  fix all header kernel-doc warnings
 
 ISST: isst_if.h:
  -  fix all kernel-doc warnings
 
 msi-wmi-platform:
  -  Fix typo in WMI GUID
  -  Only load on MSI devices
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaR9GsgAKCRBZrE9hU+XO
 MU2qAQD8C75ebO/ltd9LZ4oTzfe0P6kmV+28z0D97tFsFmt0hwEA/fZHU/bV1+3c
 +gRnoLCl4yPh214OgWnmsciPhW3iyAM=
 =AtKC
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Ilpo Järvinen:
 "This one has lots of new HW entries which adds to the size in diffstat
  but the individual changes are simple.

  Fixes

   - acer-wmi: Ignore backlight event

   - alienware-wmi-wmax: Fix quirk match table order & drop redundant
     entries

   - amd/pmc:
      - Add Xbox Ally to spurious 8042 quirk list
      - Quirk list Lenovo Legion Go 2 NVMe resume

   - msi-wmi-platform:
      - Correct GUID to uppercase
      - GUID is uncleverly copy-pasted from an example so add a DMI
        whitelist

   - intel/speed_select_if: PCIBIOS_* return code conversion

   - intel-uncore-freq & ISST: Fix kernel doc warnings

  New HW support

   - alienware-wmi-wmax:
      - Alienware 16 Aurora support
      - Alienware M support
      - Alienware X support
      - Dell G support

   - amd/pmc:
      - ROG Xbox Ally (non-X) support

   - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys

   - hp-wmi:
      - Omen 16-wf1xxx fan support
      - Omen MAX 16-ah0xx fan + thermal profile support
      - Victus 16-r0 and 16-s0 fan + thermal profile support

   - intel/hid: Intel Nova Lake support

   - intel-uncore-freq:
      - Intel Panther Lake support
      - Intel Wildcat Lake support
      - Intel Nova Lake support"

* tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits)
  platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
  platform/x86: acer-wmi: Ignore backlight event
  platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
  platform/x86/intel/hid: Add Nova Lake support
  platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora
  platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile
  platform/x86: msi-wmi-platform: Fix typo in WMI GUID
  platform/x86: msi-wmi-platform: Only load on MSI devices
  platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
  platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
  platform/x86/amd/pmc: Add support for Van Gogh SoC
  platform/x86: alienware-wmi-wmax: Add support for the whole "G" family
  platform/x86: alienware-wmi-wmax: Add support for the whole "X" family
  platform/x86: alienware-wmi-wmax: Add support for the whole "M" family
  platform/x86: alienware-wmi-wmax: Drop redundant DMI entries
  platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order
  platform/x86: ISST: isst_if.h: fix all kernel-doc warnings
  platform/x86: intel-uncore-freq: Add additional client processors
  platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support
  platform/x86: huawei-wmi: add keys for HONOR models
  ...
2025-11-20 09:39:34 -08:00
Linus Torvalds
8e621c9a33 Including fixes from IPsec and wireless.
Previous releases - regressions:
 
  - prevent NULL deref in generic_hwtstamp_ioctl_lower(),
    newer APIs don't populate all the pointers in the request
 
  - phylink: add missing supported link modes for the fixed-link
 
  - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr
 
 Previous releases - always broken:
 
  - openvswitch: remove never-working support for setting NSH fields
 
  - xfrm: number of fixes for error paths of xfrm_state creation/
    modification/deletion
 
  - xfrm: fixes for offload
    - fix the determination of the protocol of the inner packet
    - don't push locally generated packets directly to L2 tunnel
      mode offloading, they still need processing from the standard
      xfrm path
 
  - mptcp: fix a couple of corner cases in fallback and fastclose
    handling
 
  - wifi: rtw89: hw_scan: prevent connections from getting stuck,
    work around apparent bug in FW by tweaking messages we send
 
  - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait
 
  - veth: more robust handing of race to avoid txq getting stuck
 
  - eth: ps3_gelic_net: handle skb allocation failures
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmkfQv8ACgkQMUZtbf5S
 IruptQ//aa3wFISt/xfCxaygNnQAL1gxWbKg15cLnv88S5r5wrh+Mf/r+qHkT0IG
 qaxPToztcTKNGzRqMI/7x/OEXjCdfEmJtNcb5JfYRxGkYVcje81bhHrxZN+nLLcj
 jx1xD7rXCjfFNDVFSl+OzQkoTZtfGphX+JgCTKLPZ8t4qR/UhU1IwYgpoaiK0uCT
 gitXJPHrDGJLHud0ilaXbn+q0ZH9ZU08QSRhsaAq7C6YPafUseEr2fuQYgFr1kkp
 mtzFm84bEnRSneQ5+noVzoc5llbu3vf3Wd9Y5tr5sBaBjh5OpH/kK0kuPy6Lzhvd
 8y05jl8kyASMtRBoTvmpYOdi3xUNbge5AwJN3FIo4KPCmyr1bQoNoQVIivUpoiGz
 Zvv7QcceP7E5057CRuhi06krld/QaScHkmhUododbqJKmL8NWaSoXLRO7oYjB4kU
 1MuAwOJWVpsqnTUEbMw7dHJPZFTqRkLYv6oAmIqb/AWzTcqg9OXjLEc+OzUqWEl6
 mHv/SonSjAM81m3GxCxtNtH2ErKwdMIgI/ado39+KvksKTH1bhN9ZpmuyyktzpCj
 PBn9FVdd7zyct92u5xXtsKVkDWKGyD419Z2lFHC0FaAsNQmPrSqzi+U50pAtie5M
 JWABm8hsSdia4dTDrdldMgM50dzuBd5nSceY7XCqPA8nZ5+Af/8=
 =89Xl
 -----END PGP SIGNATURE-----

Merge tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from IPsec and wireless.

  Previous releases - regressions:

   - prevent NULL deref in generic_hwtstamp_ioctl_lower(),
     newer APIs don't populate all the pointers in the request

   - phylink: add missing supported link modes for the fixed-link

   - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr

  Previous releases - always broken:

   - openvswitch: remove never-working support for setting NSH fields

   - xfrm: number of fixes for error paths of xfrm_state creation/
     modification/deletion

   - xfrm: fixes for offload
      - fix the determination of the protocol of the inner packet
      - don't push locally generated packets directly to L2 tunnel
        mode offloading, they still need processing from the standard
        xfrm path

   - mptcp: fix a couple of corner cases in fallback and fastclose
     handling

   - wifi: rtw89: hw_scan: prevent connections from getting stuck,
     work around apparent bug in FW by tweaking messages we send

   - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait

   - veth: more robust handing of race to avoid txq getting stuck

   - eth: ps3_gelic_net: handle skb allocation failures"

* tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  vsock: Ignore signal/timeout on connect() if already established
  be2net: pass wrb_params in case of OS2BMC
  l2tp: reset skb control buffer on xmit
  net: dsa: microchip: lan937x: Fix RGMII delay tuning
  selftests: mptcp: add a check for 'add_addr_accepted'
  mptcp: fix address removal logic in mptcp_pm_nl_rm_addr
  selftests: mptcp: join: userspace: longer timeout
  selftests: mptcp: join: endpoints: longer timeout
  selftests: mptcp: join: fastclose: remove flaky marks
  mptcp: fix duplicate reset on fastclose
  mptcp: decouple mptcp fastclose from tcp close
  mptcp: do not fallback when OoO is present
  mptcp: fix premature close in case of fallback
  mptcp: avoid unneeded subflow-level drops
  mptcp: fix ack generation for fallback msk
  wifi: rtw89: hw_scan: Don't let the operating channel be last
  net: phylink: add missing supported link modes for the fixed-link
  selftest: af_unix: Add test for SO_PEEK_OFF.
  af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().
  net/mlx5: Clean up only new IRQ glue on request_irq() failure
  ...
2025-11-20 08:52:07 -08:00
Michal Luczaj
002541ef65 vsock: Ignore signal/timeout on connect() if already established
During connect(), acting on a signal/timeout by disconnecting an already
established socket leads to several issues:

1. connect() invoking vsock_transport_cancel_pkt() ->
   virtio_transport_purge_skbs() may race with sendmsg() invoking
   virtio_transport_get_credit(). This results in a permanently elevated
   `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.

2. connect() resetting a connected socket's state may race with socket
   being placed in a sockmap. A disconnected socket remaining in a sockmap
   breaks sockmap's assumptions. And gives rise to WARNs.

3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a
   transport change/drop after TCP_ESTABLISHED. Which poses a problem for
   any simultaneous sendmsg() or connect() and may result in a
   use-after-free/null-ptr-deref.

Do not disconnect socket on signal/timeout. Keep the logic for unconnected
sockets: they don't linger, can't be placed in a sockmap, are rejected by
sendmsg().

[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/
[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/
[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251119-vsock-interrupted-connect-v2-1-70734cf1233f@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-20 07:40:06 -08:00
Andrey Vatoropin
7d277a7a58 be2net: pass wrb_params in case of OS2BMC
be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL
at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL
pointer when processing a workaround for specific packet, as commit
bc0c3405ab ("be2net: fix a Tx stall bug caused by a specific ipv6
packet") states.

The correct way would be to pass the wrb_params from be_xmit().

Fixes: 760c295e0e ("be2net: Support for OS2BMC.")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-20 07:39:54 -08:00
Jens Axboe
49c2d5941c nvme fixes for Linux 6.18
- Admin queue use-after-free fix (Keith)
  - Target authentication fix (Alistar)
  - Multipath lockdeup fix (Shin'ichiro)
  - FC transport teardown fixes (Ewan)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAmkfNGYACgkQPe3zGtjz
 RglWKg//Uq8AfPTAAjzP2w/bYNSSw3PD037fzQKnEikDCK2U2FyJuUP/UW6QPJxm
 ChhKrwJIKWlL7gOebiFkmQk/ri/4rgbDqO/L4P/K6W4TEA3RgPi6Z+iXhSRE1Soy
 mlPltmvTtXYtj1lHH2wSaQTKMz6Xsix+0t6uLlOizKEGy8lSSzp4ihyT984PLMjO
 trCy3uRpbPRLa38fqWj4nzaQ1tItvLwQtuH+9SRvy21B7W5zMfJyeXM31Joj2WQ1
 u4HnZOhTcnA1Ihh/pdaRugEUMVACYcwGYBTFdLm/wzHXd+jZPVI2Sa9uDPeiJh3D
 oOrtCchrVMiODaxiH8sYNObn1GV7xUfsLsWxwOWJdQbe7WRBmWK1+4nOyGX12EO6
 EQ628tMU8ojqZOS0dFFzWEmAQ7SRHtfi2Sd9grZZzZdW+mim7m0EWOmKg9iW4mtY
 /8E56NgRXZhybwfqjWof3rzIiYq586H6XduFNaGCfZKVjDB2wzrWPD2OglqljSjh
 ud1NU1vTs+F67R/jhYHIOMjFi9bYWTLEbB5SEWau1whDh4iUi9/M8ndjcyNNEAvC
 yzW69vpSmD5ZJyNhska6jnlL9nwS3wMm3RIDEHIMU508ikRClVTCw2AMYNbI3XhF
 veNaDHIMO44OolspKlhGO1FMRzIkX1IltRdT/9pQn1Fj2hGOn2w=
 =M5sK
 -----END PGP SIGNATURE-----

Merge tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme into block-6.18

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.18

 - Admin queue use-after-free fix (Keith)
 - Target authentication fix (Alistar)
 - Multipath lockdeup fix (Shin'ichiro)
 - FC transport teardown fixes (Ewan)"

* tag 'nvme-6.18-2025-11-20' of git://git.infradead.org/nvme:
  nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
  nvme-multipath: fix lockdep WARN due to partition scan work
  nvmet-auth: update sc_c in target host hash calculation
  nvme: fix admin request_queue lifetime
2025-11-20 08:39:17 -07:00
Niklas Cassel
91842ed844 ata: libata-core: Set capacity to zero for a security locked drive
For Security locked drives (drives that have Security enabled, and have
not been Security unlocked by boot firmware), the automatic partition
scanning will result in the user being spammed with errors such as:

  ata5.00: failed command: READ DMA
  ata5.00: cmd c8/00:08:00:00:00/00:00:00:00:00/e0 tag 7 dma 4096 in
           res 51/04:08:00:00:00/00:00:00:00:00/e0 Emask 0x1 (device error)
  ata5.00: status: { DRDY ERR }
  ata5.00: error: { ABRT }
  sd 4:0:0:0: [sda] tag#7 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
  sd 4:0:0:0: [sda] tag#7 Sense Key : Aborted Command [current]
  sd 4:0:0:0: [sda] tag#7 Add. Sense: No additional sense information

during boot, because most commands except for IDENTIFY will be aborted by
a Security locked drive.

For a Security locked drive, set capacity to zero, so that no automatic
partition scanning will happen.

If the user later unlocks the drive using e.g. hdparm, the close() by the
user space application should trigger a revalidation of the drive.

Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2025-11-20 13:37:18 +01:00
Niklas Cassel
b118906833 ata: libata-scsi: Fix system suspend for a security locked drive
Commit cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error() status
handling") fixed ata_to_sense_error() to properly generate sense key
ABORTED COMMAND (without any additional sense code), instead of the
previous bogus sense key ILLEGAL REQUEST with the additional sense code
UNALIGNED WRITE COMMAND, for a failed command.

However, this broke suspend for Security locked drives (drives that have
Security enabled, and have not been Security unlocked by boot firmware).

The reason for this is that the SCSI disk driver, for the Synchronize
Cache command only, treats any sense data with sense key ILLEGAL REQUEST
as a successful command (regardless of ASC / ASCQ).

After commit cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error()
status handling") the code that treats any sense data with sense key
ILLEGAL REQUEST as a successful command is no longer applicable, so the
command fails, which causes the system suspend to be aborted:

  sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5
  sd 1:0:0:0: PM: failed to suspend async: error -5
  PM: Some devices failed to suspend, or early wake event detected

To make suspend work once again, for a Security locked device only,
return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense
data which a real SCSI device would have returned if locked.
The SCSI disk driver treats this sense data as a successful command.

Cc: stable@vger.kernel.org
Reported-by: Ilia Baryshnikov <qwelias@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704
Fixes: cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error() status handling")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2025-11-20 13:37:17 +01:00
Yihang Li
b32cc17d60 ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its
queue are not running.

Fixes: 0c76106cb9 ("scsi: sd: Fix TCG OPAL unlock on system resume")
Cc: stable@vger.kernel.org
Signed-off-by: Yihang Li <liyihang9@h-partners.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2025-11-20 13:12:26 +01:00
Paolo Abeni
dc9e7e652f A single fix for scanning on some rtw89 devices.
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmke1ccACgkQ10qiO8sP
 aAC5pg/9FI7YeMa8/wguZp8avQ0w48/GIaJ5qk7vpDoFuAoj9JSeIqCdlX7Kuo8L
 NulrCswFdVvpFhYqwnhYtstgaXTSxmx9Tt0VlQ4UUBevWwvgbScpB60KzpMssCW8
 sXkqqT6dWHhuj9y2W4yZJahp5is5Yt/I6B5BsOst/VRtUyr2uN29HNjIFEJ4WHvg
 h/wNd3kGuBpwnDeIcwpeekpoSnD0C+JXDvIIMN2E2lGzF37oxMEmUDZsq4UmFLFP
 /Ntlce4CyTk4qv/cESGykaTPKA5LHLtBJnRP7//suLldwuLbkCvLwFNqy78QamRB
 pgx2Vn4eTayUFjFUojnlgFR8LnmoeSa9RQspx4KPqbFCxpJ49G14D7ZIDfDD1EW6
 WjIUEqIcR6d2sdPFIGvKcAqadH0/qN8z5OSwKXl+8VYopintfMc3oYz1Zx1Q8/F8
 jIWEKLHvCntrNuUEdhZToiqklA6I8StoLan3LvZVFXloSecxsrZ6kq/bTblmq7S9
 iI6WeaFmzbhAHWKorD8u0K6kRJnMcftGPpGD0zgqbx1rb7T9DFWa11O/DS/EsXAE
 GssVtqu1+G7PqsDsHmtExm/YuCF/mBKfDSmV5AaQzD333uedthN+OehcmAtFoxzL
 Ipjhog0hCwryNQ7rPASRRCWjxHEqPc4Yk84HIB8e2XHEvCLONhY=
 =5p6s
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
wireless-2025-11-20

A single fix for scanning on some rtw89 devices.

* tag 'wireless-2025-11-20' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: rtw89: hw_scan: Don't let the operating channel be last
====================

Link: https://patch.msgid.link/20251120085433.8601-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-20 13:03:43 +01:00
David Bauer
d70b592551 l2tp: reset skb control buffer on xmit
The L2TP stack did not reset the skb control buffer before sending the
encapsulated package.

In a setup with an ath10k radio and batman-adv over an L2TP tunnel
massive fragmentations happen sporadically if the L2TP tunnel is
established over IPv4.

L2TP might reset some of the fields in the IP control buffer, but L2TP
assumes the type of the control buffer to be of an IPv4 packet.

In case the L2TP interface is used as a batadv hardif or the packet is
an IPv6 packet, this assumption breaks.

Clear the entire control buffer to avoid such mishaps altogether.

Fixes: f77ae93904 ("[PPPOL2TP]: Reset meta-data in xmit function")
Signed-off-by: David Bauer <mail@david-bauer.net>
Link: https://patch.msgid.link/20251118001619.242107-1-mail@david-bauer.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-20 11:52:24 +01:00
Oleksij Rempel
3ceb6ac211 net: dsa: microchip: lan937x: Fix RGMII delay tuning
Correct RGMII delay application logic in lan937x_set_tune_adj().

The function was missing `data16 &= ~PORT_TUNE_ADJ` before setting the
new delay value. This caused the new value to be bitwise-OR'd with the
existing PORT_TUNE_ADJ field instead of replacing it.

For example, when setting the RGMII 2 TX delay on port 4, the
intended TUNE_ADJUST value of 0 (RGMII_2_TX_DELAY_2NS) was
incorrectly OR'd with the default 0x1B (from register value 0xDA3),
leaving the delay at the wrong setting.

This patch adds the missing mask to clear the field, ensuring the
correct delay value is written. Physical measurements on the RGMII TX
lines confirm the fix, showing the delay changing from ~1ns (before
change) to ~2ns.

While testing on i.MX 8MP showed this was within the platform's timing
tolerance, it did not match the intended hardware-characterized value.

Fixes: b19ac41faa ("net: dsa: microchip: apply rgmii tx and rx delay in phylink mac config")
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20251114090951.4057261-1-o.rempel@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-20 11:26:14 +01:00
David Howells
d5227c8817 cifs: Add the smb3_read_* tracepoints to SMB1
Add the smb3_read_* tracepoints to SMB1's cifs_async_readv() and
cifs_readv_callback().

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Steve French <sfrench@samba.org>
cc: Paulo Alcantara <pc@manguebit.org>
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-11-20 03:12:05 -06:00
Shaurya Rane
7e4d9120cf cifs: fix memory leak in smb3_fs_context_parse_param error path
Add proper cleanup of ctx->source and fc->source to the
cifs_parse_mount_err error handler. This ensures that memory allocated
for the source strings is correctly freed on all error paths, matching
the cleanup already performed in the success path by
smb3_cleanup_fs_context_contents().
Pointers are also set to NULL after freeing to prevent potential
double-free issues.

This change fixes a memory leak originally detected by syzbot. The
leak occurred when processing Opt_source mount options if an error
happened after ctx->source and fc->source were successfully
allocated but before the function completed.

The specific leak sequence was:
1. ctx->source = smb3_fs_context_fullpath(ctx, '/') allocates memory
2. fc->source = kstrdup(ctx->source, GFP_KERNEL) allocates more memory
3. A subsequent error jumps to cifs_parse_mount_err
4. The old error handler freed passwords but not the source strings,
causing the memory to leak.

This issue was not addressed by commit e8c73eb7db ("cifs: client:
fix memory leak in smb3_fs_context_parse_param"), which only fixed
leaks from repeated fsconfig() calls but not this error path.

Patch updated with minor change suggested by kernel test robot

Reported-by: syzbot+87be6809ed9bf6d718e3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=87be6809ed9bf6d718e3
Fixes: 24e0a1eff9 ("cifs: switch to new mount api")
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-11-20 03:06:25 -06:00
Henrique Carvalho
a9d1f38df7 smb: client: introduce close_cached_dir_locked()
Replace close_cached_dir() calls under cfid_list_lock with a new
close_cached_dir_locked() variant that uses kref_put() instead of
kref_put_lock() to avoid recursive locking when dropping references.

While the existing code works if the refcount >= 2 invariant holds,
this area has proven error-prone. Make deadlocks impossible and WARN
on invariant violations.

Cc: stable@vger.kernel.org
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2025-11-20 03:03:30 -06:00
Johannes Berg
0ff8eeafba rtw patches for v6.18-rc7
Fix firmware goes wrong and causes device unusable after scanning. This
 issue presents under certain regulatory domain reported from end users.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuyEnvMdOsBl1WjpdjlvZYmhshd8FAmkekeoACgkQjlvZYmhs
 hd/w0g//e461H6pIvjmPIKH3EbnIVb7EfDFpvZjOvE2dUDTM0TquX4ia2uu8n+sV
 CUcF2XzU/inX/rdtcGuRbhkBRknUQoNb+guP9cFRXJuJoO0W85Ln4WTIxF8wR74w
 4+1eqHJp7tcbvSpI8Cst7+OdWjiaL4b0mX94UBAeESEeOAt//ZkUjhN36pQj4pm6
 0M0XpYjrMYV6wCSNQSicmwDuYrynC53NsitTCmgr/rvMsMhDaP8XO1/YvuX+JyXa
 P1Vj7lQ3xIQptqIX7UMeM3Cou4II/wMoQaDyakwwyCOoyBeD1NIGGzhNK1TIewbG
 KeFqTSOmrUuDF+4rEYBDGIAiFOq6OHmLodc47FbkD1kypwlirm3MTNoAaJ8Ex9Xr
 fEOkI/pLpBopm3PC+UuY6+r90obWwvqAwhGQazlf8oxL86EfKX0t17lRGAsWtmpz
 /EHR4F4fXlxQ9fJtzIbzaBpxoX8Bi4gNQzEueW/6ltPh2jEgpFMoomifBWul/TKz
 jWK4AxcvtRN/7TqOsepCcV/oRf/uuDhCIzhJot5SNhG2OHuFEnpzygMqQHJDfemA
 L8bVjf3vUQPLOnhouUoo1hNTiiLEEBb1sgmB/zNEjThQKtWuRiYmIUfaKQc16MUy
 gJs9MOF3K2MsITuY7WICcMFXI8ewof0/Ig8WkjV1xRcU8FKB6VQ=
 =vV9X
 -----END PGP SIGNATURE-----

Merge tag 'rtw-2025-11-20' of https://github.com/pkshih/rtw

Ping-Ke Shih says:
==================
rtw patches for v6.18-rc7

Fix firmware goes wrong and causes device unusable after scanning. This
issue presents under certain regulatory domain reported from end users.
==================

Link: https://patch.msgid.link/8217bee0-96c4-44c1-9593-2e9ca12eccc5@RTKEXHMBS03.realtek.com.tw
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-11-20 09:44:08 +01:00
Vincent Li
677e6123e3 LoongArch: BPF: Disable trampoline for kernel module function trace
The current LoongArch BPF trampoline implementation is incompatible
with tracing functions in kernel modules. This causes several severe
and user-visible problems:

* The `bpf_selftests/module_attach` test fails consistently.
* Kernel lockup when a BPF program is attached to a module function [1].
* Critical kernel modules like WireGuard experience traffic disruption
  when their functions are traced with fentry [2].

Given the severity and the potential for other unknown side-effects, it
is safest to disable the feature entirely for now. This patch prevents
the BPF subsystem from allowing trampoline attachments to kernel module
functions on LoongArch.

This is a temporary mitigation until the core issues in the trampoline
code for kernel module handling can be identified and fixed.

[root@fedora bpf]# ./test_progs -a module_attach -v
bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
Successfully loaded bpf_testmod.ko.
test_module_attach:PASS:skel_open 0 nsec
test_module_attach:PASS:set_attach_target 0 nsec
test_module_attach:PASS:set_attach_target_explicit 0 nsec
test_module_attach:PASS:skel_load 0 nsec
libbpf: prog 'handle_fentry': failed to attach: -ENOTSUPP
libbpf: prog 'handle_fentry': failed to auto-attach: -ENOTSUPP
test_module_attach:FAIL:skel_attach skeleton attach failed: -524
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.

[1]: https://lore.kernel.org/loongarch/CAK3+h2wDmpC-hP4u4pJY8T-yfKyk4yRzpu2LMO+C13FMT58oqQ@mail.gmail.com/
[2]: https://lore.kernel.org/loongarch/CAK3+h2wYcpc+OwdLDUBvg2rF9rvvyc5amfHT-KcFaK93uoELPg@mail.gmail.com/

Cc: stable@vger.kernel.org
Fixes: f9b6b41f0c ("LoongArch: BPF: Add basic bpf trampoline support")
Acked-by: Hengqi Chen <hengqi.chen@gmail.com>
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Huacai Chen
a6b533adfc LoongArch: Don't panic if no valid cache info for PCI
If there is no valid cache info detected (may happen in virtual machine)
for pci_dfl_cache_line_size, kernel shouldn't panic. Because in the PCI
core it will be evaluated to (L1_CACHE_BYTES >> 2).

Cc: <stable@vger.kernel.org>
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Huacai Chen
863a320dc6 LoongArch: Mask all interrupts during kexec/kdump
If the default state of the interrupt controllers in the first kernel
don't mask any interrupts, it may cause the second kernel to potentially
receive interrupts (which were previously allocated by the first kernel)
immediately after a CPU becomes online during its boot process. These
interrupts cannot be properly routed, leading to bad IRQ issues.

This patch calls machine_kexec_mask_interrupts() to mask all interrupts
during the kexec/kdump process.

Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Bibo Mao
acf5de1b23 LoongArch: Fix NUMA node parsing with numa_memblks
On physical machine, NUMA node id comes from high bit 44:48 of physical
address. However it is not true on virt machine. With general method, it
comes from ACPI SRAT table.

Here the common function numa_memblks_init() is used to parse NUMA node
information with numa_memblks.

Cc: <stable@vger.kernel.org>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Huacai Chen
1c004609fd LoongArch: Consolidate CPU names in /proc/cpuinfo
Some processors have no IOCSR.VENDOR and IOCSR.CPUNAME, some processors
have these registers but there is no valid information.

Consolidate CPU names in /proc/cpuinfo:
1. Add "PRID" to display the PRID & Core-Name;
2. Let "Model Name" display "Unknown" if no valid name.

Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Thomas Weißschuh
20d7338f2d LoongArch: Use UAPI types in ptrace UAPI header
The kernel UAPI headers already contain fixed-width integer types, there
is no need to rely on the libc types. There may not be a libc available
or the libc may not provides the <stdint.h>, like for example on nolibc.

This also aligns the header with the rest of the LoongArch UAPI headers.

Fixes: 803b0fc5c3 ("LoongArch: Add process management")
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2025-11-20 14:42:05 +08:00
Jakub Kicinski
f170b1dc26 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2025-11-18 (idpf, ice)

This series contains updates to idpf and ice drivers.

Emil adds a check for NULL vport_config during removal to avoid NULL
pointer dereference in idpf.

Grzegorz fixes PTP teardown paths to account for some missed cleanups
for ice driver.

* '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  ice: fix PTP cleanup on driver removal in error path
  idpf: fix possible vport_config NULL pointer deref in remove
====================

Link: https://patch.msgid.link/20251118235207.2165495-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:10:53 -08:00
Jakub Kicinski
4026310a04 Merge branch 'mptcp-misc-fixes-for-v6-18-rc7'
Matthieu Baerts says:

====================
mptcp: misc fixes for v6.18-rc7

Here are various unrelated fixes:

- Patch 1: Fix window space computation for fallback connections which
  can affect ACK generation. A fix for v5.11.

- Patch 2: Avoid unneeded subflow-level drops due to unsynced received
  window. A fix for v5.11.

- Patch 3: Avoid premature close for fallback connections with PREEMPT
  kernels. A fix for v5.12.

- Patch 4: Reset instead of fallback in case of data in the MPTCP
  out-of-order queue. A fix for v5.7.

- Patches 5-7: Avoid also sending "plain" TCP reset when closing with an
  MP_FASTCLOSE. A fix for v6.1.

- Patches 8-9: Longer timeout for background connections in MPTCP Join
  selftests. An additional fix for recent patches for v5.13/v6.1.

- Patches 10-11: Fix typo in a check introduce in a recent refactoring.
  A fix for v6.15.
====================

Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-0-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:19 -08:00
Gang Yan
0eee0fdf9b selftests: mptcp: add a check for 'add_addr_accepted'
The previous patch fixed an issue with the 'add_addr_accepted' counter.
This was not spot by the test suite.

Check this counter and 'add_addr_signal' in MPTCP Join 'delete re-add
signal' test. This should help spotting similar regressions later on.
These counters are crucial for ensuring the MPTCP path manager correctly
handles the subflow creation via 'ADD_ADDR'.

Signed-off-by: Gang Yan <yangang@kylinos.cn>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-11-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:16 -08:00
Gang Yan
92e239e36d mptcp: fix address removal logic in mptcp_pm_nl_rm_addr
Fix inverted WARN_ON_ONCE condition that prevented normal address
removal counter updates. The current code only executes decrement
logic when the counter is already 0 (abnormal state), while
normal removals (counter > 0) are ignored.

Signed-off-by: Gang Yan <yangang@kylinos.cn>
Fixes: 6361139185 ("mptcp: pm: remove '_nl' from mptcp_pm_nl_rm_addr_received")
Cc: stable@vger.kernel.org
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-10-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Matthieu Baerts (NGI0)
0e4ec14dc1 selftests: mptcp: join: userspace: longer timeout
In rare cases, when the test environment is very slow, some userspace
tests can fail because some expected events have not been seen.

Because the tests are expecting a long on-going connection, and they are
not waiting for the end of the transfer, it is fine to have a longer
timeout, and even go over the default one. This connection will be
killed at the end, after the verifications: increasing the timeout
doesn't change anything, apart from avoiding it to end before the end of
the verifications.

To play it safe, all userspace tests not waiting for the end of the
transfer are now having a longer timeout: 2 minutes.

The Fixes commit was making the connection longer, but still, the
default timeout would have stopped it after 1 minute, which might not be
enough in very slow environments.

Fixes: 290493078b ("selftests: mptcp: join: userspace: longer transfer")
Cc: stable@vger.kernel.org
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-9-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Matthieu Baerts (NGI0)
fb13c6bb81 selftests: mptcp: join: endpoints: longer timeout
In rare cases, when the test environment is very slow, some endpoints
tests can fail because some expected events have not been seen.

Because the tests are expecting a long on-going connection, and they are
not waiting for the end of the transfer, it is fine to have a longer
timeout, and even go over the default one. This connection will be
killed at the end, after the verifications: increasing the timeout
doesn't change anything, apart from avoiding it to end before the end of
the verifications.

To play it safe, all endpoints tests not waiting for the end of the
transfer are now having a longer timeout: 2 minutes.

The Fixes commit was making the connection longer, but still, the
default timeout would have stopped it after 1 minute, which might not be
enough in very slow environments.

Fixes: 6457595db9 ("selftests: mptcp: join: endpoints: longer transfer")
Cc: stable@vger.kernel.org
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-8-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Matthieu Baerts (NGI0)
efff6cd53a selftests: mptcp: join: fastclose: remove flaky marks
After recent fixes like the parent commit, and "selftests: mptcp:
connect: trunc: read all recv data", the two fastclose subtests no
longer look flaky any more.

It then feels fine to remove these flaky marks, to no longer ignore
these subtests in case of errors.

Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-7-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Paolo Abeni
ae15506024 mptcp: fix duplicate reset on fastclose
The CI reports sporadic failures of the fastclose self-tests. The root
cause is a duplicate reset, not carrying the relevant MPTCP option.
In the failing scenario the bad reset is received by the peer before
the fastclose one, preventing the reception of the latter.

Indeed there is window of opportunity at fastclose time for the
following race:

  mptcp_do_fastclose
    __mptcp_close_ssk
      __tcp_close()
        tcp_set_state() [1]
        tcp_send_active_reset() [2]

After [1] the stack will send reset to in-flight data reaching the now
closed port. Such reset may race with [2].

Address the issue explicitly sending a single reset on fastclose before
explicitly moving the subflow to close status.

Fixes: d21f834855 ("mptcp: use fastclose on more edge scenarios")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/596
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-6-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Paolo Abeni
fff0c87996 mptcp: decouple mptcp fastclose from tcp close
With the current fastclose implementation, the mptcp_do_fastclose()
helper is in charge of two distinct actions: send the fastclose reset
and cleanup the subflows.

Formally decouple the two steps, ensuring that mptcp explicitly closes
all the subflows after the mentioned helper.

This will make the upcoming fix simpler, and allows dropping the 2nd
argument from mptcp_destroy_common(). The Fixes tag is then the same as
in the next commit to help with the backports.

Fixes: d21f834855 ("mptcp: use fastclose on more edge scenarios")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-5-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:15 -08:00
Paolo Abeni
1bba3f219c mptcp: do not fallback when OoO is present
In case of DSS corruption, the MPTCP protocol tries to avoid the subflow
reset if fallback is possible. Such corruptions happen in the receive
path; to ensure fallback is possible the stack additionally needs to
check for OoO data, otherwise the fallback will break the data stream.

Fixes: e32d262c89 ("mptcp: handle consistently DSS corruption")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-19 20:07:14 -08:00