Commit Graph

1440620 Commits

Author SHA1 Message Date
Daniel Borkmann
1e822171ba selftests/net: Add additional test coverage in nk_qlease
Add further netkit queue-lease coverage for netns lifecycle of the guest
and physical halves, channel resize across active leases, single-device
and multi-lessee scenarios, L3 mode operation, lease capacity exhaustion,
and corner-cases of e.g. queue-create rejection paths. Also make the tests
more robust by removing the time.sleep(0.1) after netns deletion and turn
them into a wait loop.

Full test run:

  # ./nk_qlease.py
  TAP version 13
  1..45
  ok 1 nk_qlease.test_remove_phys
  ok 2 nk_qlease.test_double_lease
  ok 3 nk_qlease.test_virtual_lessor
  ok 4 nk_qlease.test_phys_lessee
  ok 5 nk_qlease.test_different_lessors
  ok 6 nk_qlease.test_queue_out_of_range
  ok 7 nk_qlease.test_resize_leased
  ok 8 nk_qlease.test_self_lease
  ok 9 nk_qlease.test_create_tx_type
  ok 10 nk_qlease.test_create_primary
  ok 11 nk_qlease.test_create_limit
  ok 12 nk_qlease.test_link_flap_phys
  ok 13 nk_qlease.test_queue_get_virtual
  ok 14 nk_qlease.test_remove_virt_first
  ok 15 nk_qlease.test_multiple_leases
  ok 16 nk_qlease.test_lease_queue_tx_type
  ok 17 nk_qlease.test_invalid_netns
  ok 18 nk_qlease.test_invalid_phys_ifindex
  ok 19 nk_qlease.test_multi_netkit_remove_phys
  ok 20 nk_qlease.test_single_remove_phys
  ok 21 nk_qlease.test_link_flap_virt
  ok 22 nk_qlease.test_phys_queue_no_lease
  ok 23 nk_qlease.test_same_ns_lease
  ok 24 nk_qlease.test_resize_after_unlease
  ok 25 nk_qlease.test_lease_queue_zero
  ok 26 nk_qlease.test_release_and_reuse
  ok 27 nk_qlease.test_veth_queue_create
  ok 28 nk_qlease.test_two_netkits_same_queue
  ok 29 nk_qlease.test_l3_mode_lease
  ok 30 nk_qlease.test_single_double_lease
  ok 31 nk_qlease.test_single_different_lessors
  ok 32 nk_qlease.test_cross_ns_netns_id
  ok 33 nk_qlease.test_delete_guest_netns
  ok 34 nk_qlease.test_move_guest_netns
  ok 35 nk_qlease.test_resize_phys_no_reduction
  ok 36 nk_qlease.test_delete_one_netkit_of_two
  ok 37 nk_qlease.test_bind_rx_leased_phys_queue
  ok 38 nk_qlease.test_resize_phys_shrink_past_leased
  ok 39 nk_qlease.test_resize_virt_not_supported
  ok 40 nk_qlease.test_lease_devices_down
  ok 41 nk_qlease.test_lease_capacity_exhaustion
  ok 42 nk_qlease.test_resize_phys_up
  ok 43 nk_qlease.test_multi_ns_lease
  ok 44 nk_qlease.test_multi_ns_delete_one
  ok 45 nk_qlease.test_move_phys_netns
  # Totals: pass:45 fail:0 xfail:0 xpass:0 skip:0 error:0

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260413220809.604592-4-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14 08:17:02 -07:00
Daniel Borkmann
e254ffb950 selftests/net: Split netdevsim tests from HW tests in nk_qlease
As pointed out in 3d2c3d2eea ("selftests: net: py: explicitly forbid
multiple ksft_run() calls"), ksft_run() cannot be called multiple times.

Move the netdevsim-based queue lease tests to selftests/net/ so that
each file has exactly one ksft_run() call.

The HW tests (io_uring ZC RX, queue attrs, XDP with MP, destroy) remain
in selftests/drivers/net/hw/.

Fixes: 65d657d806 ("selftests/net: Add queue leasing tests with netkit")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/netdev/20260409181950.7e099b6c@kernel.org
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260413220809.604592-3-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14 08:17:01 -07:00
Daniel Borkmann
4a6fe5fe60 tools/ynl: Make YnlFamily closeable as a context manager
YnlFamily opens an AF_NETLINK socket in __init__ but has no way
to release it other than leaving it to the GC. YnlFamily holds a
self reference cycle through SpecFamily's self.family = self
in its super().__init__() call, so refcount GC cannot reclaim
it and the socket stays open until the cyclic GC runs.

If a test creates a guest netns, instantiates a YnlFamily inside
it via NetNSEnter(), performs some test case work via Ynl, and
then deletes the netns, then the 'ip netns del' only drops the
mount binding and cleanup_net in the kernel never runs, so any
subsequent test case assertions that objects got cleaned up would
fail given this only gets triggered later via cyclic GC run.

Add an explicit close() that closes the netlink socket and wire
up the __enter__/__exit__ so callers can scope the instance
deterministically via 'with YnlFamily(...) as ynl: ...'.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260413220809.604592-2-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14 08:17:01 -07:00
Steven Rostedt
43cec30c44 tracefs: Removed unused 'ret' variable in eventfs_iterate()
Moving to guard() usage removed the need of using the 'ret' variable but
it wasn't removed. As it was set to zero, the compiler in use didn't warn
(although some compilers do).

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20260414110344.75c0663f@robin
Fixes: 4d9b262031 ("eventfs: Simplify code using guard()s")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202604100111.AAlbQKmK-lkp@intel.com/
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 11:08:24 -04:00
Ziqing Chen
e0da8a8cac ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
snd_ctl_elem_init_enum_names() advances pointer p through the names
buffer while decrementing buf_len. If buf_len reaches zero but items
remain, the next iteration calls strnlen(p, 0).

While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
maxlen against __builtin_dynamic_object_size(). When Clang loses track
of p's object size inside the loop, this triggers a BRK exception panic
before the return value is examined.

Add a buf_len == 0 guard at the loop entry to prevent calling fortified
strnlen() on an exhausted buffer.

Found by kernel fuzz testing through Xiaomi Smartphone.

Fixes: 8d448162bd ("ALSA: control: add support for ENUMERATED user space controls")
Cc: stable@vger.kernel.org
Signed-off-by: Ziqing Chen <chenziqing@xiaomi.com>
Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14 15:31:10 +02:00
Lorenzo Bianconi
b9d8b85668 net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()
Add the following PPE configuration in airoha_ppe_hw_init routine:
- 6RD hw offloading is currently not supported by Netfilter flowtable.
  Disable explicitly PPE 6RD offloading in order to prevent PPE to learn
  6RD flows and eventually interrupt the traffic.
- Add missing PPE bind rate configuration for L3 and L2 traffic.
  PPE bind rate configuration specifies the pps threshold to move a PPE
  entry state from UNBIND to BIND. Without this configuration this value
  is random.
- Set ageing thresholds to the values used in the vendor SDK in order to
  improve connection stability under load and avoid packet loss caused by
  fast aging.

Fixes: 00a7678310 ("net: airoha: Introduce flowtable offload support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260412-airoha_ppe_hw_init-missing-bits-v1-1-06ac670819e3@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 15:16:29 +02:00
Lorenzo Bianconi
1acdfbdb51 net: airoha: Fix VIP configuration for AN7583 SoC
EN7581 and AN7583 SoCs have different VIP definitions. Introduce
get_vip_port callback in airoha_eth_soc_data struct in order to take
into account EN7581 and AN7583 VIP register layout and definition
differences.
Introduce nbq parameter in airoha_gdm_port struct. At the moment nbq
is set statically to value previously used in airhoha_set_gdm2_loopback
routine and it will be read from device tree in subsequent patches.

Fixes: e4e5ce823b ("net: airoha: Add AN7583 SoC support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260412-airoha-7583-vip-fix-v1-1-c35e02b054bb@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 13:26:23 +02:00
Zhengchuan Liang
f7cf8ece8c net: caif: clear client service pointer on teardown
`caif_connect()` can tear down an existing client after remote shutdown by
calling `caif_disconnect_client()` followed by `caif_free_client()`.
`caif_free_client()` releases the service layer referenced by
`adap_layer->dn`, but leaves that pointer stale.

When the socket is later destroyed, `caif_sock_destructor()` calls
`caif_free_client()` again and dereferences the freed service pointer.

Clear the client/service links before releasing the service object so
repeated teardown becomes harmless.

Fixes: 43e3692101 ("caif: Move refcount from service layer to sock and dev.")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/9f3d37847c0037568aae698ca23cd47c6691acb0.1775897577.git.zcliangcn@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 13:21:54 +02:00
Luxiao Xu
fe72340daa net: strparser: fix skb_head leak in strp_abort_strp()
When the stream parser is aborted, for example after a message assembly timeout,
it can still hold a reference to a partially assembled message in
strp->skb_head.

That skb is not released in strp_abort_strp(), which leaks the partially
assembled message and can be triggered repeatedly to exhaust memory.

Fix this by freeing strp->skb_head and resetting the parser state in the
abort path. Leave strp_stop() unchanged so final cleanup still happens in
strp_done() after the work and timer have been synchronized.

Fixes: 43a0c6751a ("strparser: Stream parser for messages")
Cc: stable@kernel.org
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/ade3857a9404999ce9a1c27ec523efc896072678.1775482694.git.rakukuip@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 12:37:00 +02:00
Takashi Iwai
a1ed2ec1c5 ALSA: usb-audio: Fix missing error handling for get_min_max*()
The recent fix to add the error return value check from get_min_max*()
missed one case in build_audio_procunit() where no error value is set.
This may lead to an uninitialized variable and confuse the caller
(although this wouldn't happen practically because err is set for the
loop of num_ins at the beginning of the funciton).

Fix it by setting "err = 0" properly at the missing case, too.

Fixes: 4f55a85cd4 ("ALSA: usb-audio: Add error checks against get_min_max*()")
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/ad36dGpCBTGsyFr_@stanley.mountain
Link: https://patch.msgid.link/20260414093336.305464-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14 12:30:51 +02:00
Greg Kroah-Hartman
600dc40554 net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
A malicious USB device claiming to be a CDC Phonet modem can overflow
the skb_shared_info->frags[] array by sending an unbounded sequence of
full-page bulk transfers.

Drop the skb and increment the length error when the frag limit is
reached.  This matches the same fix that commit f0813bcd2d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") did for the
t7xx driver.

Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: stable <stable@kernel.org>
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026041134-dreamboat-buddhism-d1ec@gregkh
Fixes: 87cf65601e ("USB host CDC Phonet network interface driver")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 12:05:01 +02:00
Tom Zanussi
621a59d8fc selftests/ftrace: Add test case for fully-qualified variable references
This test adds a variable (ts0) to two events (sched_waking and
sched_wakeup) and uses a fully-qualified variable reference to expicitly
choose a particular one (sched_wakeup.$ts0) when calculating the wakeup
latency.

Link: https://patch.msgid.link/ce9d96aeb84b2d40bd469fe9a346e225442873b1.1776112478.git.zanussi@kernel.org
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 05:28:38 -04:00
Tom Zanussi
9236eebd13 tracing: Fix fully-qualified variable reference printing in histograms
The syntax for fully-qualified variable references in histograms is
subsys.event.$var, which is parsed correctly, but not displayed correctly
when printing a histogram spec. The current code puts the $ reference at
the beginning of the fully-qualified variable name i.e. $subsys.event.var,
which is incorrect.

Before:

trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-$sched.sched_wakeup.ts0: ...

After:

trigger info: hist:keys=next_comm:vals=hitcount:wakeup_lat=common_timestamp.usecs-sched.sched_wakeup.$ts0: ...

Link: https://patch.msgid.link/5dee9a86d062a4dd68c2214f3d90ac93811e1951.1776112478.git.zanussi@kernel.org
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 05:28:10 -04:00
David Carlier
fad217e16f tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func()
invokes the subsystem's ext->regfunc() before attempting to install the
new probe via func_add(). If func_add() then fails (for example, when
allocate_probes() cannot allocate a new probe array under memory pressure
and returns -ENOMEM), the function returns the error without calling the
matching ext->unregfunc(), leaving the side effects of regfunc() behind
with no installed probe to justify them.

For syscall tracepoints this is particularly unpleasant: syscall_regfunc()
bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task.
After a leaked failure, the refcount is stuck at a non-zero value with no
consumer, and every task continues paying the syscall trace entry/exit
overhead until reboot. Other subsystems providing regfunc()/unregfunc()
pairs exhibit similarly scoped persistent state.

Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the
func_add() error path, gated on the same condition used there so the
unwind is symmetric with the registration.

Fixes: 8cf868affd ("tracing: Have the reg function allow to fail")
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 05:17:02 -04:00
Vincent Donnefort
6170922f13 ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page()
As pointed out by Smatch, the ring-buffer descriptor array page_va is
counted by nr_page_va, but the accessor ring_buffer_desc_page() allows
access off by one.

Currently, this does not cause problems, as the page ID always comes
from a trusted source. Nonetheless, ensure robustness and fix the
accessor. While at it, make the page_id unsigned.

Link: https://patch.msgid.link/20260410124527.3563970-1-vdonnefort@google.com
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 05:13:09 -04:00
Pengpeng Hou
5ec1d1e97d tracing: Rebuild full_name on each hist_field_name() call
hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully
qualified variable-reference names, but it currently appends into that
buffer with strcat() without rebuilding it first. As a result, repeated
calls append a new "system.event.field" name onto the previous one,
which can eventually run past the end of full_name.

Build the name with snprintf() on each call and return NULL if the fully
qualified name does not fit in MAX_FILTER_STR_VAL.

Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn
Fixes: 067fe038e7 ("tracing: Add variable reference handling to hist triggers")
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Tested-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 04:59:33 -04:00
Paolo Abeni
ab4b6e4e80 Merge branch 'net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-for-bonding-and-add-selftest'
Jiayuan Chen says:

====================
net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest

From: Jiayuan Chen <jiayuan.chen@shopee.com>

This series has gone through several rounds of discussion and the
maintainers hold different views on where the fix should live (in the
generic xdp_master_redirect() path vs. inside bonding). I respect all
of the suggestions, but I would like to get the crash fixed first, so
this version takes the approach of checking whether the master device
is up in xdp_master_redirect(), as suggested by Daniel Borkmann. If a
different shape is preferred later it can be done as a follow-up, but
the null-ptr-deref should not linger.

syzkaller reported a kernel panic, full decoded trace here:
https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73

Problem Description

bond_rr_gen_slave_id() dereferences bond->rr_tx_counter without a NULL
check. rr_tx_counter is a per-CPU counter that bonding only allocates
in bond_open() when the mode is round-robin. If the bond device was
never brought up, rr_tx_counter stays NULL.

The XDP redirect path can still reach that code on a bond that was
never opened: bpf_master_redirect_enabled_key is a global static key,
so as soon as any bond device has native XDP attached, the
XDP_TX -> xdp_master_redirect() interception is enabled for every
slave system-wide. The path xdp_master_redirect() ->
bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() ->
bond_rr_gen_slave_id() then runs against a bond that has no
rr_tx_counter and crashes.

Solution

Patch 1: Fix this in the generic xdp_master_redirect() by skipping
master interception when the master device is not running. Returning
XDP_TX keeps the original XDP_TX behaviour on the receiving slave, and
avoids calling into any master ->ndo_xdp_get_xmit_slave() on a device
that has not fully initialized its XDP state. This is not specific to
bonding: any current or future master that defers XDP state allocation
to ->ndo_open() is protected.
Patch 2: Add a selftest that reproduces the above scenario.

v6: https://lore.kernel.org/netdev/20260410113726.368111-1-jiayuan.chen@linux.dev/T/#t
v5: https://lore.kernel.org/netdev/20260309030659.xxxxx-1-jiayuan.chen@linux.dev/
v4: https://lore.kernel.org/netdev/20260304074301.35482-1-jiayuan.chen@linux.dev/
v3: https://lore.kernel.org/netdev/20260228021918.141002-1-jiayuan.chen@linux.dev/T/#t
v2: https://lore.kernel.org/netdev/20260227092254.272603-1-jiayuan.chen@linux.dev/T/#t
v1: https://lore.kernel.org/netdev/20260224112545.37888-1-jiayuan.chen@linux.dev/T/#t

[1] https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73
====================

Link: https://patch.msgid.link/20260411005524.201200-1-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 10:39:26 +02:00
Jiayuan Chen
8dd1bdde38 selftests/bpf: add test for xdp_master_redirect with bond not up
Add a selftest that reproduces the null-ptr-deref in
bond_rr_gen_slave_id() when XDP redirect targets a bond device in
round-robin mode that was never brought up. The test verifies the fix
by ensuring no crash occurs.

Test setup:
- bond0: active-backup mode, UP, with native XDP (enables
  bpf_master_redirect_enabled_key globally)
- bond1: round-robin mode, never UP
- veth1: slave of bond1, with generic XDP (XDP_TX)
- BPF_PROG_TEST_RUN with live frames triggers the redirect path

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260411005524.201200-3-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 10:39:24 +02:00
Jiayuan Chen
1921f91298 net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
syzkaller reported a kernel panic in bond_rr_gen_slave_id() reached via
xdp_master_redirect(). Full decoded trace:

  https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73

bond_rr_gen_slave_id() dereferences bond->rr_tx_counter, a per-CPU
counter that bonding only allocates in bond_open() when the mode is
round-robin. If the bond device was never brought up, rr_tx_counter
stays NULL.

The XDP redirect path can still reach that code on a bond that was
never opened: bpf_master_redirect_enabled_key is a global static key,
so as soon as any bond device has native XDP attached, the
XDP_TX -> xdp_master_redirect() interception is enabled for every
slave system-wide. The path xdp_master_redirect() ->
bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() ->
bond_rr_gen_slave_id() then runs against a bond that has no
rr_tx_counter and crashes.

Fix this in the generic xdp_master_redirect() by refusing to call into
the master's ->ndo_xdp_get_xmit_slave() when the master device is not
up. IFF_UP is only set after ->ndo_open() has successfully returned,
so this reliably excludes masters whose XDP state has not been fully
initialized. Drop the frame with XDP_ABORTED so the exception is
visible via trace_xdp_exception() rather than silently falling through.
This is not specific to bonding: any current or future master that
defers XDP state allocation to ->ndo_open() is protected.

Fixes: 879af96ffd ("net, core: Add support for XDP redirection to slave device")
Reported-by: syzbot+80e046b8da2820b6ba73@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/698f84c6.a70a0220.2c38d7.00cc.GAE@google.com/T/
Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260411005524.201200-2-jiayuan.chen@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14 10:39:23 +02:00
Cao Ruichuang
1111e9bd83 ring-buffer: Report header_page overwrite as char
The header_page tracefs metadata currently reports overwrite as an
int field with size 1. That makes parsers warn about a type and
size mismatch even though the field is only used as a one-byte flag
within commit.

Keep the shared offset with commit as-is, but report overwrite as
char so the declared type matches the hardcoded size. The signedness
is already carried separately by the emitted signed field.

Link: https://patch.msgid.link/20260406165333.46052-1-create0818@163.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216999
Signed-off-by: Cao Ruichuang <create0818@163.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-14 04:29:55 -04:00
Kailang Yang
46c862f541 ALSA: hda/realtek - fixed speaker no sound update
Fixed speaker has pop noise on Lenovo Thinkpad X11 Carbon Gen 12.

Fixes: 630fbc6e87 ("ALSA: hda/realtek - fixed speaker no sound")
Reported-and-tested-by: Jeremy Bethmont <jeremy.bethmont@gmail.com>
Closes: https://lore.kernel.org/CAC88DfsHrhyhy0Pn1O-z9egBvMYu=6NYgcvcC6KCgwh_-Ldkxg@mail.gmail.com
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14 10:14:44 +02:00
Christian Brauner
cad3bf1c33
selftests/namespaces: remove unused utils.h include from listns_efault_test
Remove the inclusion of ../filesystems/utils.h from listns_efault_test.c.
The test doesn't use any symbols from that header. Including it alongside
../pidfd/pidfd.h causes a build failure because both headers define
wait_for_pid() with conflicting linkage:

  ../filesystems/utils.h:  extern int wait_for_pid(pid_t pid);
  ../pidfd/pidfd.h:        static inline int wait_for_pid(pid_t pid)

All symbols the test actually uses (create_child, read_nointr,
write_nointr, sys_pidfd_send_signal) come from pidfd.h.

Reported-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/all/acPV19IY3Gna6Ira@sirena.org.uk
Fixes: 07d7ad46da ("selftests/namespaces: test for efault")
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:31:18 +02:00
Christian Brauner
660c09404c
selftests/fsmount_ns: add missing TARGETS and fix cap test
Add missing top-level kselftest TARGETS entries for empty_mntns and
fsmount_ns so that 'make kselftest' discovers and runs these tests.

Fix requires_cap_sys_admin test which always SKIPped because fsopen()
was called after enter_userns(), where CAP_SYS_ADMIN in the mount
namespace's user_ns is unavailable. Move fsopen/fsconfig before fork so
the configured fs_fd is inherited by the child, which then only needs to
call fsmount() after dropping privileges.

Fixes: 3ac7ea91f3 ("selftests: add FSMOUNT_NAMESPACE tests")
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:31:07 +02:00
Christian Brauner
d38aa6cdee
selftests/empty_mntns: fix wrong CLONE_EMPTY_MNTNS hex value in comment
CLONE_EMPTY_MNTNS is (1ULL << 37) = 0x2000000000ULL, not 0x400000000ULL.

Fixes: 5b8ffd63fb ("selftests/filesystems: add clone3 tests for empty mount namespaces")
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:30:57 +02:00
Christian Brauner
1a398a2378
selftests/empty_mntns: fix statmount_alloc() signature mismatch
empty_mntns.h includes ../statmount/statmount.h which provides a
4-argument statmount_alloc(mnt_id, mnt_ns_id, mask, flags), but then
redefines its own 3-argument version without the flags parameter. This
causes a build failure due to conflicting types.

Remove the duplicate definition from empty_mntns.h and update all
callers to pass 0 for the flags argument.

Fixes: 32f54f2bbc ("selftests/filesystems: add tests for empty mount namespaces")
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:30:48 +02:00
Christian Brauner
a27e464262
selftests/statmount: remove duplicate wait_for_pid()
Remove the local static wait_for_pid() definition from
statmount_test_ns.c as it conflicts with the extern declaration in
utils.h. The identical function is already provided by utils.c.

Fixes: 3ac7ea91f3 ("selftests: add FSMOUNT_NAMESPACE tests")
Cc: <stable@kernel.org> # mainline only
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:30:31 +02:00
Christian Brauner
ad4999496e
mount: always duplicate mount
In the OPEN_TREE_NAMESPACE path vfs_open_tree() resolves a path via
filename_lookup() without holding namespace_lock. Between the lookup
and create_new_namespace() acquiring namespace_lock via
LOCK_MOUNT_EXACT_COPY() another thread can unmount the mount, setting
mnt->mnt_ns to NULL.

When create_new_namespace() then checks !mnt->mnt_ns it incorrectly
takes the swap-and-mntget path that was designed for fsmount()'s
detached mounts. This reuses a mount whose mnt_mp_list is in an
inconsistent state from the concurrent unmount, causing a general
protection fault in __umount_mnt() -> hlist_del_init(&mnt->mnt_mp_list)
during namespace teardown.

Remove the !mnt->mnt_ns special case entirely. Instead, always
duplicate the mount:

 - For OPEN_TREE_NAMESPACE use __do_loopback() which will properly
   clone the mount or reject it via may_copy_tree() if it was
   unmounted in the race window.
 - For fsmount() use clone_mnt() directly (via the new MOUNT_COPY_NEW
   flag) since the mount is freshly created by vfs_create_mount() and
   not in any namespace so __do_loopback()'s IS_MNT_UNBINDABLE,
   may_copy_tree, and __has_locked_children checks don't apply.

Reported-by: syzbot+e4470cc28308f2081ec8@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-04-14 09:30:15 +02:00
Faye Nichols
a7b56be59b ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic
The Acer PT316-51S (PCI SSID 1025:160e) with ALC287 codec does not
detect the headset microphone due to missing BIOS pin configuration
for pin 0x19. Apply ALC2XX_FIXUP_HEADSET_MIC to enable it.

Signed-off-by: Faye Nichols <faye.opensource@gmail.com>
Link: https://patch.msgid.link/20260413212645.117119-1-faye.opensource@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14 09:19:08 +02:00
Linus Torvalds
d60bc14015 power sequencing updates for v7.1-rc1
- add support for the PCIe M.2 Key E connectors in pwrseq-pcie-m2
 - describe PCIe M.2 Mechanical Key E connectors in DT bindings
 - add serdev helpers for looking up devices by OF nodes
 - minor serdev core rework to enable support for PCIe M.2 Key E connectors
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmnYtCcACgkQBZ0uy/82
 hMOjPg//fhIzA8h/w1YUXF5nW0Q7jyIzfCnpsKxNdIrREqYSKY1KRAsY8TWt0YCy
 5DcPfPyrEizn8enZoTiescZy26TnTDB87tWUMemNb1aMcpL30oRdCCzACrZK2/R5
 2+S/9h4UcsDxkChyRKnPgJfXd6M6RcsnjYDZ4nQ5zLasPQ3XCpV6+XyZuVnVVPzh
 vzENOtXQTUg0OnsK75O1pDWn4WkGCq3zc81LuucRM+yb0xSezG7aAk+jKwdIo8N1
 AfUbmnA4N0WRs0hTbQ/ovdRe8HddFGVNtBzGXqObKOSSKfslTehWMs1ukm8/HQf1
 3jLxEAJ5EC/A31rm60Wp1WhLRFbSfs9Ih6WyRM81q1AwIp4/AujV4M8k0zYpHtM1
 sdJUBOYl9UNuzQ3st5SXmc3mBZ1ivu+VoJbztm9sPJYhhpZKb7jXPPXMC6TPAu5B
 NquSscjTPcOtKm3t4h42VoYbr3WrB7hAR6FRIvX1MCC91GCgSdVaays7rAj3zU1u
 vRk7OgdEihwZ8zpI4Li8A7Qrg5O7F9ALF8qiXiNNPQjlc4npfYLvGA7FztAy1V4p
 L1yHLHkFjDc2mwl/9B7q2sLi4mKUbLFMwFRYbwR5GnwK65qdLmDXH+d2OdrmgliS
 SWCKFyNV+EmNCJIjCgVi+brH9WaIlKjW4DHAScH5z+gP5Fs1aj4=
 =Nqgg
 -----END PGP SIGNATURE-----

Merge tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull power sequencing updates from Bartosz Golaszewski:
 "For this release we have an extension of the pwrseq-pcie-m2 driver
  with support for PCIe M.2 Key E connectors.

  The rest of the commits fulfill a supporting role: document the
  hardware in DT bindings, provide required serdev helpers (this has
  been provided in an immutable branch to Rob Herring so you may see it
  in his PR as well) and is followed up by some Kconfig fixes from Arnd.

  Summary:

   - add support for the PCIe M.2 Key E connectors in pwrseq-pcie-m2

   - describe PCIe M.2 Mechanical Key E connectors in DT bindings

   - add serdev helpers for looking up devices by OF nodes

   - minor serdev core rework to enable support for PCIe M.2 Key E
     connectors"

* tag 'pwrseq-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: pcie-m2: add SERIAL_DEV_BUS dependency
  power: sequencing: pcie-m2: enforce PCI and OF dependencies
  power: sequencing: pcie-m2: Create serdev device for WCN7850 bluetooth
  power: sequencing: pcie-m2: Add support for PCIe M.2 Key E connectors
  dt-bindings: connector: Add PCIe M.2 Mechanical Key E connector
  dt-bindings: serial: Document the graph port
  serdev: Do not return -ENODEV from of_serdev_register_devices() if external connector is used
  serdev: Add an API to find the serdev controller associated with the devicetree node
  serdev: Convert to_serdev_*() helpers to macros and use container_of_const()
2026-04-13 20:28:22 -07:00
Linus Torvalds
1334d2a3b3 gpio updates for v7.1-rc1
GPIO core:
 - defer probe on software node lookups when the remote software node
   exists but has not been registered as a firmware node yet
 - unify GPIO hog handling by moving code duplicated in OF and ACPI
   modules into GPIO core and allow setting up hogs with software nodes
 - allow matching GPIO controllers by secondary firmware node if matching
   by primary does not succeed
 - demote deferral warnings to debug level as they are quite normal when
   using software nodes which don't support fw_devlink yet
 - disable the legacy GPIO character device uAPI v1 supprt in Kconfig by
   default
 - rework several core functions in preparation for the upcoming Revocable
   helper library for protecting resources against sudden removal, this
   reduces the number of SRCU dereferences in GPIO core
 - simplify file descriptor logic in GPIO character device code by using
   FD_PREPARE()
 - introduce a header defining symbols used by both GPIO consumers and
   providers to avoid having to include provider-specific headers from
   drivers which only consume GPIOs
 - replace snprintf() with strscpy() where formatting is not required
 
 New drivers:
 - add the gpio-by-pinctrl generic driver using the ARM SCMI protocol to
   control GPIOs (along with SCMI changes pulled from the pinctrl tree)
 - add a driver providing support for handling of platform events via
   GPIO-signalled ACPI events (used on Intel Nova Lake and later platforms)
 
 Driver changes:
 - extend the gpio-kempld driver with support for more recent models,
   interrupts and setting/getting multiple values at once
 - improve interrupt handling in gpio-brcmstb
 - add support for multi-SoC systems in gpio-tegra186
 - make sure we return correct values from the .get() callbacks in several
   GPIO drivers by normalizing any values other than 0, 1 or negative error
   numbers
 - use flexible arrays in several drivers to reduce the number of required
   memory allocations
 - simplify synchronous waiting for virtual drivers to probe and remove the
   dedicated, a bit overengineered helper library dev-sync-probe
 - remove unneeded Kconfig dependencies on OF_GPIO in several drivers and
   subsystems
 - convert the two remaining users of of_get_named_gpio() to using GPIO
   descriptors and remove the (no longer used) function along with the
   header that declares it
 - add missing includes in gpio-mmio
 - shrink and simplify code in gpio-max732x by using guard(mutex)
 - remove duplicated code handling the 'ngpios' property from gpio-ts4800,
   it's already handled in GPIO core
 - use correct variable type in gpio-aspeed
 - add support for a new model in gpio-realtek-otto
 - allow to specify the active-low setting of simulated hogs over the
   configfs interface (in addition to existing devicetree support) in
   gpio-sim
 
 Bug fixes:
 - clear the OF_POPULATED flag on hog nodes in GPIO chip remove path on
   OF systems
 - fix resource leaks in error path in gpiochip_add_data_with_key()
 - drop redundant device reference in gpio-mpsse
 
 Tests:
 - add selftests for use-after-free cases in GPIO character device code
 
 DT bindings:
 - add a DT binding document for SCMI based, gpio-over-pinctrl devices
 - fix interrupt description in microchip,mpfs-gpio
 - add new compatible for gpio-realtek-otto
 - describe the resets of the mpfs-gpio controller
 - fix maintainer's email in gpio-delay bindings
 - remove the binding document for cavium,thunder-8890 as the corresponding
   device is bound over PCI and not firmware nodes
 
 Documentation:
 - update the recommended way of converting legacy boards to using software
   nodes for GPIO description
 - describe GPIO line value semantics
 - misc updates to kerneldocs
 
 Misc:
 - convert OMAP1 ams-delta board to using GPIO hogs described with software
   nodes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmnYsngACgkQBZ0uy/82
 hMO+Tw/+N8eX1GOWkEdZBZRzd6QW+2qjmeMgvizMUu2CzfYpcuO9kpOqiSjguj2S
 6hODOajwU6EDdrxEHy7zJrAc6Tw1xIQeCnmSsFjC+4OePsCP6bU0QBgdb0V5waIx
 3kEdBsM3Msw48SCDFTUQJ0XyUD/VP4TZXzhDmU0X1OJsGYDSMchiBytNpZrFt18q
 qTq/NJm6mT6h5XlTeTCmfBcf/TG7MZhAPzXw8YZp+ZIgDsTRtD/P6CAZgJ0OU9f4
 MQwJO5+JFkTO7XhL+qOfJcnKnC2lRHaa7mJiSQ+XS43NOqO7NGeGH2l7hU/Lx/fR
 NIIZk27uBRV1akpnMGtgbqL2A8SFeH5yj3/o6S4rp9IzDwOouN+1seaL2RUHpTns
 TgIm037MNIZI8eQ2lSA9/+f4vwF1bml8mA/6lVBGHI9ZcaZbcUyWjXPcsuVIyiqY
 HlV+A3sVjchpaH9Eie78nbVm2X7Wm5slEazXAl3zVjlekQut+Fp+xoBWwulEjp+H
 7PZXqLP2hV/Xw4C2mn/zwwokzj+1S1DPW5Inn5Y7Qi6/j4GmvdVmI1zBculrf7jj
 GE6UUz+Vm9v6oE+q19jsksudVrDPapASYV/TLGQZk48IXhy+KxB8lep6L2rEAQtS
 YgBltnjJlbrx99u1sZkPECzgCRYSgm59Lt0aOv93CL2fURI1Seg=
 =VknJ
 -----END PGP SIGNATURE-----

Merge tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio updates from Bartosz Golaszewski:
 "For this merge window we have two new drivers: support for
  GPIO-signalled ACPI events on Intel platforms and a generic
  GPIO-over-pinctrl driver using the ARM SCMI protocol for
  controlling pins.

  Several things have been reworked in GPIO core: we unduplicated GPIO
  hog handling, reduced the number of SRCU locks and dereferences,
  improved support for software-node-based lookup and removed more
  legacy code after converting remaining users to modern alternatives.

  There's also a number of driver reworks and refactoring, documentation
  updates, some bug-fixes and new tests.

  GPIO core:
   - defer probe on software node lookups when the remote software node
     exists but has not been registered as a firmware node yet
   - unify GPIO hog handling by moving code duplicated in OF and ACPI
     modules into GPIO core and allow setting up hogs with software
     nodes
   - allow matching GPIO controllers by secondary firmware node if
     matching by primary does not succeed
   - demote deferral warnings to debug level as they are quite normal
     when using software nodes which don't support fw_devlink yet
   - disable the legacy GPIO character device uAPI v1 supprt in Kconfig
     by default
   - rework several core functions in preparation for the upcoming
     Revocable helper library for protecting resources against sudden
     removal, this reduces the number of SRCU dereferences in GPIO core
   - simplify file descriptor logic in GPIO character device code by
     using FD_PREPARE()
   - introduce a header defining symbols used by both GPIO consumers and
     providers to avoid having to include provider-specific headers from
     drivers which only consume GPIOs
   - replace snprintf() with strscpy() where formatting is not required

  New drivers:
   - add the gpio-by-pinctrl generic driver using the ARM SCMI protocol
     to control GPIOs (along with SCMI changes pulled from the pinctrl
     tree)
   - add a driver providing support for handling of platform events via
     GPIO-signalled ACPI events (used on Intel Nova Lake and later
     platforms)

  Driver changes:
   - extend the gpio-kempld driver with support for more recent models,
     interrupts and setting/getting multiple values at once
   - improve interrupt handling in gpio-brcmstb
   - add support for multi-SoC systems in gpio-tegra186
   - make sure we return correct values from the .get() callbacks in
     several GPIO drivers by normalizing any values other than 0, 1 or
     negative error numbers
   - use flexible arrays in several drivers to reduce the number of
     required memory allocations
   - simplify synchronous waiting for virtual drivers to probe and
     remove the dedicated, a bit overengineered helper library
     dev-sync-probe
   - remove unneeded Kconfig dependencies on OF_GPIO in several drivers
     and subsystems
   - convert the two remaining users of of_get_named_gpio() to using
     GPIO descriptors and remove the (no longer used) function along
     with the header that declares it
   - add missing includes in gpio-mmio
   - shrink and simplify code in gpio-max732x by using guard(mutex)
   - remove duplicated code handling the 'ngpios' property from
     gpio-ts4800, it's already handled in GPIO core
   - use correct variable type in gpio-aspeed
   - add support for a new model in gpio-realtek-otto
   - allow to specify the active-low setting of simulated hogs over the
     configfs interface (in addition to existing devicetree support) in
     gpio-sim

  Bug fixes:
   - clear the OF_POPULATED flag on hog nodes in GPIO chip remove path
     on OF systems
   - fix resource leaks in error path in gpiochip_add_data_with_key()
   - drop redundant device reference in gpio-mpsse

  Tests:
   - add selftests for use-after-free cases in GPIO character device
     code

  DT bindings:
   - add a DT binding document for SCMI based, gpio-over-pinctrl devices
   - fix interrupt description in microchip,mpfs-gpio
   - add new compatible for gpio-realtek-otto
   - describe the resets of the mpfs-gpio controller
   - fix maintainer's email in gpio-delay bindings
   - remove the binding document for cavium,thunder-8890 as the
     corresponding device is bound over PCI and not firmware nodes

  Documentation:
   - update the recommended way of converting legacy boards to using
     software nodes for GPIO description
   - describe GPIO line value semantics
   - misc updates to kerneldocs

  Misc:
   - convert OMAP1 ams-delta board to using GPIO hogs described with
     software nodes"

* tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (79 commits)
  gpio: swnode: defer probe on references to unregistered software nodes
  dt-bindings: gpio: cavium,thunder-8890: Remove DT binding
  Documentation: gpio: update the preferred method for using software node lookup
  gpio: gpio-by-pinctrl: s/used to do/is used to do/
  gpio: aspeed: fix unsigned long int declaration
  gpio: rockchip: convert to dynamic GPIO base allocation
  gpio: remove dev-sync-probe
  gpio: virtuser: stop using dev-sync-probe
  gpio: aggregator: stop using dev-sync-probe
  gpio: sim: stop using dev-sync-probe
  gpio: Add Intel Nova Lake ACPI GPIO events driver
  gpiolib: Make deferral warnings debug messages
  gpiolib: fix hogs with multiple lines
  gpio: fix up CONFIG_OF dependencies
  gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver
  gpio: dt-bindings: Add GPIO on top of generic pin control
  firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPP
  pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATE
  pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS support
  pinctrl: scmi: Add SCMI_PIN_INPUT_VALUE
  ...
2026-04-13 20:10:58 -07:00
Linus Torvalds
fbfb6bd927 Thermal control updates for 7.1-rc1
- Fix thermal core issues related to thermal zone removal and
    registration errors that may lead to a use-after-free or a memory
    leak in some cases (Rafael Wysocki)
 
  - Drop a redundant check from thermal_zone_device_update(), adjust
    thermal workqueue allocation flags, and switch over thermal_class
    allocation to static (Rafael Wysocki)
 
  - Relocate the suspend and resume of thermal zones closer to the
    suspend and resume of devices, respectively (Rafael Wysocki)
 
  - Remove a pointless variable used in the thermal core when
    registering a cooling device (Daniel Lezcano)
 
  - Replace sprintf() in thermal_bind_cdev_to_trip() and use
    str_enabled_disabled() helper in mode_show() (Thorsten Blum)
 
  - Replace cpumask_weight() in intel_hfi_offline() with cpumask_empty()
    which is generally more efficient (Yury Norov)
 
  - Add support for reading DDR data rate from PCI config space on Nova
    Lake platforms to the int340x thermal driver (Srinivas Pandruvada)
 
  - Add an OF node address to output message to make sensor names more
    distinguishable (Alexander Stein)
 
  - Add hwmon support for the i.MX97 thermal sensor (Alexander Stein)
 
  - Clamp correctly the results when doing value/temperature conversion
    in the Spreadtrum driver (Thorsten Blum)
 
  - Add SDM670 compatible DT bindings for the Tsens and the lMH thermal
    drivers (Richard Acayan)
 
  - Add SM8750 compatible DT bindings for the Tsens thermal driver (Manaf
    Meethalavalappu Pallikunhi)
 
  - Add Eliza SoC compatible DT bindings for the Tsens driver (Krzysztof
    Kozlowski)
 
  - Fix inverted condition check on error in the Spear thermal control
    driver (Gopi Krishna Menon)
 
  - Convert DT bindings documentation into DT schema (Gopi Krishna Menon)
 
  - Use max() macro to increase readability in the Broadcom STB thermal
    sensor (Thorsten Blum)
 
  - Remove a stale @trim_offset kernel-doc entry (John Madieu)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmnZBFwSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1CIAH/jT/z4QMvfBCIlTgwTN6ArqmbEPBoufI
 yhwyH/9gYEoJ5qvBBYWRu+NbiKIcQGdQ4bIVMbrYREqUAqZtD0ICTyysWKyxN0xC
 2Y+a1uyx5Q73Ac4s2+GNhNIykpFLeODSkHX4wHmA8DSjCdSLvqtfewK09XxoFKiP
 Gdb1mhihdEQREC2nfqOpWtxeRp90AK3Ak1Obvf4+95i2KYrQgrmaxXIGFH1Q7IQu
 4Va4/7ZEdFPmBTS3vpI3wNjFb5SDHtaP8/FUc/vVohs7if4mGT2JI94oE5ic/+bc
 RpCHvii51hHIs0VUJAqkzJwNIH1/3F3UDbiJtkV0sW9tYj02I8dLYPM=
 =m1xx
 -----END PGP SIGNATURE-----

Merge tag 'thermal-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control updates from Rafael Wysocki:
 "These include thermal core fixes and simplifications, driver fixes and
  new hardware support (SDM670, Eliza SoC), new driver features (hwmon
  support in imx91, DDR data rate on Nova Lake in int340x), and a
  handful of cleanups:

   - Fix thermal core issues related to thermal zone removal and
     registration errors that may lead to a use-after-free or a memory
     leak in some cases (Rafael Wysocki)

   - Drop a redundant check from thermal_zone_device_update(), adjust
     thermal workqueue allocation flags, and switch over thermal_class
     allocation to static (Rafael Wysocki)

   - Relocate the suspend and resume of thermal zones closer to the
     suspend and resume of devices, respectively (Rafael Wysocki)

   - Remove a pointless variable used in the thermal core when
     registering a cooling device (Daniel Lezcano)

   - Replace sprintf() in thermal_bind_cdev_to_trip() and use
     str_enabled_disabled() helper in mode_show() (Thorsten Blum)

   - Replace cpumask_weight() in intel_hfi_offline() with
     cpumask_empty() which is generally more efficient (Yury Norov)

   - Add support for reading DDR data rate from PCI config space on Nova
     Lake platforms to the int340x thermal driver (Srinivas Pandruvada)

   - Add an OF node address to output message to make sensor names more
     distinguishable (Alexander Stein)

   - Add hwmon support for the i.MX97 thermal sensor (Alexander Stein)

   - Clamp correctly the results when doing value/temperature conversion
     in the Spreadtrum driver (Thorsten Blum)

   - Add SDM670 compatible DT bindings for the Tsens and the lMH thermal
     drivers (Richard Acayan)

   - Add SM8750 compatible DT bindings for the Tsens thermal driver
     (Manaf Meethalavalappu Pallikunhi)

   - Add Eliza SoC compatible DT bindings for the Tsens driver
     (Krzysztof Kozlowski)

   - Fix inverted condition check on error in the Spear thermal control
     driver (Gopi Krishna Menon)

   - Convert DT bindings documentation into DT schema (Gopi Krishna
     Menon)

   - Use max() macro to increase readability in the Broadcom STB thermal
     sensor (Thorsten Blum)

   - Remove a stale @trim_offset kernel-doc entry (John Madieu)"

* tag 'thermal-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (25 commits)
  thermal: renesas: rzg3e: Remove stale @trim_offset kernel-doc entry
  thermal: core: Suspend thermal zones later and resume them earlier
  thermal: core: Allocate thermal_class statically
  thermal: core: Adjust thermal_wq allocation flags
  thermal: core: Drop redundant check from thermal_zone_device_update()
  thermal: core: Free thermal zone ID later during removal
  thermal: core: Fix thermal zone governor cleanup issues
  thermal/core: Remove pointless variable when registering a cooling device
  thermal/drivers/brcmstb_thermal: Use max to simplify brcmstb_get_temp
  dt-bindings: thermal: st,thermal-spear1340: convert to dtschema
  thermal/drivers/spear: Fix error condition for reading st,thermal-flags
  dt-bindings: thermal: qcom-tsens: Add Eliza SoC TSENS
  thermal: devfreq_cooling: avoid unnecessary kfree of freq_table
  thermal: intel: hfi: use cpumask_empty() in intel_hfi_offline()
  thermal: sysfs: Use str_enabled_disabled() helper in mode_show()
  dt-bindings: thermal: qcom-tsens: Document the SM8750 Temperature Sensor
  thermal/drivers/sprd: Use min instead of clamp in sprd_thm_temp_to_rawdata
  dt-bindings: thermal: lmh: Add SDM670 compatible
  dt-bindings: thermal: tsens: add SDM670 compatible
  thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
  ...
2026-04-13 20:01:50 -07:00
Linus Torvalds
d7c8087a9c Power management updates for 7.1-rc1
- Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa)
 
  - Update cpufreq-dt-platdev blocklist (Faruque Ansari)
 
  - Minor updates to driver and dt-bindings for Tegra (Thierry Reding,
    Rosen Penev)
 
  - Add MAINTAINERS entry for CPPC driver (Viresh Kumar)
 
  - Add support for new features: CPPC performance priority, Dynamic EPP,
    Raw EPP, and new unit tests for them to amd-pstate (Gautham Shenoy,
    Mario Limonciello)
 
  - Fix sysfs files being present when HW missing and broken/outdated
    documentation in the amd-pstate driver (Ninad Naik, Gautham Shenoy)
 
  - Pass the policy to cpufreq_driver->adjust_perf() to avoid using
    cpufreq_cpu_get() in the .adjust_perf() callback in amd-pstate which
    leads to a scheduling-while-atomic bug (K Prateek Nayak)
 
  - Clean up dead code in Kconfig for cpufreq (Julian Braha)
 
  - Remove max_freq_req update for pre-existing cpufreq policy and add a
    boost_freq_req QoS request to save the boost constraint instead of
    overwriting the last scaling_max_freq constraint (Pierre Gondois)
 
  - Embed cpufreq QoS freq_req objects in cpufreq policy so they all
    are allocated in one go along with the policy to simplify lifetime
    rules and avoid error handling issues (Viresh Kumar)
 
  - Use DMI max speed when CPPC is unavailable in the acpi-cpufreq
    scaling driver (Henry Tseng)
 
  - Switch policy_is_shared() in cpufreq to using cpumask_nth() instead
    of cpumask_weight() because the former is more efficient (Yury Norov)
 
  - Use sysfs_emit() in sysfs show functions for cpufreq governor
    attributes (Thorsten Blum)
 
  - Update intel_pstate to stop returning an error when "off" is written
    to its status sysfs attribute while the driver is already off (Fabio
    De Francesco)
 
  - Include current frequency in the debug message printed by
    __cpufreq_driver_target() (Pengjie Zhang)
 
  - Refine stopped tick handling in the menu cpuidle governor and
    rearrange stopped tick handling in the teo cpuidle governor (Rafael
    Wysocki)
 
  - Add Panther Lake C-states table to the intel_idle driver (Artem
    Bityutskiy)
 
  - Clean up dead dependencies on CPU_IDLE in Kconfig (Julian Braha)
 
  - Simplify cpuidle_register_device() with guard() (Huisong Li)
 
  - Use performance level if available to distinguish between rates in
    OPP debugfs (Manivannan Sadhasivam)
 
  - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar)
 
  - Return -ENODATA if the snapshot image is not loaded (Alberto Garcia)
 
  - Remove inclusion of crypto/hash.h from hibernate_64.c on x86 (Eric
    Biggers)
 
  - Clean up and rearrange the intel_rapl power capping driver to make
    the respective interface drivers (TPMI, MSR, and MMOI) hold their
    own settings and primitives and consolidate PL4 and PMU support
    flags into rapl_defaults (Kuppuswamy Sathyanarayanan)
 
  - Correct kernel-doc function parameter names in the power capping core
    code (Randy Dunlap)
 
  - Remove unneeded casting for HZ_PER_KHZ in devfreq (Andy Shevchenko)
 
  - Use _visible attribute to replace create/remove_sysfs_files() in
    devfreq (Pengjie Zhang)
 
  - Add Tegra114 support to activity monitor device in tegra30-devfreq as
    a preparation to upcoming EMC controller support (Svyatoslav Ryhel)
 
  - Fix mistakes in cpupower man pages, add the boost and epp options to
    the cpupower-frequency-info man page, and add the perf-bias option to
    the cpupower-info man page (Roberto Ricci)
 
  - Remove unnecessary extern declarations from getopt.h in arguments
    parsing functions in cpufreq-set, cpuidle-info, cpuidle-set,
    cpupower-info, and cpupower-set utilities (Kaushlendra Kumar)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmnY9TISHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1G9gH/j5mEqfPpiwX6fQ/ZwOGdNOOPVA5w9j4
 KPHSMwMD5lZkoaZfasp2vt27KY5SOoVVvRZ2DKkFJ3Jai4I3cUPZYypga2nre1ag
 tgzX4vOjcw2r40Eda6ezWl1h4mca/xJJBX7xH2+hn1JY+Y1in37g50CqMIjKh96z
 Uugkk6UZytL1XcF55PMhIUgDf6pDtRT5UOW9xOKOkUt8FVWTJ7ei3HaWyV5kDmVq
 b5eQ42+OH7y6sWNnoKczFd8fStvh6J/avoJurBEvcOQhMcjaIaB48G19+KjDg73E
 NjrVcgG20P2rltBvV2d0J1TKskZHkaP7XjIeWfkwjGZhee3FL7ssS/g=
 =fRCO
 -----END PGP SIGNATURE-----

Merge tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management updates from Rafael Wysocki:
 "Once again, cpufreq is the most active development area, mostly
  because of the new feature additions and documentation updates in the
  amd-pstate driver, but there are also changes in the cpufreq core
  related to boost support and other assorted updates elsewhere.

  Next up are power capping changes due to the major cleanup of the
  Intel RAPL driver.

  On the cpuidle front, a new C-states table for Intel Panther Lake is
  added to the intel_idle driver, the stopped tick handling in the menu
  and teo governors is updated, and there are a couple of cleanups.

  Apart from the above, support for Tegra114 is added to devfreq and
  there are assorted cleanups of that code, there are also two updates
  of the operating performance points (OPP) library, two minor updates
  related to hibernation, and cpupower utility man pages updates and
  cleanups.

  Specifics:

   - Update qcom-hw DT bindings to include Eliza hardware (Abel Vesa)

   - Update cpufreq-dt-platdev blocklist (Faruque Ansari)

   - Minor updates to driver and dt-bindings for Tegra (Thierry Reding,
     Rosen Penev)

   - Add MAINTAINERS entry for CPPC driver (Viresh Kumar)

   - Add support for new features: CPPC performance priority, Dynamic
     EPP, Raw EPP, and new unit tests for them to amd-pstate (Gautham
     Shenoy, Mario Limonciello)

   - Fix sysfs files being present when HW missing and broken/outdated
     documentation in the amd-pstate driver (Ninad Naik, Gautham Shenoy)

   - Pass the policy to cpufreq_driver->adjust_perf() to avoid using
     cpufreq_cpu_get() in the .adjust_perf() callback in amd-pstate
     which leads to a scheduling-while-atomic bug (K Prateek Nayak)

   - Clean up dead code in Kconfig for cpufreq (Julian Braha)

   - Remove max_freq_req update for pre-existing cpufreq policy and add
     a boost_freq_req QoS request to save the boost constraint instead
     of overwriting the last scaling_max_freq constraint (Pierre
     Gondois)

   - Embed cpufreq QoS freq_req objects in cpufreq policy so they all
     are allocated in one go along with the policy to simplify lifetime
     rules and avoid error handling issues (Viresh Kumar)

   - Use DMI max speed when CPPC is unavailable in the acpi-cpufreq
     scaling driver (Henry Tseng)

   - Switch policy_is_shared() in cpufreq to using cpumask_nth() instead
     of cpumask_weight() because the former is more efficient (Yury
     Norov)

   - Use sysfs_emit() in sysfs show functions for cpufreq governor
     attributes (Thorsten Blum)

   - Update intel_pstate to stop returning an error when "off" is
     written to its status sysfs attribute while the driver is already
     off (Fabio De Francesco)

   - Include current frequency in the debug message printed by
     __cpufreq_driver_target() (Pengjie Zhang)

   - Refine stopped tick handling in the menu cpuidle governor and
     rearrange stopped tick handling in the teo cpuidle governor (Rafael
     Wysocki)

   - Add Panther Lake C-states table to the intel_idle driver (Artem
     Bityutskiy)

   - Clean up dead dependencies on CPU_IDLE in Kconfig (Julian Braha)

   - Simplify cpuidle_register_device() with guard() (Huisong Li)

   - Use performance level if available to distinguish between rates in
     OPP debugfs (Manivannan Sadhasivam)

   - Fix scoped_guard in dev_pm_opp_xlate_required_opp() (Viresh Kumar)

   - Return -ENODATA if the snapshot image is not loaded (Alberto
     Garcia)

   - Remove inclusion of crypto/hash.h from hibernate_64.c on x86 (Eric
     Biggers)

   - Clean up and rearrange the intel_rapl power capping driver to make
     the respective interface drivers (TPMI, MSR, and MMOI) hold their
     own settings and primitives and consolidate PL4 and PMU support
     flags into rapl_defaults (Kuppuswamy Sathyanarayanan)

   - Correct kernel-doc function parameter names in the power capping
     core code (Randy Dunlap)

   - Remove unneeded casting for HZ_PER_KHZ in devfreq (Andy Shevchenko)

   - Use _visible attribute to replace create/remove_sysfs_files() in
     devfreq (Pengjie Zhang)

   - Add Tegra114 support to activity monitor device in tegra30-devfreq
     as a preparation to upcoming EMC controller support (Svyatoslav
     Ryhel)

   - Fix mistakes in cpupower man pages, add the boost and epp options
     to the cpupower-frequency-info man page, and add the perf-bias
     option to the cpupower-info man page (Roberto Ricci)

   - Remove unnecessary extern declarations from getopt.h in arguments
     parsing functions in cpufreq-set, cpuidle-info, cpuidle-set,
     cpupower-info, and cpupower-set utilities (Kaushlendra Kumar)"

* tag 'pm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (74 commits)
  cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
  cpupower: remove extern declarations in cmd functions
  cpuidle: Simplify cpuidle_register_device() with guard()
  PM / devfreq: tegra30-devfreq: add support for Tegra114
  PM / devfreq: use _visible attribute to replace create/remove_sysfs_files()
  PM / devfreq: Remove unneeded casting for HZ_PER_KHZ
  MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer
  cpufreq: Pass the policy to cpufreq_driver->adjust_perf()
  cpufreq/amd-pstate: Pass the policy to amd_pstate_update()
  cpufreq/amd-pstate-ut: Add a unit test for raw EPP
  cpufreq/amd-pstate: Add support for raw EPP writes
  cpufreq/amd-pstate: Add support for platform profile class
  cpufreq/amd-pstate: add kernel command line to override dynamic epp
  cpufreq/amd-pstate: Add dynamic energy performance preference
  Documentation: amd-pstate: fix dead links in the reference section
  cpufreq/amd-pstate: Cache the max frequency in cpudata
  Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count}
  Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file
  Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file
  amd-pstate-ut: Add a testcase to validate the visibility of driver attributes
  ...
2026-04-13 19:47:52 -07:00
Linus Torvalds
2e31b16101 ACPI support updates for 7.1-rc1
- Update maintainers information regarding ACPICA (Rafael Wysocki)
 
  - Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy() (Kees
    Cook)
 
  - Trigger an ordered system power off after encountering a fatal error
    operator in AML (Armin Wolf)
 
  - Enable ACPI FPDT parsing on LoongArch (Xi Ruoyao)
 
  - Remove the temporary stop-gap acpi_pptt_cache_v1_full structure from
    the ACPI PPTT parser (Ben Horgan)
 
  - Add support for exposing ACPI FPDT subtables FBPT and S3PT (Nate
    DeSimone)
 
  - Address multiple assorted issues and clean up the code in the ACPI
    processor idle driver (Huisong Li)
 
  - Replace strlcat() in the ACPI processor idle drive with a better
    alternative (Andy Shevchenko)
 
  - Rearrange and clean up acpi_processor_errata_piix4() (Rafael Wysocki)
 
  - Move reference performance to capabilities and fix an uninitialized
    variable in the ACPI CPPC library (Pengjie Zhang)
 
  - Add support for the Performance Limited Register to the ACPI CPPC
    library (Sumit Gupta)
 
  - Add cppc_get_perf() API to read performance controls, extend
    cppc_set_epp_perf() for FFH/SystemMemory, and make the ACPI CPPC
    library warn on missing mandatory DESIRED_PERF register (Sumit Gupta)
 
  - Modify the cpufreq CPPC driver to update MIN_PERF/MAX_PERF in target
    callbacks to allow it to control performance bounds via standard
    scaling_min_freq and scaling_max_freq sysfs attributes and add sysfs
    documentation for the Performance Limited Register to it (Sumit Gupta)
 
  - Add ACPI support to the platform device interface in the CMOS RTC
    driver, make the ACPI core device enumeration code create a platform
    device for the CMOS RTC, and drop CMOS RTC PNP device support (Rafael
    Wysocki)
 
  - Consolidate the x86-specific CMOS RTC handling with the ACPI TAD
    driver and clean up the CMOS RTC ACPI address space handler (Rafael
    Wysocki)
 
  - Enable ACPI alarm in the CMOS RTC driver if advertised in ACPI FADT
    and allow that driver to work without a dedicated IRQ if the ACPI
    alarm is used (Rafael Wysocki)
 
  - Clean up the ACPI TAD driver in various ways and add an RTC class
    device interface, including both the RTC setting/reading and alarm
    timer support, to it (Rafael Wysocki)
 
  - Clean up the ACPI AC and ACPI PAD (processor aggregator device)
    drivers (Rafael Wysocki)
 
  - Rework checking for duplicate video bus devices and consolidate
    pnp.bus_id workarounds handling in the ACPI video bus driver (Rafael
    Wysocki)
 
  - Update the ACPI core device drivers to stop setting acpi_device_name()
    unnecessarily (Rafael Wysocki)
 
  - Rearrange code using acpi_device_class() in the ACPI core device
    drivers and update them to stop setting acpi_device_class()
    unnecessarily (Rafael Wysocki)
 
  - Define ACPI_AC_CLASS in one place (Rafael Wysocki)
 
  - Convert the ni903x_wdt watchdog driver and the xen ACPI PAD driver to
    bind to platform devices instead of ACPI devices (Rafael Wysocki)
 
  - Add devm_ghes_register_vendor_record_notifier(), use it in the PCI
    hisi driver, and Add NVIDIA vendor CPER record handler (Kai-Heng
    Feng)
 
  - Consolidate the interface for obtaining a CPU UID from ACPI across
    architectures and use it to address incorrect PCI TPH Steering Tag
    on ARM64 resulting from the invalid assumption that the ACPI
    Processor UID would always be the same as the corresponding logical
    CPU ID in Linux (Chengwen Feng)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmnY/bcSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1chAH/1cGRzh9lSgQ3ZdzIIA5rpRtwKC+CTNz
 iNDvQ97W73B2N+WYzMaloOh+ZVA1Vdqc+8921aH6HI+v7wtg/ZV3h/hU7TagHNY/
 bRFDYaeRXVj4aBXNfoVdn7G5UU9j/kIDcV25I2ubOBqZaO6T5p8p1BK0j0vEj+sG
 yR7XwpEhr2OUQwlIFGKskJwFaH57QJXPEY8wf+o+lMEx/7o/JQRJzKFwsYu01ZZV
 kQy9Ee08P/rsNJwU2ibmZu5P3JMnhategAT8VAMBvkfLScv2sKX+1Vz19NGXzm71
 ARaT7y8MSPNb7SAvWmNZ/rVYrYIL+D3a76Gd7MOGrbVWEn6oXIbCIhY=
 =6vEK
 -----END PGP SIGNATURE-----

Merge tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI support updates from Rafael Wysocki:
 "These include an update of the CMOS RTC driver and the related ACPI
  and x86 code that, among other things, switches it over to using the
  platform device interface for device binding on x86 instead of the PNP
  device driver interface (which allows the code in question to be
  simplified quite a bit), a major update of the ACPI Time and Alarm
  Device (TAD) driver adding an RTC class device interface to it, and
  updates of core ACPI drivers that remove some unnecessary and not
  really useful code from them.

  Apart from that, two drivers are converted to using the platform
  driver interface for device binding instead of the ACPI driver one,
  which is slated for removal, support for the Performance Limited
  register is added to the ACPI CPPC library and there are some
  janitorial updates of it and the related cpufreq CPPC driver, the ACPI
  processor driver is fixed and cleaned up, and NVIDIA vendor CPER
  record handler is added to the APEI GHES code.

  Also, the interface for obtaining a CPU UID from ACPI is consolidated
  across architectures and used for fixing a problem with the PCI TPH
  Steering Tag on ARM64, there are two updates related to ACPICA, a
  minor ACPI OS Services Layer (OSL) update, and a few assorted updates
  related to ACPI tables parsing.

  Specifics:

   - Update maintainers information regarding ACPICA (Rafael Wysocki)

   - Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()
     (Kees Cook)

   - Trigger an ordered system power off after encountering a fatal
     error operator in AML (Armin Wolf)

   - Enable ACPI FPDT parsing on LoongArch (Xi Ruoyao)

   - Remove the temporary stop-gap acpi_pptt_cache_v1_full structure
     from the ACPI PPTT parser (Ben Horgan)

   - Add support for exposing ACPI FPDT subtables FBPT and S3PT (Nate
     DeSimone)

   - Address multiple assorted issues and clean up the code in the ACPI
     processor idle driver (Huisong Li)

   - Replace strlcat() in the ACPI processor idle drive with a better
     alternative (Andy Shevchenko)

   - Rearrange and clean up acpi_processor_errata_piix4() (Rafael
     Wysocki)

   - Move reference performance to capabilities and fix an uninitialized
     variable in the ACPI CPPC library (Pengjie Zhang)

   - Add support for the Performance Limited Register to the ACPI CPPC
     library (Sumit Gupta)

   - Add cppc_get_perf() API to read performance controls, extend
     cppc_set_epp_perf() for FFH/SystemMemory, and make the ACPI CPPC
     library warn on missing mandatory DESIRED_PERF register (Sumit
     Gupta)

   - Modify the cpufreq CPPC driver to update MIN_PERF/MAX_PERF in
     target callbacks to allow it to control performance bounds via
     standard scaling_min_freq and scaling_max_freq sysfs attributes and
     add sysfs documentation for the Performance Limited Register to it
     (Sumit Gupta)

   - Add ACPI support to the platform device interface in the CMOS RTC
     driver, make the ACPI core device enumeration code create a
     platform device for the CMOS RTC, and drop CMOS RTC PNP device
     support (Rafael Wysocki)

   - Consolidate the x86-specific CMOS RTC handling with the ACPI TAD
     driver and clean up the CMOS RTC ACPI address space handler (Rafael
     Wysocki)

   - Enable ACPI alarm in the CMOS RTC driver if advertised in ACPI FADT
     and allow that driver to work without a dedicated IRQ if the ACPI
     alarm is used (Rafael Wysocki)

   - Clean up the ACPI TAD driver in various ways and add an RTC class
     device interface, including both the RTC setting/reading and alarm
     timer support, to it (Rafael Wysocki)

   - Clean up the ACPI AC and ACPI PAD (processor aggregator device)
     drivers (Rafael Wysocki)

   - Rework checking for duplicate video bus devices and consolidate
     pnp.bus_id workarounds handling in the ACPI video bus driver
     (Rafael Wysocki)

   - Update the ACPI core device drivers to stop setting
     acpi_device_name() unnecessarily (Rafael Wysocki)

   - Rearrange code using acpi_device_class() in the ACPI core device
     drivers and update them to stop setting acpi_device_class()
     unnecessarily (Rafael Wysocki)

   - Define ACPI_AC_CLASS in one place (Rafael Wysocki)

   - Convert the ni903x_wdt watchdog driver and the xen ACPI PAD driver
     to bind to platform devices instead of ACPI devices (Rafael
     Wysocki)

   - Add devm_ghes_register_vendor_record_notifier(), use it in the PCI
     hisi driver, and Add NVIDIA vendor CPER record handler (Kai-Heng
     Feng)

   - Consolidate the interface for obtaining a CPU UID from ACPI across
     architectures and use it to address incorrect PCI TPH Steering Tag
     on ARM64 resulting from the invalid assumption that the ACPI
     Processor UID would always be the same as the corresponding logical
     CPU ID in Linux (Chengwen Feng)"

* tag 'acpi-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (73 commits)
  ACPICA: Update maintainers information
  watchdog: ni903x_wdt: Convert to a platform driver
  ACPI: PAD: xen: Convert to a platform driver
  ACPI: processor: idle: Reset cpuidle on C-state list changes
  cpuidle: Extract and export no-lock variants of cpuidle_unregister_device()
  PCI/TPH: Pass ACPI Processor UID to Cache Locality _DSM
  ACPI: PPTT: Use acpi_get_cpu_uid() and remove get_acpi_id_for_cpu()
  perf: arm_cspmu: Switch to acpi_get_cpu_uid() from get_acpi_id_for_cpu()
  ACPI: Centralize acpi_get_cpu_uid() declaration in include/linux/acpi.h
  x86/acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval
  RISC-V: ACPI: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval
  LoongArch: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval
  arm64: acpi: Add acpi_get_cpu_uid() for unified ACPI CPU UID retrieval
  ACPI: APEI: GHES: Add NVIDIA vendor CPER record handler
  PCI: hisi: Use devm_ghes_register_vendor_record_notifier()
  ACPI: APEI: GHES: Add devm_ghes_register_vendor_record_notifier()
  ACPI: tables: Enable FPDT on LoongArch
  ACPI: processor: idle: Fix NULL pointer dereference in hotplug path
  ACPI: processor: idle: Reset power_setup_done flag on initialization failure
  ACPI: TAD: Add alarm support to the RTC class device interface
  ...
2026-04-13 19:25:07 -07:00
Linus Torvalds
4793dae01f Driver core changes for 7.1-rc1
- debugfs:
   - Fix NULL pointer dereference in debugfs_create_str()
   - Fix misplaced EXPORT_SYMBOL_GPL for debugfs_create_str()
   - Fix soundwire debugfs NULL pointer dereference from uninitialized
     firmware_file
 
 - device property:
   - Make fwnode flags modifications thread safe; widen the field to
     unsigned long and use set_bit() / clear_bit() based accessors
   - Document how to check for the property presence
 
 - devres:
   - Separate struct devres_node from its "subclasses" (struct devres,
     struct devres_group); give struct devres_node its own release and
     free callbacks for per-type dispatch
   - Introduce struct devres_action for devres actions, avoiding the
     ARCH_DMA_MINALIGN alignment overhead of struct devres
   - Export struct devres_node and its init/add/remove/dbginfo
     primitives for use by Rust Devres<T>
   - Fix missing node debug info in devm_krealloc()
   - Use guard(spinlock_irqsave) where applicable; consolidate unlock
     paths in devres_release_group()
 
 - driver_override:
   - Convert PCI, WMI, vdpa, s390/cio, s390/ap, and fsl-mc to the
     generic driver_override infrastructure, replacing per-bus
     driver_override strings, sysfs attributes, and match logic; fixes
     a potential UAF from unsynchronized access to driver_override in
     bus match() callbacks
   - Simplify __device_set_driver_override() logic
 
 - kernfs:
   - Send IN_DELETE_SELF and IN_IGNORED inotify events on kernfs
     file and directory removal
   - Add corresponding selftests for memcg
 
 - platform:
   - Allow attaching software nodes when creating platform devices via
     a new 'swnode' field in struct platform_device_info
   - Add kerneldoc for struct platform_device_info
 
 - software node:
   - Move software node initialization from postcore_initcall() to
     driver_init(), making it available early in the boot process
   - Move kernel_kobj initialization (ksysfs_init) earlier to support
     the above
   - Remove software_node_exit(); dead code in a built-in unit
 
 - SoC:
   - Introduce of_machine_read_compatible() and of_machine_read_model()
     OF helpers and export soc_attr_read_machine() to replace direct
     accesses to of_root from SoC drivers; also enables
     CONFIG_COMPILE_TEST coverage for these drivers
 
 - sysfs:
   - Constify attribute group array pointers to
     'const struct attribute_group *const *' in sysfs functions,
     device_add_groups() / device_remove_groups(), and struct class
 
 - Rust:
   - Devres:
     - Embed struct devres_node directly in Devres<T> instead of going
       through devm_add_action(), avoiding the extra allocation and
       the unnecessary ARCH_DMA_MINALIGN alignment
 
   - I/O:
     - Turn IoCapable from a marker trait into a functional trait
       carrying the raw I/O accessor implementation (io_read /
       io_write), providing working defaults for the per-type Io
       methods
     - Add RelaxedMmio wrapper type, making relaxed accessors usable
       in code generic over the Io trait
     - Remove overloaded per-type Io methods and per-backend macros
       from Mmio and PCI ConfigSpace
 
   - I/O (Register):
     - Add IoLoc trait and generic read/write/update methods to the Io
       trait, making I/O operations parameterizable by typed locations
     - Add register! macro for defining hardware register types with
       typed bitfield accessors backed by Bounded values; supports
       direct, relative, and array register addressing
     - Add write_reg() / try_write_reg() and LocatedRegister trait
     - Update PCI sample driver to demonstrate the register! macro
 
         Example:
 
         ```
             register! {
                 /// UART control register.
                 CTRL(u32) @ 0x18 {
                     /// Receiver enable.
                     19:19   rx_enable => bool;
                     /// Parity configuration.
                     14:13   parity ?=> Parity;
                 }
 
                 /// FIFO watermark and counter register.
                 WATER(u32) @ 0x2c {
                     /// Number of datawords in the receive FIFO.
                     26:24   rx_count;
                     /// RX interrupt threshold.
                     17:16   rx_water;
                 }
             }
 
             impl WATER {
                 fn rx_above_watermark(&self) -> bool {
                     self.rx_count() > self.rx_water()
                 }
             }
 
             fn init(bar: &pci::Bar<BAR0_SIZE>) {
                 let water = WATER::zeroed()
                     .with_const_rx_water::<1>(); // > 3 would not compile
                 bar.write_reg(water);
 
                 let ctrl = CTRL::zeroed()
                     .with_parity(Parity::Even)
                     .with_rx_enable(true);
                 bar.write_reg(ctrl);
             }
 
             fn handle_rx(bar: &pci::Bar<BAR0_SIZE>) {
                 if bar.read(WATER).rx_above_watermark() {
                     // drain the FIFO
                 }
             }
 
             fn set_parity(bar: &pci::Bar<BAR0_SIZE>, parity: Parity) {
                 bar.update(CTRL, |r| r.with_parity(parity));
             }
         ```
 
   - IRQ:
     - Move 'static bounds from where clauses to trait declarations
       for IRQ handler traits
 
   - Misc:
     - Enable the generic_arg_infer Rust feature
     - Extend Bounded with shift operations, single-bit bool conversion,
       and const get()
 
 - Misc:
   - Make deferred_probe_timeout default a Kconfig option
   - Drop auxiliary_dev_pm_ops; the PM core falls back to driver PM
     callbacks when no bus type PM ops are set
   - Add conditional guard support for device_lock()
   - Add ksysfs.c to the DRIVER CORE MAINTAINERS entry
   - Fix kernel-doc warnings in base.h
   - Fix stale reference to memory_block_add_nid() in documentation
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCadl5SwAKCRBFlHeO1qrK
 LpjDAQCSG3vYznwrngfpmRU5bCB9sdUy/pZiX5px1357+amJkwEA9LgIVQvtHAZW
 ZXcQ7Jr+mR3mJEdlatbkWHp3w1VHqAQ=
 =y1DV
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core updates from Danilo Krummrich:
 "debugfs:
   - Fix NULL pointer dereference in debugfs_create_str()
   - Fix misplaced EXPORT_SYMBOL_GPL for debugfs_create_str()
   - Fix soundwire debugfs NULL pointer dereference from uninitialized
     firmware_file

  device property:
   - Make fwnode flags modifications thread safe; widen the field to
     unsigned long and use set_bit() / clear_bit() based accessors
   - Document how to check for the property presence

  devres:
   - Separate struct devres_node from its "subclasses" (struct devres,
     struct devres_group); give struct devres_node its own release and
     free callbacks for per-type dispatch
   - Introduce struct devres_action for devres actions, avoiding the
     ARCH_DMA_MINALIGN alignment overhead of struct devres
   - Export struct devres_node and its init/add/remove/dbginfo
     primitives for use by Rust Devres<T>
   - Fix missing node debug info in devm_krealloc()
   - Use guard(spinlock_irqsave) where applicable; consolidate unlock
     paths in devres_release_group()

  driver_override:
   - Convert PCI, WMI, vdpa, s390/cio, s390/ap, and fsl-mc to the
     generic driver_override infrastructure, replacing per-bus
     driver_override strings, sysfs attributes, and match logic; fixes a
     potential UAF from unsynchronized access to driver_override in bus
     match() callbacks
   - Simplify __device_set_driver_override() logic

  kernfs:
   - Send IN_DELETE_SELF and IN_IGNORED inotify events on kernfs file
     and directory removal
   - Add corresponding selftests for memcg

  platform:
   - Allow attaching software nodes when creating platform devices via a
     new 'swnode' field in struct platform_device_info
   - Add kerneldoc for struct platform_device_info

  software node:
   - Move software node initialization from postcore_initcall() to
     driver_init(), making it available early in the boot process
   - Move kernel_kobj initialization (ksysfs_init) earlier to support
     the above
   - Remove software_node_exit(); dead code in a built-in unit

  SoC:
   - Introduce of_machine_read_compatible() and of_machine_read_model()
     OF helpers and export soc_attr_read_machine() to replace direct
     accesses to of_root from SoC drivers; also enables
     CONFIG_COMPILE_TEST coverage for these drivers

  sysfs:
   - Constify attribute group array pointers to
     'const struct attribute_group *const *' in sysfs functions,
     device_add_groups() / device_remove_groups(), and struct class

  Rust:
   - Devres:
      - Embed struct devres_node directly in Devres<T> instead of going
        through devm_add_action(), avoiding the extra allocation and the
        unnecessary ARCH_DMA_MINALIGN alignment

   - I/O:
      - Turn IoCapable from a marker trait into a functional trait
        carrying the raw I/O accessor implementation (io_read /
        io_write), providing working defaults for the per-type Io
        methods
      - Add RelaxedMmio wrapper type, making relaxed accessors usable in
        code generic over the Io trait
      - Remove overloaded per-type Io methods and per-backend macros
        from Mmio and PCI ConfigSpace

   - I/O (Register):
      - Add IoLoc trait and generic read/write/update methods to the Io
        trait, making I/O operations parameterizable by typed locations
      - Add register! macro for defining hardware register types with
        typed bitfield accessors backed by Bounded values; supports
        direct, relative, and array register addressing
      - Add write_reg() / try_write_reg() and LocatedRegister trait
      - Update PCI sample driver to demonstrate the register! macro

         Example:

         ```
             register! {
                 /// UART control register.
                 CTRL(u32) @ 0x18 {
                     /// Receiver enable.
                     19:19   rx_enable => bool;
                     /// Parity configuration.
                     14:13   parity ?=> Parity;
                 }

                 /// FIFO watermark and counter register.
                 WATER(u32) @ 0x2c {
                     /// Number of datawords in the receive FIFO.
                     26:24   rx_count;
                     /// RX interrupt threshold.
                     17:16   rx_water;
                 }
             }

             impl WATER {
                 fn rx_above_watermark(&self) -> bool {
                     self.rx_count() > self.rx_water()
                 }
             }

             fn init(bar: &pci::Bar<BAR0_SIZE>) {
                 let water = WATER::zeroed()
                     .with_const_rx_water::<1>(); // > 3 would not compile
                 bar.write_reg(water);

                 let ctrl = CTRL::zeroed()
                     .with_parity(Parity::Even)
                     .with_rx_enable(true);
                 bar.write_reg(ctrl);
             }

             fn handle_rx(bar: &pci::Bar<BAR0_SIZE>) {
                 if bar.read(WATER).rx_above_watermark() {
                     // drain the FIFO
                 }
             }

             fn set_parity(bar: &pci::Bar<BAR0_SIZE>, parity: Parity) {
                 bar.update(CTRL, |r| r.with_parity(parity));
             }
         ```

   - IRQ:
      - Move 'static bounds from where clauses to trait declarations for
        IRQ handler traits

   - Misc:
      - Enable the generic_arg_infer Rust feature
      - Extend Bounded with shift operations, single-bit bool
        conversion, and const get()

  Misc:
   - Make deferred_probe_timeout default a Kconfig option
   - Drop auxiliary_dev_pm_ops; the PM core falls back to driver PM
     callbacks when no bus type PM ops are set
   - Add conditional guard support for device_lock()
   - Add ksysfs.c to the DRIVER CORE MAINTAINERS entry
   - Fix kernel-doc warnings in base.h
   - Fix stale reference to memory_block_add_nid() in documentation"

* tag 'driver-core-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (67 commits)
  bus: fsl-mc: use generic driver_override infrastructure
  s390/ap: use generic driver_override infrastructure
  s390/cio: use generic driver_override infrastructure
  vdpa: use generic driver_override infrastructure
  platform/wmi: use generic driver_override infrastructure
  PCI: use generic driver_override infrastructure
  driver core: make software nodes available earlier
  software node: remove software_node_exit()
  kernel: ksysfs: initialize kernel_kobj earlier
  MAINTAINERS: add ksysfs.c to the DRIVER CORE entry
  drivers/base/memory: fix stale reference to memory_block_add_nid()
  device property: Document how to check for the property presence
  soundwire: debugfs: initialize firmware_file to empty string
  debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
  debugfs: check for NULL pointer in debugfs_create_str()
  driver core: Make deferred_probe_timeout default a Kconfig option
  driver core: simplify __device_set_driver_override() clearing logic
  driver core: auxiliary bus: Drop auxiliary_dev_pm_ops
  device property: Make modifications of fwnode "flags" thread safe
  rust: devres: embed struct devres_node directly
  ...
2026-04-13 19:03:11 -07:00
Linus Torvalds
d568788baa hardening updates for v7.1-rc1
- randomize_kstack: Improve implementation across arches (Ryan Roberts)
 
 - lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test
 
 - refcount: Remove unused __signed_wrap function annotations
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCad16PwAKCRA2KwveOeQk
 u7crAP4qz8gXCjes76KsZm/YQS8PtOG5JroAVu5Oa4ohw0RfaQD+K/XLow1plcNF
 4Bi8zSuv2ifcLysh9qEAbx5+wcHijgo=
 =woB3
 -----END PGP SIGNATURE-----

Merge tag 'hardening-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening updates from Kees Cook:

 - randomize_kstack: Improve implementation across arches (Ryan Roberts)

 - lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test

 - refcount: Remove unused __signed_wrap function annotations

* tag 'hardening-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lkdtm/fortify: Drop unneeded FORTIFY_STR_OBJECT test
  refcount: Remove unused __signed_wrap function annotations
  randomize_kstack: Unify random source across arches
  randomize_kstack: Maintain kstack_offset per task
2026-04-13 17:52:29 -07:00
Linus Torvalds
cea4a90faf seccomp update for v7.1-rc1
- selftests: Add hard-coded __NR_uprobe for x86_64 (Oleg Nesterov)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCad146wAKCRA2KwveOeQk
 u9LrAP4hemiMrgvEIo2DPVJ8H+QiRZtsJvFLFC/yvdgrllxyUQEA24RjRKXoZcL4
 G9hD3FL31MTcbTV9Gdf0bOlLCqqUqg4=
 =7sDF
 -----END PGP SIGNATURE-----

Merge tag 'seccomp-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull seccomp update from Kees Cook:

 - selftests: Add hard-coded __NR_uprobe for x86_64 (Oleg Nesterov)

* tag 'seccomp-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  selftests/seccomp: Add hard-coded __NR_uprobe for x86_64
2026-04-13 17:45:25 -07:00
Linus Torvalds
613b48bbd4 execve updates for v7.1-rc1
- use strnlen() in __set_task_comm (Thorsten Blum)
 
 - update task_struct->comm comment (Thorsten Blum)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCad131AAKCRA2KwveOeQk
 u2tAAP9+DZqxGgNeJSvbzovlFaiFev8b78+tZBZ5ini0ygEbYQEApyejML17Lfqc
 fwhu3aXHfwqIcUw5UfOCMHX/WvnY+AE=
 =7l7I
 -----END PGP SIGNATURE-----

Merge tag 'execve-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull execve updates from Kees Cook:

 - use strnlen() in __set_task_comm (Thorsten Blum)

 - update task_struct->comm comment (Thorsten Blum)

* tag 'execve-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  sched: update task_struct->comm comment
  exec: use strnlen() in __set_task_comm
2026-04-13 17:41:36 -07:00
Linus Torvalds
cae0d23288 pstore updates for v7.1-rc1
- fix ftrace dump, when ECC is enabled (Andrey Skvortsov)
 
 - fix resource leak when ioremap() fails (Cole Leavitt)
 
 - Remove useless memblock header (Guilherme G. Piccoli)
 
 - Fix ECC parameter help text (Guilherme G. Piccoli)
 
 - Keep ftrace module parameter and debugfs switch in sync
   (Guilherme G. Piccoli)
 
 - Factor KASLR offset in the core kernel instruction addresses
   (Guilherme G. Piccoli)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCad13XgAKCRA2KwveOeQk
 uxEeAP94VlOCWiCzuL2NPOEOlzIXYWPZp25PYQSnDTHa1FGL+gEAx7KcBmLOvbNM
 0RX2y1ejJeJ12afH8IQdGYO1zQ102wY=
 =1xG2
 -----END PGP SIGNATURE-----

Merge tag 'pstore-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull pstore updates from Kees Cook:

 - fix ftrace dump when ECC is enabled (Andrey Skvortsov)

 - fix resource leak when ioremap() fails (Cole Leavitt)

 - Remove useless memblock header (Guilherme G. Piccoli)

 - Fix ECC parameter help text (Guilherme G. Piccoli)

 - Keep ftrace module parameter and debugfs switch in sync (Guilherme G.
   Piccoli)

 - Factor KASLR offset in the core kernel instruction addresses
   (Guilherme G. Piccoli)

* tag 'pstore-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  pstore/ftrace: Factor KASLR offset in the core kernel instruction addresses
  pstore/ftrace: Keep ftrace module parameter and debugfs switch in sync
  pstore/ram: fix resource leak when ioremap() fails
  pstore/ramoops: Fix ECC parameter help text
  pstore/ramoops: Remove useless memblock header
  pstore: fix ftrace dump, when ECC is enabled
2026-04-13 17:39:08 -07:00
Linus Torvalds
d142ab35ee CRC updates for 7.1
- Several improvements related to crc_kunit, to align with the
   standard KUnit conventions and make it easier for developers and CI
   systems to run this test suite
 
 - Add an arm64-optimized implementation of CRC64-NVME
 
 - Remove unused code for big endian arm64
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCadWAVxQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK4zEAP9Asz9U6aA8XdlYa66nSORpUz0zQxVL
 tIvSOaQis6K0LwEAm4xABXc+rrVHqYhePRRqDteAEOzhBOX9mwY8wPjR3Ag=
 =VknF
 -----END PGP SIGNATURE-----

Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull CRC updates from Eric Biggers:

 - Several improvements related to crc_kunit, to align with the standard
   KUnit conventions and make it easier for developers and CI systems to
   run this test suite

 - Add an arm64-optimized implementation of CRC64-NVME

 - Remove unused code for big endian arm64

* tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crc: arm64: Simplify intrinsics implementation
  lib/crc: arm64: Use existing macros for kernel-mode FPU cflags
  lib/crc: arm64: Drop unnecessary chunking logic from crc64
  lib/crc: arm64: Assume a little-endian kernel
  lib/crc: arm64: add NEON accelerated CRC64-NVMe implementation
  lib/crc: arm64: Drop check for CONFIG_KERNEL_MODE_NEON
  crypto: crc32c - Remove another outdated comment
  crypto: crc32c - Remove more outdated usage information
  kunit: configs: Enable all CRC tests in all_tests.config
  lib/crc: tests: Add a .kunitconfig file
  lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT
  lib/crc: tests: Make crc_kunit test only the enabled CRC variants
2026-04-13 17:36:04 -07:00
Linus Torvalds
370c388319 Crypto library updates for 7.1
- Migrate more hash algorithms from the traditional crypto subsystem
   to lib/crypto/.
 
   Like the algorithms migrated earlier (e.g. SHA-*), this simplifies
   the implementations, improves performance, enables further
   simplifications in calling code, and solves various other issues:
 
     - AES CBC-based MACs (AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC)
 
         - Support these algorithms in lib/crypto/ using the AES
           library and the existing arm64 assembly code
 
         - Reimplement the traditional crypto API's "cmac(aes)",
           "xcbc(aes)", and "cbcmac(aes)" on top of the library
 
         - Convert mac80211 to use the AES-CMAC library. Note: several
           other subsystems can use it too and will be converted later
 
         - Drop the broken, nonstandard, and likely unused support for
           "xcbc(aes)" with key lengths other than 128 bits
 
         - Enable optimizations by default
 
     - GHASH
 
         - Migrate the standalone GHASH code into lib/crypto/
 
         - Integrate the GHASH code more closely with the very similar
           POLYVAL code, and improve the generic GHASH implementation
           to resist cache-timing attacks and use much less memory
 
         - Reimplement the AES-GCM library and the "gcm" crypto_aead
           template on top of the GHASH library. Remove "ghash" from
           the crypto_shash API, as it's no longer needed
 
         - Enable optimizations by default
 
     - SM3
 
         - Migrate the kernel's existing SM3 code into lib/crypto/, and
           reimplement the traditional crypto API's "sm3" on top of it
 
         - I don't recommend using SM3, but this cleanup is worthwhile
           to organize the code the same way as other algorithms
 
 - Testing improvements
 
     - Add a KUnit test suite for each of the new library APIs
 
     - Migrate the existing ChaCha20Poly1305 test to KUnit
 
     - Make the KUnit all_tests.config enable all crypto library tests
 
     - Move the test kconfig options to the Runtime Testing menu
 
 - Other updates to arch-optimized crypto code
 
     - Optimize SHA-256 for Zhaoxin CPUs using the Padlock Hash Engine
 
     - Remove some MD5 implementations that are no longer worth keeping
 
     - Drop big endian and voluntary preemption support from the arm64
       code, as those configurations are no longer supported on arm64
 
 - Make jitterentropy and samples/tsm-mr use the crypto library APIs
 
 Note: the overall diffstat is neutral, but when the test code is
 excluded it is significantly negative:
 
     Tests:     13 files changed, 1982 insertions(+),  888 deletions(-)
     Non-test: 141 files changed, 2897 insertions(+), 3987 deletions(-)
     All:      154 files changed, 4879 insertions(+), 4875 deletions(-)
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCadWPyxQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK8QCAQD0i98miI1mu01RKuEwrBzmn7L/2sUH
 ReYV/dFDtnN0GwD+KMCiNAM2XTVLRKq5t3OxPHpKZ4y+gZwRowAJeFA02Q8=
 =5rip
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library updates from Eric Biggers:

 - Migrate more hash algorithms from the traditional crypto subsystem to
   lib/crypto/

   Like the algorithms migrated earlier (e.g. SHA-*), this simplifies
   the implementations, improves performance, enables further
   simplifications in calling code, and solves various other issues:

     - AES CBC-based MACs (AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC)

         - Support these algorithms in lib/crypto/ using the AES library
           and the existing arm64 assembly code

         - Reimplement the traditional crypto API's "cmac(aes)",
           "xcbc(aes)", and "cbcmac(aes)" on top of the library

         - Convert mac80211 to use the AES-CMAC library. Note: several
           other subsystems can use it too and will be converted later

         - Drop the broken, nonstandard, and likely unused support for
           "xcbc(aes)" with key lengths other than 128 bits

         - Enable optimizations by default

     - GHASH

         - Migrate the standalone GHASH code into lib/crypto/

         - Integrate the GHASH code more closely with the very similar
           POLYVAL code, and improve the generic GHASH implementation to
           resist cache-timing attacks and use much less memory

         - Reimplement the AES-GCM library and the "gcm" crypto_aead
           template on top of the GHASH library. Remove "ghash" from the
           crypto_shash API, as it's no longer needed

         - Enable optimizations by default

     - SM3

         - Migrate the kernel's existing SM3 code into lib/crypto/, and
           reimplement the traditional crypto API's "sm3" on top of it

         - I don't recommend using SM3, but this cleanup is worthwhile
           to organize the code the same way as other algorithms

 - Testing improvements:

     - Add a KUnit test suite for each of the new library APIs

     - Migrate the existing ChaCha20Poly1305 test to KUnit

     - Make the KUnit all_tests.config enable all crypto library tests

     - Move the test kconfig options to the Runtime Testing menu

 - Other updates to arch-optimized crypto code:

     - Optimize SHA-256 for Zhaoxin CPUs using the Padlock Hash Engine

     - Remove some MD5 implementations that are no longer worth keeping

     - Drop big endian and voluntary preemption support from the arm64
       code, as those configurations are no longer supported on arm64

 - Make jitterentropy and samples/tsm-mr use the crypto library APIs

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (66 commits)
  lib/crypto: arm64: Assume a little-endian kernel
  arm64: fpsimd: Remove obsolete cond_yield macro
  lib/crypto: arm64/sha3: Remove obsolete chunking logic
  lib/crypto: arm64/sha512: Remove obsolete chunking logic
  lib/crypto: arm64/sha256: Remove obsolete chunking logic
  lib/crypto: arm64/sha1: Remove obsolete chunking logic
  lib/crypto: arm64/poly1305: Remove obsolete chunking logic
  lib/crypto: arm64/gf128hash: Remove obsolete chunking logic
  lib/crypto: arm64/chacha: Remove obsolete chunking logic
  lib/crypto: arm64/aes: Remove obsolete chunking logic
  lib/crypto: Include <crypto/utils.h> instead of <crypto/algapi.h>
  lib/crypto: aesgcm: Don't disable IRQs during AES block encryption
  lib/crypto: aescfb: Don't disable IRQs during AES block encryption
  lib/crypto: tests: Migrate ChaCha20Poly1305 self-test to KUnit
  lib/crypto: sparc: Drop optimized MD5 code
  lib/crypto: mips: Drop optimized MD5 code
  lib: Move crypto library tests to Runtime Testing menu
  crypto: sm3 - Remove 'struct sm3_state'
  crypto: sm3 - Remove the original "sm3_block_generic()"
  crypto: sm3 - Remove sm3_base.h
  ...
2026-04-13 17:31:39 -07:00
Linus Torvalds
9932f00bf4 fscrypt updates for 7.1
- Various cleanups for the interface between fs/crypto/ and
   filesystems, from Christoph Hellwig
 
 - Simplify and optimize the implementation of v1 key derivation by
   using the AES library instead of the crypto_skcipher API
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCadV8xhQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK0wSAPsGg/zd0bMiF9dcKKVESAVIePSKFbvx
 5e1speATaXTSVAEAnkLLL1PZJJq9HOKpQY8Wkqpzy8Kmt8x53VeI4YW0fQc=
 =Rb7e
 -----END PGP SIGNATURE-----

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

Pull fscrypt updates from Eric Biggers:

 - Various cleanups for the interface between fs/crypto/ and
   filesystems, from Christoph Hellwig

 - Simplify and optimize the implementation of v1 key derivation by
   using the AES library instead of the crypto_skcipher API

* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux:
  fscrypt: use AES library for v1 key derivation
  ext4: use a byte granularity cursor in ext4_mpage_readpages
  fscrypt: pass a real sector_t to fscrypt_zeroout_range
  fscrypt: pass a byte length to fscrypt_zeroout_range
  fscrypt: pass a byte offset to fscrypt_zeroout_range
  fscrypt: pass a byte length to fscrypt_zeroout_range_inline_crypt
  fscrypt: pass a byte offset to fscrypt_zeroout_range_inline_crypt
  fscrypt: pass a byte offset to fscrypt_set_bio_crypt_ctx
  fscrypt: pass a byte offset to fscrypt_mergeable_bio
  fscrypt: pass a byte offset to fscrypt_generate_dun
  fscrypt: move fscrypt_set_bio_crypt_ctx_bh to buffer.c
  ext4, fscrypt: merge fscrypt_mergeable_bio_bh into io_submit_need_new_bio
  ext4: factor out a io_submit_need_new_bio helper
  ext4: open code fscrypt_set_bio_crypt_ctx_bh
  ext4: initialize the write hint in io_submit_init_bio
2026-04-13 17:29:12 -07:00
Linus Torvalds
81dc1e4d32 twenty six smb3 client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmndBe8ACgkQiiy9cAdy
 T1FpBwv/aFC7A+t2Cc7YAfbcy6reyOWO7SSHFh3drnlHMnwSMuGenVT5mHl0NuqF
 ZHaOu7NL9G0jwiorPFhNvfcrS9cAfKeNj/+0Zjl7XaaZg8gg4/yOBvYHbYb6k+/d
 s9eNcLZncZxsx9hY6afPOFM3gZLY6sMreoe0DdILk8Ez7J2FfGDPY2bKB8OIUE40
 Gt41PHhFJmd8kd1AfE0ihKtfmkLjuFcF9gBHFgq6o8TZj2Zjgzvw3SP+wjwKwIjL
 WG5F6HKke1mgFJn7oB3qrzbNowoK61Il7BCdII+sDlyQLWoAXk10+3IeBvVCMjN6
 mX531RmITm9NgiBS8PABizf/6GYP2zw3TKQqHGWy0zt4Rb+fzFEVquyG10xTr+s4
 b7NA9UJt8iRrVZzEY9NQVU/wspXgSkBeB7OzlnCOeuxbQN9bKowHlI25EC4ZWSV3
 gw6A0XPpMSwe1WPOytDKxTBTwlZ0tdeMXh3Kj/iZgnhf0KVFlZ0CJY4bJf/YbKmL
 I250Z3Xl
 =FbUp
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc1-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client updates from Steve French:

 - Fix EAs bounds check

 - Fix OOB read in symlink response parsing

 - Add support for creating tmpfiles

 - Minor debug improvement for mount failure

 - Minor crypto cleanup

 - Add missing module description

 - mount fix for lease vs. nolease

 - Add Metze as maintainer for smbdirect

 - Minor error mapping header cleanup

 - Improve search speed of SMB1 maperror

 - Fix potential null ptr ref in smb2 map error tests

* tag 'v7.1-rc1-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (26 commits)
  smb: client: allow both 'lease' and 'nolease' mount options
  smb: client: get rid of d_drop()+d_add()
  smb: client: set ATTR_TEMPORARY with O_TMPFILE | O_EXCL
  smb: client: add support for O_TMPFILE
  vfs: introduce d_mark_tmpfile_name()
  MAINTAINERS: create entry for smbdirect
  smb: client: add missing MODULE_DESCRIPTION() to smb1maperror_test
  smb: client: fix OOB reads parsing symlink error response
  smb: client: fix off-by-8 bounds check in check_wsl_eas()
  smb: client: Remove unnecessary selection of CRYPTO_ECB
  smb/client: move smb2maperror declarations to smb2proto.h
  smb/client: introduce KUnit tests to check DOS/SRV err mapping search
  smb/client: check if SMB1 DOS/SRV error mapping arrays are sorted
  smb/client: use binary search for SMB1 DOS/SRV error mapping
  smb/client: autogenerate SMB1 DOS/SRV to POSIX error mapping
  smb/client: annotate smberr.h with POSIX error codes
  smb/client: move ERRnetlogonNotStarted to DOS error class
  smb/client: introduce KUnit test to check ntstatus_to_dos_map search
  smb/client: check if ntstatus_to_dos_map is sorted
  smb/client: use binary search for NT status to DOS mapping
  ...
2026-04-13 17:09:00 -07:00
Linus Torvalds
0b0128e64a xfs: new code for Linux 7.1
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCadyo1AAKCRBcsMJ8RxYu
 YzqJAYDic0mU0VPFyPVQKGvlEw0QTPbWNrbnLa7POD3pyZ4yhTuroA5016YuMM2m
 DouQN6sBgOTZ/kSRH/Rgui6dXmnG5VdR5dZo/ADcTmimfycqwXSgFnxEgTNN4eQE
 Uq0drKXU1A==
 =l6Ln
 -----END PGP SIGNATURE-----

Merge tag 'xfs-merge-7.1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs updates from Carlos Maiolino:
 "There aren't any new features.

  The whole series is just a collection of bug fixes and code
  refactoring. There is some new information added a couple new
  tracepoints, new data added to mountstats, but no big changes"

* tag 'xfs-merge-7.1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (41 commits)
  xfs: fix number of GC bvecs
  xfs: untangle the open zones reporting in mountinfo
  xfs: expose the number of open zones in sysfs
  xfs: reduce special casing for the open GC zone
  xfs: streamline GC zone selection
  xfs: refactor GC zone selection helpers
  xfs: rename xfs_zone_gc_iter_next to xfs_zone_gc_iter_irec
  xfs: put the open zone later xfs_open_zone_put
  xfs: add a separate tracepoint for stealing an open zone for GC
  xfs: delay initial open of the GC zone
  xfs: fix a resource leak in xfs_alloc_buftarg()
  xfs: handle too many open zones when mounting
  xfs: refactor xfs_mount_zones
  xfs: fix integer overflow in busy extent sort comparator
  xfs: fix integer overflow in deferred intent sort comparators
  xfs: fold xfs_setattr_size into xfs_vn_setattr_size
  xfs: remove a duplicate assert in xfs_setattr_size
  xfs: return default quota limits for IDs without a dquot
  xfs: start gc on zonegc_low_space attribute updates
  xfs: don't decrement the buffer LRU count for in-use buffers
  ...
2026-04-13 17:03:48 -07:00
Lorenzo Bianconi
34e1a98ff2 net: airoha: Remove PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration
PCE_MC_EN_MASK bit in REG_FE_PCE_CFG configuration performed in
airoha_fe_init() is used to duplicate multicast packets and send a copy
to the CPU when the traffic is offloaded. This is necessary just if
it is requested by the user. Disable multicast packets duplication by
default.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20260412-airoha_fe_init_remove_mc_en_bit-v1-1-7b6a5a25a74d@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13 17:01:23 -07:00
Linus Torvalds
230fb3a33e Changes since last update:
- Validate xattr h_shared_count to report -EFSCORRUPTED explicitly
    for crafted images
 
  - Verify metadata accesses for file-backed mounts via rw_verify_area()
 
  - Fix FS_IOC_GETFSLABEL to include the trailing NUL byte, consistent
    with ext4 and xfs
 
  - Properly handle 48-bit on-disk blocks/uniaddr for extra devices
 
  - Fix an index underflow in the LZ4 in-place decompression that can
    cause out-of-bounds accesses with crafted images
 
  - Minor fixes and cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmncchsRHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qoXXA//S3iYT8i7iyyeMVwrP5/10k6AbFGDJTar
 eTeLx9itzsxDDNIqih6hmcQKb4fBhHbLA7fMt183+HnO8j2gW9oGUWRfYRWuuRj2
 7xz0JOe5lcRkwS/fzthywOmtHWVGqLZ/JME3bCoZkLOpK8cQSG0o0ZTJjYufdcev
 2UZAIjU2eWrA1lSRfZdnfM5N5oKixOTzEb9/serifgBygYZvNSSPRLecEQPldYKY
 5Db00Q5RnxVwX7HVBmAg8pYyX6ogeIo4Mnh9Itra/vyIJZ9OdgCUVfjx9Q2qAAA5
 gMOv6KppnMZGa8JNvpxg/7+/K/vx2wuNxcf2w0Bz4dVs/6Sby8tbrn2iLJjNYCPh
 Y72aysH51EZK5yD+GEGFKG0rDuBOeW+kSicl8IlfZWDj5hLU4hjboOKNXAZBh921
 DQcoHfkPhf8Ay0z0dDW7Xod9w2VNVtiSXP08T0TvAEelHVMYwkTVCST2bQlOFVrO
 8zy54QwQ5e6deFV5LSpTQn4Nj4+iPqZRaojqX2xlqFd17DXCzu6VolpCr9cIiNmO
 WlAKg3WkomuLcyb1cYt7eNK4PbHZGjUmNjUS+OG6hbqXBMLn5IUF+F31syTf/Q9f
 erSM89entNNk6kVwqiRIVxO314iPp5q9rFDGzBJjxyR99V+oYqv0JVSb7X3SWPTu
 w4VmhbQRsiM=
 =rEW8
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs updates from Gao Xiang:

 - Validate xattr h_shared_count to report -EFSCORRUPTED explicitly for
   crafted images

 - Verify metadata accesses for file-backed mounts via rw_verify_area()

 - Fix FS_IOC_GETFSLABEL to include the trailing NUL byte, consistent
   with ext4 and xfs

 - Properly handle 48-bit on-disk blocks/uniaddr for extra devices

 - Fix an index underflow in the LZ4 in-place decompression that can
   cause out-of-bounds accesses with crafted images

 - Minor fixes and cleanups

* tag 'erofs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: error out obviously illegal extents in advance
  erofs: clean up encoded map flags
  erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
  erofs: handle 48-bit blocks/uniaddr for extra devices
  erofs: include the trailing NUL in FS_IOC_GETFSLABEL
  erofs: ensure all folios are managed in erofs_try_to_free_all_cached_folios()
  erofs: verify metadata accesses for file-backed mounts
  erofs: harden h_shared_count in erofs_init_inode_xattrs()
2026-04-13 16:59:19 -07:00
Linus Torvalds
a62fe21079 Description for this pull request:
- Implement FALLOC_FL_ALLOCATE_RANGE to add support for preallocating
    clusters without zeroing, helping to reduce file fragmentation.
  - Add a unified block readahead helper for FAT chain conversion, bitmap
    allocation, and directory entry lookups.
  - Optimize exfat_chain_cont_cluster() by caching buffer heads to minimize
    mark_buffer_dirty() and mirroring overhead during NO_FAT_CHAIN to
    FAT_CHAIN conversion.
  - Switch to truncate_inode_pages_final() in evict_inode() to prevent
    BUG_ON caused by shadow entries during reclaim.
  - Fix a 32-bit truncation bug in directory entry calculations by ensuring
    proper bitwise coercion.
  - Fix sb->s_maxbytes calculation to correctly reflect the maximum possible
    volume size for a given cluster size, resolving xfstests generic/213.
  - Introduced exfat_cluster_walk() helper to traverse FAT chains by
    a specified step, handling both ALLOC_NO_FAT_CHAIN and ALLOC_FAT_CHAIN
    modes.
  - Introduced exfat_chain_advance() helper to advance an exfat_chain
    structure, updating both the current cluster and remaining size.
  - Remove dead assignments and fix Smatch warnings.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmnbHMUWHGxpbmtpbmpl
 b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCHXZEACDyb7s63to6V0tdry1D+/Q0hrX
 blgUDnD+oGM5J+rFsvmfU+GhUJhe3hIgvLReUpBzrjegdVXCc6wBn+pBzQkjq81A
 emJOIjOzyTgwusLuneSMGBZ3oCBJDiREGWqFeoeV1IHZoXvL4oqVr11V4b+8l2ms
 Y2FqMljg8AYsgD/Wf3nXPJ1kph/5qpxeKQB4O1RIMEqJp5uoU0byDAtJSjde7oKy
 cBRyYeGxcJ0UkQNX3pOfJHe2+Hb2wvCOPWpZ7fw4OfsOYcJMM7IFEKoT2tH67sx9
 fo3J/Q74A2Gd0pwyWUwX2xK70uSkoLCR6TxInIgLaKK2IHmgpSHUJa+F5Nz9QFED
 PDsBMedt38QXlI4jHNfYTIZuFXgFpIuDJyiphX7tQ72n+JVTiWNnKEF9mRRpRzZ+
 2AV6h6YXN0Sd4/EJts+hf1S5admwEKNYpaBXgNTUBD/BbUQcKmvw8JQNk5/tYjU4
 9jr4ab1jj1tvWtw9r2Ceu/W71W3l+Ys8gxcJB2DJB1vvo9h23NyHoNwnBMAwmNRv
 5ykE7LFFHzwt8QUTMiGlMy5NFpd9cwcVKjzXd+Iogxqa1pDW/lFXrEYxzfvsqPwo
 cBNIu2hUf2ESqctAmOWbpCRZwSWMQjh7cUwIHPqNcG2f3JMCzxxVlQC6SUJYr1qv
 LoSPVMnQU/ReqFfK6w==
 =JG0E
 -----END PGP SIGNATURE-----

Merge tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat

Pull exfat updates from Namjae Jeon:

 - Implement FALLOC_FL_ALLOCATE_RANGE to add support for preallocating
   clusters without zeroing, helping to reduce file fragmentation

 - Add a unified block readahead helper for FAT chain conversion, bitmap
   allocation, and directory entry lookups

 - Optimize exfat_chain_cont_cluster() by caching buffer heads to
   minimize mark_buffer_dirty() and mirroring overhead during
   NO_FAT_CHAIN to FAT_CHAIN conversion

 - Switch to truncate_inode_pages_final() in evict_inode() to prevent
   BUG_ON caused by shadow entries during reclaim

 - Fix a 32-bit truncation bug in directory entry calculations by
   ensuring proper bitwise coercion

 - Fix sb->s_maxbytes calculation to correctly reflect the maximum
   possible volume size for a given cluster size, resolving xfstests
   generic/213

 - Introduced exfat_cluster_walk() helper to traverse FAT chains by a
   specified step, handling both ALLOC_NO_FAT_CHAIN and ALLOC_FAT_CHAIN
   modes

 - Introduced exfat_chain_advance() helper to advance an exfat_chain
   structure, updating both the current cluster and remaining size

 - Remove dead assignments and fix Smatch warnings

* tag 'exfat-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
  exfat: use exfat_chain_advance helper
  exfat: introduce exfat_chain_advance helper
  exfat: remove NULL cache pointer case in exfat_ent_get
  exfat: use exfat_cluster_walk helper
  exfat: introduce exfat_cluster_walk helper
  exfat: fix incorrect directory checksum after rename to shorter name
  exfat: fix s_maxbytes
  exfat: fix passing zero to ERR_PTR() in exfat_mkdir()
  exfat: fix error handling for FAT table operations
  exfat: optimize exfat_chain_cont_cluster with cached buffer heads
  exfat: drop redundant sec parameter from exfat_mirror_bh
  exfat: use readahead helper in exfat_get_dentry
  exfat: use readahead helper in exfat_allocate_bitmap
  exfat: add block readahead in exfat_chain_cont_cluster
  exfat: add fallocate FALLOC_FL_ALLOCATE_RANGE support
  exfat: Fix bitwise operation having different size
  exfat: Drop dead assignment of num_clusters
  exfat: use truncate_inode_pages_final() at evict_inode()
2026-04-13 16:57:31 -07:00
Linus Torvalds
f2729827ae nilfs2 updates for v7.1
- nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
 - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCadlsMAAKCRAhI4xTh21N
 nVLWAQC9fY9kH2fzW7MQKt0/33iN+KwnWPCTChVjSspoSG14QAEAiWqEiVcJtvGN
 ARJgvHKX7fUzZf2YoVnVeGheOrbdvgE=
 =XmKt
 -----END PGP SIGNATURE-----

Merge tag 'nilfs2-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2

Pull nilfs2 updates from Viacheslav Dubeyko:
 "This contains fixes of syzbot reported issues in NILFS2 functionality:

   - The DAT inode's btree node cache (i_assoc_inode) is initialized
     lazily during btree operations.

     However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is
     already initialized when copying dirty pages to the shadow map
     during GC. If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately
     after mount before any btree operation has occurred on the DAT
     inode, i_assoc_inode is NULL leading to a general protection fault.

     Fix this by calling nilfs_attach_btree_node_cache() on the DAT
     inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is
     always initialized before any GC operation can use it (Deepanshu
     Kartikey)

   - nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead
     blocks by comparing it with the current block number bd_blocknr. If
     they differ, the block is considered dead and skipped.

     A corrupted ioctl request with bd_oblocknr set to 0 causes the
     comparison to incorrectly match when the lookup returns -ENOENT and
     sets bd_blocknr to 0, bypassing the dead block check and calling
     nilfs_bmap_mark() on a non- existent block. This causes
     nilfs_btree_do_lookup() to return -ENOENT, triggering the
     WARN_ON(ret == -ENOENT).

     Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at
     the beginning of each iteration (Deepanshu Kartikey)"

* tag 'nilfs2-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
  nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
  nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
2026-04-13 16:53:19 -07:00
Linus Torvalds
4d9981429a hfs/hfsplus updates for v7.1
- hfsplus: fix generic/642 failure
 - hfsplus: rework logic of map nodes creation in xattr b-tree
 - hfsplus: fix logic of alloc/free b-tree node
 - hfsplus: fix error processing issue in hfs_bmap_free()
 - hfsplus: fix potential race conditions in b-tree functionality
 - hfsplus: extract hidden directory search into a helper function
 - hfsplus: fix held lock freed on hfsplus_fill_super()
 - hfsplus: fix generic/523 test-case failure
 - hfsplus: validate b-tree node 0 bitmap at mount time
 - hfsplus: refactor b-tree map page access and add node-type validation
 - hfsplus: fix to update ctime after rename
 - hfsplus: fix generic/533 test-case failure
 - hfsplus: set ctime after setxattr and removexattr
 - hfsplus: fix uninit-value by validating catalog record size
 - hfsplus: fix potential Allocation File corruption after fsync
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCadlj7wAKCRAhI4xTh21N
 nRzsAQDhjGNvUe9QJUDk7D/GjMxWUs+8jrGw9Ruu8GhvRIePzwEAtkZoJRwNQzwa
 9XEyenrKqxLTaqaPtRChicbmdKw7eQQ=
 =TUrR
 -----END PGP SIGNATURE-----

Merge tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs

Pull hfsplus updates from Viacheslav Dubeyko:
 "This contains several fixes of syzbot reported issues and HFS+ fixes
  of xfstests failures.

   - Fix a syzbot reported issue of a KMSAN uninit-value in
     hfsplus_strcasecmp().

     The root cause was that hfs_brec_read() doesn't validate that the
     on-disk record size matches the expected size for the record type
     being read. The fix introduced hfsplus_brec_read_cat() wrapper that
     validates the record size based on the type field and returns -EIO
     if size doesn't match (Deepanshu Kartikey)

   - Fix a syzbot reported issue of processing corrupted HFS+ images
     where the b-tree allocation bitmap indicates that the header node
     (Node 0) is free. Node 0 must always be allocated. Violating this
     invariant leads to allocator corruption, which cascades into kernel
     panics or undefined behavior.

     Prevent trusting a corrupted allocator state by adding a validation
     check during hfs_btree_open(). If corruption is detected, print a
     warning identifying the specific corrupted tree and force the
     filesystem to mount read-only (SB_RDONLY).

     This prevents kernel panics from corrupted images while enabling
     data recovery (Shardul Bankar)

   - Fix a potential deadlock in hfsplus_fill_super().

     hfsplus_fill_super() calls hfs_find_init() to initialize a search
     structure, which acquires tree->tree_lock. If the subsequent call
     to hfsplus_cat_build_key() fails, the function jumps to the
     out_put_root error label without releasing the lock.

     Fix this by adding the missing hfs_find_exit(&fd) call before
     jumping to the out_put_root error label. This ensures that
     tree->tree_lock is properly released on the error path (Zilin Guan)

   - Update a files ctime after rename in hfsplus_rename() (Yangtao Li)

  The rest of the patches introduce the HFS+ fixes for the case of
  generic/348, generic/728, generic/533, generic/523, and generic/642
  test-cases of xfstests suite"

* tag 'hfs-v7.1-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
  hfsplus: fix generic/642 failure
  hfsplus: rework logic of map nodes creation in xattr b-tree
  hfsplus: fix logic of alloc/free b-tree node
  hfsplus: fix error processing issue in hfs_bmap_free()
  hfsplus: fix potential race conditions in b-tree functionality
  hfsplus: extract hidden directory search into a helper function
  hfsplus: fix held lock freed on hfsplus_fill_super()
  hfsplus: fix generic/523 test-case failure
  hfsplus: validate b-tree node 0 bitmap at mount time
  hfsplus: refactor b-tree map page access and add node-type validation
  hfsplus: fix to update ctime after rename
  hfsplus: fix generic/533 test-case failure
  hfsplus: set ctime after setxattr and removexattr
  hfsplus: fix uninit-value by validating catalog record size
  hfsplus: fix potential Allocation File corruption after fsync
2026-04-13 16:50:38 -07:00
Xin Long
2cd7e6971f sctp: disable BH before calling udp_tunnel_xmit_skb()
udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with
BH disabled.  After commit 6f1a9140ec ("add xmit recursion limit to
tunnel xmit functions"), on the path:

  udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()

dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.

Without local_bh_disable(), the context may move between CPUs, which can
break the inc/dec pairing. This may lead to incorrect recursion level
detection and cause packets to be dropped in ip(6)_tunnel_xmit() or
__dev_queue_xmit().

Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.

In my testing, after enabling the SCTP over UDP:

  # ip net exec ha sysctl -w net.sctp.udp_port=9899
  # ip net exec ha sysctl -w net.sctp.encap_port=9899
  # ip net exec hb sysctl -w net.sctp.udp_port=9899
  # ip net exec hb sysctl -w net.sctp.encap_port=9899

  # ip net exec ha iperf3 -s

- without this patch:

  # ip net exec hb iperf3 -c 192.168.0.1 --sctp
  [  5]   0.00-10.00  sec  37.2 MBytes  31.2 Mbits/sec  sender
  [  5]   0.00-10.00  sec  37.1 MBytes  31.1 Mbits/sec  receiver

- with this patch:

  # ip net exec hb iperf3 -c 192.168.0.1 --sctp
  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  sender
  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  receiver

Fixes: 6f1a9140ec ("net: add xmit recursion limit to tunnel xmit functions")
Fixes: 046c052b47 ("sctp: enable udp tunneling socks")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/c874a8548221dcd56ff03c65ba75a74e6cf99119.1776017727.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13 16:50:28 -07:00
Xin Long
bf6f95ae3b sctp: fix missing encap_port propagation for GSO fragments
encap_port in SCTP_INPUT_CB(skb) is used by sctp_vtag_verify() for
SCTP-over-UDP processing. In the GSO case, it is only set on the head
skb, while fragment skbs leave it 0.

This results in fragment skbs seeing encap_port == 0, breaking
SCTP-over-UDP connections.

Fix it by propagating encap_port from the head skb cb when initializing
fragment skbs in sctp_inq_pop().

Fixes: 046c052b47 ("sctp: enable udp tunneling socks")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/ea65ed61b3598d8b4940f0170b9aa1762307e6c3.1776017631.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-13 16:49:37 -07:00