Commit Graph

1462158 Commits

Author SHA1 Message Date
Suresh Guttula
9c809e4898 drm/amdgpu: Disable JDPG on VCN5_3
JDPG does not support on VCN5

This patch will disable JDPG, because DPG is not correctly
copying the JRBC Read/Write Pointers (R/WPTR) from the PG
(Power Gating) block to JRBC.

Signed-off-by: Suresh Guttula <suresh.guttula@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ea3fdd1eda088030d8925f023613728969f55955)
2026-07-08 16:20:30 -04:00
Kanala Ramalingeswara Reddy
e2469bde3f drm/amdgpu: add support for SMU version 15.0.9
Initialize SMU Version 15_0_9

Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com>
Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1dfd4e84b5beec353a81d61af9eaf4e5a56e0c57)
2026-07-08 16:20:02 -04:00
Kanala Ramalingeswara Reddy
58aad119f4 drm/amdgpu: add support for PSP version 15.0.9
Initialize PSP Version 15_0_9

Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com>
Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit ef71f00173228904763552b7405169023f8034a8)
2026-07-08 16:19:30 -04:00
Linus Torvalds
8cdeaa50ea Linux 7.2-rc2 2026-07-05 14:44:06 -10:00
Linus Torvalds
f105f3631d - Prevent OOB access in the resctrl code while offlining
CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
    (Reinette Chatre)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKEsURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gcWhAApp+w5vUx0FXlou1Mzvn63bXey9/CMXyX
 rrUeWA+ic7PpNvImuwixdyPyS1CnF2l7lMcmOtiNE4wnRvCf+0rsrwgYy4m4qd/2
 aLAftFDp9WhKKH3Bb6gnVfMXiXmYb4eCQO0pRhJY26QtVJ2RGkbenW/TdTnAAAwS
 KO8bJGsllufiF0+k4G5YMgiVcgZFByn/nuqmzvIc+oKQt5LSMvkKijoM7ozX9q5g
 c1ABWvag3KWU2gFI00GfvzuQ7n7ckGhBVRwtO9DMox68liOlKOHedEFF0A0+KiDt
 fk6b2LFbqm6hB7TpWRQqQ+rPusbDdAVxKG8ehIkjR8BD49VwzZUcr5kiWS5/xplm
 a9F7cJpAJiuSiTi2HYtQVOlrCujonmjt11qqj3cCCjkton+IC9twhDkrj6+Kxygq
 W3oc8Gia2JWoFBNt/6l0iKRJjluqgPJ8crPHpnDr4C5KEnsEIqCQsSPsVjoYM5mY
 +xwS9jMJM7Dhrw3OZ6b5D8jY9oonBM/BB+jMomQ9ncDijUwKybgqp0JXB/3ydIw3
 ci69tewFdVD+9EyNAz+dqANuhNyF1JTFza/5QxAU88E1wp2O2WjahSPvkNU/ekNK
 jDGLf8VyiI08bH2pyYIhEhcvmTZ5Ocyuj9zA4Ufi2V3gaDMkvMXRipxm50dAhaWG
 CMoZ+wTnI/8=
 =mae/
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Prevent OOB access in the resctrl code while offlining
   CPUs when Intel SNC (Sub-NUMA Clustering) is enabled
   (Reinette Chatre)

* tag 'x86-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
2026-07-05 05:37:46 -10:00
Linus Torvalds
c10dc5c03e Misc perf events fixes:
- Fix a perf_event_attr::remove_on_exec bug for group
    events (Taeyang Lee)
 
  - Fix uprobes CALL emulation interaction with shadow stacks,
    and add a testcase for this (David Windsor)
 
  - Fix uprobes unregister bug (Jiri Olsa)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCX8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hwJRAAne1HniwuV9PV2GQHNKipeKV320tod2iR
 WY9yy9ez5WJbPttS7Fy28NobQKxuTanNWnAJqqM3TJF0tPPSrrYqkhAGrpEb2ab0
 G7gl4KlrO//5kKTZnnI86t/quSV5BDt00UUdMBFp+hbNYXNul5/AeUxqMhNoGqB6
 DpJHrV+7kNQZ4I7tjatYWL11hZHpEhrx4QWLUsnd+nDwddpmdsRNXVZwpGh9+Dh4
 +XXcgLD7M8FqNFN3GCVfhJKO8x8HRaBWv3FHeGqbCUL9k5viWcn+N91IbrcPVat1
 HBk0JDtpLK286WHLFy7uROafCA59AlYp5DX7mobXi0VF1FdMqPtjaXEsZM7Ng/P5
 /tpbV5P4irrUnMSCEDSDzqZJWXbcBSqCJ9p6z5/Tjzo3VegHyrXe29wjVoqvXjLx
 og/9OnPZv/2QEsE37rBRwNC889ihFMUDZh3T+uUc1YKUEwYWFXwtUECTg+0Oi+lL
 mLTdK05j/6NmVkcY77mFjQfTMFAZeD78g6cPY3yDHiHRFtxPOIhknCKBeLD5BjXD
 tz08x3MN0ItVEBXfuKAlkb1KPhHy8x02IrpdfVojoQ7lUBRH/JqLvnSGgvVsRM+0
 v9D3N9BAuB3s8DmxEdh0wyRzISl6jzBHJDJ83+uWSfZWLlEW+RVn9NbH2ubNU/jt
 FO3U81r1MvE=
 =Mb4z
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix a perf_event_attr::remove_on_exec bug for group events
   (Taeyang Lee)

 - Fix uprobes CALL emulation interaction with shadow stacks, and
   add a testcase for this (David Windsor)

 - Fix uprobes unregister bug (Jiri Olsa)

* tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
  selftests/x86: Add shadow stack uprobe CALL test
  x86/uprobes: Keep shadow stack in sync for emulated CALLs
  perf/core: Detach event groups during remove_on_exec
2026-07-05 05:34:43 -10:00
Linus Torvalds
fe5881ed72 - Fix a futex-requeue deadlock detection regression
(Thomas Gleixner)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCDcRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jyeA//UjX1T39xy3suH0on24bO4aiMe9I/+rSD
 cSYRE7di8o/B6W8emvnrL1qumt18fO2wVbV84WpVJEznuphoVRR8CveOcISyBlmt
 Ea73S80RX5hDyJAkCSY4ttAFFyULTPE+gvTrP2lagNRV2S0K+80lqtZxRIiL7IYU
 ElVbCoeMUm+5mOFQ8t6KdkNxNJudceQEO7KY0xu3k3qUL1CDFWO6XYY3cdhfYirO
 z2A4k4nFp9i+FrvJxPG2BF6KboNbXukdBYWIecFdoTHK2r2n81ZFBodlQFYuB3/o
 g6Gv73rcCr2mKxrMiKO5LUBoxsbLbbchxF4dZROktf8h54v/qwcHWLSZDDerhXyX
 zk92iw//N71HO+3ktJdmfXxN2sk0ZZy2Yt5bgdMGvTZIoSbwklIEMn67mlQQqB5X
 bKsZWWgiH/tN7z/JN6JQZ2+J1F7lTwrx/bJ4iriy79iIjPAYbne1OSM9j1/ycWgN
 9u1fpcd3lcK4W3A3DUE1AJnmGw+NwDPHipoD5lk5wAdQGSpeIH712kKB05eIonIa
 l8dF7ZDgKVDSLDfcqoHfbKGPxm06NZuSc4VL9+YSftV7YeRhpDPP6gti/aaYBtew
 0Bz5uBR9Sptvi+GsHNiblkEsNVkS5SSbvs0wkgxLHd22nVRO9bi1SdMSWLeI7PDn
 LzJpjnA+5Cs=
 =JNeN
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull futex fix from Ingo Molnar:

 - Fix a futex-requeue deadlock detection regression (Thomas Gleixner)

* tag 'locking-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
2026-07-05 05:31:41 -10:00
Linus Torvalds
610533cb3b Misc irqchip driver fixes:
- Fix a resource leak in the RISC-V imsic-early driver
    (Haoxiang Li)
 
  - Fix an OF node reference leak in the ARM gic-v3-its driver
    (Yuho Choi)
 
  - Fix a dangling handler function on module removal bug in
    the TS-4800 ARM board irqchip driver (Qingshuang Fu)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKBtQRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jUjRAAjiQDEcEdOsNtx7WEmi077EX32qv6ZQ2L
 rn15M3sJyFS/XlZNYhgNa5DQ+8BsmHxZY5FjUW/VvQ6tQop+KbH83WjUDG3wnZYz
 TZzZHR2I3k6tjJc3eAccJphn/2e4jDfkMcBy+Ao4Zbgxc6ntpXKxMRTNAFDd1p+1
 OHPk7P7e4YJ4YcskJNxcbQ1zeg8d07NQa4tAoIEGrAx0LPcKW61jp7DW+AL/y/dc
 MjAmNL7e+pMfGOQHKBk2iXS7oX9OiNf4oWbHQA60GQsrngRb41sF1SJ9kcKbb4vl
 K/Pe8s0uH68g9bYARTFUbh2zuIEK36PmLNvF0lIhm3QEmaT57a+n4b3AzSCFOlLD
 WnLWpRAog5aEw6RNu/WHTnhwV2FZMY9ivwVncL75GDlepCzMiGHGNLnv2hDs3Dqz
 ogiZ1BseAnFKWXbhjuaYJApv+Z3pUqIhGvbQ0TmMa6K1f8O2cWaCWJedJ7tK1C1F
 jj2ijSkKP1+3DM1yOZ8cLJ5g+Ci4bRtUDWjA3TzJ1q6eI4Fys3YpHWzF4to9qbqH
 8wtGgI7CH8aXr4wWwUYxWEljhc8t+El7mE4ZndFMbMX6m0LsYP6eYRipDJefa2BR
 L0IcxiW+FtAq9A6iqdH2nVdldVrIGAZ0yIwDlkSOxb46ac/mlNVIOafs319wci1K
 LU9T/ZT8p5w=
 =aWLS
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:
 "Misc irqchip driver fixes:

   - Fix a resource leak in the RISC-V imsic-early driver (Haoxiang Li)

   - Fix an OF node reference leak in the ARM gic-v3-its driver (Yuho
     Choi)

   - Fix a dangling handler function on module removal bug in the
     TS-4800 ARM board irqchip driver (Qingshuang Fu)"

* tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/ts4800: Fix missing chained handler cleanup on remove
  irqchip/gic-v3-its: Fix OF node reference leak
  irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
2026-07-05 05:29:41 -10:00
Linus Torvalds
216a8b2179 sound fixes for 7.2-rc2
A standard set of driver-specific fixes and quirks accumulated since
 the merge window:
 
 ASoC:
 - SOF: Sanity check to prevent OOB reads
 - rsnd: Fix clock leak and double-disable issues with PM
 - tas675x: Misc fixes for register fields, etc
 - lpass-va-macro: Correct codec version for Qualcomm SC7280
 - amd-yc: DMIC quirk for Alienware m15 R7 AMD
 
 Others:
 - us144mkii: Fix a UAF on disconnect and anchor list corruption
 - HD-audio: Realtek quirks for HP models
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpKCqgOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+lgBAAk83zPbT+2y7L7GewxT2QTwOj5WMudl6q9RBp
 sDfT8sabkVGs68IoWBVijn6H8n7Jy9V9OVqm+I1j/53mcQl4haLiW+Uk0hcOlN1N
 UOySZLQusv+UOM7eVOpfvfb+rdx0MiGOr3NZeFD5tyIfhcMjhJ0NRDFHUDu1W3YU
 7BRCOqX1xchsYAnGEdI/otb1d2rEHlg4bRUYMqanfOO1mAayfd2kw3RkVlEF4dW9
 +8SoVdxWNOueIuq1WWU3DI/nE5Lq0la3ZsHulKTVkfKW3wlBsFhbk5tbWPBC123o
 odz71gpoM1wNM10ANWniJoZ3FlUSvKc2N3gJfKgYVp/EWSzFAp01BYpqm4JA8Iq7
 EAX7vNj+4wA4HMZYg20vGaj9dekZ15jrro9Xy8sg1+8TSC377xIpXBo1WA470YrS
 /B1UCvhhaYmao0tTTsChaDEcBI0OWgS+OagWDijPz8ASwskNOczVeBhE4HxgHidd
 eq4IqXcK+qakTcNc6d8AdFdOog8PekUqE+ZaSPkrW7P/QIYKgWEAXfpu0f2IaK8k
 3S15xQAg4dvkGAz4+vOWvZfJSP1P1xRabuSNftEgZk8UvlAoIwMZSuoB7uazt61n
 4La6BdPHiY//qmco9rV310YHYQE6uISFEPgs0xxKAHWYeTNRfhACDClm8U905Jo2
 LZH9c5g=
 =eXcj
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A standard set of driver-specific fixes and quirks accumulated since
  the merge window:

  ASoC:
   - SOF: Sanity check to prevent OOB reads
   - rsnd: Fix clock leak and double-disable issues with PM
   - tas675x: Misc fixes for register fields, etc
   - lpass-va-macro: Correct codec version for Qualcomm SC7280
   - amd-yc: DMIC quirk for Alienware m15 R7 AMD

  Others:
   - us144mkii: Fix a UAF on disconnect and anchor list corruption
   - HD-audio: Realtek quirks for HP models"

* tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume
  Documentation: sound: tas675x: Fix temperature range and impedance documentation
  ASoC: codecs: tas675x: Fix CHx temperature range register bit fields
  ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently
  ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent
  ASoC: SOF: validate probe info element counts
  ALSA: usx2y: us144mkii: fix work UAF on disconnect
  ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
  ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED
  MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware
  ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280
  ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
2026-07-05 05:26:45 -10:00
Linus Torvalds
9c9330c764 spi: Fixes for v7.2
A small set of fixes that came in since -rc1, we have one core fix for
 shutting down target mode properly if the system suspends while it's
 running plus a small set of fairly unremarkable device specific fixes.
 There's also a couple of pure DT binding changes for Renesas SoCs, the
 power domains one allows some SoCs to be correctly described with
 existing code.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpKRNUACgkQJNaLcl1U
 h9DGTAf9GNwul6yPo0ybe0uwbkuymsUhkf6oWz8qVPY4nFiQfP+pGiFae7gJrST7
 gCeyTlqPT2549MpxgsJwxCdsAaX4VuJbdwY1U8OVeg5VCtVmv/geDweJBXax5uHR
 EKayi1W8wGrdt+xReDvbcqS9T+kwyRWxrrWRi7HIz7P4Lbziq8naQaPQ6LODnHnT
 h5/M9nr4VjQh+kSHIIOyHlN10hQR256XRHoZY6e7yQmJfzxayN9NTw7MmIw7kE3P
 ZztQT8VcqaT4hlsJYZKLC9anSeWz03aTnJ3lPpKy935Od1PktElGEV6SLgbX/hEZ
 QI6rjVNbe3UT5fiy+PjMDSl67II+DA==
 =wCwg
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A small set of fixes that came in since -rc1, we have one core fix for
  shutting down target mode properly if the system suspends while it's
  running plus a small set of fairly unremarkable device specific fixes.
  There's also a couple of pure DT binding changes for Renesas SoCs, the
  power domains one allows some SoCs to be correctly described with
  existing code"

* tag 'spi-fix-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: rzv2h-rspi: Fix DMA transfer error handling for signal interruption
  spi: dt-bindings: snps,dw-apb-ssi: add 'power-domains' property
  spi: dt-bindings: snps,dw-apb-ssi: drop superfluous RZ/N1 entry
  spi: dw: use the correct error msg if request_irq() fails
  spi: dw: fix first spi transfer with dma always fallback to PIO
  spi: core: Abort active target transfer on controller suspend
  spi: sh-msiof: abort transfers when reset times out
2026-07-05 05:24:06 -10:00
Linus Torvalds
7404ce5163 s390 updates for 7.2-rc2
- Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation,
   and leaving protected key verification to the pkey handler
 
 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpJMw4ACgkQjYWKoQLX
 FBg7mwf/V8AKr7uPTvCMEvPUrgFPz1NWE0Eg4UZb5WYoToP6HwMMJpkkBcuWDcpT
 L7UVkXczlzhd4QqjftmVSVd8ea3MT+IZQ8W6TVEM+zgu3kYuLT0JC2POUTwIS5D+
 boYruqFfH4Cn2DRacOEV8dRfHNVyrZ4MdWEQnHTtJ0n6dxT1O93aH4YfAPhRrT57
 LEf4PnnWTza/xWF5Huyk5pXmNjrwsF63djwh7YSHIOxMfG4mK3h/cQzu/sEwKMWs
 Q5wPqhl8U20WG8fc8bi+VpfEI/v7ajjZm7mIYC09t2ymVSqz85wzaDk9igeSvv7i
 bsy26udNG4XjmwFNbJSz8JOyaph8LA==
 =AWqj
 -----END PGP SIGNATURE-----

Merge tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation, and
   leaving protected key verification to the pkey handler

 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer

* tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/monwriter: Reject buffer reuse with different data length
  pkey: Move keytype check from pkey api to handler
2026-07-04 06:28:45 -10:00
Linus Torvalds
410430b616 collected fixes for 7.2
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmpIu3UaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHC8MRAAmzNvYJhYC+4wnvzTv3q0
 kzsVgAkQaYQT5mwRjRBjZ4dX396s+zvFtXKJ3/DBZ/cluBOAOCf9sXCpVbKHKCq3
 y2n8kxTMT1Z4w1blbpK0BXLbJec2Kij5tnqLewWfg+Q08sodmBaahX0/41VBjLkl
 ldvtOaWwrW1vKY/67WS9GOA8W+YcmuMIPZFvEXHxWZ/kEGo0Te5jPD595FF5LENe
 G1c9W6tmlYuQnbwJHbTAnpLhVzeDuXVbVf6zpvnqqakAYEhA15f/FO1AiFLIlCUT
 Eimbc+MXpYmOfN1I+pDCxt6BMQDZ4jFhfmbtonFUnmRZ4B7nB4OlUHjz1gK8ipMZ
 yWu2NQRXXsb5ABJY2MWFvQEkMiyMHWOmjvtT8Ptfj7mnztSuXZLTXTbECz3OBIXr
 KqHK/9j2CLVLs8/RorDLh0VGuPJ2TtVryMGMQ5SSV3KvkLPrDLBgpxL5z3uPLoC6
 Vrh13Zb/TDLubAiKvIepbB31sWECLS12d+btvKfFBChIkKsAhAlYtcjp5yfg9UgP
 Rj95UGwPgnNmQ8I0B0Wa+dNIA6pDHFp5x0ZHHLYfUcjPgf9GL1NhEYD1N43/bOi0
 TqrPgsBKWRwDpLAmojnIpgJrUC3P6KL04jRhhDBWTRoYkQ55lrTH22Sb3QNo2xLN
 CLg/1pGpdAiWUV8FmssP140=
 =fR8s
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fixes from Thomas Bogendoerfer.

* tag 'mips-fixes_7.2_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: configs: Enable the current Ingenic USB PHY symbol
  MIPS: loongson64: add IRQ work based on self-IPI
  MIPS: mm: Add check for highmem before removing memory block
  mips: Add build salt to the vDSO
  MIPS: DEC: Ensure RTC platform device deregistration upon failure
2026-07-04 06:05:28 -10:00
Linus Torvalds
1e9cdc2ea1 16 ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpIIEQACgkQiiy9cAdy
 T1F7/Qv+JNKEjHIO4ckW44iuX9FC435P9A0hNI41ILqPwAkPFr3nbJFlFGiHQXRr
 zCwsxOUDBNtvleJczata8b6hcHR+6d00w6k5MKTZn/h59MJx21I7ukZd6RLy9saV
 KtndptFrfUw1ZR+BWohVUknpEFzt8lU9Ai2V1Rq8zvb9GtckkArR5sapF38Y3Cbr
 F7bu3uDlyXM9uGBDNoU58o0qA7en7FfISR6S3YC7ToZPsOUZUFMmu/7LtbUFv1WH
 EMKaCdFKKKqJbBrqDC0AnLQW8N6js5yOJ2KXc1+eG1t1sBQizYf8x3yy94YECVkI
 sXppz7s9aDYoWMAMD9ofDq+fBQQhI9zyRULNZIVCtLy09WDoXYoibbTWzID7nrd/
 ufW7H91s9t4s+yTFKigN3vzY3A8JEqEA04TscJw7rLi/LaovcVvgLvm33A5mrxOS
 kjcjoha7Rz2kac7A8KxAIHK4CCLMS7bG028sLS0vY2lBW2KrDjzKiANJqMeSuB1m
 9IM0u7eK
 =waBr
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix several use-after-free races in durable handle reconnect,
   supersede, and oplock handling

 - Avoid holding the inode oplock lock while waiting for a lease break
   acknowledgement. This removes delays of up to 35 seconds when cifs.ko
   closes a deferred handle in response to a lease break

 - Fix malformed security descriptor handling, including an undersized
   DACL allocation issue and an out-of-bounds ACE SID read

 - Fix memory leaks in security descriptor and DOS attribute xattr
   encoding/decoding error paths

 - Fix outstanding SMB2 credit leaks on aborted requests and correct the
   QUERY_INFO credit charge calculation

 - Fix hard-link creation without replacement being incorrectly rejected
   when the handle lacks DELETE access

 - Avoid unnecessary zeroing of large SMB2 read buffers

 - Add an oplock list lockdep annotation and update the documented
   support status for durable handles and SMB3.1.1 compression

 - Durable handle fixes to address ownership and lifetime races during
   reconnect, session teardown, oplock handling, and superseding opens,
   preventing stale session and file references from being used by
   concurrent operations

* tag 'v7.2-rc1-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix app-instance durable supersede session UAF
  ksmbd: snapshot previous oplock state before durable checks
  ksmbd: close superseded durable handles through refcount handoff
  ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
  smb/server: do not require delete access for non-replacing links
  ksmbd: don't hold ci->m_lock while waiting for a lease break ack
  ksmbd: doc: update feature support status for durable handles and compression
  ksmbd: annotate oplock list traversals under m_lock
  ksmbd: fix outstanding credit leak on abort and error paths
  ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
  ksmbd: avoid zeroing the read buffer in smb2_read()
  ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
  ksmbd: reject undersized DACLs before parsing ACEs
  ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
  ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
  ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
2026-07-03 18:55:34 -10:00
Linus Torvalds
dac0b8c587 drm fixes for 7.2-rc2
core:
 - kernel doc fix
 - include types.h in drm_ras.h
 
 dma-fence:
 - fix NULL ptr dereference
 - use correct callback
 - make dma_fence_dedup_array more robust
 
 dp:
 - handle torn down topology gracefully
 - fix kernel doc
 
 i915:
 - Input validation fixes for BIOS and EDID
 - Fix HDCP code buffer overflow and seq_num_v monotonic increase check
 - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion
 
 xe:
 - Wedge from the timeout handler only after releasing the queue
 - Fix a NULL pointer dereference
 - Remove redundant exec_queue_suspended
 - RTP / OA whitelist fixes
 - Return error on non-migratable faults requiring devmem
 - Skip FORCE_WC and vm_bound check for external dma-bufs
 - Hold notifier lock for write on inject test path
 - Drop bogus static from finish in force_invalidate
 - Fix double-free of managed BO in error path
 - Don't attempt to process FAST_REQ or EVENT relays
 - Fix NPD in bo_meminfo
 - Prevent invalid cursor access for purged BOs
 - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG
 
 amdgpu:
 - Soc24 aborted suspend fix
 - Drop unecessary BUG() and BUG_ON() from error paths
 - SCPM fix
 - Power reporting fix
 - DCE HDR fix
 - UVD boundary checks
 - VCN boundary checks
 - VCE boundary checks
 - DCN 4.2 fixes
 - Large stack allocation fixes
 - Fix aperture mapping leak
 - UserQ fixes
 - Ignore_damage_clips fix
 - ACP fixes
 - DC boundary checks
 - GPUVM fixes
 - JPEG idle check fixes
 - Userptr fix
 - GC 11.7 updates
 - Non-4K page fix
 - SMU 13 fixes
 - DP alt mode fix
 
 amdkfd:
 - Boundary checks
 - CRIU fixes
 
 amdxdna:
 - fix device removal issues
 - fix use after free in debug BO
 
 imagination:
 - fix double call to scheduler fini
 - fix ioctl return values
 - fix user array stride
 
 virtio:
 - handle EDIDs better
 
 panthor:
 - irq safe fence lock fix
 - reset work fix
 - fix invalid pointer
 - fix iomem access in suspended state
 - sched resume fix
 - unplug suspend fix
 - drop needless check
 - eviction leak fix
 - bail on group start/resume fix
 - keep irqs masked
 
 malidp:
 - use clock bulk API
 
 komeda:
 - clock prepare fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpILLYACgkQDHTzWXnE
 hr4jBw/7Bhh6wdPLs2lqdFecpMikm3icmyQylayY8f67TiHhsg93FNgmjHlkjnkH
 VfblnRR5jB5VNwOdzeMPKivR5X2wP2ruvjRWUIfN1dZiHoI6cf+1ClR1ZJD1aWPH
 kJkE35bbufGldjiztwGmuUjfiOl/8b58DzJdWYs5BJXbNTDn8XMGQp0ai+ye2yco
 PwHEDlD576k40BRPUVQk8fjPNd/YZw7t/zdmUQJxKVqVnT1GtgkJabdfje/QtqVw
 PU3diSmT/tYHZ4H0AIyYvneXFDHPKrvTBm7T1ADTnK2QbLxEcBaidgcGHYmncbFX
 nB/KP30ordTWf23LtsFYMfzB/yM+b0n/XiyzsZhm1XP9C2uPe4YJsmf+mPCH3KVI
 tAoSBpsPI9LQEkywf8Vu/QjiiWdO5b25SlkJy1AlNfLBZ2XX+TjgOCwjD62sUzer
 gfanrUl+viIUOBvT9oRMMTiR37g7+U2JoBJWLLB+pnTkZylJdLcK5J/tquEnjOdN
 uw/feReG221NJqJvxh7i1plfZTIx08E99gmH3OhVIvNOQbKSdSRGkCN9qON33XbA
 GovE+RoF5Zzl4MU1RlbfCOmG56Yez8VW2loSZwpX6r1JyJa/Mld6UjSp+/tkI00r
 e+LLdbQ/LeB/ARGGPf3ctS5/PZRvPNNGJiVtYpwN2ZvPz8lL1d8=
 =bXRh
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes for drm. This is large for rc2 but it's just a lot of
  small fixes across a bunch of drivers, xe, amdgpu as usual, plus some
  sashiko-inspired fixes for panthor, and some dma-fence updates.

  core:
   - kernel doc fix
   - include types.h in drm_ras.h

  dma-fence:
   - fix NULL ptr dereference
   - use correct callback
   - make dma_fence_dedup_array more robust

  dp:
   - handle torn down topology gracefully
   - fix kernel doc

  i915:
   - Input validation fixes for BIOS and EDID
   - Fix HDCP code buffer overflow and seq_num_v monotonic increase check
   - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion

  xe:
   - Wedge from the timeout handler only after releasing the queue
   - Fix a NULL pointer dereference
   - Remove redundant exec_queue_suspended
   - RTP / OA whitelist fixes
   - Return error on non-migratable faults requiring devmem
   - Skip FORCE_WC and vm_bound check for external dma-bufs
   - Hold notifier lock for write on inject test path
   - Drop bogus static from finish in force_invalidate
   - Fix double-free of managed BO in error path
   - Don't attempt to process FAST_REQ or EVENT relays
   - Fix NPD in bo_meminfo
   - Prevent invalid cursor access for purged BOs
   - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG

  amdgpu:
   - Soc24 aborted suspend fix
   - Drop unecessary BUG() and BUG_ON() from error paths
   - SCPM fix
   - Power reporting fix
   - DCE HDR fix
   - UVD boundary checks
   - VCN boundary checks
   - VCE boundary checks
   - DCN 4.2 fixes
   - Large stack allocation fixes
   - Fix aperture mapping leak
   - UserQ fixes
   - Ignore_damage_clips fix
   - ACP fixes
   - DC boundary checks
   - GPUVM fixes
   - JPEG idle check fixes
   - Userptr fix
   - GC 11.7 updates
   - Non-4K page fix
   - SMU 13 fixes
   - DP alt mode fix

  amdkfd:
   - Boundary checks
   - CRIU fixes

  amdxdna:
   - fix device removal issues
   - fix use after free in debug BO

  imagination:
   - fix double call to scheduler fini
   - fix ioctl return values
   - fix user array stride

  virtio:
   - handle EDIDs better

  panthor:
   - irq safe fence lock fix
   - reset work fix
   - fix invalid pointer
   - fix iomem access in suspended state
   - sched resume fix
   - unplug suspend fix
   - drop needless check
   - eviction leak fix
   - bail on group start/resume fix
   - keep irqs masked

  malidp:
   - use clock bulk API

  komeda:
   - clock prepare fixes"

* tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel: (105 commits)
  drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
  drm/xe/pt: prevent invalid cursor access for purged BOs
  drm/xe: fix NPD in bo_meminfo()
  drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
  drm/xe/hw_engine: Fix double-free of managed BO in error path
  drm/xe/userptr: Drop bogus static from finish in force_invalidate
  drm/xe/userptr: Hold notifier_lock for write on inject test path
  drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
  drm/xe: Return error on non-migratable faults requiring devmem
  drm/xe/rtp: Ensure locking/ref counting for OA whitelists
  drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
  drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
  drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
  drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
  drm/xe/rtp: Generalize whitelist_apply_to_hwe
  drm/xe/rtp: Keep track of non-OA nonpriv slots
  drm/xe/rtp: Maintain OA whitelists separately
  drm/xe/rtp: Fix build error with clang < 21 and non-const initializers
  drm/imagination: Fix user array stride in pvr_set_uobj_array()
  drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
  ...
2026-07-03 15:42:20 -10:00
Linus Torvalds
e6174e9b38 ACPI support fixes for 7.2-rc2
- Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake to
    the ACPI TAD driver (Xu Rao)
 
  - Define acpi_ut_safe_strncpy() as an alias for strscpy_pad() which is
    viable because that function is only called from kernel code (Rafael
    Wysocki)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmpIAfgSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1BrsH/j1RgYp/hU3ws2RFCw7Cs2ap8vbidedB
 XtcliFxVfvy4NI5Xlw+YNHW2lyjCcF1lcInumkW1yG5KFkqyOevX6YmnykOJkDON
 7alv7rt/W7qLT3BDvZdzUm+zCflm8ieapohpFMEtaJTgguJKwP+0HS3XCQ1eSorH
 4mou0SI1qkjqllXZB7PKTPEgcD0ji3dkusjtcp3qvZrgeO9qsZ6C2GABeQwDRIPU
 BZhIdjf1jwX/T7Qn5llQHGMWCM78zHSGIRDA6zXnqn7jse5pntbQOwYL/6jRc0QA
 kj+9akgDe1YnEAAvIm5cMAygBuqGDCH4S4XEBtQeTc9XwJaDC0g1Hzc=
 =ffMf
 -----END PGP SIGNATURE-----

Merge tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI support fixes from Rafael Wysocki:
 "These fix a coding mistake in the ACPI TAD (Time and Alarm
  Device) driver introduced by one of its previous updates and
  get rid of the ugly #ifdef __KERNEL__ conditional compilation
  in acpi_ut_safe_strncpy() by redefining that function as an
  alias for strscpy_pad():

   - Add a missing ACPI_TAD_AC_WAKE capability check omitted by mistake
     to the ACPI TAD driver (Xu Rao)

   - Define acpi_ut_safe_strncpy() as an alias for strscpy_pad()
     which is viable because that function is only called from kernel
     code (Rafael Wysocki)"

* tag 'acpi-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias
  ACPI: TAD: Check AC wake capability before enabling wakeup
2026-07-03 15:13:50 -10:00
Linus Torvalds
590cae7152 RISC-V updates for v7.2-rc2
- Fix a crash when a kretprobe reads from the stack
 
 - Fix an issue with the build-time mcount sorter that broke ftrace
 
 - Fix the rv32 IRQ stack frame padding to match the ABI
 
 - Only defer IOMMU configuration during initialization.  This avoids
   an issue where IOMMU configuration could be indefinitely deferred
 
 - Add the missing build salt to the vDSO
 
 - Now that RISC-V systems with higher numbers of cores are starting to
   become available, raise NR_CPUS for RISC-V to 256
 
 - Clean up some warnings from sparse caused by the RISC-V-optimized
   RAID6 code
 
 - Clean up our __cpu_up() code with a few minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpH+BAACgkQx4+xDQu9
 Kkt2BxAAkHACbEzUDBJnhKL+Ce39S4QzNb+5iE25t7cUrpkK2ArYMBCd5Zir0Q+E
 WIP1nmDYsE9z6fNa8CncIEY6CnNBNDRK2eR7BiUM+tOhS5jMqvctb7LxkIGgbh3/
 VuNCw0NIavQ5zMqdVHQVzfIS+PojysZVnSQ3CwAHV1hgKO0p1FVozfv3N+TWBHjL
 hMCGxCNxIQaDXFKLSYlOh4fJEgpyznRo/YNybmugCAe8HqY2RyOgWhm62ipL0kcP
 OAjpKRIJ9o4CCaC+F3TNGjubw2I+AkEf8rMbw1KDuzwDI2HmsubMyFS/LHrhM0D7
 VhSjxu3DxJT7ObM4ID07hjywWTRAfmwI0AokajYmBPqVi3t+erJnAU2ayExnFmg9
 PWN53BbEMg+T2W5ym7arhWz28MdHoATviwEy1gLgaJbQtAQJDzK1FQ9in5m+AJAe
 QAO6O04bS+PUOz4orlGMDa7bLnHQucLKNvkI7EkXdS47yYPvs6OwOX1EjfMkM1TE
 O+36Uc6FSAEoO3nN5QGhV2OUegPyKm8lSJhqfftK4qBSd7Ffd9Mpsw9APCj/75ay
 uZ2yvllHli+SLo/xgOs/oFFUTrID1LUmwDzU7K1tr11hI2AV2BZ4aA1h3B6LbVt9
 Tz3vxaOC4DEx9owhQRaFgo13KvSYAAz4QYAwr1EMPHtDMRxu6k8=
 =qgfC
 -----END PGP SIGNATURE-----

Merge tag 'riscv-for-linus-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

Pull RISC-V fixes from Paul Walmsley:

 - Fix a crash when a kretprobe reads from the stack

 - Fix an issue with the build-time mcount sorter that broke ftrace

 - Fix the rv32 IRQ stack frame padding to match the ABI

 - Only defer IOMMU configuration during initialization. This avoids an
   issue where IOMMU configuration could be indefinitely deferred

 - Add the missing build salt to the vDSO

 - Now that RISC-V systems with higher numbers of cores are starting to
   become available, raise NR_CPUS for RISC-V to 256

 - Clean up some warnings from sparse caused by the RISC-V-optimized
   RAID6 code

 - Clean up our __cpu_up() code with a few minor fixes

* tag 'riscv-for-linus-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: probes: save original sp in rethook trampoline
  riscv: Fix 32-bit call_on_irq_stack() frame pointer ABI
  scripts/sorttable: Handle RISC-V patchable ftrace entries
  riscv: smp: use secs_to_jiffies in __cpu_up
  ACPI: RIMT: Only defer the IOMMU configuration in init stage
  riscv: Add build salt to the vDSO
  raid6: fix raid6_recov_rvv symbol undeclared warning
  raid6: fix riscv symbol undeclared warnigns
  riscv: Raise default NR_CPUS for 64BIT to 256
2026-07-03 15:07:24 -10:00
Linus Torvalds
6cf48bfec9 4 smb client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpIEO8ACgkQiiy9cAdy
 T1FANwwAiPzR+deWnTwY0euLqG7MxRe7JTF2jQYvF4YPa6HRzCj6wjcPzwYa0fAV
 fu2ZpOvfmHZFmgbMdcTU2NcRbDIjGAG02wEFHu7okw1BgcQSijHqTz7k82N7LzzF
 4GiOqX3L4zXKzwSH1HIyudfDdEsuo1xN2ydW6mouWM8r26BUvAA7SFyCquN9t+ou
 sp76oxlj9VZbNvaTWenYRFQM+PfLCEM/E+RcSDwpyvtj0uYArE/bLxteDr7gbao4
 zJltCCQCO8lzhHjwBWP9RRUQZH/pbtfZ6ylr3Qaa/eRgZR/C3cKBe6B5pZ/6RPUN
 9vLvd4cRaO1rxTcZ2+8DVXFWVz42CMPa6JkBQeRLgpNlAfEqeTmrDX2EsX/m53yz
 56/heHWz7yUtuuBFPI2y83tEzcRCIkOV9T3Xbw9+Q/qPweHuXvM3u0zmVuPwnvID
 LAGRvqC6g2VhJFw1u4T4i6Z/RDl0uQSZPcwDQriEknONGwT0jCteuXBMK6waMEbn
 ZH3DQ6Sj
 =C9Qx
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Credit fix

 - Fix alignment issue in parse_posix_ctxt

 - SID parsing fix

* tag 'v7.2-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Fix missing credit release on failure in cifs_issue_read()
  cifs: update internal module version number
  smb: client: use unaligned reads in parse_posix_ctxt()
  smb: client: harden POSIX SID length parsing
2026-07-03 15:01:33 -10:00
Rafael J. Wysocki
973772c7cf Merge branch 'acpi-tad'
Merge an ACPI TAD (Time and Alarm Device) driver fix for 7.2-rc2.

* acpi-tad:
  ACPI: TAD: Check AC wake capability before enabling wakeup
2026-07-03 20:28:08 +02:00
Linus Torvalds
71dfdfb020 vfs-7.2-rc2.fixes
Please consider pulling these changes from the signed vfs-7.2-rc2.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCakeSGAAKCRCRxhvAZXjc
 opdAAQDCui7Q517Wxe59USK+wtnOVARMzCN0Tu6e/HodvbbIEAD/RmgGnQrYF13I
 3BuCwTMS9Q1lHQLUtIkd9WqqYa2rQws=
 =uL08
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - netfs:

    - fix the decision when to disallow write-streaming with fscache in
      use, handling of asynchronous cache object creation, a double fput
      in cachefiles, clearing S_KERNEL_FILE without the inode lock held,
      page extraction bugs in the iov_iter helpers (a potential
      underflow, a missing allocation failure check, a memory leak, and
      a folio offset miscalculation), writeback error and ENOMEM
      handling, DIO write retry for filesystems without a
      ->prepare_write() method, and the replacement of the wb_lock mutex
      with a bit lock plus writethrough collection offload so that
      multiple asynchronous writebacks don't interfere with each other.

    - Fix the barriering when walking the netfs subrequest list during
      retries as it was possible to see a subrequest that was just added
      by the application thread.

 - iomap:

    - Change iomap to submit read bios after each extent instead of
      building them up across extents. The old behavior was considered
      problematic for a while and now caused an actual erofs bug.

    - Guard the ioend io_size EOF trim in iomap against underflow when a
      concurrent truncate moves EOF below the start of the ioend,
      wrapping io_size to a huge value.

 - overlayfs

    - Fix a stale overlayfs comment about the locking order.

    - Store the linked-in upper dentry instead of the disconnected
      O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or
      virtiofs upper layer ->d_revalidate() would try to look up "/" in
      the workdir and fail, causing persistent ESTALE errors that broke
      dpkg and apt.

 - vfs-bpf:

   Have the bpf_real_data_inode() kfunc take a struct file instead of a
   dentry so it is usable from the bprm_check_security, mmap_file, and
   file_mprotect hooks, and rename it from bpf_real_inode() to make the
   data-inode semantics explicit. The kfunc landed this cycle so the
   change is safe.

 - afs:

   NULL pointer dereferences in the callback service and in
   afs_get_tree(), several memory and refcount leaks, missing locking
   around the dynamic root inode numbers and premature cell exposure
   through /afs, a netns destruction hang caused by a misplaced
   increment of net->cells_outstanding, a bulk lookup malfunction caused
   by the dir_emit() API change, inode (re)initialisation issues, and
   assorted smaller fixes to error codes, seqlock handling, and debug
   output.

 - vfs:

   Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a
   selftest for it.

 - vboxsf:

   Add Jori Koolstra as vboxsf maintainer, taking over from Hans de
   Goede.

 - dio:

   Release the pages attached to a short atomic dio bio; the REQ_ATOMIC
   size check error path leaked them.

 - procfs:

   Only bump the parent directory link count when registering
   directories in procfs. Registering regular files inflated the count
   and leaked a link on every create and remove cycle.

 - minix:

   Avoid an unsigned overflow in the minix bitmap block count
   calculation that let crafted images with huge inode or zone counts
   pass superblock validation and crash the kernel during mount.

 - cachefiles:

   Fix a double unlock in the cachefiles nomem_d_alloc error path left
   over from the start_creating() conversion.

 - fat:

   Stop fat from reading directory entries past the 0x00
   end-of-directory marker. If the trailing on-disk slots aren't
   zero-filled the driver surfaced arbitrary garbage as directory
   entries.

 - freexvfs:

   Don't BUG() on unknown typed-extent types in freevxfs, reachable via
   ioctl(FIBMAP) on a crafted image; fail with an I/O error instead.

 - orangefs:

   Keep the readdir entry size 64-bit in orangefs fill_from_part().
   Truncating it to __u32 bypassed the bounds check and led to
   out-of-bounds reads triggerable by the userspace client.

 - xfs:

   Fix the error unwind in xfs_open_devices() which released the rt
   device file twice and left dangling buftarg pointers behind that were
   freed again when the failed mount was torn down.

 - exec:

   Fix an off-by-one in the comment documenting the maximum binfmt
   rewrite depth in exec_binprm(). The code allows five rewrites, not
   four; restricting the code would break userspace so the comment is
   fixed instead.

 - file handles:

   Reject detached mounts in capable_wrt_mount(). A detached mount can
   be dissolved concurrently, leaving a NULL mount namespace that
   open_by_handle_at() would dereference.

* tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits)
  netfs: Fix barriering when walking subrequest list
  iomap: submit read bio after each extent
  fuse: call fuse_send_readpages explicitly from fuse_readahead
  iomap: consolidate bio submission
  fhandle: reject detached mounts in capable_wrt_mount()
  netfs: Fix DIO write retry for filesystems without a ->prepare_write()
  netfs: Fix folio state after ENOMEM whilst under writeback iteration
  netfs: Fix writeback error handling
  netfs: Fix writethrough to use collection offload
  netfs: Replace wb_lock with a bit lock for asynchronicity
  netfs: Fix kdoc warning
  scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
  iov_iter: Remove unused variable in kunit_iov_iter.c
  iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
  iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
  iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
  cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
  cachefiles: Fix double fput
  netfs: Fix netfs_create_write_req() to handle async cache object creation
  netfs: Fix decision whether to disallow write-streaming due to fscache use
  ...
2026-07-03 05:48:05 -10:00
Linus Torvalds
025d0d6221 xfs: fixes for 7.2-rc2
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCakeeeQAKCRBcsMJ8RxYu
 Y6Q+AX9gnOQ1ZkxIKb+/hHq061nh/41iOaiO1CHEgvkCuX2pkRDJkIO2g5+1WaCC
 FcjSzLcBf0COW1/Pye2+ViB1u/SkMJZpKbrKl6lY4wcVHtqNSwn/D0zvbXsfBSsb
 Zj6I2kGZGw==
 =FpZC
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.2-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:
 "A collection of bugfixes and some small code refactoring"

* tag 'xfs-fixes-7.2-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: simplify __xfs_buf_ioend
  xfs: fix handling of synchronous errors in xfs_buf_submit
  xfs: remove xfs_buf_ioend
  xfs: improve the xfs_buf_ioend_fail calling convention
  xfs: use null daddr for unset first bad log block
  xfs: fix memory leak in xfs_dqinode_metadir_create()
  xfs: release dquot buffer after dqflush failure
  xfs: also mark the buffer stale on verifier failure in xfs_buf_submit
  xfs: open code xfs_buf_ioend_fail in xfs_buf_submit
  xfs: fix AGFL extent count calculation in xrep_agfl_fill
  xfs: simplify the failure path in xfs_buf_alloc_vmalloc
  xfs: fix incorrect use of gfp flags in xfs_buf_alloc_backing_mem
  xfs: lift setting __GFP_NOFAIL from xfs_buf_alloc_kmem to the caller
  xfs: split up xfs_buf_alloc_backing_mem
2026-07-03 05:44:56 -10:00
Linus Torvalds
4dbc94bcc2 xen: branch for v7.2-rc2
-----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCakeC1xsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQgFxhu0/YY74ZBQD/chB7mZrRK5FWdhtEYZuT
 5is9FKdEe7P3rRChGuDxGZoBAISClrfxdh46C90D8jhjE3G3xWsN5DIajo1YaDbH
 TroI
 =wiih
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.2a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:

 - rename function parameters and a comment related to
   xen_exchange_memory() (Jan Beulich)

 - replace __ASSEMBLY__ with __ASSEMBLER__ (Thomas Huth)

 - add some sanity checking to the Xen pvcalls frontend driver (Michael
   Bommarito)

 - fix error handling in the Xen gntdev driver (Wentao Liang)

 - fix several minor bugs in Xen related drivers (Yousef Alhouseen)

* tag 'for-linus-7.2a-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  x86/Xen: correct commentary and parameter naming of xen_exchange_memory()
  xenbus: reject unterminated directory replies
  xen/gntalloc: validate grant count before allocation
  xen/gntalloc: make grant counters unsigned
  xen/front-pgdir-shbuf: free grant reference head on errors
  xen/gntdev: fix error handling in ioctl
  xen: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files
  xen/pvcalls: bound backend response req_id before indexing rsp[]
2026-07-03 05:40:58 -10:00
Linus Torvalds
2916bfc6ba gpio fixes for v7.2-rc2
- check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio
 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)
 - with the above: restoe non-sleeping GPIO access in pinctrl-meson
 - fix return value on OOM in gpio-timberdale
 - fix interrupt handling in gpio-mt7621
 - support both A and B variants of NCT6126D in gpio-f7188x
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmpHaxAACgkQBZ0uy/82
 hMMo+Q/+MPDFUmy4E7mA1FwcJ1jwx4sFp7tIVu5jAjlC9GyrRJXxN6IS4od4RcqP
 x6r+FU+2j8G1Fyob6kh7nvsjsvNFkGkHToMIzJLaR/BNCQe3JhU/ipNx8rQ5OOHN
 lFBUfax0NoodxXbCftn3FHtvvLjNuRMTq9i0OkmoNgtqvuGmPFI4Zv/M3NdR/+bA
 hvv4cmdnQFNceX2FNTo5tcOyDyuAsrt+2oguE8zgLoLXKXk4E5NTrtxUVlyOCtPD
 43WpqoLC1nZJQZ2pK7Tfh4vjSlKl78ybhSEk9i/h9N+8fjWfWYQfYnT+akmi5oou
 LhDrg2k7AD4tJUJX1TPJofCnRM5F/qTPkxliXzzsi6zzMGpoKuLTejDEuY4Vl5D3
 TRk5lMi6yoorNtaKKmpDzflbpFZlnNvn7BE1KrUgYp/w1Vm8sEPfva87rSH+yYj/
 AhDnJvm9c6A6vsb58RO0h4QMArzq71BIR8S1fA7P5AFDyUk2EEBM3RZGdJfCo61c
 8/2PoYvRJWvlHsRlPmY/eWsOq25RE2fUEjpVI5PV8C9z+QFFM6gW+6QSZjbnWrtA
 Bdph8+549oWtPwCmx1CmdM5vxMOkuLYU/B7fdWAjzgL/YtIbM93+KLuzh9eblUpr
 eOKRxHIZoOb09Zcte4ke8wFckbCCEN3HmDIl+2TSgVG8i1L3FS8=
 =Q09c
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - check the return value of gpiochip_add_data() in gpio-mvebu and
   gpio-htc-egpio

 - avoid locking context issues with GPIO drivers using the shared GPIO
   proxy by only allowing sleeping operations (atomic GPIO ops don't
   really make sense in shared context anyway)

 - with the above: restore non-sleeping GPIO access in pinctrl-meson

 - fix return value on OOM in gpio-timberdale

 - fix interrupt handling in gpio-mt7621

 - support both A and B variants of NCT6126D in gpio-f7188x

* tag 'gpio-fixes-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  pinctrl: meson: restore non-sleeping GPIO access
  gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
  gpio: mt7621: be sure IRQ domain is created before exposing GPIO chips
  gpio: mt7621: more robust management of IRQ domain teardown
  gpio: mt7621: avoid corruption of shared interrupt trigger state
  gpio: shared-proxy: always serialize with a sleeping mutex
  gpio-f7188x: Add support for NCT6126D version B
  gpio: htc-egpio: use managed gpiochip registration
  gpio: mvebu: fail probe if gpiochip registration fails
2026-07-03 05:38:12 -10:00
David Howells
5c6ce05e40
netfs: Fix barriering when walking subrequest list
Fix the barriering used when walking the subrequest list in retry as
there's a possibility of seeing a subreq that's just been added by the
application thread.

Fixes: ee4cdf7ba8 ("netfs: Speed up buffered reading")
Fixes: 288ace2f57 ("netfs: New writeback implementation")
Link: https://sashiko.dev/#/patchset/20260608145432.681865-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/138807.1782980582@warthog.procyon.org.uk
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-03 11:52:41 +02:00
Takashi Iwai
5720deab6d ASoC: Fixes for v7.2
A fairly standard set of driver specific fixes and quirks that have come
 in since the merge window, plus a MAINTAINERS update.  The tas675x
 READ_ONCE change is probably not actually fixing issues properly but we
 need a whole new approach to concurrency there and it came along with
 some good fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpGs+4ACgkQJNaLcl1U
 h9ACNwf/Tn088OJahzUFoky3ZZo/BYIf+Fg0Dsc4rhYZxxuolL8ahW5505KXsNt/
 zqAViW+Stk+CcYRnMHHUcUvU9QNo5m7rG2L6fi5vxR5TckFNktIi21HgR12vmRE2
 vQB6Oxwf2wHJogrtNplA1BUTz+3f3pho3yXu/7dDN+rARHnXxS31/mGStzRP2dhO
 xl74IQ0Gg+7vCOHkmH2LTKOmZMxUFOfSriejyTNqNiUbZrufeCpA6u64ply05wD+
 Hawc5hg1qaTykIGvr+cvZyav2Z8lvQmiDAcCp19bp4sk3HPo15U1ZdeqdVFkBXjK
 B+OfMgQZrN5b3sIA7vhj9ztDT/RSmA==
 =aubo
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v7.2-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.2

A fairly standard set of driver specific fixes and quirks that have come
in since the merge window, plus a MAINTAINERS update.  The tas675x
READ_ONCE change is probably not actually fixing issues properly but we
need a whole new approach to concurrency there and it came along with
some good fixes.
2026-07-03 09:30:30 +02:00
Linus Torvalds
d2c9a99135 Split <linux/mod_devicetable.h> in per subsystem headers
<linux/mod_devicetable.h> is included transitively in nearly every
 driver in an x86_64 allmodconfig build of v7.1:
 
         $ find drivers -name \*.o -not -name \*.mod.o | wc -l
         21330
         $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
         17038
 
 The result of this mixture of different and unrelated subsystem details
 is that even when touching an obscure device id struct most of the
 kernel needs to be recompiled. Given that each driver typically only
 needs one or two of these structures, splitting into per subsystem
 headers and only including what is really needed reduces the amount of
 needed recompilation.
 
 This split is implemented in the first commit and then after some
 preparatory work in the following commits, the last two replace
 includes of <linux/mod_devicetable.h> by the actually needed more
 specific headers. There are still a few instances left, but the ones
 with high impact (that is in headers that are used a lot) and the easy
 ones (.c files) are handled. These remaining includes will be addressed
 during the next merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmpHSvIACgkQj4D7WH0S
 /k6Rdgf/QqxMIt7DEAN6KvyCnwVnNnvEWQhac/DtYA3NF1JaynieJIoFcimrRr/j
 cntxjz2zlMhLH4CYZ87IunZ7nGZgkMlsnl/OVMm5NY0wq0vVYX6VmpiSvhMAgvjV
 QxKHOAyuVqPslwVE8DF2Vh9mgJILviH5t/yIy8DHF85QBrDSjcd/n6csx09uTjIy
 +D6NuxQ7ZeOi+O2wZuiDhYpD1kwgO1sXAg56ogN1OSTQoo1kkKqj66b5fgbPVm4/
 MX3EBOjKIytX8csfWBJjNSB7aRyWVMkMKmmDO9+7MIq6tPRbc3yYwhu2kZBAw5Pt
 mQfy1oyUi+0jwew4yKHeoVLyWAc4bg==
 =YhFg
 -----END PGP SIGNATURE-----

Merge tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull mod_devicetable.h header split from Uwe Kleine-König:
 "Split <linux/mod_devicetable.h> in per subsystem headers

  <linux/mod_devicetable.h> is included transitively in nearly every
  driver in an x86_64 allmodconfig build of v7.1:

      $ find drivers -name \*.o -not -name \*.mod.o | wc -l
      21330
      $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
      17038

  The result of this mixture of different and unrelated subsystem
  details is that even when touching an obscure device id struct most of
  the kernel needs to be recompiled. Given that each driver typically
  only needs one or two of these structures, splitting into per
  subsystem headers and only including what is really needed reduces the
  amount of needed recompilation.

  This split is implemented in the first commit and then after some
  preparatory work in the following commits, the last two replace
  includes of <linux/mod_devicetable.h> by the actually needed more
  specific headers.

  There are still a few instances left, but the ones with high impact
  (that is in headers that are used a lot) and the easy ones (.c files)
  are handled. These remaining includes will be addressed during the
  next merge window"

* tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)
  parisc: #include <linux/compiler.h> for unlikely() in <asm/ptrace.h>
  media: em28xx: Add include for struct usb_device_id
  LoongArch: KVM: Add include defining struct cpu_feature
  ALSA: hda/core: Add include defining struct hda_device_id
  usb: dwc2: Add include defining struct pci_device_id
  platform/x86: int3472: Add include defining struct dmi_system_id
  platform/x86: x86-android-tablets: Add include defining struct dmi_system_id
  i2c: Let i2c-core.h include <linux/i2c.h>
  of: Explicitly include <linux/types.h> and <linux/err.h>
  platform/x86: msi-ec: Ensure dmi_system_id is defined
  usb: serial: Include <linux/usb.h> in <linux/usb/serial.h>
  driver core: platform: Include header for struct platform_device_id
  driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver
  media: ti: vpe: #include <linux/platform_device.h> explicitly
  mod_devicetable.h: Split into per subsystem headers
2026-07-02 20:54:26 -10:00
Linus Torvalds
c85167c926 ata fixes for 7.2-rc2
- Quirk the Phison PS3111-S11 SSD with NOLPM due to its defective link
    power management (Bryam).
 
  - Strengthen checks on a device concurrent positioning range
    information to make sure to reject any invalid report (Bryam).
 
  - Fix probe error handling in the pata_pxa and sata_gemini drivers
    (Myeonghun, Wentao).
 
  - Limit buffer size of replies from translated commands to what libata
    actually generated (Karuna)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCakc/rAAKCRDdoc3SxdoY
 dp4BAQC5DDPG9r9/fitNLy+Sm8lJtFMhjd2JTY405ZghCNUoOQD+KaBwFmK7/rny
 QuD0UtF9SV4swbQka2n83ZGCTLmIrgA=
 =x7nY
 -----END PGP SIGNATURE-----

Merge tag 'ata-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Damien Le Moal:

 - Quirk the Phison PS3111-S11 SSD with NOLPM due to its defective
   link power management (Bryam)

 - Strengthen checks on a device concurrent positioning range
   information to make sure to reject any invalid report (Bryam)

 - Fix probe error handling in the pata_pxa and sata_gemini
   drivers (Myeonghun, Wentao)

 - Limit buffer size of replies from translated commands to what
   libata actually generated (Karuna)

* tag 'ata-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-scsi: limit simulated SCSI command copy to response length
  ata: pata_pxa: Fix DMA channel leak on probe error
  ata: sata_gemini: unwind clocks on IDE pinctrl errors
  ata: libata-core: Reject an invalid concurrent positioning ranges count
  ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
2026-07-02 20:05:43 -10:00
Uwe Kleine-König (The Capable Hub)
995832b2ce Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:17 +02:00
Uwe Kleine-König (The Capable Hub)
ecca1d63c1 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)
<linux/mod_devicetable.h> is included in a many files:

	$ git grep '<linux/mod_devicetable.h>' ef0c9f75a1 | wc -l
	1598

; some of them are widely used headers. To stop mixing up different and
unrelated driver( type)s let the subsystem headers only use the subset
of the recently split <linux/mod_devicetable.h> that are relevant for
them.

The fallout (I hope) is addressed in the previous commits that handle
sources relying on e.g. <linux/i2c.h> pulling in the full legacy header
and thus providing pci_device_id.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/199fe46b624ba07fb9bd3e0cd6ff13757932cb5f.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:16 +02:00
Uwe Kleine-König (The Capable Hub)
a7e8cae4c6 parisc: #include <linux/compiler.h> for unlikely() in <asm/ptrace.h>
Currently <linux/compiler.h> isn't included at all (not even
transitively) in <asm/ptrace.h>.
arch/parisc/kernel/asm-offsets.c just happens to include the following
chain of includes before <asm/ptrace.h>:

	<linux/sched.h>
	-> <asm/processor.h>
	-> <asm/hardware.h>
	-> <linux/mod_devicetable.h>
	-> <linux/uuid.h>
	-> <linux/string.h>
	-> <linux/compiler.h>

. That chain will be broken, because in one of the next commits
<asm/hardware.h> is changed to only include <linux/device-id/parisc.h>
instead of <linux/mod_devicetable.h>. So to ensure
arch/parisc/kernel/asm-offsets.c knows about unlikely() even after that
change, #include <linux/compiler.h> explicitly.

Link: https://patch.msgid.link/0574a2b73363c3cbf21c55c27455c3cecfb33583.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:16 +02:00
Uwe Kleine-König (The Capable Hub)
c19f08f796 media: em28xx: Add include for struct usb_device_id
Traditionally <linux/mod_devicetable.h> was a header defining a plethora
of structs, among them struct usb_device_id. This was split now with the
objective that only the relevant bits are included.

Currently <linux/mod_devicetable.h> is transitively included in
drivers/media/usb/em28xx/em28xx.h via:

	drivers/media/usb/em28xx/em28xx.h ->
	<linux/i2c.h> ->
	<linux/acpi.h> ->
	<linux/device.h> ->
	<linux/device/driver.h> ->
	<linux/mod_devicetable.h

To keep struct usb_device_id available once <linux/device/driver.h>
stops including <linux/mod_devicetable.h>, include it the header
providing that struct explictly.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/e72de5b4b9f1aa77a3c19a5e698a195dfd81ae0b.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:16 +02:00
Uwe Kleine-König (The Capable Hub)
a59fbb8cef LoongArch: KVM: Add include defining struct cpu_feature
Traditionally <linux/mod_devicetable.h> was a header defining a plethora
of structs, among them struct cpu_features. This was split now with the
objective that only the relevant bits are included.

Currently <linux/mod_devicetable.h> is transitively included in
arch/loongarch/kvm/main.c via:

	arch/loongarch/kvm/main.c ->
	<linux/kvm_host.h> ->
	<linux/entry-virt.h> ->
	<linux/resume_user_mode.h> ->
	<linux/memcontrol.h> ->
	<linux/cgroup.h> ->
	<linux/kernel_stat.h> ->
	<linux/interrupt.h> ->
	<linux/hardirq> ->
	<asm/hardirq.h> ->
	<linux/irq.h> ->
	<asm/irq.h> ->
	<linux/irqdomain.h> ->
	<linux/of.h> ->
	<linux/mod_devicetable.h>

To keep struct cpu_features available once <linux/of.h> stops including
<linux/mod_devicetable.h>, include it here explicitly.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/052feec0e04ea8f5b2706a19a5b236679eed0aba.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:16 +02:00
Uwe Kleine-König (The Capable Hub)
4e38ddd96b ALSA: hda/core: Add include defining struct hda_device_id
Traditionally all *_device_id were defined in a single header
<linux/mod_devicetable.h>. This was split now with the objective that
only the relevant bits are included. So including <linux/pci.h> won't be
enough to get a definition of (the unrelated to pci) struct
hda_device_id.

Add an explicit include for the header defining struct hda_device_id to
keep working when <linux/pci.h> stops providing this defintion.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/376883bc5889d5cca01efb6f8d4e07a20158f2b8.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
e3cda6938a usb: dwc2: Add include defining struct pci_device_id
Up to now <linux/acpi.h> includes <linux/mod_devicetable.h> that
provides struct pci_device_id. However <linux/mod_devicetable.h> was
split into per bus headers and <linux/acpi.h> will only include the acpi
related one (and similar for other bus headers).

As struct pci_device_id is used in drivers/usb/dwc2/core.h, add an
include to ensure it's defined also after the includes in <linux/acpi.h>
are tightened.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/bddfcdfaf36d735c244e03efada6083ef98ebd51.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
a66f9107a8 platform/x86: int3472: Add include defining struct dmi_system_id
Currently <linux/mod_devicetable.h> is included transitively in
int3472.h via

	<linux/clk-provider.h> ->
	<linux/of.h> ->
	<linux/mod_devicetable.h>

However these includes will be tightend such that only the bits relevant
for of will be provided by <linux/of.h>. To ensure that dmi_system_id
stays around, include the respective header explicitly.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Link: https://patch.msgid.link/0ba52730f67dc995d9d896b81fa6a7320bf8cb4b.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
5e4cc258b3 platform/x86: x86-android-tablets: Add include defining struct dmi_system_id
Currently <linux/i2c.h> includes <linux/mod_devicetable.h> transitively
which ensures that struct dmi_system_id is defined in
drivers/platform/x86/x86-android-tablets/x86-android-tablets.h. However
this include in <linux/i2c.h> will be replaced by one for i2c_device_id
only. To ensure that dmi_system_id is available add the include for that
explicitly.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/32928d9ee47cefc7dfc4c385c06bd5e598b0fca1.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
6d924c42e0 i2c: Let i2c-core.h include <linux/i2c.h>
The subsystem private header i2c-core.h uses several symbols defined in
<linux/i2c.h>, e.g. struct i2c_board_info and i2c_lock_bus()). This
doesn't pose a problem in practise because all files including
"i2c-core.h" also include <linux/i2c.h>.

To make this more robust add an include statement for <linux/i2c.h>
making the header self-contained.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/46aa85ab3dc4e63bfb5bd8ff1fd212a3d0e31f58.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
2fb03de525 of: Explicitly include <linux/types.h> and <linux/err.h>
<linux/of_platform.h> uses resource_size_t and relies on the transitive
include <linux/mod_devicetable.h> -> <linux/types.h>. It also uses error
constants and thus relying on the include chain
<linux/mod_devicetable.h> -> <linux/uuid.h> -> <linux/string.h> ->
<linux/err.h>.

With the plan to split <linux/mod_devicetable.h> per subsystem and then
only letting of_platform.h include the of-specific bits (which don't
require these two headers), add the needed includes explicitly to keep
the header self-contained.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/a730991bc8813cf70c2445064ea425291538f709.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
4c8f323b9e platform/x86: msi-ec: Ensure dmi_system_id is defined
Currently <linux/acpi.h> includes <linux/mod_devicetable.h> and thus
dmi_system_id is available for the driver. To disentangle includes
<linux/acpi.h> will be changed to only include the header for
acpi_device_id instead of the full <linux/mod_devicetable.h>. To prepare
for that include the dedicated header for struct dmi_device_id.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/600c7ab3263dcb8cee39b43dbd313eba8abef376.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:15 +02:00
Uwe Kleine-König (The Capable Hub)
b14f81978d usb: serial: Include <linux/usb.h> in <linux/usb/serial.h>
All consumers of the latter also include the former, but without that
struct usb_driver and struct usb_device_id (and maybe more) are not
defined. Add an include for <linux/usb.h> to make the header
self-contained.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/82219ab65d16ee5bfe5a35d11bc938baac3fd3bc.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:14 +02:00
Uwe Kleine-König (The Capable Hub)
00cd8fc630 driver core: platform: Include header for struct platform_device_id
Platform drivers can define an array containing the supported device
variants to be assigned to the struct platform_driver's .id_table.

While a forward declaration of struct platform_device_id is technically
enough to make the driver self-contained, it's reasonable to provide the
(very lightweight) data type definition for that array in
<linux/platform_device.h> to not add that burden to all platform drivers
with an id-table.

Note that currently <linux/device.h> transitively includes
<linux/mod_devicetable.h> that provides struct platform_device_id. But
that include is planned to be replaced by a tighter set of includes that
only define the structures relevant for the stuff in <linux/device.h>.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/4ca29592c9d1c6d528a65e05b80af7355f3c79c5.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:14 +02:00
Uwe Kleine-König (The Capable Hub)
e1da37efb5 driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver
struct device_driver contains pointers of type struct of_device_id* and
struct acpi_device_id* but doesn't ensure these are defined. To make the
header self-contained add the (very lightweight) includes that contain
the respective definitions.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/199ba71b4ac73f4b4d9f5d2be635c96eec73c70e.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:14 +02:00
Uwe Kleine-König (The Capable Hub)
1b44cfa834 media: ti: vpe: #include <linux/platform_device.h> explicitly
The driver uses several symbols and structs defined in that header. The
header is currently included transitively via

	"vip.h" ->
	<media/v4l2-ctrls.h> ->
	<media/media-request.h> ->
	<media/media-device.h> ->
	<linux/platform_device.h>

which seems to be on the lower end of the scale between random and
reliable.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/9f2e0e001eec087f00ac2c5af2de2e8f6d0978c1.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:38:14 +02:00
Uwe Kleine-König (The Capable Hub)
ad428f5811 mod_devicetable.h: Split into per subsystem headers
<linux/mod_devicetable.h> is included transitively in nearly every
driver in an x86_64 allmodconfig build of v7.1:

	$ find drivers -name \*.o -not -name \*.mod.o | wc -l
	21330
	$ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
	17038

The result is that even when touching an obscure device id struct most
of the kernel needs to be recompiled. Given that each driver typically
only needs one or two of these structures, splitting into per subsystem
headers and only including what is really needed reduces the amount of
needed recompilation.

Implement the first step and define each device id struct in a separate
header (together with its associated #defines).

<linux/mod_devicetable.h> is modified to include all the new headers to
continue to provide the same symbols.

Several headers currently include <linux/mod_devicetable.h>, those that
are most lukrative to include only their subsystem headers only are:

	$ git -C source grep -l mod_devicetable.h include/linux | while read h; do echo -n "$h:"; find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l $h | wc -l; done | sort -t: -k2 -n -r | head
	include/linux/of.h:10897
	include/linux/pci.h:7920
	include/linux/acpi.h:7097
	include/linux/i2c.h:5402
	include/linux/spi/spi.h:1897
	include/linux/dmi.h:1643
	include/linux/usb.h:1222
	include/linux/input.h:1205
	include/linux/mdio.h:835
	include/linux/phy.h:733

struct cpu_feature isn't really a device_id struct. That is kept in
<linux/mod_devicetable.h> for now.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # zorro
Link: https://patch.msgid.link/41400e323be8640702b906d04327e833c5bdaf4a.1782808461.git.u.kleine-koenig@baylibre.com
[Drop "MOD" from the header guards]
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
2026-07-03 07:37:43 +02:00
Karuna Ramkumar
cd64be0ecd ata: libata-scsi: limit simulated SCSI command copy to response length
The function ata_scsi_rbuf_fill() is used to copy the response of
emulated SCSI commands from ata_scsi_rbuf to the SCSI command's
scatterlist.

Currently, sg_copy_from_buffer() is called with the size argument
set to ATA_SCSI_RBUF_SIZE (2048 bytes). Since ata_scsi_rbuf is
zeroed out before the simulation actor is invoked, copying the
full buffer size causes the remainder of the SCSI command's
transfer buffer (beyond the actual response length 'len') to be
overwritten with zeroes. This clobbers any pre-existing sentinel
values or data in the caller's buffer tail, even though the
correct residual count is reported via scsi_set_resid().

Fix this by passing the actual response length 'len' as the copy
size to sg_copy_from_buffer(), ensuring that the tail of the
caller's buffer remains untouched. Also, add a defensive check
to ensure that the actor does not return a length exceeding the
static buffer capacity. If this occurs, trigger a WARN_ON(),
fail the command with an aborted command error, and return
immediately without copying any data.

The fix was tested by invoking an SCSI SG_IO INQUIRY on
an ATA disk on vanilla build, and build with the fix. Confirmed
that the input buffer's tail end remains unmodified with the fix.

Fixes: 5251ae224d ("ata: libata-scsi: Return residual for emulated SCSI commands")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Karuna Ramkumar <rkaruna@google.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03 13:44:18 +09:00
Wentao Liang
fcaf242e7f ata: pata_pxa: Fix DMA channel leak on probe error
When dmaengine_slave_config() fails, the DMA channel acquired by
dma_request_chan() is not released before returning the error,
leaking the channel reference.

Fix by adding dma_release_channel() in the error path.

The ata_host_activate() error path already correctly releases the
DMA channel.

Cc: stable@vger.kernel.org
Fixes: 88622d80af ("ata: pata_pxa: dmaengine conversion")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03 13:44:18 +09:00
Myeonghun Pak
c0ace4130e ata: sata_gemini: unwind clocks on IDE pinctrl errors
gemini_sata_bridge_init() prepares and enables both SATA PCLKs, then
disables them again while keeping the clocks prepared for later bridge
start and stop operations. If gemini_setup_ide_pins() fails after that,
gemini_sata_probe() returns directly and skips the existing
out_unprep_clk unwind path.

Route the IDE pinctrl failure through out_unprep_clk so the clocks
prepared by gemini_sata_bridge_init() are unprepared before probe
fails.

Fixes: d872ced29d ("ata: sata_gemini: Introduce explicit IDE pin control")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03 13:44:18 +09:00
Bryam Vargas
533a0b940f ata: libata-core: Reject an invalid concurrent positioning ranges count
ata_dev_config_cpr() takes the number of range descriptors from buf[0]
of the concurrent positioning ranges log (up to 255), which the device
reports independently of the log size in the GPL directory. The count is
then walked at a fixed 32-byte stride in two places with no bound: the
log read here, and the INQUIRY VPD page B9h emitter, which writes one
descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device
reporting a count larger than its own log overflows the read buffer (up
to 7704 bytes past a 512-byte slab), and a count above 62 overflows the
response buffer on the emit side.

Bound the count once, on probe, against both the log the device returned
and the number of descriptors the VPD B9h response buffer can hold
(ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range
count with a warning; this keeps the emitter in bounds with no separate
change there.

Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Fixes: fe22e1c2f7 ("libata: support concurrent positioning ranges log")
Fixes: c745dfc541 ("libata: fix reading concurrent positioning ranges log")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03 13:44:18 +09:00
Bryam Vargas
462775c620 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus
after entering Device-Initiated Slumber during idle. With the default
med_power_with_dipm policy the link goes down (SStatus 1 SControl 300)
and does not recover, forcing the filesystem read-only. Forcing
max_performance keeps the link stable across prolonged idle.

Add a NOLPM quirk so link power management is disabled for this drive
specifically, leaving it intact for other devices on the host.

Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-03 13:44:18 +09:00
Linus Torvalds
51512e22ef BPF fixes:
- Initialize task local storage before fork bails out to
   free the task (Jann Horn)
 
 - Fix insn_aux_data leak on verifier error path (KaFai Wan)
 
 - Reject BPF inode storage map creation when BPF LSM is
   uninitialized (Matt Bobrowski)
 
 - Mask pseudo pointer values in verifier logs when pointer
   leaks are not allowed (Nuoqi Gui)
 
 - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)
 
 - Reject a skb-modifying SK_SKB stream parser since the latter
   is only meant to measure the next message (Sechang Lim)
 
 - Fix bpf_refcount_acquire to reject refcounted allocation
   arguments with a non-zero fixed offset (Yiyang Chen)
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCaka0NhUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIMPywD/ePh+eOZjFwXy88kOdNa2qmKLuTQm
 nv6jPDOEafVDfbUA/R0qT9t+144K5Ig1NU58uR9vMIevqWRjLrnQtWU7KI0D
 =4aKP
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann:

 - Initialize task local storage before fork bails out to free the task
   (Jann Horn)

 - Fix insn_aux_data leak on verifier error path (KaFai Wan)

 - Reject BPF inode storage map creation when BPF LSM is uninitialized
   (Matt Bobrowski)

 - Mask pseudo pointer values in verifier logs when pointer leaks are
   not allowed (Nuoqi Gui)

 - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)

 - Reject a skb-modifying SK_SKB stream parser since the latter is only
   meant to measure the next message (Sechang Lim)

 - Fix bpf_refcount_acquire to reject refcounted allocation arguments
   with a non-zero fixed offset (Yiyang Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Prefer dirty packs for eBPF allocations
  bpf: Prefer packs that won't trigger an IBPB flush on allocation
  bpf: Skip redundant IBPB in pack allocator
  bpf: Restrict JIT predictor flush to cBPF
  x86/bugs: Enable IBPB flush on BPF JIT allocation
  bpf: Support for hardening against JIT spraying
  bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
  bpf,fork: wipe ->bpf_storage before bailouts that access it
  bpf: Fix insn_aux_data leak on verifier err_free_env path
  selftests/bpf: Cover pseudo-BTF ksym log masking
  bpf: Mask pseudo pointer values in verifier logs
  selftests/bpf: Cover refcount acquire node offsets
  bpf: Reject offset refcount acquire arguments
  selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser
  bpf, sockmap: reject a packet-modifying SK_SKB stream parser
  selftests/bpf: don't modify the skb in the strparser parser prog
2026-07-02 16:39:28 -10:00
Linus Torvalds
826eec5b5e VFIO fixes for v7.2-rc2
- Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci
    variant driver with a binary split between setup/release and
    runtime modified flags.  These were noted across several Sashiko
    reviews as pre-existing issues. (Alex Williamson)
 
  - Fix runtime PM inconsistency where the vfio-pci driver module_init
    could modify the idle PM policy of existing devices through globals
    managed in vfio-pci-core, leading to unbalanced runtime PM
    operations. (Alex Williamson)
 
  - Restore mutability of writable vfio-pci module options by further
    pulling policy globals out of vfio-pci-core, to instead be latched
    per device at device init.  Provide visibility of the per device
    latched values through debugfs. (Alex Williamson)
 
  - Fix missing VGA arbiter uninit callback in unwind path.
    (Alex Williamson)
 
  - Reorder device debugfs removal before device_del() to avoid gap
    where debugfs is available with stale devres pointers.
    (Alex Williamson)
 
  - Move UUID library linking flag from vfio selftest Makefile into
    libvfio.mk to avoid exposing such dependencies when linking with
    KVM selftests. (Sean Christopherson)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmpGoBgRHGFsZXhAc2hh
 emJvdC5vcmcACgkQI5ubbjuwiyIsTQ//aBSIKmchiU701m5Cl9FP/er0IRkjqmJd
 EoKseoQoFvBi9Rsog5RiDwTnsu3NTcvqaZgcWshxJZ0G3/rPP6wTqr3W3sGMqsXp
 q6EwdeebmCsBecc14gexMjic6azS3w4IyqDGo56X30i7BbRAxpQdnlOG2oGdCmz6
 bxjIlRVYiYgC4NYJM5wwpx+fVxcHmoejgKQVxetG3ersvW/PoWR8DT8AEP1iDA2W
 /jhj+aqX0Il7+Wxxxxhw7qQoBe0U1U1uz3+frRVAMwBQY0dTsMzU6aGuT+ajbTJC
 /rgXSiXVDUoRaIUGi8TolWwXXE+V9IpXoNouEokCoQ6WoxiThhS4codKwveArWOv
 C4LdEV1XLiZTBFj59q4DKCj7+6mYWK2z8OylPIUxXckxvWsEH8b4U/BjMH+NwyAy
 hn854fEpMA0SSIl4GEJRocZcH7C+EzE7CDDBop18e4fKDIwjU3odnci5c1titG8W
 kvqSel11JYnOnThLCF8qvqAHmRJqqbtUurlrzPQwWif+tNwAl/QVyHYxr/HY4UMB
 wLKgfb9TbFD2jH1b3KPOeUv8I2AkIBbXARsBZXn1r0+MWHr0hRkrlgir1thTzcxn
 yau7OWlkOnbf9NCiB+KyZ0xwqhG+dBJWmX2lzQcDMQ/1hbrqOTfAaKvg9kRZNdjn
 qckJIv7VGwQ=
 =V/L3
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio

Pull VFIO fixes from Alex Williamson:
 "Mostly straightforward fixes here, inconsistent runtime PM handling
  due to global device policies, bitfield races, unwind path gaps,
  teardown ordering, and a misplaced library flag.

   - Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci
     variant driver with a binary split between setup/release and
     runtime modified flags. These were noted across several Sashiko
     reviews as pre-existing issues (Alex Williamson)

   - Fix runtime PM inconsistency where the vfio-pci driver module_init
     could modify the idle PM policy of existing devices through globals
     managed in vfio-pci-core, leading to unbalanced runtime PM
     operations (Alex Williamson)

   - Restore mutability of writable vfio-pci module options by further
     pulling policy globals out of vfio-pci-core, to instead be latched
     per device at device init. Provide visibility of the per device
     latched values through debugfs (Alex Williamson)

   - Fix missing VGA arbiter uninit callback in unwind path (Alex
     Williamson)

   - Reorder device debugfs removal before device_del() to avoid gap
     where debugfs is available with stale devres pointers (Alex
     Williamson)

   - Move UUID library linking flag from vfio selftest Makefile into
     libvfio.mk to avoid exposing such dependencies when linking with
     KVM selftests (Sean Christopherson)"

* tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio:
  vfio: selftests: Add luuid to libvfio.mk's list of libraries, not to the Makefile
  vfio/pci: Expose latched module parameter policy in debugfs
  vfio: Remove device debugfs before releasing devres
  vfio/pci: Latch all module parameters per device
  vfio/mlx5: Fix racy bitfields and tighten struct layout
  vfio/pci: Fix racy bitfields and tighten struct layout
  vfio/pci: Release the VGA arbiter client on register_device() failure
  vfio/pci: Latch disable_idle_d3 per device
2026-07-02 15:25:54 -10:00