Commit Graph

1413902 Commits

Author SHA1 Message Date
Linus Torvalds
5dbeeb268b Driver core fixes for 6.19-rc7
- Always inline I/O and IRQ methods using build_assert!() to avoid
     false positive build errors.
 
   - Do not free the driver's device private data in I2C shutdown()
     avoiding race conditions that can lead to UAF bugs.
 
   - Drop the driver's device private data after the driver has been
     fully unbound from its device to avoid UAF bugs from &Device<Bound>
     scopes, such as IRQ callbacks.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaXTJdAAKCRBFlHeO1qrK
 Lqt/AQDN7X8D6ABCPpYVZ0KKZZulLXjmv52CqtXc1IHBuergCgD/TEOu+t41amVb
 EkSO6/yN/NwMP0+eEF+XT1ybM3CYDQI=
 =8bg5
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Always inline I/O and IRQ methods using build_assert!() to avoid
   false positive build errors

 - Do not free the driver's device private data in I2C shutdown()
   avoiding race conditions that can lead to UAF bugs

 - Drop the driver's device private data after the driver has been
   fully unbound from its device to avoid UAF bugs from &Device<Bound>
   scopes, such as IRQ callbacks

* tag 'driver-core-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  rust: driver: drop device private data post unbind
  rust: driver: add DriverData type to the DriverLayout trait
  rust: driver: add DEVICE_DRIVER_OFFSET to the DriverLayout trait
  rust: driver: introduce a DriverLayout trait
  rust: auxiliary: add Driver::unbind() callback
  rust: i2c: do not drop device private data on shutdown()
  rust: irq: always inline functions using build_assert with arguments
  rust: io: always inline functions using build_assert with arguments
2026-01-24 10:13:22 -08:00
Linus Torvalds
12a0094839 Misc fixes:
- Fix auxiliary timekeeper update & locking bug
 
  - Reduce the sensitivity of the clocksource watchdog, to
    fix false positive measurements that marked the
    TSC clocksource unstable.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAml0ksERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gvtRAAvLWNMb9YPW/65Gn8dkyMQUPzXBjEaq8A
 yP4L1b8EujoM6fSeQC0Y367hpn1GKHhEGZyj9ksRcU4dsU5XWlzPZr9QXCETmMuh
 ffTCvrUGI6d95685S+R1VplmhoCQAkerQAFcPQDAQd0QgfoEJO+hf2AWHrilnicu
 gCcZGDE/+gLAPYjR7LaRu7vb0W6VtwqhXvz8xTCGALmMlU84BDT3deLzCmujxtbF
 PvNaShBAtppm468Ln6HY2mk4mN5kWthPnonNF4n0zVYy8uAHLEEUERr/LndZ60Ua
 KlFgKukfoPXyJoU0M0umNcX6oXaRw7DeyNcPtJovZUwtfXyjkTPWrcfZ4sD3r37K
 QWjFqmbTCtj70vlUFP2RiHusOmNkuzcWKww5KdpA+HoeXEI4zcjhZq7zObyjDPIZ
 t0Cs5sZoWWpL7o53ikMjsO2Fe/zSDRaocYyImCWh2U+DdBn3/fh8a0pboXQakujx
 kjmuDrHaLXFNMI9h7NvlP143IW8g7AHUpu0piDGLVFFkZoNcII/8g7qawemQw8T9
 ZCUmL3oq1Zu0z3aGq9GRFz31ysVLXwDZdtY8CCuHxgVTuZQQnRNrLiNiTjZn75E/
 PY63jtSgKNJsAOTHJZ5hnyvcGb8w05anU0T7M38kTJFtiX4R6JaaDJVmj3eFG3g8
 es9cQ4gJGmo=
 =O1ly
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fixes from Ingo Molnar:

 - Fix auxiliary timekeeper update & locking bug

 - Reduce the sensitivity of the clocksource watchdog,
   to fix false positive measurements that marked the
   TSC clocksource unstable

* tag 'timers-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clocksource: Reduce watchdog readout delay limit to prevent false positives
  timekeeping: Adjust the leap state for the correct auxiliary timekeeper
2026-01-24 09:36:03 -08:00
Linus Torvalds
af5a3fae86 Miscellaneous scheduler fixes:
- Fix PELT clock synchronization bug when entering idle
 
  - Disable the NEXT_BUDDY feature, as during extensive testing
    Mel found that the negatives outweigh the positives.
 
  - Make wakeup preemption less aggressive, which resulted in
    an unreasonable increase in preemption frequency.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAml0kYYRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1j/Bw/+M5UK6EOPzLTs0Tj87X/kI7vXLN/uf9+K
 FpDtFNmoJnJKrQxPFfa8aT8OAz7zLfnjrGmRgxOG1fFkACMuB8s+TO4+i9lhzAsF
 gHOg6lDczi4K14mkTyiP/Bdaf3lZThghZitdRCBZFN4gjBpAh1rRI4ikQ0a3pwJH
 6y1NF8fX/xRBm6Bgprgbv/em+fKsO89i6NwunPtYaxHsOGA5U0FVPFSa3yghz+X2
 7Sl4U8LRdkU3Z62M+I8DKWuAMMb9nLwEXrSiNy+KJHIJ7FNFb1+U10gPrLq+z2Oi
 hvd25pzDzGUgOglZ7f1IRL5H48putMjCqv+A2wOZnzl7fHt4c02hpTBqMDle5hEP
 DYHyNNC1ZIRQ1zuy8j33LzB10ycP6pX9nawt+S1trEZcDVwaKwq9TbYsBjbJKtmZ
 V7C181fTUaNQ6M4wJY3gx+hD1ocrLv+Y0vhXJnK7sg+j4IhWJ7Yk6ne9hrpXbbUj
 cK8gzvo4OkShYtMlB9ut/RIiuyvFThyJd9rcNkeN4tTM9DVFURvOlIK2W6U70Yty
 OJDkhI6KBmkERPQoa43OsGvxZwF+g0KY8ISsLq3bJ2vLyATPdpJ2ns+zRg6I+B+q
 zHZmI86Fc8gr+O/y9oqi2VJhgio34RcoSId/QcAPC1Gl4TaIcmqFFTSzMhI+kLk9
 Ng7vHy/3KQg=
 =pGnx
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:

 - Fix PELT clock synchronization bug when entering idle

 - Disable the NEXT_BUDDY feature, as during extensive testing
   Mel found that the negatives outweigh the positives

 - Make wakeup preemption less aggressive, which resulted in
   an unreasonable increase in preemption frequency

* tag 'sched-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Revert force wakeup preemption
  sched/fair: Disable scheduler feature NEXT_BUDDY
  sched/fair: Fix pelt clock sync when entering idle
2026-01-24 09:29:41 -08:00
Linus Torvalds
ceaeaf66a2 Two perf events fixes:
- Fix mmap_count warning & bug when creating a group member event
    with the PERF_FLAG_FD_OUTPUT flag.
 
  - Disable the sample period == 1 branch events BTS optimization
    on guests, because BTS is not virtualized.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAml0kF8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1icZxAAhsYBY0uB3OzAgJYRIVlw/vzF7ubHh8+r
 PhQ+azap/uSk/dS8IXZ0FrP/vq9kgqEFpsYwWbB1EFRxB24nd8AAYarASyc22Dhb
 Qe6tKh4hzlDC9Cw0vJ111PgKJLiPDrmkxzS4C2HkPwYwriNql81hQjLW5nF6dHwg
 i8aP7+/uNB2h/xnPIRgkUFSUzBacRz1Snqgi/vSHmwEhk1GFI48rXoYywM9ItAnR
 CGN7tGxJ45YwDYeknZf9Ngsd3q+/eh38ihPfMEKoulf4oFvhIsiG4rJ1Vee0V9fD
 aD1NhukULtjw3lkKnMM75W+Jdb7fHDTOuxzUov9WpyIOIUTMqRkbvaKHgJzSD2SK
 01TbP3kQixhGhiRXx78GDQwYGjX8JQxngbqyJvL708GNvxbcKYrLhqtr5Ho00pWH
 ERxx/ajoDXB7Neo7XPhgYRHk/lrlnZsK1LoidhMzN1UX6C12VnhPcD+zUSqRxz5w
 yFuJp0+7wF+G74FpO7kv8jv5KDB/lery5mdzWu0kqAKMfYWdw5eGoaI6T48DVoBy
 IwNYU8bxDBRPzu64XudDE4xBuTuy4HpJmbvOUkxMUkBGMTZ+nysqHu8D7cJJqYtL
 2xYJOpR+P4Se9fRyR9xo5vtTZy27TQqTp+AjA5RlIoVOJhYK5T9mAFCJaEhdupbM
 2IA4xdYhbb8=
 =lNSW
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix mmap_count warning & bug when creating a group member event
   with the PERF_FLAG_FD_OUTPUT flag

 - Disable the sample period == 1 branch events BTS optimization
   on guests, because BTS is not virtualized

* tag 'perf-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Do not enable BTS for guests
  perf: Fix refcount warning on event->mmap_count increment
2026-01-24 09:24:17 -08:00
Linus Torvalds
dc67a35505 Fix objtool build error in non-standard static library build
environments.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAml0jzERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gVCxAAv5I9R4UK4jR2mCZE82ye7dofNDeOT+Kd
 X3vrpeDq+vwjLvONHIdJoTVAw1jTCfroczwdaV+txrtVW/0Wsms8dD38rHTN22xg
 LU1qn8iKuqXuDBw8O68Pm+XtbF86U0QntlGUsskJb8uXp8VOmhaKRolGwyy/drhS
 x3Z67uD2fvLO8M4J99qp/YNwuKngS4TslTxrMnykOFJ2zDA3l0rYqkHkYq5ULgQo
 9dVJ4GQ8CROOm4nCGy0rSMKC98W670JMqDPRqoyxXVqK5RqVSz18shSKym2ev+ER
 kE1Lh4MUvosXQV1fa/MbcsTRmPwaIoNocjLerof8kzYM2FRJPhiqifJADAwzkTFt
 zm3HmGL/jn/whTYDI8Bf0RDT+9yg+v1kN5+CD1KWQd55B3y6cYZY+CIK0vt4f13U
 wEZjDTJBxo7qPH65em/IL8qH30xh7Zzgj4v/xpG9aMHbh5m2DY0uSfycq9bC5yut
 /GrKhu8zqRCKrm6XMvkOTK6gZNh6Ph6ZDRss5K+hVXS3nyoiGYAmVTTjgzLL4rel
 7LUCQXNxVrKEK6bqi8R9EaAGqMsTGeYHumpjVA3euoCCpbLuWuUWx9ONi2rv8njp
 5VcWVbI/RIahh/+z8NoYjhlO6NlL4XQqbJa8zrhMbaRUeZ3vnz/eqyl2WiRhmJna
 z3MiibvYJK4=
 =UnzZ
 -----END PGP SIGNATURE-----

Merge tag 'objtool-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull objtool fix from Ingo Molnar:
 "Fix objtool build error in non-standard static library build
  environments"

* tag 'objtool-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  objtool: Fix libopcodes linking with static libraries
2026-01-24 09:22:09 -08:00
Linus Torvalds
4fc8d3fcb9 Two irqchip driver fixes:
- Fix spurious interrupts during resume in the renesas-rzv2h driver
 
  - Fix a 32+ bit physical memory truncation bug in the gic-v3-its
    driver
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAml0jRsRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hLDRAAikyh9MMo4qQB9k0D4mo2DYNVk8oQVUl4
 PZAM/tfNLMUU/39g++aMbzYXWeaguKry2jbf0i1jkdrDND6I/b6e/0pe+s422usd
 aNg5G3Q7+5PusX41erXgRosYF8q6PMn965JMDbzIZK8uJ44p+tIKO/j4BJ6Tcg2K
 dpaiAuH/ZrWJ5UIa1/8GD9bAp6VMJtvbYlHIFSJP4S0U0czdyhgRv+/3loagbnNO
 OJDp0Sn4efuFS7Z58mdlKadYazdX9fEf8Q8NIz3gE1Gh7XMGzH2D1zct9fyLvtRd
 /3UBCYOf+DG7cydc0Ddn/xUzspyHQt0gQXO6GMddLGU/keTH7CgTECrJ6J+OyYP5
 +WlA7Vwo6y7CjAQq/4i9sGfEukWHOzTiPJPZT/RzdMhX1Lx/8HseQ74WB+P5CMSr
 N77HTi5qhXcSWS0nnZ7jUOut3vXZOtlVagfvhXInuTX86hvkWIkX8OfGUfEQhTuN
 E9HYcWe+L5n+FTjbIo2zTmegiA8jg8mTqGabvNFbVSP0o+/RNK1vbIt9L1iaX5dY
 MLk34MnuhxpUo4qwNyaFNO3xs8jceEIc0Xsn+nJNCYebGkSWF8Gg2gmripTLBvfs
 1P9EvZMptLOlUUAdU72xP7BxQl9EA3NVQD6/otA2emXwya1aVw44mieAZialNKtv
 ADoVUkjagVA=
 =pNjT
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:

 - Fix spurious interrupts during resume in the renesas-rzv2h driver

 - Fix a 32+ bit physical memory truncation bug in the gic-v3-its driver

* tag 'irq-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/gic-v3-its: Avoid truncating memory addresses
  irqchip/renesas-rzv2h: Prevent TINT spurious interrupt during resume
2026-01-24 09:15:25 -08:00
Linus Torvalds
4a51fe919b KVM/arm64 fixes for 6.19
- Ensure early return semantics are preserved for pKVM fault handlers
 
 - Fix case where the kernel runs with the guest's PAN value when
   CONFIG_ARM64_PAN is not set
 
 - Make stage-1 walks to set the access flag respect the access
   permission of the underlying stage-2, when enabled
 
 - Propagate computed FGT values to the pKVM view of the vCPU at
   vcpu_load()
 
 - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
   tables
 
 - Check that the VM is actually using VGICv3 before accessing the GICv3
   CPU interface
 
 - Delete some unused code
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAml0eFAUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroP+6Qf/QyjSaQHurVqfigKoj4XI9QsF2IoD
 m4anhrLyzkcE1vMShHkaw6Xx7GjZcrbCqZ5L1qY94B4yUdIaFGR5hkGYPX4OXqrn
 XP6Oq5lO+1iOzxfOQ+7gZVBYBIHt6OBjFpBRxv9AtRHuin1GkxEmh7g5oPsy/zT6
 8IHCtf85mnJXZNDGwVuzII1QXj4CnYwCL37lzNTo+bzf9os7Xtn1RSj3p2OoMKsM
 IKzF2oevMblj3r+L4pOQLXkc22S5OF3nkti+Q6uu2nBoiZ9ivWOTHxjkYU5QAXwm
 tyRkEMHuV5zNGIaAhRDe+0wxx0iD5DTJQfioE+z8vfLASqZ8nmY5DRyaQw==
 =+Y93
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull arm64 kvm fixes from Paolo Bonzini:

 - Ensure early return semantics are preserved for pKVM fault handlers

 - Fix case where the kernel runs with the guest's PAN value when
   CONFIG_ARM64_PAN is not set

 - Make stage-1 walks to set the access flag respect the access
   permission of the underlying stage-2, when enabled

 - Propagate computed FGT values to the pKVM view of the vCPU at
   vcpu_load()

 - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
   tables

 - Check that the VM is actually using VGICv3 before accessing the GICv3
   CPU interface

 - Delete some unused code

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers
  KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit
  KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF
  KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps()
  KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate()
  KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp()
  KVM: arm64: Inject UNDEF for a register trap without accessor
  KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load
  KVM: arm64: Fix EL2 S1 XN handling for hVHE setups
  KVM: arm64: gic: Check for vGICv3 when clearing TWI
2026-01-24 09:02:56 -08:00
Paolo Bonzini
e89f0e9a0a KVM/arm64 fixes for 6.19
- Ensure early return semantics are preserved for pKVM fault handlers
 
  - Fix case where the kernel runs with the guest's PAN value when
    CONFIG_ARM64_PAN is not set
 
  - Make stage-1 walks to set the access flag respect the access
    permission of the underlying stage-2, when enabled
 
  - Propagate computed FGT values to the pKVM view of the vCPU at
    vcpu_load()
 
  - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
    tables
 
  - Check that the VM is actually using VGICv3 before accessing the GICv3
    CPU interface
 
  - Delete some unused code
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaWiyJBccb2xpdmVyLnVw
 dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFqVhAQDM4Lbrq0F80X+YzvO7oxWioOy4
 JiTATSii9Lit8KY6fgEAvLD4qaggLdF3+WY+V37YmTj3UDgI31ClBr+xSvSengA=
 =XaL0
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-6.19-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.19

 - Ensure early return semantics are preserved for pKVM fault handlers

 - Fix case where the kernel runs with the guest's PAN value when
   CONFIG_ARM64_PAN is not set

 - Make stage-1 walks to set the access flag respect the access
   permission of the underlying stage-2, when enabled

 - Propagate computed FGT values to the pKVM view of the vCPU at
   vcpu_load()

 - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
   tables

 - Check that the VM is actually using VGICv3 before accessing the GICv3
   CPU interface

 - Delete some unused code
2026-01-24 08:42:14 +01:00
Linus Torvalds
62085877ae Second round of Kbuild fixes for 6.19
- Reduce possible complications when cross-compiling by increasing use
    of ${NM} in check-function-names.sh
 
  - Fix static linking of nconf
 
 Cc: Carlos Llamas <cmllamas@google.com>
 Cc: Arkadiusz Kozdra <floss@arusekk.pl>
 Cc: Nathan Chancellor <nathan@kernel.org>
 Cc: linux-kbuild@vger.kernel.org
 Signed-off-by: Nicolas Schier <nsc@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEh0E3p4c3JKeBvsLGB1IKcBYmEmkFAmlz5YcACgkQB1IKcBYm
 EmlwfhAAsMLMfwviC8s47QPhsZfBSmMDCRbJBib9w5ARD19bQNe8WknxV30YOJsT
 vquxAZQx5ZZrKow9uPPaaoRMSh31ooljcthXDNIJylPOXQrytsnWutTPh0gcvTHE
 1whNLhrtaZ3L3E5IyD+WrXwGGzZzuXNiUnVU5TdAeO+DeRz1tZf9x3ejLW1yw7p5
 zTeEHWTzDbWLXw2AxkYxgjt908K+DYsFz/dCeDS752t37ZUXJ/SdxVsY5BespXoo
 lpBABRsGJTg1xOyMElvRvAQL5il1lKZVgr2LrnI4hhWndsc8otcqxFo8QhynenYi
 BncJEjqxjehkEjeoQRBooWReGmytxvqOc7AhTT0k2sHoCMd01RSRnWLOIGi8iix1
 2B6lNXTqOW71U4R/0OzcPYq/Xwy6mDFzRFn9VQ4LyQ2yK/8yc63gOX9Z6XgXbO7C
 sBZy1HzEn6xVac6U+o4IRxYPuRfkjJPf25E1pWStkNfslJ+zUpER64t4hyucCcDu
 QwMLIfbdmczLPj4pJaiwWj40qSPvmykqJAmA2O2VrN8wYbQetgy/H1LDJu3l7gXY
 v09OPSDc2PFbuAWNkSgIBftvrgtQGkwZ3WopgSPVdw7ZFs/EmftejBrngJXPDJpM
 5JpbTYeqj5CaD1ZcSswdRqiuaV8o2N36Bk4ySbMhDhvpidvAJwg=
 =ExIb
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux

Pull kbuild fixes from Nicolas Schier:

 - Reduce possible complications when cross-compiling by increasing use
   of ${NM} in check-function-names.sh

 - Fix static linking of nconf

* tag 'kbuild-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
  kconfig: fix static linking of nconf
  kbuild: prefer ${NM} in check-function-names.sh
2026-01-23 14:58:51 -08:00
Linus Torvalds
3a622041d7 s390 fixes for 6.19-rc7
- Add $(DISABLE_KSTACK_ERASE) to vdso compile flags to fix compile errors
   with old gcc versions
 
 - Fix path to s390 chacha implementation in vdso selftests, after vdso64
   has been renamed to vdso
 
 - Fix off-by-one bug in APQN limit calculation
 
 - Discard .modinfo section from decompressor image to fix SecureBoot
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAmlze6cACgkQIg7DeRsp
 bsI6bxAApt9LWUqAQL8GtdWdVm+o+lgEeBOVqv0Pil7i9HSfwuvUxppIVlI4hDku
 vFavggZFNFN6nSSM5bBiz5SjRiUvlEqO2ZynBubgakfutrXMDw89qGph4jTiaOTl
 ySIIOkf0+/In9DWWGW8qibuu+9Ff2lWcdIie1bS/E/JwmqaS4uUsH2J4JuhX8N2b
 TuFWnKKUqvnLaXoRMjIigC/aMJW+rCTH/T/B29H8Fdu4R8e1XbsjFSP0IlhSLgZy
 ks+2jVjoJDezfJYfwwBT+vhn2Z7Z5h2KYDei713vDI3WgiaczDwCRw6aVvF1wtQK
 D1YPA6GO0QLGkjgrnMTDaORzdp/dqRc9Y6yk4d79/mVkN4NUpPyVFeMJAdhX92Ym
 ccSWFbsA5DmzRR6Dg77Z737wapO5DbTo6hCfF2su2Otlulz4EEdgyKT9cc0jKnmk
 ol+bWMxaJd1R0IaSfOvCceFeL3mHvNdFcOk1Zew+SA7ybmcAeTaVOw1l4E7T38sL
 hjbUFDTzZJ/mAexCwq2qn5h/epF3yvrWquiF616JdZCR2d0iZS053at+hxW0gUbV
 kmf80XjMHnLSazDMc32YU8/XRHMgi0Qrkn61ELSiGpbaTAeiPw5O8o2n/j4pFC6K
 kNnwrjZpHWscs+Jb2GJJ/eJDH4WrSbVkcU18hXD6UNMMCMahkBM=
 =ugtG
 -----END PGP SIGNATURE-----

Merge tag 's390-6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Heiko Carstens:

 - Add $(DISABLE_KSTACK_ERASE) to vdso compile flags to fix compile
   errors with old gcc versions

 - Fix path to s390 chacha implementation in vdso selftests, after
   vdso64 has been renamed to vdso

 - Fix off-by-one bug in APQN limit calculation

 - Discard .modinfo section from decompressor image to fix SecureBoot

* tag 's390-6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer
  s390/ap: Fix wrong APQN fill calculation
  selftests: vDSO: getrandom: Fix path to s390 chacha implementation
  s390/vdso: Disable kstack erase
2026-01-23 14:00:58 -08:00
Linus Torvalds
e85d3e9d58 arm64 fixes:
- A set of fixes for FPSIMD/SVE/SME state management (around signal
    handling and ptrace) where a task can be placed in an invalid state
 
  - __nocfi added to swsusp_arch_resume() to avoid a data abort on
    resuming from hibernate
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlzvVUACgkQa9axLQDI
 XvFWZQ/8DUqOm0tHQMi/kgh82T7Iv1GslfPhlSfgWftbDIqiOlJqo4eCa+p1YrSZ
 uwXBF4B4d1KpSr+46ScbLUPjdlla9zpXM7AXQzSY7xAP0+dNKAWzyRlh1ZpUz0KY
 VrgOdrqN90H6EuZ1VC+9nGAT/AuiLLvBc5cSETVAJAKvZ+zVE/1VeJ6AnDndOamD
 dlPYyolyG8RgP9tHxcIsuHQ4y/CoKmTgSEM5l9A5STwigzTspdk1hKJUuhfocklZ
 PXvCD3rRe0Skaokl9hHxpGa7mS+YPWrGMI3zSkGarBgwYcFGOJ2g9zIPElT6r8a9
 t5reRhuZad6UeE4zdv6VWrjTJxQO7iGoMfQoxqtmoqdkM8/49eWBE/xCEHp4J1+H
 X3DPEbHl1sGYBLHFZEGWBCw2H3vI3Whxx0frv3ysrB4agzdPD5VZpUhgq+/c7QXA
 mySddycGv0upBygahW7ORWt8mVwEjheJnz+jm37gfUEvt9tvXcoZW/zxW0kpyw0u
 fYGuizmVR3ysmrCpG2Awkrt46tTn2kyv4VWhTLeULIgcgTHNBq0idNS3+ZNH3ElM
 EiKgWXlI39LZKlX+p/yg2TQz/vDtqgGLKsSQg9zF+62FP7vpCVz1cgaX2czAcYXY
 0Yx4mx8fp15JWBLd6epHeTAWcRQATnhVwoSrn9+HzOVFebPACno=
 =8SiM
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Catalin Marinas:

 - A set of fixes for FPSIMD/SVE/SME state management (around signal
   handling and ptrace) where a task can be placed in an invalid state

 - __nocfi added to swsusp_arch_resume() to avoid a data abort on
   resuming from hibernate

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Set __nocfi on swsusp_arch_resume()
  arm64/fpsimd: signal: Fix restoration of SVE context
  arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
  arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
2026-01-23 13:56:04 -08:00
Linus Torvalds
6d06443237 three ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmlyz9oACgkQiiy9cAdy
 T1E8gwv/bzcY/byyOwyk6zsEPFC/l9X1ETCpdsriUlJ/sI+crl0OyJbMvjyI/ECm
 tStPKnXwkqy/B8HkpfOD8NMfl9u1qMZxMTq3+nhYucpK7Im0hx/3XrvGmuR50jbe
 y7OA/+MBxmwB+eOFsUHX53eHTmFXfuXolWZICz9QFk7yDpLd35SAC8/9fPSrmazB
 fddQrOR0ZIVDYvywc3JDxRU2x2Omqd5kgjYQBMYVfG7XFJckJG/ujs1AHx3HYf3L
 uxYpD2CHIeJ5uIdaaCkKAm1swmxbCuAeGMjT866r4HV8Xe6m6R2Wt10A7rcvBSmB
 8j4uy7t0ygwpZoWSsPFvcYFNX2D7hASmPz7CDhaAW9yZoxgC2MI+tLqSIBw0tFO3
 hO0JulWyiGTajOnlU2nzYcKSa8PG5qS+S54laaqUn/NQ5qMaPnktnEfUloIWoQJ/
 HHb9w7ZzK9y4B5gdzGKugka1NpoKbR5hn49hzzzweWqQ07k7RXv+KBE0UpGejFoL
 X0d34+h+
 =YfQ+
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc6-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Use the original nents value for ib_dma_unmap_sg(), preventing
   potential memory corruption in the RDMA transport layer

 - Fix a naming discrepancy in the kernel-doc for
   ksmbd_vfs_kern_path_start_removing() as identified by sparse static
   analysis

 - Reset smb_direct_port to its default value during initialization to
   ensure the correct port is used when switching between different RDMA
   device types without module reload

* tag 'v6.19-rc6-server-fixes' of git://git.samba.org/ksmbd:
  smb: server: reset smb_direct_port = SMB_DIRECT_PORT_INFINIBAND on init
  smb: server: fix comment for ksmbd_vfs_kern_path_start_removing()
  ksmbd: smbd: fix dma_unmap_sg() nents
2026-01-23 13:40:55 -08:00
Linus Torvalds
5bde837031 pci-v6.19-fixes-4
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmlzs3wUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vxjixAAsYMkd1F6PeyhiyslfMErg2qX34fv
 UfxLlarm1OgcTvPabHNE0ifRWrGVc6qaFHiFwrhoyeTDtXoGxuXYtGPFSsamj4de
 AiMBk0ZvMZ7zooKxEAZVsrgNkiOtNBjz2552BM1yZiHaC5Wxs4sBReFRHXheWwxM
 R2AcPjIRKLKuhKKVyReU6m41ubR1LIpq4s+6SwHpPfk3ZUmWRL6bvhQBK8Oa+B0H
 WLE9D48l/RVIFPgXw1LsaVNs+MBTTOTPFRb1UFwWu6xHWC5hH69r6e/XbUd9MZ08
 8SC+zIHDIkBaTNNFthP19NTF24CyDu7Ph2CDAJgq4uWRDAqWePjWw9UxGLQnEFe6
 gkTQ7WNeeFPPD7AS4Ds+754IhEBCr3uF5Gb75HYJjXjS/v5hPl7vX9WPNlDcP0vR
 Q0YaOiXIMmq72z8OtfazOrvQ6ehMcdFtgg9++cQG44gOoo6fJd3fgnTr9XJIpdgm
 gM0PBhiNIxXk8LEwxwPL7jHgM+uaTc9FchhqQK8stEywJC+syqtQFSZhpO5IYC21
 leYFCOkMz5Vq493Ai051LY7xTWqzGfLSbZ2jjJA4SXUB2VUSNMUsRQYGx4dfFKT3
 FRSJOlFqhc2zd2b//9ZMrC+g5Njp9eRU1ykRD/7m2rMVMjXuE2mOivcTCBXU+NPX
 FhKMeI9xkvJswcA=
 =s5tT
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.19-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull PCI fixes from Bjorn Helgaas:

 - Fix the pci_do_resource_release_and_resize() failure path, which
   clobbered the intended failure return value (Ilpo Järvinen)

 - Restore resizable BAR size before value because the size determines
   which bits are writable; this fixes i915 and xe regressions (Ilpo
   Järvinen)

* tag 'pci-v6.19-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: Fix Resizable BAR restore order
  PCI: Fix BAR resize rollback path overwriting ret
2026-01-23 13:20:24 -08:00
Linus Torvalds
2a4d91142e platform-drivers-x86 for v6.19-3
Fixes and New HW Support
 
 - acer-wmi:
 
   - Extend support for Acer Nitro AN515-58
 
   - Fix missing capability check
 
 - amd/wbrf: Fix memory leak in wbrf_record()
 
 - asus-armoury:
 
   - Fix GA403U* matching
 
   - Fix FA608UM TDP data
 
   - Add many models
 
 - asus-wmi: Move OOBE presence check outside deprecation ifdef
 
 - docs:
 
   - alienware-wmi: Typo fix
 
   - amd_hsmp: Fix document link
 
 - hp-bioscfg:
 
   - Fix kernel panic in GET_INSTANCE_ID macro
 
   - Fix kobject warnings for empty attribute names
 
   - Correct GUID to uppercase (lowercase letter prevented autoloading
     the module)
 
 - mellanox: Fix SN5640/SN5610 LED platform data
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  Extend support for Acer Nitro AN515-58
  -  Fix missing capability check
 
 amd:
  -  Fix memory leak in wbrf_record()
 
 asus-armoury:
  -  Add power limits for Asus G513QY
  -  add support for FA401UV
  -  add support for FA617XT
  -  add support for G835L
  -  add support for GA403UV
  -  add support for GA403WM
  -  add support for GA403WW
  -  add support for GV302XV
  -  fix ppt data for FA608UM
  -  fix ppt data for GA403U* renaming to GA403UI
  -  keep the list ordered alphabetically
 
 asus-wmi:
  -  fix sending OOBE at probe
 
 docs: alienware-wmi:
  -  fix typo
 
 docs:
  -  fix PPR for AMD EPYC broken link
 
 hp-bioscfg:
  -  Fix automatic module loading
  -  Fix kernel panic in GET_INSTANCE_ID macro
  -  Fix kobject warnings for empty attribute names
 
 mellanox:
  -  Fix SN5640/SN5610 LED platform data
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaXOZ7AAKCRBZrE9hU+XO
 MRyUAP4m5mllFdMRFeuLKq76tZPuXS0qTE/5KJ0YD+ytSoM8FAEAhpQkZ/hF4lV9
 5i/ANXjkOkeWRblguPuBwJ+8UNOa2AY=
 =chCU
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Ilpo Järvinen:

 - acer-wmi:
     - Extend support for Acer Nitro AN515-58
     - Fix missing capability check

 - amd/wbrf: Fix memory leak in wbrf_record()

 - asus-armoury:
     - Fix GA403U* matching
     - Fix FA608UM TDP data
     - Add many models

 - asus-wmi: Move OOBE presence check outside deprecation ifdef

 - hp-bioscfg:
     - Fix kernel panic in GET_INSTANCE_ID macro
     - Fix kobject warnings for empty attribute names
     - Correct GUID to uppercase (lowercase letter prevented autoloading
       the module)

 - mellanox: Fix SN5640/SN5610 LED platform data

 - docs:
     - alienware-wmi: Typo fix
     - amd_hsmp: Fix document link

* tag 'platform-drivers-x86-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits)
  platform/x86: acer-wmi: Fix missing capability check
  platform/x86: acer-wmi: Extend support for Acer Nitro AN515-58
  platform/x86: asus-armoury: add support for GA403WW
  platform/x86: asus-armoury: keep the list ordered alphabetically
  platform/x86: asus-armoury: add support for G835L
  platform/x86: asus-armoury: fix ppt data for FA608UM
  platform/x86: hp-bioscfg: Fix automatic module loading
  platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
  platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
  platform/x86: asus-wmi: fix sending OOBE at probe
  platform/x86: asus-armoury: add support for FA617XT
  platform/x86: asus-armoury: add support for FA401UV
  platform/x86: asus-armoury: add support for GV302XV
  platform/x86: asus-armoury: Add power limits for Asus G513QY
  platform/x86/amd: Fix memory leak in wbrf_record()
  platform/mellanox: Fix SN5640/SN5610 LED platform data
  docs: fix PPR for AMD EPYC broken link
  docs: alienware-wmi: fix typo
  platform/x86: asus-armoury: add support for GA403UV
  asus-armoury: fix ppt data for GA403U* renaming to GA403UI
  ...
2026-01-23 13:16:26 -08:00
Linus Torvalds
9731fa48be pmdomain providers:
- imx: Remove incorrect reset/clock mask for 8mq vpu
  - rockchip: Fix initial state of PM domain
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmlzZXoXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCl2MQ/9ENVi3Us1n2Uk6hBI9FC8l1I8
 JHtk7Oy8K+QYcenHU9Fevcgb/7HtR2XsugBu3Xuvn8jHGmdQM0ldCBoLDGamTvJX
 oUVjXNAW5Gh+M5OA5dnjt+kh0Nut7WjdAupdVlQwydD0mykakdp845Sc6PquqcrE
 SVFlElvmyfdKwbB+Quj4q49gJtEqqq9EKhZ2IxHTLC/uL/NdZV8vZSTsHe5V0s4q
 ofSPHtnNI8CfGPFCGWw5/DoFukPCboSbr/0T0qieDpRTyFee0HecdIFyyLSyLmAt
 +Z1LIaD+GLkMStLU25Klh7c08MPMD2vUYU2u2or1V5KTw7xU/mChzClTKYGBobce
 QC/HrniQKqJ5hJlPsMXJk0CurEkDt3/VoBj9DXkCqVGJSHVkg1zUB30Z/9IyKE9l
 GhYpVDBWS4lG9ABHo8uLXdH9T7/+dMioDUTs4QkoAc4NSygK4gLRpaMV6yk1dPdh
 gMEzzkFdhV+BpMHl83HGkTujhHpL9lHDcHYKFDqPNmMcuTzR9htQfSFlmrQjF6Nd
 t9sZ8PiK8JN8QLPNGK7o4amoAZ6o0FpEw7PU5oYDX+2mAHHwanNhJV/vQVDZb3pw
 CfurtSwV3blgfSt2ytlRwUZtDIIyFiu1bOdU03oup+Y2b+/yGw4IuK7REcUVHl7k
 ZRhWyLRYlxQ3omHcVvo=
 =yDKM
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v6.19-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fixes from Ulf Hansson:

 - imx: Remove incorrect reset/clock mask for 8mq vpu

 - rockchip: Fix initial state of PM domain

* tag 'pmdomain-v6.19-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  pmdomain:rockchip: Fix init genpd as GENPD_STATE_ON before regulator ready
  pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
2026-01-23 13:12:49 -08:00
Linus Torvalds
d4be90cce6 MMC host:
- rtsx_pci_sdmmc: Fix signal voltage switch
  - sdhci-of-dwcmshc: A couple of fixes for Eswin EIC7700
  - sdhci-of-dwcmshc: Fix support for HS200/HS400 mode
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmlzY1UXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCl8zQ//YuvNrH8AGr8/9Nx/wtLvlKcL
 Z7C4W6bdOTcLpPyb3ixGIFXJ6CfLw6QjwPs6vcsjyu+DXH9gMttyFDE1v7ZzUdTw
 hiII/nj0CRZzxqPE1GMHtAujOSJiKapA5vJU4MKy0QAVwtENBsz+2f+PyzeNOQlN
 nPUylQ+lgOt2xANxCcObA6z96cAcd2q3ZkQ+bx9pLwYIppv+erhXVORzO7zEh5sX
 x+/0ajBmy/XYa/VA4xiKRrS2rh8y0Lj0HfwPB+AYg7GQOD4q+8QvgXWXyrH3TX35
 rBzrps7yj08F7KPzplR8+gwCW1tZc0mk7C6l+DKsJlRaed5M/mesWayDQeYmVdcO
 IPRL5KkmIlpyZXT105qHk5gHjCcXApBGm7t6KNznM+7tIOQAEGT2Ccu9x0BxYnEV
 GYZcj4BksLy8wJn1cJ4ZE0QDrRGsoaUfGQcfj0IRvmvgacdMSIVGE4LqDaewv55n
 Z1rNpwsBXbTiV8VAYElgP5H8FN2ywcdBKwkheOOG016qDaRsi5l/0P0oTrZQaD4Q
 3WK9RPRrkFrj6QwO/M65RxfEmfMq+pWEfgjt2cxVTY1kz1LEBvF/09Xq3N9Ot7qK
 X3x3o/NYuKRsvCWReI2tz7oxyzRz6zXCQfnSuElNrVlbcFuR4RYtBzDBfBUr4TdF
 p9bYCmpRLK4J5pSJnOs=
 =S8D/
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:

 - rtsx_pci_sdmmc: Fix signal voltage switch

 - sdhci-of-dwcmshc:
     - A couple of fixes for Eswin EIC7700
     - Fix support for HS200/HS400 mode

* tag 'mmc-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-of-dwcmshc: Fix DMA 128MB boundary for Eswin EIC7700
  mmc: sdhci-of-dwcmshc: Fix init for AXI clock for Eswin EIC7700
  mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
  mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
2026-01-23 13:01:28 -08:00
Linus Torvalds
00d20db21e block-6.19-20260122
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmly5rUQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpv30EACNx0n1MlRvrIHvqIH+gq2NmpweLhJphars
 3e4lyDD5bBUuQ1V2iRc5k7MiKPEtQJpF83m1WVIvycNjjx2qWLBsZyCc9PCNoZIn
 nBe1/qCuKOs8kmrNkTXLKjr1uFVp+0Nm5jWSjeIgNI1zd7IDe6fpkjyH6JrnKsw8
 DD7aCYE4jHGJH8q9Ks3rOu3M2syiFwkqmOD12Xgqiz29fP4qJJDvC/y4yOMDWbZY
 G7ZKFHZK5QS8tmjRUhgJacVpJlN3NCL6lZ16f0fRTJoIlWzOAaBafeJTAjiS3S01
 TS8sadfTLrVZocFYSKZjixVgUocHqE5QeKBrDe09N0A5XsWz/YJkcNisNw0oRcvb
 BKCrO1TCHiPzliPCobPcaFZII4z2HeiIfVGSTaJAzSM4ZCt/EH9BFTKrgohGRZi4
 v+bPNdJaCLaFOipgsUeA63NZpt9xN+PsfmzFGC1PvF50gQMM+JeFpqjNh37XjCIt
 6QtK9rzLzC9GvdFXV3o1CRbIBAli3UEgjyLeThhsCu2HPnab/yrrf9AwF5udZQlJ
 wK7S8kB3zl25nyM3jwKzzaVLqi+aUWr1Jn+D+DA2BwwPg3m8h7yIrysJryF5Leon
 5VAYHCOg+MhPuvhNFjqkgahjreJqV/3Qou+sbGcLur4PXdKXeW8SY5wrDlplumFb
 +BZSUZ06Kw==
 =RK+t
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - A set of selftest fixes for ublk

 - Fix for a pid mismatch in ublk, comparing PIDs in different
   namespaces if run inside a namespace

 - Fix for a regression added in this release with polling, where the
   nvme tcp connect code would spin forever

 - Zoned device error path fix

 - Tweak the blkzoned uapi additions from this kernel release, making
   them more easily discoverable

 - Fix for a regression in bcache with bio endio handling added in this
   release

* tag 'block-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  bcache: use bio cloning for detached device requests
  blk-mq: use BLK_POLL_ONESHOT for synchronous poll completion
  selftests/ublk: fix garbage output in foreground mode
  selftests/ublk: fix error handling for starting device
  selftests/ublk: fix IO thread idle check
  block: make the new blkzoned UAPI constants discoverable
  ublk: fix ublksrv pid handling for pid namespaces
  block: Fix an error path in disk_update_zone_resources()
2026-01-23 12:53:56 -08:00
Linus Torvalds
7907f673d0 io_uring-6.19-20260122
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmly5p8QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpqzlD/4+wBnwP7VGJSQJRHkWnewgbLk4CZcDbFdw
 jlv2Hp8AymmhNkMQmCauKJMahUYcDz0Gb+sSs3/MdOMqNvHkh1G6QVEMbK0W9N35
 HuMmimb9Pac2JSMrTiJnVcogi371P/iD1Ps7qlo08QvxV6uSQtHxtoUvsuQqwkxn
 WxhDVIxlLOZgWL0OiSAJ9maEvGWiMYeI1Me+MKatQQbkEybTBOMy34HhTe3Fi3zQ
 X3jVD2loyu/dP309/yjr2ZS2b3SGJyMCqpiICunpAeAafvnPr4vXiuUhATZHmQ1B
 XnAkkb4p0k8nECMDNZjSgqcFbDzkbHvsuyFMiSFgEELwV87qusZnbL66jmcPC3eh
 JDd6SuE4FpXNUhdGc7h6ma+vNwcr1ZNdPlUmqvlDbhcl57fcge14930OXybFPW8Q
 z3+LC5Jo37e61wYTv7M84wtsjdzdADkUb71y482U2bpeIZyg2YhTZ39FO9u6GETW
 2JhBXuikE1fanTji9klh0de2+LIbtlGZlJA1SkQiWsPRxWZB6Jg4wa2kkXZBLb94
 eR026zmg0h5Wt8g815E0XEHzv8hEqy14vGc+dj3Mw5pMYQGONNr5UOog50yihVNF
 q8dTYmtI4EN6Vbqq7usZ7Q/mN72PUzlykIT8OABPoWzvzvOZh4b2pZtKH1kfLUfN
 zMtq1Y7+dw==
 =n+AN
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix for a potential leak of an iovec, if a specific cleanup path is
   used and the rw_cache is full at the time of the call

 - Fix for a regression added in this cycle, where waitid should be
   using prober release/acquire semantics for updating the wait queue
   head

 - Check for the cancelation bit being set for every work item processed
   by io-wq, not just at the start of the loop. Has no real practical
   implications other than to shut up syzbot doing crazy things that
   grossly overload a system, hence slowing down ring exit

 - A few selftest additions, updating the mini_liburing that selftests
   use

* tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  selftests/io_uring: support NO_SQARRAY in miniliburing
  selftests/io_uring: add io_uring_queue_init_params
  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  io_uring/waitid: fix KCSAN warning on io_waitid->head
  io_uring/rw: free potentially allocated iovec on cache put failure
2026-01-23 12:51:00 -08:00
Linus Torvalds
b33d706259 IOMMU Fixes for Linux v6.19-rc6
Including:
 
 	- AMD IOMMU: Fix potential NULL-ptr dereference in error path of
 	  amd_iommu_probe_device().
 
 	- Generic IOMMUPT: Fix another compiler issue seen with older compiler
 	  versions.
 
 	- Fix signedness issue in ARM IO-PageTable code.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmlzOg0ACgkQK/BELZcB
 GuMQRhAAhgPw7RD6NPEb67NG4g28tuDBLEWBc10IS0d0XjP5QZCcFT3wLY4CYDsK
 J5QRDgYv6sACaOWgv5oB4N2WffqC6nC2YVniOmmq3s2Emfk/5eAo0MpRchvdiVDD
 F6tuUU/RwmeuUbK/6pa6SDrRsXy/SgQI858FkvVQSk8Ngj0ECFoUyJCbaqODzpP6
 Cxp2KyY0FqcfssGtf6uFMSvXhC0CrFOwWHBXp5UzMOPnEHABxMUdQEHTfsR631bt
 IrYphkspnhfMpeAntZxpqAeejWnWcMf3nYlwt5j1UxjUuvfNtloc6hHFb6ln+/ad
 BG0wX5kqOK4LC4oiStz3qo9eMWrmbvG8L32Wpo8iPxd1CJ+Lu2+EaaHAYDrgoMo2
 ApRAEEApzDkuGK61J3a1Ff2eg2WInBXmY55VXH2rBA2wnUrZKwYriivojt6ySXWz
 g6RpOWHxo6ztQN/C7VynqnvaQ5WKMHG9AhL2M6jQtP16obCz9hJut0Ps3v6AbOl2
 9bQDTAEnFAi+ribCqg4PFKlcVg8wLqjDQJQLRO/hbATfV/mY0loyRVIHdyPuQUya
 IP1iKZn2LNwsYgl0AtrcDvXojl6CD/T1W5XjR0Q5hrNbWk1CSi2GmXMJFCiKV0pu
 fzS6Sv/8DS2tE1QgG4IAgbEqqb0TKeOdWcYFdZP/WRgaC8tPTeM=
 =k63u
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu fixes from Joerg Roedel:

 - AMD IOMMU: Fix potential NULL-ptr dereference in error path
   of amd_iommu_probe_device()

 - Generic IOMMUPT: Fix another compiler issue seen with older
   compiler versions

 - Fix signedness issue in ARM IO-PageTable code

* tag 'iommu-fixes-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
  iommupt: Make it clearer to the compiler that pts.level == 0 for single page
  iommu/amd: Fix error path in amd_iommu_probe_device()
2026-01-23 12:46:12 -08:00
Linus Torvalds
c133687c2e spi: Fixes for v6.19
One new device ID, plus a few fixes.  The most substantial of the fixes
 is for the Cadence driver which in at least some instantiations requires
 transmit data to drive data through the IP.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlzk5EACgkQJNaLcl1U
 h9Do6ggAhqhHRYoU2DyG+fDxCGBM7N1qj02/YsG8XETHsr2p+bIoB7VzVNF1xE/w
 hTeHsWsEpj7rAt2Ieq31n1on3iS75lkY7f29uyoJa8uorBCSd+MpVNoeySZVr/s6
 nFFhMiIjf/g82UdNoaaDBCvcCYphg+FNhkswSJ/Z1Hej4kw74LZydSUggpsmLR+K
 wnZUpV2PRGH1fMnJgRHDR0JV9PfMAe6BW043ud1cQDLpd2GQXKOLbwDDWv69XZBL
 F1O8ulHsTRb8hDKxZ2bBXNaLW4+eZp3AglVEIPHtrztLmIyyyToYIXFGALr1DV0C
 nXuDf/zi9Dlfuk1UvAcEa81qhv2Vfg==
 =PFwm
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "One new device ID, plus a few fixes.

  The most substantial of the fixes is for the Cadence driver which in
  at least some instantiations requires transmit data to drive data
  through the IP"

* tag 'spi-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: intel-pci: Add support for Nova Lake SPI serial flash
  spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
  spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  spi: spi-sprd-adi: Fix double free in probe error path
2026-01-23 10:20:28 -08:00
Linus Torvalds
346c558355 regulator: Fix for v6.19
A trivial fix adding a missing memory allocation check.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlzke4ACgkQJNaLcl1U
 h9APlAf/Zl4mK6LShJJZryTgZTRqSX+Gz1NrjvbKqFWhuwqK5ODZ8WVZuKVn7Fje
 Sy66yP2NOAZOGITR9hsTpmFGC892abT/VCa526MIx2b2MYHYBr2IgZFn2cEiqEaR
 ZAYORPozIcSQ9FWsrLTA5f6/p/a3eM3I16WdjTPjCnBe0hQkLeCoTLbnMGz7GJ4/
 3RPqMCRjiPIo2c+Tycdekm13CGFZPvVnAzdAsZ0M6sVPSt/w3cqE9CJPy/zFMQSb
 j9DDL/yDS5pgNY4x2luL+VpPFgUQxonNHjy3RyxvZjc/TQHCpyBUnNnKdLoZg0iI
 5/MAyo6TiKC8Ri66bvQEcY27jQnl9w==
 =PM+N
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "A trivial fix adding a missing memory allocation check"

* tag 'regulator-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: fp9931: Add missing memory allocation check
2026-01-23 10:19:18 -08:00
Linus Torvalds
afb923b819 regmap: Fixes for v6.19
A couple of small fixes, one error handling one and another for misuse
 of the hwspinlock API.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlzkXAACgkQJNaLcl1U
 h9BzEgf+P1U0W8t1Ol/v6sttRiZOaIAlM0/3ZX0zsttJarHTjdMY7ilzFvN361wR
 xNsVNB8FUVrAeVzoW4+xPNgPEuBqD+pO9kUz4cg2ZEt2Ym/BsgeL6vE7Gbj5+P6V
 6tIZOZkIQnQZ4DqCXH3IMv5AFCgHWtrt/3bHVUpUUHdxYadvh1iKRwv1Sgr/SWeO
 wi1zlYGABY+Bv8FDzv6w29CCKI5YkMahuLSzXEYlaneGF8eCswyogzyaHG6gmD6h
 t06OlG2+vNlghrvJqbXk+casJyM7UDxF8NUgWrFQ3k+kBDAQojcrqAfFPiGMgmyV
 SVfFVQ0OGsaLh1KQHJi9KivlQyjT0Q==
 =nXyd
 -----END PGP SIGNATURE-----

Merge tag 'regmap-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap fixes from Mark Brown:
 "A couple of small fixes, one error handling one and another for misuse
  of the hwspinlock API"

* tag 'regmap-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Fix race condition in hwspinlock irqsave routine
  regmap: maple: free entry on mas_store_gfp() failure
2026-01-23 10:17:06 -08:00
Linus Torvalds
1f664bbd5f gpio fixes for v6.19-rc7
- fix resource leaks in error paths in GPIO character device code
 - return -ENOMEM and not -ENODEV on memory allocation failure
 - fix an audio issue on Qualcomm platforms due to configuration not
   being propagated to pinctrl from shared GPIO proxy
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmlzQPgACgkQBZ0uy/82
 hMOVLBAAoRiX+SyZ2zXnsjqmgoUB4DdpeRLu7E4vgrB3mvSqdKfFLG76aPUO0S9H
 QwYG5S8P/NoXNt7wJKoIc0jBiv+/P7leGIe7rEumg+uzfQ7dznIdXloPNttE9mB2
 eaLQF3B1i/HtHKOSwJYtq5E8Pqxy0TU56SYMTbfJV7+ZpqhSv7z43lxSCIjXFPJ4
 rhmn07rs1t6q/QGusdHyEk35kzYOGYhFkLdWuUnqVAw5/y2PDXU00YQ/r/av5CO4
 K38WqDOpxl1/HCifQUYof89nUq5aysAHu80pUd3u7GsPZPaL9KZY8xuRdYIIlC8e
 3Mr2KhgeKWrx8IrFizOoE4TnsXkLzD61JOQmHMnx9kXIRU1GcUdO9NS1CAxZABJ9
 lO4mTa+QnYI4PDlsx0e0ixgShzu/HhhJhdLBmbRhUEsJNp1qlhisyNIBhkHxByJ7
 bGXWxUOARccceSX8EkhcC0B1W24sTwH+1pjotzZRoCt0e1vD4cNU67nnIP23ApdC
 j+ExPdj89pe9Hc7NlxkGNx7Z2eG9l8J3Tx2EkK4TIGnUplEqrZl3sXG9KEYxesFd
 1dNPcv9C1qrVhquEGQHOYNfCH5nljvFq7cjE0H+TWXVvLVAgRhLpgVnxXSiFkjry
 mC2VwVUcmvYti0T6vhvYb213XI/zMm0+7sOyRmjXrpG8nvQl7kk=
 =/U+a
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:
 "Some fixes to resource leaks in the character device handling and
  another small fix for shared GPIO management:

   - fix resource leaks in error paths in GPIO character device code

   - return -ENOMEM and not -ENODEV on memory allocation failure

   - fix an audio issue on Qualcomm platforms due to configuration not
     being propagated to pinctrl from shared GPIO proxy"

* tag 'gpio-fixes-for-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: shared: propagate configuration to pinctrl
  gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register()
  gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()
  gpio: cdev: Correct return code on memory allocation failure
2026-01-23 10:14:52 -08:00
Zhaoyang Huang
e2f8216ca2 arm64: Set __nocfi on swsusp_arch_resume()
A DABT is reported[1] on an android based system when resume from hiberate.
This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*()
and does not have a CFI hash, but swsusp_arch_resume() will attempt to
verify the CFI hash when calling a copy of swsusp_arch_suspend_exit().

Given that there's an existing requirement that the entrypoint to
swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text
section, we cannot fix this by marking swsusp_arch_suspend_exit() with
SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in
swsusp_arch_resume().

Mark swsusp_arch_resume() as __nocfi to disable the CFI check.

[1]
[   22.991934][    T1] Unable to handle kernel paging request at virtual address 0000000109170ffc
[   22.991934][    T1] Mem abort info:
[   22.991934][    T1]   ESR = 0x0000000096000007
[   22.991934][    T1]   EC = 0x25: DABT (current EL), IL = 32 bits
[   22.991934][    T1]   SET = 0, FnV = 0
[   22.991934][    T1]   EA = 0, S1PTW = 0
[   22.991934][    T1]   FSC = 0x07: level 3 translation fault
[   22.991934][    T1] Data abort info:
[   22.991934][    T1]   ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
[   22.991934][    T1]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   22.991934][    T1]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   22.991934][    T1] [0000000109170ffc] user address but active_mm is swapper
[   22.991934][    T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP
[   22.991934][    T1] Dumping ftrace buffer:
[   22.991934][    T1]    (ftrace buffer empty)
[   22.991934][    T1] Modules linked in:
[   22.991934][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419
[   22.991934][    T1] Hardware name: Unisoc UMS9360-base Board (DT)
[   22.991934][    T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   22.991934][    T1] pc : swsusp_arch_resume+0x2ac/0x344
[   22.991934][    T1] lr : swsusp_arch_resume+0x294/0x344
[   22.991934][    T1] sp : ffffffc08006b960
[   22.991934][    T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000
[   22.991934][    T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820
[   22.991934][    T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000
[   22.991934][    T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058
[   22.991934][    T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004
[   22.991934][    T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000
[   22.991934][    T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000
[   22.991934][    T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b
[   22.991934][    T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530
[   22.991934][    T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000
[   22.991934][    T1] Call trace:
[   22.991934][    T1]  swsusp_arch_resume+0x2ac/0x344
[   22.991934][    T1]  hibernation_restore+0x158/0x18c
[   22.991934][    T1]  load_image_and_restore+0xb0/0xec
[   22.991934][    T1]  software_resume+0xf4/0x19c
[   22.991934][    T1]  software_resume_initcall+0x34/0x78
[   22.991934][    T1]  do_one_initcall+0xe8/0x370
[   22.991934][    T1]  do_initcall_level+0xc8/0x19c
[   22.991934][    T1]  do_initcalls+0x70/0xc0
[   22.991934][    T1]  do_basic_setup+0x1c/0x28
[   22.991934][    T1]  kernel_init_freeable+0xe0/0x148
[   22.991934][    T1]  kernel_init+0x20/0x1a8
[   22.991934][    T1]  ret_from_fork+0x10/0x20
[   22.991934][    T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110)

Co-developed-by: Jeson Gao <jeson.gao@unisoc.com>
Signed-off-by: Jeson Gao <jeson.gao@unisoc.com>
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Acked-by: Will Deacon <will@kernel.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
[catalin.marinas@arm.com: commit log updated by Mark Rutland]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-01-23 18:13:07 +00:00
Linus Torvalds
6e49f9e05c sound fixes for 6.19-rc7
A collection of a few more small fixes for HD- and USB-audio,
 including a regression fix for the OOB fix that was included in
 the previous PR.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmlyUsMOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE8Jsg//bdurKx6pYKtDDPRvcOs+1D5pE6a804M8vEiM
 YyfzseQ3KpJ+MsMXEXD4zZ4AJ0GgZoeCkjsvHxKbXu4gBv+AiHfuke0nmA/5hwas
 Nge6ItXd8/JNVsltpZblp+SodPLGWHsxdnIxgUSXVqlGeyg8OnbJh3VDcMtBq3gA
 0GnpkcQ6GRMo1O9owa4p1Mfx6OwXzW+Frtukxo0p0vMqcj7A1D8r3hR1dvsSfygT
 vFXkVyy7Zoe7HYy4DfbHVEwaeSU2S9+CDoKAjzLaf5dGG8i1VeuDXa4zDsnwFkfK
 X1YKScJ+gb6e40W39jrAWqLnksmal8m5KWaNqSJrJJBrLmaWfpP0vr84EhNtDzie
 mpXnIGeylkMe8HM8+2TGE3rAz2a2SuVzs1ICigXwf4UxJ6X/gtdoTnbZ8oB+3UJQ
 LHsuYFPmKkXNuCyA6fWD2bFwu9EG1anGkNHmjzHH60BIhGox/Jsp9/Aw2HHr/Ryv
 re+0vCPURYhiZUjc/UdI6BR41fA0Uu+fXNu0urwCdjefTMB0QXxG+dRRigr3uD4x
 0ezSxO3C8RfpPxqilUGree4xbZVwqINI8E9LoIUm8+CyRUtmAEDcjcOIwaz0dvOB
 YF7jvpTuMExb0fLImJz3xwWXjHqKprrXjvA4WJKV3FrzMB3H/7tf2Ig0HAPE9Tpa
 rF2YSUA=
 =MH0R
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of a few more small fixes for HD- and USB-audio,
  including a regression fix for the OOB fix that was included
  in the previous pull request"

* tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
  ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone
  ALSA: usb-audio: Use the right limit for PCM OOB check
  ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
  ALSA: ctxfi: Fix potential OOB access in audio mixer handling
  selftests: ALSA: Remove unused variable in utimer-test
  ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti
  ALSA: scarlett2: Fix buffer overflow in config retrieval
  ALSA: usb: Increase volume range that triggers a warning
2026-01-23 09:37:35 -08:00
Linus Torvalds
d6112dddbf drm fixes for 6.19-rc7
xe:
 - Disallow bind-queue sharing across multiple VMs
 - Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE
 - Fix a missed page count update
 - Fix a confused argument to alloc_workqueue()
 - Kernel-doc fixes
 - Disable a workaround on VFs
 - Fix a job lock assert
 - Update wedged.mode only after successful reset policy change
 - Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected
 
 amdgpu:
 - fix color pipeline string leak
 - GC 12 fix
 - Misc error path fixes
 - DC analog fix
 - SMU 6 fixes
 - TLB flush fix
 - DC idle optimization fix
 
 amdkfd:
 - GC 11 cooperative launch fix
 
 imagination:
 - sync wait for logtype update completion to ensure FW trace is
   available
 
 bridge/synopsis:
 - Fix error paths in dw_dp_bind
 
 nouveau:
 - Add and implement missing DSB connector types, and improve unknown
   connector handling.
 - Set missing atomic function ops.
 
 intel:
 - place 3D lut at correct place in pipeline
 - fix color pipeline string leak
 
 vkms:
 - fix color pipeline string leak
 
 mediatek:
 - Fix platform_get_irq() error checking
 - HDMI DDC v2 driver fixes
 - dpi: Find next bridge during probe
 - mtk_gem: Partial refactor and use drm_gem_dma_object
 - dt-bindings: Fix typo 'hardwares' to 'hardware'
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmlzBFkACgkQDHTzWXnE
 hr7pyg//TjFajyFkWu0tcxmM6qGmaYfTW4TFnbeUR3I/P3bOgP9ak9c074tFoiFD
 Gc+3tE1u3absXbewfmc1BpR9dexx+KjNByrEfp2FXl48/cXNsLJx8MYM/TMMNj+e
 k+RWI9Aou4D55fPGxuiQ5pCQnW3WjlVjT3JYEfufxIhuoIBDYCneQ9WP7991LTw9
 OvC6kpHnCBx6U9TuJDJ8z+36Y0xUZ77Ih47i8VfZdv7BbzJnBe4pjTAaIPMBFdQr
 X9Ii2RI2SLrlaSa38UmB5v46g2KAWJYEL5Gx+h8phTWHiaUqjR38QQ0nHinfLNWw
 +KUUIADXqRJ8YWtRE0xz/2JDQyHthDtrLcapMpi2MXR/jJr0rpUGOSDfa7xAiuXC
 MyjB1C/hUQTCXaxBMyliRagat4TQBHKdXQR/w44TsbUtnWicRNqPXqjLkebvkIlA
 VjC11j45KKm29qTgBQftGUT3cKXmA4kGwcmj4jtJv5wYwHIZ9FtfIt9y9tflrntd
 djTZXTCfEYXOJRIljHzIdVe9j7j9TWT3DROsrBRlIjMEK1GRLk5o+cMOpa/Na19i
 hxfIiaQSUrsf5se5/qWOXDpJcJDLd5u2uZqgwL4N0Zvd803Uxmc4BxVrmNe1AAEl
 V28f+lrIUwAn+Y1wI7Tl0jd5grVNZ9c6hs/EICvW03ASYXkFL10=
 =Ur9f
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-01-23' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Probably a good thing you decided to do an rc8 in this round. Nothing
  stands out, but xe/amdgpu and mediatek all have a bunch of fixes, and
  then there are a few other single patches. Hopefully next week is
  calmer for release.

  xe:
   - Disallow bind-queue sharing across multiple VMs
   - Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE
   - Fix a missed page count update
   - Fix a confused argument to alloc_workqueue()
   - Kernel-doc fixes
   - Disable a workaround on VFs
   - Fix a job lock assert
   - Update wedged.mode only after successful reset policy change
   - Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected

  amdgpu:
   - fix color pipeline string leak
   - GC 12 fix
   - Misc error path fixes
   - DC analog fix
   - SMU 6 fixes
   - TLB flush fix
   - DC idle optimization fix

  amdkfd:
   - GC 11 cooperative launch fix

  imagination:
   - sync wait for logtype update completion to ensure FW trace
     is available

  bridge/synopsis:
   - Fix error paths in dw_dp_bind

  nouveau:
   - Add and implement missing DSB connector types, and improve
     unknown connector handling
   - Set missing atomic function ops

  intel:
   - place 3D lut at correct place in pipeline
   - fix color pipeline string leak

  vkms:
   - fix color pipeline string leak

  mediatek:
   - Fix platform_get_irq() error checking
   - HDMI DDC v2 driver fixes
   - dpi: Find next bridge during probe
   - mtk_gem: Partial refactor and use drm_gem_dma_object
   - dt-bindings: Fix typo 'hardwares' to 'hardware'"

* tag 'drm-fixes-2026-01-23' of https://gitlab.freedesktop.org/drm/kernel: (38 commits)
  Revert "drm/amd/display: pause the workload setting in dm"
  drm/xe: Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected
  drm, drm/xe: Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE
  drm/i915/display: Fix color pipeline enum name leak
  drm/vkms: Fix color pipeline enum name leak
  drm/amd/display: Fix color pipeline enum name leak
  drm/i915/color: Place 3D LUT after CSC in plane color pipeline
  drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)
  drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors
  drm/nouveau: add missing DCB connector types
  drm/amdgpu: fix type for wptr in ring backup
  drm/amdgpu: Fix validating flush_gpu_tlb_pasid()
  drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
  drm/amd/pm: Don't clear SI SMC table when setting power limit
  drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting
  drm/xe: Update wedged.mode only after successful reset policy change
  drm/xe/migrate: fix job lock assert
  drm/xe/uapi: disallow bind queue sharing
  drm/amd/display: Only poll analog connectors
  drm/amdgpu: fix error handling in ib_schedule()
  ...
2026-01-23 09:01:26 -08:00
Vincent Guittot
15257cc2f9 sched/fair: Revert force wakeup preemption
This agressively bypasses run_to_parity and slice protection with the
assumpiton that this is what waker wants but there is no garantee that
the wakee will be the next to run. It is a better choice to use
yield_to_task or WF_SYNC in such case.

This increases the number of resched and preemption because a task becomes
quickly "ineligible" when it runs; We update the task vruntime periodically
and before the task exhausted its slice or at least quantum.

Example:
2 tasks A and B wake up simultaneously with lag = 0. Both are
eligible. Task A runs 1st and wakes up task C. Scheduler updates task
A's vruntime which becomes greater than average runtime as all others
have a lag == 0 and didn't run yet. Now task A is ineligible because
it received more runtime than the other task but it has not yet
exhausted its slice nor a min quantum. We force preemption, disable
protection but Task B will run 1st not task C.

Sidenote, DELAY_ZERO increases this effect by clearing positive lag at
wake up.

Fixes: e837456fdc ("sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals")
Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260123102858.52428-1-vincent.guittot@linaro.org
2026-01-23 11:53:20 +01:00
Mel Gorman
4f70f106bc sched/fair: Disable scheduler feature NEXT_BUDDY
NEXT_BUDDY was disabled with the introduction of EEVDF and enabled again
after NEXT_BUDDY was rewritten for EEVDF by commit e837456fdc ("sched/fair:
Reimplement NEXT_BUDDY to align with EEVDF goals"). It was not expected
that this would be a universal win without a crystal ball instruction
but the reported regressions are a concern [1][2] even if gains were
also reported. Specifically;

o mysql with client/server running on different servers regresses
o specjbb reports lower peak metrics
o daytrader regresses

The mysql is realistic and a concern. It needs to be confirmed if
specjbb is simply shifting the point where peak performance is measured
but still a concern. daytrader is considered to be representative of a
real workload.

Access to test machines is currently problematic for verifying any fix to
this problem. Disable NEXT_BUDDY for now by default until the root causes
are addressed.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Madadi Vineeth Reddy <vineethr@linux.ibm.com>
Link: https://lore.kernel.org/lkml/4b96909a-f1ac-49eb-b814-97b8adda6229@arm.com [1]
Link: https://lore.kernel.org/lkml/ec3ea66f-3a0d-4b5a-ab36-ce778f159b5b@linux.ibm.com [2]
Link: https://patch.msgid.link/fyqsk63pkoxpeaclyqsm5nwtz3dyejplr7rg6p74xwemfzdzuu@7m7xhs5aqpqw
2026-01-23 11:53:19 +01:00
Linus Torvalds
c072629f05 This push contains the following changes:
- Add assoclen check in authencesn.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmlvI3EACgkQxycdCkmx
 i6cNEw/+O8NYAk2QPbYaG0gFrlCPHT7IxhJLZMXNFWZgibrJbdImyX/oPGluGt98
 vE74h4A9NLJ9pR/oDq9j/HQ+pUITYNw8GYDTnnESAlQRZedg1hZPoGHnlVg9f+/H
 bvRAmvNW2SK1POz97pTvwLDx6WEOq22rl5OsQrobnd54qvXCLzhTSeL8jgciHWzA
 pCRGaW8EpqjwQLr8ndAftrh9cDqU5D5SuRvjhxJurcviv1o3m3Ba30zzflmLbijI
 ErvTwlPax6aNBzB0Xib/tm+0Iu977Hu5ambNp9qKk5PnQU4+7XHR3OjxibimLFVP
 92VVgcnvXSfOum1HwXyw9p6I/dA2+r6dXY+a5iBPuaHdxu8cp3+zWnCh/K3ymXr6
 ov6qZGQGdc7BkkD+lqT6B70dKm/+WwjEY4hh8uNXyM6XAOmvv4YwmQeTqvM9rK6i
 MtXo39e1/VWHyOusHA9Hrw8j0uqqcOGnoBKtPiOfqW30ftfZANU6rjrnrUk0hlSS
 UUSMv7QJx/myoUltrBZLmE3g2ZK+HiOjGL2/A0cBAyQhl5A8zh1Q8QiDU7uFgxCK
 VIZ5OuqarBL2zEkvp8tKp5Se8RrSE+E+Mqbxi00GV1PVPxcG+3GgkG5yA/pGJWwu
 hfWhcscAQX15+cocaY5sTgEvKJd3MCodkLaXaIJvuvXV8qBV+V0=
 =BEIq
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fix from Herbert Xu:

 - Add assoclen check in authencesn

* tag 'v6.19-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
2026-01-22 19:39:25 -08:00
Cedric Xing
614da1d3d4 x86: make page fault handling disable interrupts properly
There's a big comment in the x86 do_page_fault() about our interrupt
disabling code:

    * User address page fault handling might have reenabled
    * interrupts. Fixing up all potential exit points of
    * do_user_addr_fault() and its leaf functions is just not
    * doable w/o creating an unholy mess or turning the code
    * upside down.

but it turns out that comment is subtly wrong, and the code as a result
is also wrong.

Because it's certainly true that we may have re-enabled interrupts when
handling user page faults.  And it's most certainly true that we don't
want to bother fixing up all the cases.

But what isn't true is that it's limited to user address page faults.

The confusion stems from the fact that we have logic here that depends
on the address range of the access, but other code then depends on the
_context_ the access was done in.  The two are not related, even though
both of them are about user-vs-kernel.

In other words, both user and kernel addresses can cause interrupts to
have been enabled (eg when __bad_area_nosemaphore() gets called for user
accesses to kernel addresses).  As a result we should make sure to
disable interrupts again regardless of the address range before
returning to the low-level fault handling code.

The __bad_area_nosemaphore() code actually did disable interrupts again
after enabling them, just not consistently.  Ironically, as noted in the
original comment, fixing up all the cases is just not worth it, when the
simple solution is to just do it unconditionally in one single place.

So remove the incomplete case that unsuccessfully tried to do what the
comment said was "not doable" in commit ca4c6a9858 ("x86/traps: Make
interrupt enable/disable symmetric in C code"), and just make it do the
simple and straightforward thing.

Signed-off-by: Cedric Xing <cedric.xing@intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Fixes: ca4c6a9858 ("x86/traps: Make interrupt enable/disable symmetric in C code")
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-01-22 16:49:17 -08:00
Stefan Metzmacher
5914d98ff0 smb: server: reset smb_direct_port = SMB_DIRECT_PORT_INFINIBAND on init
This allows testing with different devices (iwrap vs. non-iwarp) without
'rmmod ksmbd && modprobe ksmbd', but instead
'ksmbd.control -s && ksmbd.mountd' is enough.

In the long run we want to listen on iwarp and non-iwarp at the same time,
but requires more changes, most likely also in the rdma layer.

Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-01-22 18:13:44 -06:00
Stefan Metzmacher
8e50cd059c smb: server: fix comment for ksmbd_vfs_kern_path_start_removing()
This was found by sparse...

Fixes: 1ead2213dd ("smb/server: use end_removing_noperm for for target of smb2_create_link()")
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: NeilBrown <neil@brown.name>
Cc: Christian Brauner <brauner@kernel.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-01-22 18:13:44 -06:00
Thomas Fourier
98e3e2b561 ksmbd: smbd: fix dma_unmap_sg() nents
The dma_unmap_sg() functions should be called with the same nents as the
dma_map_sg(), not the value the map function returned.

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-01-22 18:13:44 -06:00
Dave Airlie
b91adbe830 Mediatek DRM Fixes - 20260119
1. Fix platform_get_irq() error checking
 2. HDMI DDC v2 driver fixes
 3. dpi: Find next bridge during probe
 4. mtk_gem: Partial refactor and use drm_gem_dma_object
 5. dt-bindings: Fix typo 'hardwares' to 'hardware'
 -----BEGIN PGP SIGNATURE-----
 
 iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmluT6cYHGNodW5rdWFu
 Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4kztAQAIcOjE6LFQlZ/06HJSI7a2GM
 ZhI7vsLg+690m7/FBuIxIWWpjzJZy/9aAHMBq8ggxRyoQXIOQUG0At+oYepQRaHF
 +KzA4kzAmuH9fZ5nY3TvqT75Kij9O3j6B25SLx8dXStyBUei8bpFf7+UUCIWeQW+
 LbNIRO1Go5G7w++h8l1n60pBB/sGNDzGXdUAZUu7L1XcHZmAsHVgdIckIbMpGKzu
 Y2D/cz7vfmSpj7j8kbycUihrYNLAPySQyiwgka4uXIo9ufqNp43lnLXFeDjTAuyI
 NWDybmoUuoTdcNMTsk97LAUd/s3eBC0vtOEbItnSEqIhNYJm+0UmZSfpjEkFXWLm
 QWZjIbvRM4lK0L+Vk7bypmvWPD6w8cAov4wEo/tdtU8kls2brV5mZv+VMBj1Brwp
 r84F2ZlIxspVuEJBXBIlzvBR+DF0OkkeG/sX/9INl6xDPRJd4QIU3eWaCQqM6kFo
 9EhCNhVi8KX8l+G94lIlp6+5Avh8Vb1q3SHZb9Il383dT9Uyb0PkkpZ6kH0ctcla
 Vt7eEITAgbD+dMxNOwfgKDkkJXhqAun4OtTSuaorMB1VeJzfUYHDHAwKTeQLy6YO
 u5xvFCt5fisUXoEvq8C/h5LODqKH/3CctyU71ngdQNJdyKTsGaNgbP77uo7JlV+z
 oK1zViYjROa7eNqm2ZnO
 =dXiD
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-fixes-20260119' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes

Mediatek DRM Fixes - 20260119

1. Fix platform_get_irq() error checking
2. HDMI DDC v2 driver fixes
3. dpi: Find next bridge during probe
4. mtk_gem: Partial refactor and use drm_gem_dma_object
5. dt-bindings: Fix typo 'hardwares' to 'hardware'

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patch.msgid.link/20260119154717.4735-1-chunkuang.hu@kernel.org
2026-01-23 10:13:12 +10:00
Dave Airlie
2312e0ab59 amd-drm-fixes-6.19-2026-01-22:
amdgpu:
 - GC 12 fix
 - Misc error path fixes
 - DC analog fix
 - SMU 6 fixes
 - TLB flush fix
 - DC idle optimization fix
 
 amdkfd:
 - GC 11 cooperative launch fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaXKLGQAKCRC93/aFa7yZ
 2GcoAQDqgc1GiSwOyLhSE5MQimgofNVxaXZJ5zrM1JoAfmNelwD/bPAPejDZvyHm
 FECX3UOoMUTIFZT3Ja1yFp4VDWyXhAA=
 =58xj
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.19-2026-01-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.19-2026-01-22:

amdgpu:
- GC 12 fix
- Misc error path fixes
- DC analog fix
- SMU 6 fixes
- TLB flush fix
- DC idle optimization fix

amdkfd:
- GC 11 cooperative launch fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260122204308.946339-1-alexander.deucher@amd.com
2026-01-23 08:12:39 +10:00
Dave Airlie
e63b9229c3 UAPI Changes:
- Disallow bind-queue sharing across multiple VMs (Matt Auld)
 
 Core Changes:
 - Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE (Thomas)
 
 Driver Changes:
 - Fix a missed page count update (Matt Brost)
 - Fix a confused argument to alloc_workqueue() (Marco Crivellari)
 - Kernel-doc fixes (Jani)
 - Disable a workaround on VFs (Matt Brost)
 - Fix a job lock assert (Matt Auld)
 - Update wedged.mode only after successful reset policy change (Lukasz)
 - Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected (Thomas)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCaXIbUgAKCRC4FpNVCsYG
 v+HJAP0fU6LmLJtJ1iVkde0lapI2Yt24HZO2aKyGpfyCG11kggD/TsrGzalpH3MB
 5+HG8rkdhJl6slSq3Bc4Ql+0FnXSiwY=
 =Y5u3
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2026-01-22' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

UAPI Changes:
- Disallow bind-queue sharing across multiple VMs (Matt Auld)

Core Changes:
- Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE (Thomas)

Driver Changes:
- Fix a missed page count update (Matt Brost)
- Fix a confused argument to alloc_workqueue() (Marco Crivellari)
- Kernel-doc fixes (Jani)
- Disable a workaround on VFs (Matt Brost)
- Fix a job lock assert (Matt Auld)
- Update wedged.mode only after successful reset policy change (Lukasz)
- Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected (Thomas)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/aXIdiXaY-RxoaviV@fedora
2026-01-23 08:03:49 +10:00
Dave Airlie
353f91bc25 drm-msic-fixes for v6.19:
imagination:
 - sync wait for logtype update completion to ensure FW trace is
   available
 
 bridge/synopsis:
 - Fix error paths in dw_dp_bind
 
 nouveau:
 - Add and implement missing DSB connector types, and improve unknown
   connector handling.
 - Set missing atomic function ops.
 
 intel/display, amd, vkms:
 - (intel) Place 3D lut at correct place in colorops pipeline.
 - (all) Fix a leak during device init where strings were leaked.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmlx79kACgkQ/lWMcqZw
 E8MchQ/+KUw7LhBjW/nYnAi6NPKYAFyZ1C+5SmKbUp7WdqmN7Qeauzpw+ElcF/mf
 XyG7UZLUwkCo8V3y7ePqOwkGONZmJB6xts17H7/qc067yQ9OftrKSzgtdNv1D4v9
 u7MRVrmjBhJLnAAbCqxdKb2x65O564gUmtkIXLgwDzblmzxE453Oea5GCmKGwXZO
 cGrJYlFQi0oLF3pc3pI4Vt0Ada1YOy1T2MNI4SuA5Hk6HcPPnriX8Ao7DM2nyYcJ
 +qmk/OVkIkT8MfMNY7sERd75Zk0CeRfrc0iikKT9BLiq0tdpGLo64uiswyp8A8ku
 pMAZc+ExgRiw9JNW6zf3FcuDtszQhYsWQ45/CG2uyuBhU6CReVHroxg7/TAI8Q8P
 51gfKQFz8rEyg40nwNG7ryRC+IuWiUjW8Htl8WeRmuxf3JyQObdD8S7QuBIZRhub
 xz1j5C/hQCCSjfDYPF4q8dEohQ+tQMoIi6m3gzdovsd1bcXTl8e/jScpH0rs0GrV
 yAQDKM4GOK/8ilj0rnTpNdBEwqT1cPByIW7HQGz87zUAZhcl3jMeBmzXapCbPJnI
 vqFIeDWtbb3AcJpRtzybR8U1+wFNYE7mzOkwekJ1J930J59NuL7Rs7RCVm+MXTi2
 VB6hNIqZPP0kbbPvNZYuB5622rOuVB5VH2GniRxFK8yBdt8kMhk=
 =kwm3
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-01-22' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

drm-msic-fixes for v6.19:

imagination:
- sync wait for logtype update completion to ensure FW trace is
  available

bridge/synopsis:
- Fix error paths in dw_dp_bind

nouveau:
- Add and implement missing DSB connector types, and improve unknown
  connector handling.
- Set missing atomic function ops.

intel/display, amd, vkms:
- (intel) Place 3D lut at correct place in colorops pipeline.
- (all) Fix a leak during device init where strings were leaked.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/4c2f66df-c990-448a-b466-99a66981272b@linux.intel.com
2026-01-23 07:51:56 +10:00
Linus Torvalds
0a80e38d0f Including fixes from CAN and wireless.
Pretty big PR, but hard to make up any cohesive story that would
 explain it, a random collection of fixes. The two reverts of bad
 patches from this release here feel like stuff that'd normally
 show up by rc5 or rc6. Perhaps obvious thing to say, given the MW
 timing.
 
 That said, no active investigations / regressions. Let's see what
 the next week brings.
 
 Current release - fix to a fix:
 
  - can: alloc_candev_mqs(): add missing default CAN capabilities
 
 Current release - regressions:
 
  - usbnet: fix crash due to missing BQL accounting after resume
 
  - Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not ...
 
 Previous releases - regressions:
 
  - Revert "nfc/nci: Add the inconsistency check between the input ...
 
 Previous releases - always broken:
 
  - number of driver fixes for incorrect use of seqlocks on stats
 
  - rxrpc: fix recvmsg() unconditional requeue, don't corrupt rcv queue
    when MSG_PEEK was set
 
  - ipvlan: make the addrs_lock be per port avoid races in the port
    hash table
 
  - sched: enforce that teql can only be used as root qdisc
 
  - virtio: coalesce only linear skb
 
  - wifi: ath12k: fix dead lock while flushing management frames
 
  - eth: igc: reduce TSN TX packet buffer from 7KB to 5KB per queue
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmlyVNQACgkQMUZtbf5S
 IrvoMQ/+N+KikpNLtHFpkqKAsTnNC6gR9yG+NYvUck1Oo+CQQpc/wJ78pS2cyPpM
 siMa7lLzRuCKPYni3RVpG9nqG/jv9HKvFXpgpSb71Evs6syO85kI8Dy4z8G4mClk
 A4QFH6/8V4uZpH/ewy9DTIjxdWPEJA6CuXXnmolTEBhrNkgskv0Sz3jFVTxDjFzN
 xTMk6H2PhgANUsYFree9PQ+gR+QAHKHPvjobWCsepYRHlT4YVi8PrmqoYBvycLwa
 Q//xy6PUOSXZM4sa6YSUMZk2Nou/84BvqouQ05ljaLSZDl4Ecfxl5MDkh/kzZHjR
 wPbMhiZUrJngwwyXQWcSnir1M17IPKjC/FAEDFUFVWDT/wYYHODt9npCRpdglsa5
 SGoy0yDgUN5Lq9Q5dPL0PMLHVLkuDdlzmyva4uso/dQYovXgTi/5Kx2bPc6LLqMJ
 CP5QxjN5OsOHKnGdI/UO28OU5Yn2KRCmJiW9nW3XdxR316lkmo6BWHAxWG9XhbJE
 aCBXu3EoqNSDVuWaZFVQ8g2uTN3uOhnuJqBllhahtENbdqjsat0cxcjYTuUDvuMm
 B1W0My5qq7O6TRjlFl6JfC3k2gqbZ+HlLg3LfmC74bmddOL52up+9HKyeRoWiIaA
 9BQ3DKpjD3VFEbsbBVPfoZ4Ch4jrB+G+ck8f7g/l9BCNM+Ji1Ds=
 =Ehzr
 -----END PGP SIGNATURE-----

Merge tag 'net-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from CAN and wireless.

  Pretty big, but hard to make up any cohesive story that would explain
  it, a random collection of fixes. The two reverts of bad patches from
  this release here feel like stuff that'd normally show up by rc5 or
  rc6. Perhaps obvious thing to say, given the holiday timing.

  That said, no active investigations / regressions. Let's see what the
  next week brings.

  Current release - fix to a fix:

   - can: alloc_candev_mqs(): add missing default CAN capabilities

  Current release - regressions:

   - usbnet: fix crash due to missing BQL accounting after resume

   - Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not ...

  Previous releases - regressions:

   - Revert "nfc/nci: Add the inconsistency check between the input ...

  Previous releases - always broken:

   - number of driver fixes for incorrect use of seqlocks on stats

   - rxrpc: fix recvmsg() unconditional requeue, don't corrupt rcv queue
     when MSG_PEEK was set

   - ipvlan: make the addrs_lock be per port avoid races in the port
     hash table

   - sched: enforce that teql can only be used as root qdisc

   - virtio: coalesce only linear skb

   - wifi: ath12k: fix dead lock while flushing management frames

   - eth: igc: reduce TSN TX packet buffer from 7KB to 5KB per queue"

* tag 'net-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits)
  Octeontx2-af: Add proper checks for fwdata
  dpll: Prevent duplicate registrations
  net/sched: act_ife: avoid possible NULL deref
  hinic3: Fix netif_queue_set_napi queue_index input parameter error
  vsock/test: add stream TX credit bounds test
  vsock/virtio: cap TX credit to local buffer size
  vsock/test: fix seqpacket message bounds test
  vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  net: fec: account for VLAN header in frame length calculations
  net: openvswitch: fix data race in ovs_vport_get_upcall_stats
  octeontx2-af: Fix error handling
  net: pcs: pcs-mtk-lynxi: report in-band capability for 2500Base-X
  rxrpc: Fix data-race warning and potential load/store tearing
  net: dsa: fix off-by-one in maximum bridge ID determination
  net: bcmasp: Fix network filter wake for asp-3.0
  bonding: provide a net pointer to __skb_flow_dissect()
  selftests: net: amt: wait longer for connection before sending packets
  be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not-at-end warning"
  netrom: fix double-free in nr_route_frame()
  ...
2026-01-22 09:32:11 -08:00
Linus Torvalds
0309fc3cc0 LEDs Fixes
- Fix race condition leading to null pointer dereference on ThinkPad
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmlyDUAACgkQUa+KL4f8
 d2EcOA/9GNDUv4zKgxiPlR577PkZklvmFH/pRws1YDqG8Huf5fH8H+MxwasgcgI9
 l7lBHw8MxK8qaxnQgy4xzXdISfkbiVXFPuCHaP3DyS1YdY7u67BBfDWuh7xFqymk
 JB8dUw0g9DYsjFNjfngFkYndGv5Ynb/Mdu/pK72ZtdR43WGIZnwH+hTn7oYteHfc
 E+g6jZNA06+w+Z9suUJk92NDk+PoRFXkZo519i0uQamZMXDSXIuG2lTPSqZQplc2
 sPnopmdr5l23cPYLu8/FZ4IADUtWv+E1UEDF1WxsJ4vnu3K7SBicsEOhx7Hknm5f
 KZt1zZlcJBp17drAoK2JCLtN0Hg5dNJLSZNGPlheVx2yexVX0oEGVIhEQr6rYT7b
 H5c7gbUSjPChMGn1ScI3KMv6vS/DQPJcwZ/CZ40uvJJitPfVlM75fooitKsP5qwi
 xAWnORL85BKzG2DH0m4Ynu/4O59kbl4G0c5jc5cSuenGZrC1qNMp94a2o6i2xwas
 8PCdC2J86oAjJNVzluYPhT6P9zi8UQbErqfhY04gY4SuVwg2OoJFrh1+XoHTYErp
 ISE35ByEnTHKxvFpsAgRBohol3SpQyJ3t+fzGTdT6HBubwKzGnxHgegB3TCax47+
 ENXB3a+Lns8i8zX2eqZ9xXdKZjkadehvRU7Bv5WO1CoGQ7I4YJ0=
 =RjDN
 -----END PGP SIGNATURE-----

Merge tag 'leds-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

Pull LED fix from Lee Jones:

 - Fix race condition leading to null pointer dereference on ThinkPad

* tag 'leds-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds:
  leds: led-class: Only Add LED to leds_list when it is fully ready
2026-01-22 09:24:00 -08:00
Alex Deucher
f377ea0561 Revert "drm/amd/display: pause the workload setting in dm"
This reverts commit bc6d54ac7e.

The workload profile needs to be in the default state when
the dc idle optimizaion state is entered.  However, when
jobs come in for video or GFX or compute, the profile may
be set to a non-default profile resulting in the dc idle
optimizations not taking affect and resulting in higher
power usage.  As such we need to pause the workload profile
changes during this transition.  When this patch was originally
committed, it caused a regression with a Dell U3224KB display,
but no other problems were reported at the time.  When it
was reapplied (this patch) to address increased power usage, it
seems to have caused additional regressions.  This change seems
to have a number of side affects (audio issues, stuttering,
etc.).  I suspect the pause should only happen when all displays
are off or in static screen mode, but I think this call site
gets called more often than that which results in idle state
entry more often than intended.  For now revert.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4894
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4717
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4725
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4517
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4806
Cc: Yang Wang <kevinyang.wang@amd.com>
Cc: Kenneth Feng <kenneth.feng@amd.com>
Cc: Roman Li <Roman.Li@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1412482b71)
2026-01-22 12:10:44 -05:00
Ilpo Järvinen
5528fd38f2 PCI: Fix Resizable BAR restore order
The commit 337b1b566d ("PCI: Fix restoring BARs on BAR resize rollback
path") changed BAR resize to layer rebar code and resource setup/restore
code cleanly. Unfortunately, it did not consider how the value of the BAR
Size field impacts the read-only bits in the Base Address Register (PCIe7
spec, sec. 7.8.6.3). That is, it very much matters in which order the BAR
Size and Base Address Register are restored.

Post-337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
during BAR resize rollback, pci_do_resource_release_and_resize() attempts
to restore the old address to the BAR that was resized, but it can fail to
setup the address correctly if the address has low bits set that collide
with the bits that are still read-only. As a result, kernel's resource and
BAR will be out-of-sync.

Fix this by restoring BAR Size before rolling back the resource changes and
restoring the BAR.

Fixes: 337b1b566d ("PCI: Fix restoring BARs on BAR resize rollback path")
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260121131417.9582-3-ilpo.jarvinen@linux.intel.com
2026-01-22 10:29:55 -06:00
Ilpo Järvinen
08d9eae76b PCI: Fix BAR resize rollback path overwriting ret
The commit 337b1b566d ("PCI: Fix restoring BARs on BAR resize rollback
path") added BAR rollback to pci_do_resource_release_and_resize() in case
of resize failure.

On the rollback, pci_claim_resource() is called, which can fail and the
code is prepared for that possibility. pci_claim_resource()'s return value,
however, overwrites the original value of ret so
pci_do_resource_release_and_resize() will return an incorrect value in the
end (as pci_claim_resource() normally succeeds, in practice ret will be 0).

Fix the issue by directly calling pci_claim_resource() inside the if ().

Fixes: 337b1b566d ("PCI: Fix restoring BARs on BAR resize rollback path")
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260121131417.9582-2-ilpo.jarvinen@linux.intel.com
2026-01-22 10:28:59 -06:00
Hariprasad Kelam
4a3dba4818 Octeontx2-af: Add proper checks for fwdata
firmware populates MAC address, link modes (supported, advertised)
and EEPROM data in shared firmware structure which kernel access
via MAC block(CGX/RPM).

Accessing fwdata, on boards booted with out MAC block leading to
kernel panics.

Internal error: Oops: 0000000096000005 [#1]  SMP
[   10.460721] Modules linked in:
[   10.463779] CPU: 0 UID: 0 PID: 174 Comm: kworker/0:3 Not tainted 6.19.0-rc5-00154-g76ec646abdf7-dirty #3 PREEMPT
[   10.474045] Hardware name: Marvell OcteonTX CN98XX board (DT)
[   10.479793] Workqueue: events work_for_cpu_fn
[   10.484159] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   10.491124] pc : rvu_sdp_init+0x18/0x114
[   10.495051] lr : rvu_probe+0xe58/0x1d18

Fixes: 997814491c ("Octeontx2-af: Fetch MAC channel info from firmware")
Fixes: 5f21226b79 ("Octeontx2-pf: ethtool: support multi advertise mode")
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Link: https://patch.msgid.link/20260121094819.2566786-1-hkelam@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 08:09:00 -08:00
Ivan Vecera
f3ddbaaaaf dpll: Prevent duplicate registrations
Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add()
to reject duplicate registration attempts.

Previously, if a caller attempted to register the same pin multiple
times (with the same ops, priv, and cookie) on the same device, the core
silently increments the reference count and return success. This behavior
is incorrect because if the caller makes these duplicate registrations
then for the first one dpll_pin_registration is allocated and for others
the associated dpll_pin_ref.refcount is incremented. During the first
unregistration the associated dpll_pin_registration is freed and for
others WARN is fired.

Fix this by updating the logic to return `-EEXIST` if a matching
registration is found to enforce a strict "register once" policy.

Fixes: 9431063ad3 ("dpll: core: Add DPLL framework base functions")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260121130012.112606-1-ivecera@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 08:08:42 -08:00
Eric Dumazet
27880b0b0d net/sched: act_ife: avoid possible NULL deref
tcf_ife_encode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166
CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
 <TASK>
  ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101
  tcf_ife_encode net/sched/act_ife.c:841 [inline]
  tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877
  tc_act include/net/tc_wrapper.h:130 [inline]
  tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152
  tcf_exts_exec include/net/pkt_cls.h:349 [inline]
  mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42
  tc_classify include/net/tc_wrapper.h:197 [inline]
  __tcf_classify net/sched/cls_api.c:1764 [inline]
  tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860
  multiq_classify net/sched/sch_multiq.c:39 [inline]
  multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66
  dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147
  __dev_xmit_skb net/core/dev.c:4262 [inline]
  __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798

Fixes: 295a6e06d2 ("net/sched: act_ife: Change to use ife module")
Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yotam Gigi <yotam.gi@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 08:01:44 -08:00
Fan Gong
fb2bb2a1eb hinic3: Fix netif_queue_set_napi queue_index input parameter error
Incorrectly transmitted interrupt number instead of queue number
when using netif_queue_set_napi. Besides, move this to appropriate
code location to set napi.

Remove redundant netif_stop_subqueue beacuase it is not part of the
hinic3_send_one_skb process.

Fixes: 17fcb3dc12 ("hinic3: module initialization and tx/rx logic")
Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com>
Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com>
Signed-off-by: Fan Gong <gongfan1@huawei.com>
Link: https://patch.msgid.link/7b8e4eb5c53cbd873ee9aaefeb3d9dbbaff52deb.1769070766.git.zhuyikai1@h-partners.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 07:57:16 -08:00
Jakub Kicinski
9146fe2829 Another set of updates:
- various small fixes for ath10k/ath12k/mwifiex/rsi
  - cfg80211 fix for HE bitrate overflow
  - mac80211 fixes
    - S1G beacon handling in scan
    - skb tailroom handling for HW encryption
    - CSA fix for multi-link
    - handling of disabled links during association
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmlyArkACgkQ10qiO8sP
 aACZxA/+N/q+DAHhVgqETwqOh80WAFTSuhDZsUXc6PNtFkOHvuZaeHePU+fn8hco
 +CkUVEnWYoNgUiaVg1697PJubp0psN7H+3+cq8kn8C/oNB2YnEV2kPCk4x7R8LCj
 TP6mad/Fb+I6Ct7XaCFymCS49eP4Bju7UBgYgLTiKJYvabA+Jim7LavZr8j0Tvra
 h9TNeA0I8+dgGppAWLTssrnsxp65xfSdq71mtRCFUrpEUHjzCl589PEv6BYcIRwv
 N50pm6Am5KJ1TZn5sVSYVfKiiG7UtL/pbXbsM5Cj/54yIFIgmE3bGI5MGAXRlWNG
 o/d/bo0rJg1xppipyZDEN5OJS6S0ijyC5TNKFFRX6IU2eZ8jJs7CWrQw6L8hWCbY
 G+lnVSh4yPAzLEk80S/zBHQccAPXnONtm+cFyPsPab79oAboxQVauuDdH1t5cxbQ
 1HRn0RopyfEoPLmxsCcCSVcdF+hDwRZxAUO735Opnz/amDJNjBKgXTKezXSubfPH
 5hvoAs/VZh7xSyJmEViDO5gavW1SX4nKlUixLYLUrXyq4i+eZkEIvqlCkIWuN9EW
 y/leooWqFzoXY3K8QL8nKQyHWg10WJL1l56tVz+Y+YAh8TvqgWWTB/O/u3g+/ZqO
 eDkaeKbbexUy6iyN0/TMb2RNnTERO0xOepMmIu3sw0HXhptkl1Q=
 =njuT
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2026-11-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Another set of updates:
 - various small fixes for ath10k/ath12k/mwifiex/rsi
 - cfg80211 fix for HE bitrate overflow
 - mac80211 fixes
   - S1G beacon handling in scan
   - skb tailroom handling for HW encryption
   - CSA fix for multi-link
   - handling of disabled links during association

* tag 'wireless-2026-11-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: cfg80211: ignore link disabled flag from userspace
  wifi: mac80211: apply advertised TTLM from association response
  wifi: mac80211: parse all TTLM entries
  wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
  wifi: mac80211: don't perform DA check on S1G beacon
  wifi: ath12k: Fix wrong P2P device link id issue
  wifi: ath12k: fix dead lock while flushing management frames
  wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel
  wifi: ath12k: cancel scan only on active scan vdev
  wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
  wifi: mac80211: correctly check if CSA is active
  wifi: cfg80211: Fix bitrate calculation overflow for HE rates
  wifi: rsi: Fix memory corruption due to not set vif driver data size
  wifi: ath12k: don't force radio frequency check in freq_to_idx()
  wifi: ath12k: fix dma_free_coherent() pointer
  wifi: ath10k: fix dma_free_coherent() pointer
====================

Link: https://patch.msgid.link/20260122110248.15450-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 07:54:31 -08:00
Paolo Abeni
5778d65d4b Merge branch 'vsock-virtio-fix-tx-credit-handling'
Stefano Garzarella says:

====================
vsock/virtio: fix TX credit handling

The original series was posted by Melbin K Mathew <mlbnkm1@gmail.com> till v4.
Since it's a real issue and the original author seems busy, I'm sending
the new version fixing my comments but keeping the authorship (and restoring
mine on patch 2 as reported on v4).

v5: https://lore.kernel.org/netdev/20260116201517.273302-1-sgarzare@redhat.com/
v4: https://lore.kernel.org/netdev/20251217181206.3681159-1-mlbnkm1@gmail.com/

From Melbin K Mathew <mlbnkm1@gmail.com>:

This series fixes TX credit handling in virtio-vsock:

Patch 1: Fix potential underflow in get_credit() using s64 arithmetic
Patch 2: Fix vsock_test seqpacket bounds test
Patch 3: Cap TX credit to local buffer size (security hardening)
Patch 4: Add stream TX credit bounds regression test

The core issue is that a malicious guest can advertise a huge buffer
size via SO_VM_SOCKETS_BUFFER_SIZE, causing the host to allocate
excessive sk_buff memory when sending data to that guest.

On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with
32 guest vsock connections advertising 2 GiB each and reading slowly
drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only
recovered after killing the QEMU process.

With this series applied, the same PoC shows only ~35 MiB increase in
Slab/SUnreclaim, no host OOM, and the guest remains responsive.
====================

Link: https://patch.msgid.link/20260121093628.9941-1-sgarzare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-22 15:41:36 +01:00
Melbin K Mathew
2a689f76ed vsock/test: add stream TX credit bounds test
Add a regression test for the TX credit bounds fix. The test verifies
that a sender with a small local buffer size cannot queue excessive
data even when the peer advertises a large receive buffer.

The client:
  - Sets a small buffer size (64 KiB)
  - Connects to server (which advertises 2 MiB buffer)
  - Sends in non-blocking mode until EAGAIN
  - Verifies total queued data is bounded

This guards against the original vulnerability where a remote peer
could cause unbounded kernel memory allocation by advertising a large
buffer and reading slowly.

Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
[Stefano: use sock_buf_size to check the bytes sent + small fixes]
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260121093628.9941-5-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-22 15:41:33 +01:00
Melbin K Mathew
8ee784fdf0 vsock/virtio: cap TX credit to local buffer size
The virtio transports derives its TX credit directly from peer_buf_alloc,
which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.

On the host side this means that the amount of data we are willing to
queue for a connection is scaled by a guest-chosen buffer size, rather
than the host's own vsock configuration. A malicious guest can advertise
a large buffer and read slowly, causing the host to allocate a
correspondingly large amount of sk_buff memory.
The same thing would happen in the guest with a malicious host, since
virtio transports share the same code base.

Introduce a small helper, virtio_transport_tx_buf_size(), that
returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume
peer_buf_alloc.

This ensures the effective TX window is bounded by both the peer's
advertised buffer and our own buf_alloc (already clamped to
buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer
cannot force the other to queue more data than allowed by its own
vsock settings.

On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with
32 guest vsock connections advertising 2 GiB each and reading slowly
drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only
recovered after killing the QEMU process. That said, if QEMU memory is
limited with cgroups, the maximum memory used will be limited.

With this patch applied:

  Before:
    MemFree:        ~61.6 GiB
    Slab:           ~142 MiB
    SUnreclaim:     ~117 MiB

  After 32 high-credit connections:
    MemFree:        ~61.5 GiB
    Slab:           ~178 MiB
    SUnreclaim:     ~152 MiB

Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest
remains responsive.

Compatibility with non-virtio transports:

  - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per
    socket based on the local vsk->buffer_* values; the remote side
    cannot enlarge those queues beyond what the local endpoint
    configured.

  - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and
    an MTU bound; there is no peer-controlled credit field comparable
    to peer_buf_alloc, and the remote endpoint cannot drive in-flight
    kernel memory above those ring sizes.

  - The loopback path reuses virtio_transport_common.c, so it
    naturally follows the same semantics as the virtio transport.

This change is limited to virtio_transport_common.c and thus affects
virtio-vsock, vhost-vsock, and loopback, bringing them in line with the
"remote window intersected with local policy" behaviour that VMCI and
Hyper-V already effectively have.

Fixes: 06a8fc7836 ("VSOCK: Introduce virtio_vsock_common.ko")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
[Stefano: small adjustments after changing the previous patch]
[Stefano: tweak the commit message]
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260121093628.9941-4-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-22 15:41:33 +01:00