mirror of
https://github.com/torvalds/linux.git
synced 2026-07-29 10:41:49 +02:00
39d3389331
1413370 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
39d3389331 |
drm-fixes for 6.19-rc6
Core Changes: - take gem lock when preallocating in gpuvm. - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations Driver Changes: - i915: compiler noise fix - amdgpu/amdkfd: pile of fixes all over - vmwgfx: v10 cursor regression fix, other fixes - rockchip: waiting for cfgdone regression fix, other fixes - gud: fix oops on disconnect - simple-panel: regression fix when connector is not set, fix for DataImage SCF0700C48GGU18 - nouveau: cursor handling locking fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEciDa6W7nX7VwIxa1EpWk/0GBDXwFAmlqpQ0ACgkQEpWk/0GB DXzbAhAAtdjW2PuO02IJWAx7xl5BTOUwvgYrl5UkWOQN+P/V4Q3+37F2WbRxhHfd vjCWn76A1ePNATkT9kwgjZr8CjfqILMU4I9bTPlqwI8uxAt8dwfTLj3FeiWMAn5N vXEZC1imUjdHBcM1ezVODM5cgYV7WovpB7C7ZTsJM6eJF2YmUxOZcShpPEJct3ul bkIGO/q8/YOxGiOf9EHLV6uev0dEh7HPUDvE70zmQM42P5hs/kROVjFl6o97pynV LLfdCfShWOZe9FPWP7s3u2QTT68YM+ce9hCrIiRMKZVWnQm6f2BS/GMq7JUbwUsa FJUD5aR+Cfe7Q3FbyzDBPBavPsJcRdE1SgLtyNixTevKeQUNf9vLNK736WnWkTBr VGzAqla90WTBfAw3Bo87d9K6XTdVOOKmdWZrXFFLf9GLS8LnxuGIzBaG7MWvhF64 EL1ETyS0rc2TjvH4O9vsKHiGpX2nexYPfvyQ1ax1gRPcDdeYRg6j77pDA+j7vOMH 7ImtypG+T6ZdeWjTFtKoGeJS8rgHCjunLG/KxCgUX8x9uImPCQqVHf9SG5HxBSWl cLh4jxJwaliQyrC+VfIT8zLEWuyinQZYuCRTOynLyKEkncQ+ZyM5J4pwHhgm8Tyk aArLlTfxfbQOBzTmwpA9Jy90ndsT4V/XHmqb2IFRIx5NVvBoXPg= =AH3M -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "We've had nothing aside of a compiler noise fix until today, when the amd and drm-misc fixes showed up after Dave already went into weekend mode. So it's on me to push these out, since there's a bunch of important fixes in here I think that shouldn't be delayed for a week. Core Changes: - take gem lock when preallocating in gpuvm - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations Driver Changes: - i915: compiler noise fix - amdgpu/amdkfd: pile of fixes all over - vmwgfx: - v10 cursor regression fix - other fixes - rockchip: - waiting for cfgdone regression fix - other fixes - gud: fix oops on disconnect - simple-panel: - regression fix when connector is not set - fix for DataImage SCF0700C48GGU18 - nouveau: cursor handling locking fix" * tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernel: (33 commits) drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 drm/amdkfd: No need to suspend whole MES to evict process Revert "drm/amdgpu: don't attach the tlb fence for SI" drm/amdgpu: validate the flush_gpu_tlb_pasid() drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 drm/amd/display: Initialise backlight level values from hw drm/amd/display: Bump the HDMI clock to 340MHz drm/amd/display: Show link name in PSR status message drm/amdkfd: fix a memory leak in device_queue_manager_init() drm/amdgpu: make sure userqs are enabled in userq IOCTLs drm/amdgpu: Use correct address to setup gart page table for vram access Revert duplicate "drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces" drm/amd: Clean up kfd node on surprise disconnect drm/amdgpu: fix drm panic null pointer when driver not support atomic drm/amdgpu: Fix gfx9 update PTE mtype flag drm/sysfb: Remove duplicate declarations drm/nouveau/kms/nv50-: Assert we hold nv50_disp->lock in nv50_head_flush_* drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare drm/gud: fix NULL fb and crtc dereferences on USB disconnect ... |
||
|
Linus Torvalds
|
6782a30d20 |
cxl fixes for v6.19-rc6
- Recognize all ZONE_DEVICE users as physaddr consumers - Fix format string for extended_linear_cache_size_show() - Fix target list setup for multiple decoders sharing the same downstream port - Restore HBIW check before derefernce platform data - Fix potential infinite loop in __cxl_dpa_reserve() - Check for invalid addresses returned from translation functions on error. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmlqdOUACgkQYGjFFmlT OEp6bA/8C5uSMf4BMN+gJMerX1wTcVfmDy3nYyk80ZM4Gw2QqxrhtRzG3bfeYaXm IioxYVMWscqasN16xuX7uje2sSDvoPTZYJ2tfnzKfAbyReknlolXvjWJtgoSuVKj IGZDGLjuW0CcTpFW8NgNGiiSExnv6Iap7CnzRTXj72ZQkGcb8Goh4JL/CmAWrF8m HQDbFZWQHI60rOLgxTXgWzlNKej4/tZfCTRKV1KIhqRv+MCurzNPb62H+giCwGDh M+apYESCW3xCk2B7RbGmc6U+rcSmCNc3O31JL3Yt9TKPp4V5N0kaH8dd1196GnQX HOJFlDjV5J/HTJjk4vondyAcIcUaSw3T7IJLtBRbXOBrs1zQ76adV96UNSwSEQC4 KaRjRf0uCsdDvwBw44VbxnWJiH6Y6jrMhKGPyCrXxFikX2EIR5I1l7+ytKDTNC/+ wdAf3+ch3qc6PfTBtooAWzji9e8JFfWpby87UHkWSz0eeKedJQnMbKtbloc6tHLc fO/jiUbhay5QGfnvdPwL31zTGqvZB9eGUR2oBSasRJ7taWvURN2ibAzhAnTY8UTN EQrTZ7isXPfxHwEkaGtpFNWts0iX8kJYzl/wjZjWtukltT4NmMy7NfMlkecXWQ5N iueUMr6tHKYeDpmmFbdC+Y83LFSWv3i9TiINF1vMWuRj8MryRVU= =pIv9 -----END PGP SIGNATURE----- Merge tag 'cxl-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: - Recognize all ZONE_DEVICE users as physaddr consumers - Fix format string for extended_linear_cache_size_show() - Fix target list setup for multiple decoders sharing the same downstream port - Restore HBIW check before derefernce platform data - Fix potential infinite loop in __cxl_dpa_reserve() - Check for invalid addresses returned from translation functions on error * tag 'cxl-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Check for invalid addresses returned from translation functions on errors cxl/hdm: Fix potential infinite loop in __cxl_dpa_reserve() cxl/acpi: Restore HBIW check before dereferencing platform_data cxl/port: Fix target list setup for multiple decoders sharing the same dport cxl/region: fix format string for resource_size_t x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers |
||
|
Linus Torvalds
|
d815858300 |
pci-v6.19-fixes-3
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmlqaqEUHGJoZWxnYWFz QGdvb2dsZS5jb20ACgkQWYigwDrT+vyRKRAAoVQOcfcmUqBkNq8fqDYlJQanZVPZ Krq+He/5zGLwjieAezMUCbonq8rVDnZitAFl7gh02g8YcDf2ypevUOBYD3Pes+K1 TgLP1j4cuUgWTaFeXaaECOfmmXcSlWoI13dIMHX1GyBlVGBrbfm2M5ErAeJNAR5C k7wyuIkKQN4ie+vOoaIdzmRerOODpu/JblDML84A8VzhyaJwhmWw6nt0iIEj6dI2 pqkiv/yX5n6BbnyaQg/AdsDZSv3hGWso40mUUGIK9Ii+GfWZUwFu/qrvHEbAObCC qo4OJHMOkxFNJVCZCN6grGuWYMgHiyE50UQUDEqBUgSw500FiBK6MygibkrYncVZ Q+jVwTl+/6cxPY2ZBciekrwI0XEBW2biZBXIRE2V2fNeSeXqwK0ZZUpiK8anGsWs 2P72ZLW4anfavrKrt61EbzOa7VnriQ7nJ3s5ESC+yEUBIhWDNLmu+PaHE86FgW8S GpZYUA4i92CvPdw1C06IKm4MX2h+FuaspR3iWjjDrKeFC6P0CcS5aE5APs4Y4h7K mGglinWItTWC+AX3c5e1Db0iJ0ZkgApCp582/KsVHhHceSTjLYjXIVwMOfrcz3mI o1WN0oriW82Q77WsZdGjL9GnePzyOOmtia6ru2BiPiXaSRcQxaqrFk/Ux2rKxQ+x p8AiXddPij2c1iw= =ZgwY -----END PGP SIGNATURE----- Merge tag 'pci-v6.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Add a pci_free_irq_vectors() stub to fix a build issue when CONFIG_PCI is not set (Boqun Feng) * tag 'pci-v6.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Provide pci_free_irq_vectors() stub |
||
|
Linus Torvalds
|
b62ce2547f |
Power management fixes for 6.19-rc6
- Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout)
- Fix stale description of the cost field in struct em_perf_state to
reflect the current code (Yaxiong Tian)
- Fix and revamp the energy model YNL specification added recently
along with the energy model netlink interface (Changwoo Min)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmlqWS8SHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1BhAH/iSA/9YP9/xIW+rIZj2irsncGVc/hJ+V
8PcM2tar966AEQBlmDPc7ug2MXT0Mb/5WRtQo/IvZ1tdAALB+bC70FHjdu3y7SAX
IzFGyHKJ9OVJHGxYq0TCBbRXgYubUZiqvAnaBTBZ/ZIFlt3B4KEyatfFfxJMb1Pe
H9zQIyUVBN1tjPfgNVbc22XGfkwfmmla72le6GmHseKZRqpwutIwzxm1PoMNVeLb
fQv625LsWrDD9NU6j5uGq3WEq3xPltubtHN545FTFi4aGwBYJaG1FuIi+kPiQuCR
VZmxTWVEiVwjttiZf/xWbOkPfwQqdgeXlTk5j+iBlF1jkrrW75IuLYQ=
=eJ2p
-----END PGP SIGNATURE-----
Merge tag 'pm-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These fix an error path memory leak in the energy model management
code, fix a kerneldoc comment in it, and fix and revamp the energy
model YNL specification added recently along with the new energy model
management netlink interface (that received feedback after being
added):
- Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout)
- Fix stale description of the cost field in struct em_perf_state to
reflect the current code (Yaxiong Tian)
- Fix and revamp the energy model YNL specification added recently
along with the energy model netlink interface (Changwoo Min)"
* tag 'pm-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: EM: Add dump to get-perf-domains in the EM YNL spec
PM: EM: Change cpus' type from string to u64 array in the EM YNL spec
PM: EM: Rename em.yaml to dev-energymodel.yaml
PM: EM: Fix yamllint warnings in the EM YNL spec
PM: EM: Fix memory leak in em_create_pd() error path
PM: EM: Fix incorrect description of the cost field in struct em_perf_state
|
||
|
Simona Vetter
|
9dd1f5f3eb |
drm-misc-fixes for v6.19-rc6:
vmwgfx: - Fix hw regression from refactoring cursor handling on v10 'hardware' - Fix warnings in destructor by merging the 2 release functions - kernel doc fix - error handling in vmw_compat_shader_add() rockchip: - fix vop2 polling - fix regression waiting for cfgdone without config change - fix warning when enabling encoder core: - take gem lock when preallocating in gpuvm. - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations gud: - Fix oops on usb disconnect Simple panel: - Re-add fallback when connector is not set to fix regressions - Set correct type in DataImage SCF0700C48GGU18 nouveau: - locking fixes for cursor handling. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmlqIjYACgkQ/lWMcqZw E8PnzA/+PkSSjxyYhjr6/thd8fGXQ6kEIqLtfNB/VEffNeDssVtea+kK0DJNK4XR 4OVoNs5EXMXEhhKRgy5L2duaRqeR+gHPjVkBJTkQDO+ADnwQody2v/LXU1b8Wfdc hr8CzGHRFL2Vabmjtn0k7t1HBx5UOA0mxtXZHuZs5ZR9nTLFVgjzLML+DV4IG2ng jjOFi0lHtRDEE/1Q6enCH8r7h34SvztCTBd354zRBhi3oA+mD7gdlzLq05ewOqHd HbGKR8pdsaloVN5EaNbR8WxEfRI8MXRt29Msuv2FsJ8v0A1w1mRPd+Nupvmynqs4 Gm/RXeaFRktLK1xqdefN9w0Wga7HkgVXAyhrgsAWqJrZPzwxr0HVFH5wJ/ghQyL+ dItG2wE/uUYt1iGs6sRhW+360v5yLjPG7nVna1vi2Q+D5dLGEbVZKfYmsjIL1C7Y F2wcp13OVJFFceEaxOcJKUguVXfA0ll8uhaoQrn7g0bEZLxlTtQMQRO+Iu6Hu5wT 0ehdv/UD+jsBWuWWM8n0cjgVeUUMnkaFFfnEbvAXGetvBhZRfqe/BRH4INmO6uHv OviS1++e6ki5ZEraphh07ngnnTloV6rTm15QtVBOhsVRWNfLagMicP7YyD7QJjH4 6oBamDgcPvXTyYzrZM6WxWHfRghZSMAcuxMQfGMxlcsgXCGvlXI= =Oc9s -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc6: vmwgfx: - Fix hw regression from refactoring cursor handling on v10 'hardware' - Fix warnings in destructor by merging the 2 release functions - kernel doc fix - error handling in vmw_compat_shader_add() rockchip: - fix vop2 polling - fix regression waiting for cfgdone without config change - fix warning when enabling encoder core: - take gem lock when preallocating in gpuvm. - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations gud: - Fix oops on usb disconnect Simple panel: - Re-add fallback when connector is not set to fix regressions - Set correct type in DataImage SCF0700C48GGU18 nouveau: - locking fixes for cursor handling. Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/ce0acfe2-9c1a-42b7-8782-f1e7f34b8544@linux.intel.com |
||
|
Linus Torvalds
|
e547d4f733 |
ACPI support fixes for 6.19-rc6
Add checks missed by a previous recent update to the ACPI suspend-to-idle code and add a debug module parameter to it to work around a platform firmware issue exposed by that update (Rafael Wysocki) -----BEGIN PGP SIGNATURE----- iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmlqWf4SHHJqd0Byand5 c29ja2kubmV0AAoJEO5fvZ0v1OO1af0H/3MSxrRFbG1F+e+yYNRGVfEW8pLCoDts sjHpB4PDLPsp1mnobzEdyqmhaTxsf4vvmZzS63GNIMt3tl0G28o5baTQP55fKpYM zdcyF42yG1HiZnfHRYf8aPirTFQ98ztNRKYltlg6RV36CYC1BW7U7/YqZuw3KUd0 DMF0voYvA0mYa7XwpdoERgAtGkXcKYUBSUdu/FjExnDkk+ZgQM3lrCHEvuiFqscF ld4MmHg9b18sWfPXUcb56jTW90zVpIYu6VVa7wWyL93JoGDpBnvPeagwqbhP+VMx Z/ea5ADoDO1OXtszm5C7UGVGrgLdiATkho8y6cw/R9iqsU2lx7KhZ4I= =ZulU -----END PGP SIGNATURE----- Merge tag 'acpi-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Add checks missed by a previous recent update to the ACPI suspend-to-idle code and add a debug module parameter to it to work around a platform firmware issue exposed by that update (Rafael Wysocki)" * tag 'acpi-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Add module parameter for LPS0 constraints checking ACPI: PM: s2idle: Add missing checks to acpi_s2idle_begin_lps0() |
||
|
Linus Torvalds
|
711673f8dd |
sound fixes for 6.19-rc6
This PR became a bit larger than wished, often seen as a bump at the
middle, but almost all changes are small device-specific fixes, so the
risk must be pretty low.
- SoundWire fix for missing symbol export
- Fixes for device-tree bindings
- A fix for OOB access in USB-audio, spotted by fuzzer
- Quirks for HD-audio, SoundWire, AMD ACP
- A series of ASoC tlv320 and wsa codec fixes
- Other misc fixes in PCM OSS error-handling, Cirrus scodec test,
ASoC ops endianess, davinci, simple-card, and tegra.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmlpB+kOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8/AhAAqp94DWV8TJU5GOz+FzMilAHNomhuXpDz8+vq
gQpL4rmZCYl+BE+clOItQ4GxD9NWNhE87YFqguvzmBIZ68bSzQ1jDtPudIDp7m9n
LNmxZlgIobRnzUeulI5ri+kxd7nLm0WheIhL3dDtb9LK7TDENUic+o3f59LZussQ
PcO1vfO9f80CbNEpwPnt27C7GV0esYUyCKAvkHzQ0SvVkD44zMrRPsiNESCVKkaH
8Kgvs+TCl1dO8VlDQo2WErLTLJH/5CsovGA01osXA1YzXXMl5fU5JcKQXq3RK6xm
6NTM4Er/yO5/DKDSa0r7Tr6LZ8UxuDQttg11YKC/bjtaO2l1gmbrdLaFPPPDdyRD
DCPHzhZzRPtL7ueFSwBSsbw4NInrTZpvrtwqfILb+XMSgvQacOLaOdqFf4+uEL+N
j9xEenW3ecliBzFGKi26R2+GAqQ8Jd3R57RkV0AMZQSd45DQLPxkKffYGa5oImVe
uMObAaEbCIkSNfBn7I0AyUEej09e3ReQMjJxeOZlwKpQnqnwPS2obO7HxAIyQewe
LtPYdxjbaUXpQuwBBwMXWOrb1aKpbetdfnn2ETVdpOaMLyV6R68Hpp7h3TsqvjXy
vL0SouznSkyO118v3lXt3NTRsDBZD+nk5cmW0luz3K50AEbq8eBxJR0v/iOuKJiC
M7LtvUc=
=zwBT
-----END PGP SIGNATURE-----
Merge tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"This became a bit larger than wished for, often seen as a bump at the
middle, but almost all changes are small device-specific fixes, so the
risk must be pretty low.
- SoundWire fix for missing symbol export
- Fixes for device-tree bindings
- A fix for OOB access in USB-audio, spotted by fuzzer
- Quirks for HD-audio, SoundWire, AMD ACP
- A series of ASoC tlv320 and wsa codec fixes
- Other misc fixes in PCM OSS error-handling, Cirrus scodec test,
ASoC ops endianess, davinci, simple-card, and tegra"
* tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits)
ALSA: hda/tas2781: Add newly-released HP laptop
ASoC: rt5640: Fix duplicate clock properties in DT binding
ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED
ASoC: tlv320adcx140: fix word length
ASoC: tlv320adcx140: Propagate error codes during probe
ASoC: tlv320adcx140: fix null pointer
ASoC: tlv320adcx140: invert DRE_ENABLE
ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
ASoC: sdw_utils: Call init callbacks on the correct codec DAI
soundwire: Add missing EXPORT for sdw_slave_type
ALSA: usb-audio: Prevent excessive number of frames
ALSA: hda/cirrus_scodec_test: Fix test suite name
ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
ALSA: hda/realtek: Add quirk for Asus Zephyrus G14 2025 using CS35L56, fix speakers
ASoC: amd: yc: Fix microphone on ASUS M6500RE
ASoC: tegra: Revert fix for uninitialized flat cache warning in tegra210_ahub
ASoC: dt-bindings: rockchip-spdif: Allow "port" node
ASoC: dt-bindings: realtek,rt5640: Allow 7 for realtek,jack-detect-source
ASoC: dt-bindings: realtek,rt5640: Add missing properties/node
ASoC: dt-bindings: realtek,rt5640: Document port node
...
|
||
|
Simona Vetter
|
52456a6217 |
amd-drm-fixes-6.19-2026-01-15:
amdgpu: - GC 9 PTE mtype fix - Non-DC display kernel panic helper fix - Merge fix - GART vram access fix - Userq fixes - PSR debugging fix - HDMI fixes - Backlight fix - SMU 14 fix - TLB flush fixes amdkfd: - KFD node cleanup for eGPU disconnect - Memory leak fix - MES evict process fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaWlTRwAKCRC93/aFa7yZ 2MTJAP45YDzS6zo5Ldku5ZqB/CunUAtswDMVmvny0xgGrV5d5QD/f9xF8a3a0chp YPNPL7uIhZCdxu3CrnSYda+xlBdinQc= =D9B+ -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-6.19-2026-01-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-15: amdgpu: - GC 9 PTE mtype fix - Non-DC display kernel panic helper fix - Merge fix - GART vram access fix - Userq fixes - PSR debugging fix - HDMI fixes - Backlight fix - SMU 14 fix - TLB flush fixes amdkfd: - KFD node cleanup for eGPU disconnect - Memory leak fix - MES evict process fix Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260115205405.1890089-1-alexander.deucher@amd.com |
||
|
Linus Torvalds
|
c2a44a02d7 |
gpio fixes for v6.19-rc6
- implement the missing .get_direction() callback for gpio-davinci
- remove redundant check in GPIO core which can also propagate an
invalid errno to user-space
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmlqHwAACgkQBZ0uy/82
hMPlqA/7BCNp4OLeEBcs6EXERSoTLdllY4Z1and2UTzRZ7ioyckDJtwehQKKiZG/
3H0LtB948kq7RV19vrJLjQzDOm7j68eNdV0nIfeSjiS+UWqjnohmbJM3bgzG6IzL
l4N1ZHsKr2nsc/OaFS7felLED5GZ5mynoPzsy4tQQgvEeNLJGSTj06f0KcVbwK2K
mFUveKyuTa1o3QNIuu8P2BdKZC3rApP8KA2pAusuUmrQ1yNkolDZehWySVNTtlfT
N2504JQgy/rFl/tudjtYz4e0d1gWcjqgwcJ8n6Sw3lA8dS9COsSTpDDlri0c7lTB
nMXBSigS0A+vD6H0FtNhXIvejqQ075gfys1iUBOAGMfoDaSDTr36MtOMjwg2tpQt
5AZHJYzngrOpLADq40lxHAxSJtH0Zh/xWHWkVSxOZ+ol5Yv7NdCy80D24wr8p72r
D4aCYjfu+XF24rkEp7eIXecHSt8tFh5LRkNG9A0gWVQWsNyTd1NfJppykmcoE9Z5
DNZdYREpFJ08rS5cyUE4EKUPuOrGv0in9RevdoUOk58SoRSACnUaXT9ME4BJ3plE
l0f1indq1pA72bhOytvVIEpk236xcR1bRYcfqHe386xHq8xtaWSJBe5UQ0dgDrD2
KllaPA0uh3+wY+tRpiJIi4cwksacx3O8WaQ3fC7Chne4JrOxO1s=
=jof/
-----END PGP SIGNATURE-----
Merge tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
"Two more GPIO fixes addressing an issue uncovered by the shared GPIO
management changes in v6.19:
- implement the missing .get_direction() callback for gpio-davinci
- remove redundant check in GPIO core which can also propagate an
invalid errno to user-space"
* tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
gpiolib: remove redundant callback check
gpio: davinci: implement .get_direction()
|
||
|
Linus Torvalds
|
7a2c1b27cd |
printk fixup for 6.19 rc6
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmlqGMYbFIAAAAAABAAO bWFudTIsMi41KzEuMTEsMiwyAAoJEFKgDEdIgJTyT0UP/3Wn4tm0h0n3XeyujQEA IPNisJCczF6aWIAuwccRigR8hQFriPNvkZ5AhMGtotZJrY3uUoe1/8aF+XIdqnl/ Yb1434AGwVNIpSaap+vtEclHrLDmzZH+Z75/FTWQwldM/hPkPWJI8fsEuRLqBZsn v520NBFtrQVcOZKKNy0npBnHsC0DsAmqoZuOvLTx0mx5AyE029CfPbDMZuVnSNix KjZ4U5KL0qDs2LIMpdB/mqprydGkHdogdIbrPK3WtzStVgNbi9VmnV19ZwbUlXJM rYPbtbQg3htwuspgR+yM6O21qsthRf2qZF5+2/a929IzOBsD/qAXQbbxQWVpF7Qb ELYXNV4N5hqm9EW8WeOOpLKUUG7k0fRPf81X/07uGVafPMQKQJ8kFNgLBkBFR4ya RAMNxTPHbHQvVaLcRujxZXoC4Wh3ZTunQXpIouy0p9dKOzbsCAj0ZqeqDa09UsaW rCEm50p/Pd1csML8a9A/2nNoWjQzuSVmML7F6obGCOWaW6p21GhSKHzqqDIjBab9 3wxhpllVeYRYS2yhkKjOPJkQKXo3idIdpieLpW8IVbJvp/gQgmeKjWdhnvNvUan9 hyCzfI8OZXVz0vItBfWsoX44+6UtpLHd4o16aDYjyDItflJOPuQbWzky+icT2R3x 8B5xPC08tmEGitf3miv2EGq9 =d/xV -----END PGP SIGNATURE----- Merge tag 'printk-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Prevent softlockup by restoring IRQs in atomic flush after each record * tag 'printk-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Restore IRQ in atomic flush after each emitted record |
||
|
Linus Torvalds
|
353c6f43ab |
xfs: fixes for v6.19-rc6
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaWnveQAKCRBcsMJ8RxYu Y0O2AX9BkFKr3/bucy59KNJwtCNJ1oK/dGTF5/7b9GqICH/OA6rEiIn4tlZvmxyA o3w9UYsBgPt811ISnYfyPCw5jRD5fyD7Y1uldy5ZSah5fl4g297/MdXHmgV/icLe eo7/0jYRLw== =8VNu -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "Just a few obvious fixes and some 'cosmetic' changes" * tag 'xfs-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: set max_agbno to allow sparse alloc of last full inode chunk xfs: Fix xfs_grow_last_rtg() xfs: improve the assert at the top of xfs_log_cover xfs: fix an overly long line in xfs_rtgroup_calc_geometry xfs: mark __xfs_rtgroup_extents static xfs: Fix the return value of xfs_rtcopy_summary() xfs: fix memory leak in xfs_growfs_check_rtgeom() |
||
|
Rafael J. Wysocki
|
d51e68b700 |
Merge branch 'pm-em'
Merge fixes related to the energy model management for 6.19-rc6: - Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout) - Fix stale description of the cost field in struct em_perf_state to reflect the current code (Yaxiong Tian) - Fix and revamp the energy model YNL specification added recently along with the energy model netlink interface (Changwoo Min) * pm-em: PM: EM: Add dump to get-perf-domains in the EM YNL spec PM: EM: Change cpus' type from string to u64 array in the EM YNL spec PM: EM: Rename em.yaml to dev-energymodel.yaml PM: EM: Fix yamllint warnings in the EM YNL spec PM: EM: Fix memory leak in em_create_pd() error path PM: EM: Fix incorrect description of the cost field in struct em_perf_state |
||
|
Dave Airlie
|
85807edac8 |
Merge tag 'drm-intel-fixes-2026-01-15' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
drm/i915 fixes for v6.19-rc6: - make 'guc_hw_reg_state' static Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/65bb05f7c8cbd3faf2350f979d4d47a395e5d372@intel.com |
||
|
Tim Bird
|
983d014aaf |
kernel: modules: Add SPDX license identifier to kmod.c
Add a GPL-2.0 license identifier line for this file. kmod.c was originally introduced in the kernel in February of 1998 by Linus Torvalds - who was familiar with kernel licensing at the time this was introduced. Signed-off-by: Tim Bird <tim.bird@sony.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|
Linus Torvalds
|
88e490913f |
ftrace fixes for v6.19:
- Fix allocation accounting on boot up The ftrace records for each function that ftrace can attach to is done in a group of pages. At boot up, the number of pages are calculated and allocated. After that, the pages are filled with data. It may allocate more than needed due to some functions not being recorded (because they are unused weak functions), this too is recorded. After the data is filled in, a check is made to make sure the right number of pages were allocated. But this was off due to the assumption that the same number of entries fit per every page. Because the size of an entry does not evenly divide into PAGE_SIZE, there is a rounding error when a large number of pages is allocated to hold the events. This causes the check to fail and triggers a warning. Fix the accounting by finding out how many pages are actually allocated from the functions that allocate them and use that to see if all the pages allocated were used and the ones not used are properly freed. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaWlyoxQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qoZoAQDuPOaly/RM9cS70zngDo/UsZmi2lQL RxuMR7sPVMwkrAEAp/gnpJenSRxCzaO4EdQYUYI28/ihkdNGp3KG8Q2MNw0= =v899 -----END PGP SIGNATURE----- Merge tag 'ftrace-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace fix from Steven Rostedt: - Fix allocation accounting on boot up The ftrace records for each function that ftrace can attach to is done in a group of pages. At boot up, the number of pages are calculated and allocated. After that, the pages are filled with data. It may allocate more than needed due to some functions not being recorded (because they are unused weak functions), this too is recorded. After the data is filled in, a check is made to make sure the right number of pages were allocated. But this was off due to the assumption that the same number of entries fit per every page. Because the size of an entry does not evenly divide into PAGE_SIZE, there is a rounding error when a large number of pages is allocated to hold the events. This causes the check to fail and triggers a warning. Fix the accounting by finding out how many pages are actually allocated from the functions that allocate them and use that to see if all the pages allocated were used and the ones not used are properly freed. * tag 'ftrace-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Do not over-allocate ftrace memory |
||
|
Linus Torvalds
|
603c05a163 |
NFS client bugfixes for Linux 6.19
Bugfixes:
- NFS: Fix another deadlock involving nfs_release_folio()
- NFS/localio: Stop I/O upon hitting a fatal error
- NFS/localio: Deal with page offsets that are > PAGE_SIZE
- NFS: Fix size read races in truncate, fallocate and copy offload
- NFSv4.x: Several bugfixes for the directory delegation client code
- pNFS: Fix a pNFS-related deadlock when returning delegations during open
- pNFS: Fix memory leaks in various error paths
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQR8xgHcVzJNfOYElJo6EXfx2a6V0QUCaWlCPwAKCRA6EXfx2a6V
0QZoAP49jxzzGogZlW0muoCmqZ9MXLH4OxlhmbLw/xKJlxzZqAD9F+p4Oq0uZMeh
t4mMaLdlVdrNnEXxpN3H0Vm9tH64tQo=
=IDVZ
-----END PGP SIGNATURE-----
Merge tag 'nfs-for-6.19-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
Pull NFS client fixes from Trond Myklebust:
- Fix another deadlock involving nfs_release_folio()
- localio:
- Stop I/O upon hitting a fatal error
- Deal with page offsets that are > PAGE_SIZE
- Fix size read races in truncate, fallocate and copy offload
- Several bugfixes for the NFSv4.x directory delegation client code
- pNFS:
- Fix a deadlock when returning delegations during open
- Fix memory leaks in various error paths
* tag 'nfs-for-6.19-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
NFS: Fix size read races in truncate, fallocate and copy offload
NFS: Don't immediately return directory delegations when disabled
NFS/localio: Deal with page bases that are > PAGE_SIZE
NFS/localio: Stop further I/O upon hitting an error
NFSv4.x: Directory delegations don't require any state recovery
NFSv4: Don't free slots prematurely if requesting a directory delegation
NFSv4: Fix nfs_clear_verifier_delegated() for delegated directories
NFS: Fix directory delegation verifier checks
pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
NFS: Fix a deadlock involving nfs_release_folio()
pNFS: Fix a deadlock when returning a delegation during open()
|
||
|
Trond Myklebust
|
d5811e6297 |
NFS: Fix size read races in truncate, fallocate and copy offload
If the pre-operation file size is read before locking the inode and
quiescing O_DIRECT writes, then nfs_truncate_last_folio() might end up
overwriting valid file data.
Fixes:
|
||
|
Linus Torvalds
|
bc08b65880 |
EFI fixes for v6.19 #2
- Wipe the INITRD config table upon consumption so it doesn't confuse kexec - Let APEI/GHES maintainers take responsibility for CPER processing logic - Fix wrong return value in CPER string helper routine -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCaWio5AAKCRAwbglWLn0t XKgSAQDFigknu/LkOwYhrY4elRRQbnH11kLwB4EPLU8cYReVXAEAy9O8m80+8zIo /u30MXnGZWdzC5oTrkheNJnFg2ESRA0= =hMLX -----END PGP SIGNATURE----- Merge tag 'efi-fixes-for-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Wipe the INITRD config table upon consumption so it doesn't confuse kexec - Let APEI/GHES maintainers take responsibility for CPER processing logic - Fix wrong return value in CPER string helper routine * tag 'efi-fixes-for-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/cper: Fix cper_bits_to_str buffer handling and return value MAINTAINERS: add cper to APEI files efi: Wipe INITRD config table from memory after consumption |
||
|
Linus Torvalds
|
13b2d15d99 |
32 hotfixes. 16 are cc:stable, 24 are for MM.
- four kerneldoc fixes from Bagas Sanjaya - four DAMON fixes from SeongJae - four mremap VMA-related fixes from Lorenzo - various singletons - please see the changelogs for details -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaWkP3gAKCRDdBJ7gKXxA jnmTAQCBiCyw7Pvvak5OM8Of0qQ8m/jQmNMBPRrd5M3tAAEOlwD9F7E6RjcmyItU k+sboDgNKTvgdRHTmRzj1t96aXJrSQQ= =OxTh -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-01-15-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: - kerneldoc fixes from Bagas Sanjaya - DAMON fixes from SeongJae - mremap VMA-related fixes from Lorenzo - various singletons - please see the changelogs for details * tag 'mm-hotfixes-stable-2026-01-15-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (30 commits) drivers/dax: add some missing kerneldoc comment fields for struct dev_dax mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed' mailmap: add entry for Daniel Thompson tools/testing/selftests: fix gup_longterm for unknown fs mm/page_alloc: prevent pcp corruption with SMP=n iommu/sva: include mmu_notifier.h header mm: kmsan: fix poisoning of high-order non-compound pages tools/testing/selftests: add forked (un)/faulted VMA merge tests mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too tools/testing/selftests: add tests for !tgt, src mremap() merges mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure mm/damon/sysfs: cleanup intervals subdirs on attrs dir setup failure mm/damon/core: remove call_control in inactive contexts powerpc/watchdog: add support for hardlockup_sys_info sysctl mips: fix HIGHMEM initialization mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported ... |
||
|
Linus Torvalds
|
9e995c573b |
Including fixes from bluetooth, can and IPsec.
Current release - regressions:
- net: add net.core.qdisc_max_burst
- can: propagate CAN device capabilities via ml_priv
Previous releases - regressions:
- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
- ipv6: fix use-after-free in inet6_addr_del().
- xfrm: fix inner mode lookup in tunnel mode GSO segmentation
- ip_tunnel: spread netdev_lockdep_set_classes()
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
- bluetooth: hci_sync: enable PA sync lost event
- eth: virtio-net:
- fix the deadlock when disabling rx NAPI
- fix misalignment bug in struct virtnet_info
Previous releases - always broken:
- ipv4: ip_gre: make ipgre_header() robust
- can: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
- eth: mlx5e: profile change fix
- eth: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
- eth: macvlan: fix possible UAF in macvlan_forward_source()
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmlo9uMSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOk4iAP/i3I0frORQbcM/NI8sqjQsc7w84SbBB9
K3FyfA+pfmS+sa5eZBan/eEe3tSQM5xn6XBflZXVxTC2QBxfiH3OVPWGconA7WRk
KIizSl340vtMhBMlUlXyox8BG7nn+pxjI3BqB5aTHWvEolS9eUgxtJJEDC1MnRzw
ZkarPXmNTLK6pDWAZ/CYjjBVnaUOt1V2ceRFfRU1SK/ROG7ajpfVLrSXZ4gICc/8
+br2g4p8hZx6sDYTY4lV/fMMzbbu3n8rRSoqgy8UDAfDJgglifvm4Ocu+EW5mLLG
IlNobJghtCUcbQN4X8GPg+6cW1yA94qeyHZSHD0Zg3lN7Hfa92WnhVwoqqjCgETC
ppXnj0zRZN81TeIQx9UIJLXxBZOt+3SSpvdaYdruKg2Sx0rsKraWLjXlResiehzw
DFZb893SFkJgPEVCcndzGi2I5/MCX3skNQq8+Od73Xcjbl35qiXafGa856R2Z5Ne
nSEE6BdnYvQAuCwCJ01nFJLQw3ot1H1TO2hF9QEDQ7K42zp2Yj5EKVcYQLAzlAAk
rzb3D9VIpEpSaXTIpJwa+fZUnpe649J+Rgg71fdj4FJUoNqYErvHQ6QzblmhdThr
efdpHg1PN3EvpVao27eSiDLl7DGOL8kDmXDpvIhFctKMVhw8mFhdFDmWenGTRQaT
u2hT+oC19rEG
=zUPN
-----END PGP SIGNATURE-----
Merge tag 'net-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from bluetooth, can and IPsec.
Current release - regressions:
- net: add net.core.qdisc_max_burst
- can: propagate CAN device capabilities via ml_priv
Previous releases - regressions:
- dst: fix races in rt6_uncached_list_del() and
rt_del_uncached_list()
- ipv6: fix use-after-free in inet6_addr_del().
- xfrm: fix inner mode lookup in tunnel mode GSO segmentation
- ip_tunnel: spread netdev_lockdep_set_classes()
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
- bluetooth: hci_sync: enable PA sync lost event
- eth: virtio-net:
- fix the deadlock when disabling rx NAPI
- fix misalignment bug in struct virtnet_info
Previous releases - always broken:
- ipv4: ip_gre: make ipgre_header() robust
- can: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
- eth:
- mlx5e: profile change fix
- octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
- macvlan: fix possible UAF in macvlan_forward_source()"
* tag 'net-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (37 commits)
virtio_net: Fix misalignment bug in struct virtnet_info
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
can: raw: instantly reject disabled CAN frames
can: propagate CAN device capabilities via ml_priv
Revert "can: raw: instantly reject unsupported CAN frames"
net/sched: sch_qfq: do not free existing class in qfq_change_class()
selftests: drv-net: fix RPS mask handling for high CPU numbers
selftests: drv-net: fix RPS mask handling in toeplitz test
ipv6: Fix use-after-free in inet6_addr_del().
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
net: hv_netvsc: reject RSS hash key programming without RX indirection table
tools: ynl: render event op docs correctly
net: add net.core.qdisc_max_burst
net: airoha: Fix typo in airoha_ppe_setup_tc_block_cb definition
net: phy: motorcomm: fix duplex setting error for phy leds
net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
net/mlx5e: Restore destroying state bit after profile cleanup
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
net/mlx5e: Fix crash on profile change rollback failure
...
|
||
|
Guenter Roeck
|
be55257fab |
ftrace: Do not over-allocate ftrace memory
The pg_remaining calculation in ftrace_process_locs() assumes that
ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the
allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE
(integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g.
4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages)
have significantly more capacity than 256 * 170. This leads to pg_remaining
being underestimated, which in turn makes skip (derived from skipped -
pg_remaining) larger than expected, causing the WARN(skip != remaining)
to trigger.
Extra allocated pages for ftrace: 2 with 654 skipped
WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0
A similar problem in ftrace_allocate_records() can result in allocating
too many pages. This can trigger the second warning in
ftrace_process_locs().
Extra allocated pages for ftrace
WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580
Use the actual capacity of a page group to determine the number of pages
to allocate. Have ftrace_allocate_pages() return the number of allocated
pages to avoid having to calculate it. Use the actual page group capacity
when validating the number of unused pages due to skipped entries.
Drop the definition of ENTRIES_PER_PAGE since it is no longer used.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Shenghao Ding
|
46b8d0888f |
ALSA: hda/tas2781: Add newly-released HP laptop
HP released the new laptop with the subid 0x103C. Signed-off-by: Shenghao Ding <shenghao-ding@ti.com> Link: https://patch.msgid.link/20260115124907.629-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|
Takashi Iwai
|
f2161d5f1a |
ASoC: Fixes for v6.19
A moderately large collection of fixes since I missed a week, plus a few new device IDs and quirks. It's all fairly minor, including a bunch of work on the device tree bindings fixes which have no runtime effect. There's one SoundWire change here exporting a symbol which was required for a fix to the ASoC SoundWire code. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlo7B4ACgkQJNaLcl1U h9ARAAf/TTsq6PAtYduc9VZvvFumdCQVozcthVVA7IklymKjWrSbtXn/ouorz8Kt wqnwsBql+jCWfTO7trOw2lWKWHVIN6GV2q9QvYM92vWSXTSiEKvSnlR9CSZDrBHE Cy82FFldB4RNEv6NwpDfgUgGGI4ceEYUXiFqSpwzRDwT3+cJMyxf2iBJhOvh/lkE JKXpdyeQC4tANxX2b+Mk32gGoe/1L1mPhNSjhJrd4h/sM3530ck6VvlEGobVDRkb paMHoNI9vBdhQcCTqcXiKypWRzfwyZX5pXYa3lCdE6kEGAsMFqtlELnkIBxkav32 xRKfFOdaIa61LnvCiPonswOHsP2zgw== =YL/h -----END PGP SIGNATURE----- Merge tag 'asoc-fix-v6.19-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A moderately large collection of fixes since I missed a week, plus a few new device IDs and quirks. It's all fairly minor, including a bunch of work on the device tree bindings fixes which have no runtime effect. There's one SoundWire change here exporting a symbol which was required for a fix to the ASoC SoundWire code. |
||
|
Paolo Abeni
|
851822aec1 |
linux-can-fixes-for-6.19-20260115
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEn/sM2K9nqF/8FWzzDHRl3/mQkZwFAmloq5ETHG1rbEBwZW5n dXRyb25peC5kZQAKCRAMdGXf+ZCRnJdjCACd/tKNnhH0VjjAexLT+pm68MuI+MOB He/DKc81hzpJ8FVaC9aTDVYsv5A+EeL+CiSSdO1oYXgzt3hT0MEztgbINAUICOi6 SfosYrkGR9s1xJvabxWRjn2XrdZtzTFNy0IupDnLiPRXqsFOfWdkF1VQI41aG22i ZSgIFQ77Ga3tpWWmoRBimIDBEj+xjx6xfHV6F1hPZ/hEzixnG6ZKMXJjXCIBo90q wD1Z2rzu1KvCfIZexdax5L5BzotH3axZ0ci9/RKlTWxkyTY3s+ic27a+E+uZZhgn 7WwGbMvmDVCiCH23mpX51V5PlkpFEun7rxiwAmF4IcXU3t5uSkL41IXB =KHQB -----END PGP SIGNATURE----- Merge tag 'linux-can-fixes-for-6.19-20260115' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-15 this is a pull request of 4 patches for net/main, it super-seeds the "can 2026-01-14" pull request. The dev refcount leak in patch #3 is fixed. The first 3 patches are by Oliver Hartkopp and revert the approach to instantly reject unsupported CAN frames introduced in net-next-for-v6.19 and replace it by placing the needed data into the CAN specific ml_priv. The last patch is by Tetsuo Handa and fixes a J1939 refcount leak for j1939_session in session deactivation upon receiving the second RTS. linux-can-fixes-for-6.19-20260115 * tag 'linux-can-fixes-for-6.19-20260115' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts can: raw: instantly reject disabled CAN frames can: propagate CAN device capabilities via ml_priv Revert "can: raw: instantly reject unsupported CAN frames" ==================== Link: https://patch.msgid.link/20260115090603.1124860-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Paolo Abeni
|
5ce234a8fe |
ipsec-2026-01-14
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmlnh0AACgkQrB3Eaf9P W7fhlQ//ZsSZ1+7UlmSmuzfdS+0erXDqNuIvmX1GudWmUfSWu988+efsCgZcIRSh B7YPHjO75mNRQLOxGI4f61JZUwX+h+p/1vbqW1z3/AycPxi3UGBS2P+QaPCK7q+3 P7Xgch0WCV7acZDMBOSRZb2j3Iu72u2G0AXGfPYJHTOyIIwaBX+c77nvqw+4t2Si N31OSQICwdocGSRyFpAb1InklRrW7fixiwXctC0q3MBahBXU2RqjXp/jLm8xY2Nx WJupmMng7cxz4vgsKY+tY+2EAvbuAwHEcBK4rjNKdm4E2m0nNpohAoiV3xYnkmoN Q4I+Yr9xpBGf2+Eoq7MwuLl1y5A+k5H8PgbnuO5zMP7grzOzCWka6Gx7fDXKuMCY t5c/dVG2beQI8MlV60PbUb+UuIhhMUAyKalm5OdQ1uk7mv/RhYO0Pg6g+sIT9uk9 TvT0UGZOI/Af0uhwYLp7Vl9HicFMYtPhBlEWO+JcUgZXXbqUBnNDml5KG7wcOXh2 Mj7GHSAfwtl/rNdiVPbo6cPezhuj5mY/QOAPl9/qr6BG7Tusf8TcAnRV5jphYfwV Dbo9qjIg5LmtscyfhB5CYk+X8e6Ca1X89lgT1JjW5yyO63yJ2vsORsDC+iakGTEl H4pQwIcObseM9X7klH9K2MZYUNhe17p88qQ+atGxUXExXHqil0U= =Y9BD -----END PGP SIGNATURE----- Merge tag 'ipsec-2026-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-01-14 1) Fix inner mode lookup in tunnel mode GSO segmentation. The protocol was taken from the wrong field. 2) Set ipv4 no_pmtu_disc flag only on output SAs. The insertation of input SAs can fail if no_pmtu_disc is set. Please pull or let me know if there are problems. ipsec-2026-01-14 * tag 'ipsec-2026-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set xfrm: Fix inner mode lookup in tunnel mode GSO segmentation ==================== Link: https://patch.msgid.link/20260114121817.1106134-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Mark Brown
|
be5a39e799
|
ASoC: rt5640: Fix duplicate clock properties in DT binding
Not quite overlapping changes to the rt5640 binding resulted in duplicate definitions of the clocks and clock-names properties. Delete one of them, preferring the simpler one. Reported-by: Jon Hunter <jonathanh@nvidia.com> Closes: https://lore.kernel.org/r/0e68c5f4-f68d-4544-bc7a-40694829db75@nvidia.com Signed-off-by: Mark Brown <broonie@kernel.org> Link: https://patch.msgid.link/20260114-asoc-fix-rt5640-dt-clocks-v1-1-421d438673c2@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Zhang Heng
|
ab2be3af8c |
ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED
This quirk enables mute LED on HP Pavilion x360 2-in-1 Laptop 14-ek0xxx, which use ALC245 codec. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220220 Cc: <stable@vger.kernel.org> Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260115015844.3129890-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|
Gustavo A. R. Silva
|
4156c3745f |
virtio_net: Fix misalignment bug in struct virtnet_info
Use the new TRAILING_OVERLAP() helper to fix a misalignment bug
along with the following warning:
drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it (in this case
`u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This
overlays the trailing members (rss_hash_key_data) onto the FAM
(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.
The static_assert() ensures this alignment remains.
Notice that due to tail padding in flexible `struct
virtio_net_rss_config_trailer`, `rss_trailer.hash_key_data`
(at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at
offset 84 in struct virtnet_info) are misaligned by one byte. See
below:
struct virtio_net_rss_config_trailer {
__le16 max_tx_vq; /* 0 2 */
__u8 hash_key_length; /* 2 1 */
__u8 hash_key_data[]; /* 3 0 */
/* size: 4, cachelines: 1, members: 3 */
/* padding: 1 */
/* last cacheline: 4 bytes */
};
struct virtnet_info {
...
struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */
/* XXX last struct has 1 byte of padding */
u8 rss_hash_key_data[40]; /* 84 40 */
...
/* size: 832, cachelines: 13, members: 48 */
/* sum members: 801, holes: 8, sum holes: 31 */
/* paddings: 2, sum paddings: 5 */
};
After changes, those members are correctly aligned at offset 795:
struct virtnet_info {
...
union {
struct virtio_net_rss_config_trailer rss_trailer; /* 792 4 */
struct {
unsigned char __offset_to_hash_key_data[3]; /* 792 3 */
u8 rss_hash_key_data[40]; /* 795 40 */
}; /* 792 43 */
}; /* 792 44 */
...
/* size: 840, cachelines: 14, members: 47 */
/* sum members: 801, holes: 8, sum holes: 35 */
/* padding: 4 */
/* paddings: 1, sum paddings: 4 */
/* last cacheline: 8 bytes */
};
As a result, the RSS key passed to the device is shifted by 1
byte: the last byte is cut off, and instead a (possibly
uninitialized) byte is added at the beginning.
As a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also
moved to the end, since it seems those three members should stick
around together. :)
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Tetsuo Handa
|
1809c82aa0 |
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is
called only when the timer is enabled, we need to call
j1939_session_deactivate_activate_next() if we cancelled the timer.
Otherwise, refcount for j1939_session leaks, which will later appear as
| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
problem.
Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes:
|
||
|
Marc Kleine-Budde
|
6c1f5146b2 |
Merge patch series "can: raw: better approach to instantly reject unsupported CAN frames"
Oliver Hartkopp <socketcan@hartkopp.net> says: This series reverts commit |
||
|
Oliver Hartkopp
|
faba5860fc |
can: raw: instantly reject disabled CAN frames
For real CAN interfaces the CAN_CTRLMODE_FD and CAN_CTRLMODE_XL control
modes indicate whether an interface can handle those CAN FD/XL frames.
In the case a CAN XL interface is configured in CANXL-only mode with
disabled error-signalling neither CAN CC nor CAN FD frames can be sent.
The checks are now performed on CAN_RAW sockets to give an instant feedback
to the user when writing unsupported CAN frames to the interface or when
the CAN interface is in read-only mode.
Fixes:
|
||
|
Oliver Hartkopp
|
166e87329c |
can: propagate CAN device capabilities via ml_priv
Commit |
||
|
Oliver Hartkopp
|
4650ff58a1 |
Revert "can: raw: instantly reject unsupported CAN frames"
This reverts commit |
||
|
John Groves
|
3e8e590fd6 |
drivers/dax: add some missing kerneldoc comment fields for struct dev_dax
Add the missing @align and @memmap_on_memory fields to kerneldoc comment header for struct dev_dax. Also, some other fields were followed by '-' and others by ':'. Fix all to be ':' for actual kerneldoc compliance. Link: https://lkml.kernel.org/r/20260110191804.5739-1-john@groves.net Fixes: |
||
|
Ben Dooks
|
f46c26f1bc |
mm: numa,memblock: include <asm/numa.h> for 'numa_nodes_parsed'
The 'numa_nodes_parsed' is defined in <asm/numa.h> but this file
is not included in mm/numa_memblks.c (build x86_64) so add this
to the incldues to fix the following sparse warning:
mm/numa_memblks.c:13:12: warning: symbol 'numa_nodes_parsed' was not declared. Should it be static?
Link: https://lkml.kernel.org/r/20260108101539.229192-1-ben.dooks@codethink.co.uk
Fixes:
|
||
|
Daniel Thompson
|
18e87bceae |
mailmap: add entry for Daniel Thompson
My linaro address stopped working a long time ago but I didn't update my mailmap entry. Fix that. Link: https://lkml.kernel.org/r/20260108-mailmap-daniel_thompson_linaro-org-v1-1-83f610876377@kernel.org Signed-off-by: Daniel Thompson <danielt@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Lorenzo Stoakes
|
21c68ad1d9 |
tools/testing/selftests: fix gup_longterm for unknown fs
Commit |
||
|
Vlastimil Babka
|
038a102535 |
mm/page_alloc: prevent pcp corruption with SMP=n
The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: <IRQ> __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) </IRQ> <TASK> RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) </TASK> Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure. The problem has been introduced by commit |
||
|
Carlos Llamas
|
4b5c493ff7 |
iommu/sva: include mmu_notifier.h header
A call to mmu_notifier_arch_invalidate_secondary_tlbs() was introduced in commit |
||
|
Ryan Roberts
|
4795d205d7 |
mm: kmsan: fix poisoning of high-order non-compound pages
kmsan_free_page() is called by the page allocator's free_pages_prepare()
during page freeing. Its job is to poison all the memory covered by the
page. It can be called with an order-0 page, a compound high-order page
or a non-compound high-order page. But page_size() only works for order-0
and compound pages. For a non-compound high-order page it will
incorrectly return PAGE_SIZE.
The implication is that the tail pages of a high-order non-compound page
do not get poisoned at free, so any invalid access while they are free
could go unnoticed. It looks like the pages will be poisoned again at
allocation time, so that would bookend the window.
Fix this by using the order parameter to calculate the size.
Link: https://lkml.kernel.org/r/20260104134348.3544298-1-ryan.roberts@arm.com
Fixes:
|
||
|
Lorenzo Stoakes
|
fb39444732 |
tools/testing/selftests: add forked (un)/faulted VMA merge tests
Now we correctly handle forked faulted/unfaulted merge on mremap(),
exhaustively assert that we handle this correctly.
Do this in the less duplicative way by adding a new merge_with_fork
fixture and forked/unforked variants, and abstract the forking logic as
necessary to avoid code duplication with this also.
Link: https://lkml.kernel.org/r/1daf76d89fdb9d96f38a6a0152d8f3c2e9e30ac7.1767638272.git.lorenzo.stoakes@oracle.com
Fixes:
|
||
|
Lorenzo Stoakes
|
3b617fd3d3 |
mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too
The is_mergeable_anon_vma() function uses vmg->middle as the source VMA. However when merging a new VMA, this field is NULL. In all cases except mremap(), the new VMA will either be newly established and thus lack an anon_vma, or will be an expansion of an existing VMA thus we do not care about whether VMA is CoW'd or not. In the case of an mremap(), we can end up in a situation where we can accidentally allow an unfaulted/faulted merge with a VMA that has been forked, violating the general rule that we do not permit this for reasons of anon_vma lock scalability. Now we have the ability to be aware of the fact we are copying a VMA and also know which VMA that is, we can explicitly check for this, so do so. This is pertinent since commit |
||
|
Lorenzo Stoakes
|
0ace8f2db6 |
tools/testing/selftests: add tests for !tgt, src mremap() merges
Test that mremap()'ing a VMA into a position such that the target VMA on
merge is unfaulted and the source faulted is correctly performed.
We cover 4 cases:
1. Previous VMA unfaulted:
copied -----|
v
|-----------|.............|
| unfaulted |(faulted VMA)|
|-----------|.............|
prev
target = prev, expand prev to cover.
2. Next VMA unfaulted:
copied -----|
v
|.............|-----------|
|(faulted VMA)| unfaulted |
|.............|-----------|
next
target = next, expand next to cover.
3. Both adjacent VMAs unfaulted:
copied -----|
v
|-----------|.............|-----------|
| unfaulted |(faulted VMA)| unfaulted |
|-----------|.............|-----------|
prev next
target = prev, expand prev to cover.
4. prev unfaulted, next faulted:
copied -----|
v
|-----------|.............|-----------|
| unfaulted |(faulted VMA)| faulted |
|-----------|.............|-----------|
prev next
target = prev, expand prev to cover. Essentially equivalent to 3, but
with additional requirement that next's anon_vma is the same as the
copied VMA's.
Each of these are performed with MREMAP_DONTUNMAP set, which will cause a
KASAN assert for UAF or an assert on zero refcount anon_vma if a bug
exists with correctly propagating anon_vma state in each scenario.
Link: https://lkml.kernel.org/r/f903af2930c7c2c6e0948c886b58d0f42d8e8ba3.1767638272.git.lorenzo.stoakes@oracle.com
Fixes:
|
||
|
Lorenzo Stoakes
|
61f67c230a |
mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge
Patch series "mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge", v2. Commit |
||
|
Pavel Butsykin
|
590b13669b |
mm/zswap: fix error pointer free in zswap_cpu_comp_prepare()
crypto_alloc_acomp_node() may return ERR_PTR(), but the fail path checks
only for NULL and can pass an error pointer to crypto_free_acomp(). Use
IS_ERR_OR_NULL() to only free valid acomp instances.
Link: https://lkml.kernel.org/r/20251231074638.2564302-1-pbutsykin@cloudlinux.com
Fixes:
|
||
|
SeongJae Park
|
392b3d9d59 |
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of
access_pattern/ directory, subdirectories of access_pattern/ directory are
not cleaned up. As a result, DAMON sysfs interface is nearly broken until
the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-5-sj@kernel.org
Fixes:
|
||
|
SeongJae Park
|
dc7e1d75fd |
mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of
quotas/ directory, subdirectories of quotas/ directory are not cleaned up.
As a result, DAMON sysfs interface is nearly broken until the system
reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-4-sj@kernel.org
Fixes:
|
||
|
SeongJae Park
|
9814cc832b |
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
When a context DAMON sysfs directory setup is failed after setup of attrs/
directory, subdirectories of attrs/ directory are not cleaned up. As a
result, DAMON sysfs interface is nearly broken until the system reboots,
and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-3-sj@kernel.org
Fixes:
|
||
|
SeongJae Park
|
a24ca8ebb0 |
mm/damon/sysfs: cleanup intervals subdirs on attrs dir setup failure
Patch series "mm/damon/sysfs: free setup failures generated zombie sub-sub
dirs".
Some DAMON sysfs directory setup functions generates its sub and sub-sub
directories. For example, 'monitoring_attrs/' directory setup creates
'intervals/' and 'intervals/intervals_goal/' directories under
'monitoring_attrs/' directory. When such sub-sub directories are
successfully made but followup setup is failed, the setup function should
recursively clean up the subdirectories.
However, such setup functions are only dereferencing sub directory
reference counters. As a result, under certain setup failures, the
sub-sub directories keep having non-zero reference counters. It means the
directories cannot be removed like zombies, and the memory for the
directories cannot be freed.
The user impact of this issue is limited due to the following reasons.
When the issue happens, the zombie directories are still taking the path.
Hence attempts to generate the directories again will fail, without
additional memory leak. This means the upper bound memory leak is
limited. Nonetheless this also implies controlling DAMON with a feature
that requires the setup-failed sysfs files will be impossible until the
system reboots.
Also, the setup operations are quite simple. The certain failures would
hence only rarely happen, and are difficult to artificially trigger.
This patch (of 4):
When attrs/ DAMON sysfs directory setup is failed after setup of
intervals/ directory, intervals/intervals_goal/ directory is not cleaned
up. As a result, DAMON sysfs interface is nearly broken until the system
reboots, and the memory for the unremoved directory is leaked.
Cleanup the directory under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-1-sj@kernel.org
Link: https://lkml.kernel.org/r/20251225023043.18579-2-sj@kernel.org
Fixes:
|
||
|
SeongJae Park
|
f9132fbc2e |
mm/damon/core: remove call_control in inactive contexts
If damon_call() is executed against a DAMON context that is not running,
the function returns error while keeping the damon_call_control object
linked to the context's call_controls list. Let's suppose the object is
deallocated after the damon_call(), and yet another damon_call() is
executed against the same context. The function tries to add the new
damon_call_control object to the call_controls list, which still has the
pointer to the previous damon_call_control object, which is deallocated.
As a result, use-after-free happens.
This can actually be triggered using the DAMON sysfs interface. It is not
easily exploitable since it requires the sysfs write permission and making
a definitely weird file writes, though. Please refer to the report for
more details about the issue reproduction steps.
Fix the issue by making two changes. Firstly, move the final
kdamond_call() for cancelling all existing damon_call() requests from
terminating DAMON context to be done before the ctx->kdamond reset. This
makes any code that sees NULL ctx->kdamond can safely assume the context
may not access damon_call() requests anymore. Secondly, let damon_call()
to cleanup the damon_call_control objects that were added to the
already-terminated DAMON context, before returning the error.
Link: https://lkml.kernel.org/r/20251231012315.75835-1-sj@kernel.org
Fixes:
|