Commit Graph

1367826 Commits

Author SHA1 Message Date
Linus Torvalds
afa3d8b6e0 We recently got a report of a crash [1] with misuse of call_rcu().
Instead of crashing the kernel, a warning and graceful return is better.
 [1] https://lore.kernel.org/all/aEnVuzK7VhGSizWj@pc636/
 
 Uladzislau Rezki (Sony) (1):
       rcu: Return early if callback is not specified
 
  kernel/rcu/tree.c | 4 ++++
  1 file changed, 4 insertions(+)
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEEcoCIrlGe4gjE06JJqA4nf2o45hAFAmhVuzAWHGpvZWxhZ25l
 bGZAbnZpZGlhLmNvbQAKCRCoDid/ajjmEEIkD/96Thn+TWnz4hOu9F39YIbtsqC3
 4K+T2CFHmu4gBdUmXSadSSSShjDZgwwD9iLLWw/tmCyOS39Mkoh22x8bxWAy0KM1
 A36hR3sgyl+OE4m+u+o8kJxFMHMrsLXt8L/wKIT9jf/VbqkI4VMpgwfTCjz8ySFc
 FuujXT0QwkS2+1BtP9n19OJdyJ3vUQy6vNsk3RbEUpmBdMvADpYskWwJqTFd7hMc
 b1PYtsIn+0cB4qQfGcC2qtLRQAYdegg+No3VnrmFPYsfMmnG0kKl8+E/L7ts8hGJ
 1nYs3Sqhql8Q6y68KOUp0PD6qVWJHL22jNKCzieNB8vV2Y7PkVr0VKmvDSNAGCsC
 pUsPLUjQIVMpu/k6ZM8iiaQN0vZ8C7yRUFHJqeREy/t1rpnq39x4ObhPkAzj1dCl
 IYMv6M03IzMzUQa1sZMJ5eCZWmtIbd2/1hDE02fK8EE/MBiyCPQgpAKZ/bGzJtOZ
 HgYzAhATX4tEdjj8m5Uk6F517VGp3hUs/3nn6TrGUW64SdqLp6WWd2nMBpLz1JrA
 BAXVliYhoI94X9Zlc/ecd+CefN2Bu/DgbYa6uO7i7/c1w/4FIG/oDVqdUoobwoDI
 WoQ/O/hUCh/ltO/UMmxwDbvWdmRH4iQ2Tpt8TXvLuo2El1tQda1VErexqArylOvw
 FG9sXft2miCQjOx9Ng==
 =PVd7
 -----END PGP SIGNATURE-----

Merge tag 'rcu/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux

Pull RCU fix from Joel Fernandes:
 "We recently got a report of a crash [1] with misuse of call_rcu().

  Instead of crashing the kernel, a warning and graceful return is
  better:

   - rcu: Return early if callback is not specified (Uladzislau Rezki)"

Link: https://lore.kernel.org/all/aEnVuzK7VhGSizWj@pc636/ [1]

* tag 'rcu/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:
  rcu: Return early if callback is not specified
2025-06-21 08:10:21 -07:00
Linus Torvalds
7c7f9dd1ea perf tools fixes for v6.16, 1st batch:
- Fix some file descriptor leaks that stand out with recent changes to
   'perf list'.
 
 - Fix prctl include to fix building 'perf bench futex' hash with musl libc.
 
 - Restrict 'perf test' uniquifying entry to machines with 'uncore_imc' PMUs.
 
 - Document new output fields (op, cache, mem, dtlb, snoop) used with
   'perf mem'.
 
 - Synchronize kernel header copies.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCaFWAEwAKCRCyPKLppCJ+
 J0/LAP46WdlK1T49um790QowJR+HqRQEngur6ZIb8ya0FpCc4AEAnv8KdGdeoF21
 H403o3fbCaMGN5ZQ4loe3IEO9gh6EAY=
 =9GzE
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix some file descriptor leaks that stand out with recent changes to
   'perf list'

 - Fix prctl include to fix building 'perf bench futex' hash with musl
   libc

 - Restrict 'perf test' uniquifying entry to machines with 'uncore_imc'
   PMUs

 - Document new output fields (op, cache, mem, dtlb, snoop) used with
   'perf mem'

 - Synchronize kernel header copies

* tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  tools headers x86 cpufeatures: Sync with the kernel sources
  perf bench futex: Fix prctl include in musl libc
  perf test: Directory file descriptor leak
  perf evsel: Missed close() when probing hybrid core PMUs
  tools headers: Synchronize linux/bits.h with the kernel sources
  tools arch amd ibs: Sync ibs.h with the kernel sources
  tools arch x86: Sync the msr-index.h copy with the kernel sources
  tools headers: Syncronize linux/build_bug.h with the kernel sources
  tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench'
  tools headers UAPI: Sync linux/kvm.h with the kernel sources
  tools headers UAPI: Sync the drm/drm.h with the kernel sources
  perf beauty: Update copy of linux/socket.h with the kernel sources
  tools headers UAPI: Sync kvm header with the kernel sources
  tools headers x86 svm: Sync svm headers with the kernel sources
  tools headers UAPI: Sync KVM's vmx.h header with the kernel sources
  tools kvm headers arm64: Update KVM header from the kernel sources
  tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob
  perf mem: Document new output fields (op, cache, mem, dtlb, snoop)
  tools headers: Update the fs headers with the kernel sources
  perf test: Restrict uniquifying test to machines with 'uncore_imc'
2025-06-21 07:59:45 -07:00
Linus Torvalds
3f75bfff44 The main fix that really needs to get in is the revert of the patch
adding the new mtd_master class, because it entirely fails the
 partitioning if a specific Kconfig option is set. We need to think how
 to handle that differently, so let's revert it as we need to get back to
 the pen and paper situation again.
 
 Otherwise the definition of some Winbond SPI NAND chips are receiving
 some fixes (geometry and maximum frequency, mostly).
 
 And finally a small memory leak gets also fixed.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmhVfg0ACgkQJWrqGEe9
 VoTa8wf7BaY8T+mpA6zbgou4LBNFiqcB+NkL8N4uFOaVsGQYQfb5SX6m1CKitD8y
 oIbkwYZI7c2R3ZuQ8vj6PgKwbG7HJrmSfO5dbWoamNJ6cE2Y1rQFJUCyE98zrO/g
 MsZBy2PjBM3q5YRwuA0YzzHWQec4bXpeQlxUhk+VYGW/2BJdROUzmLebPz7cuKKx
 m+VVLdVEByu41JaLE9j3+ntfFnoY3Fp5DooheGCCEAdHEv+drfcbLv2TEiy9wyCv
 LLhau6MPaBDgL0+VIZd91Lgys7stFYtbPBSlItRsdZ91mRIVt8AtJAA0k0t8lQGo
 srb8eSEbTeIVFkJjGC43utY6mIic1A==
 =5vwJ
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull mtd fixes from Miquel Raynal:
 "The main fix that really needs to get in is the revert of the patch
  adding the new mtd_master class, because it entirely fails the
  partitioning if a specific Kconfig option is set. We need to think how
  to handle that differently, so let's revert it as we need to get back
  to the pen and paper situation again.

  Otherwise the definition of some Winbond SPI NAND chips are receiving
  some fixes (geometry and maximum frequency, mostly).

  And finally a small memory leak gets also fixed"

* tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spinand: fix memory leak of ECC engine conf
  mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
  mtd: spinand: winbond: Increase maximum frequency on an octal operation
  mtd: spinand: winbond: Fix W35N number of planes/LUN
  Revert "mtd: core: always create master device"
2025-06-20 22:36:48 -07:00
Linus Torvalds
a765b9e6db SCSI fixes on 20250620
Two small and obvious driver fixes.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCaFVmPCYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishVihAP0f8k3/
 yBL63Mu4H4PemV1Xx70lerRL9lFY/NqrcnZQQQEAmUTHB9Cdb1N3NiYOf0OmNYzd
 BSUIL6zI5lW1aPb8xWY=
 =2iYQ
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two small and obvious driver fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
2025-06-20 22:34:52 -07:00
Uladzislau Rezki (Sony)
33b6a1f155 rcu: Return early if callback is not specified
Currently the call_rcu() API does not check whether a callback
pointer is NULL. If NULL is passed, rcu_core() will try to invoke
it, resulting in NULL pointer dereference and a kernel crash.

To prevent this and improve debuggability, this patch adds a check
for NULL and emits a kernel stack trace to help identify a faulty
caller.

Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
2025-06-20 15:31:48 -04:00
Linus Torvalds
11313e2f78 gpio fixes for v6.16-rc3
- correct the ACPI GPIO access mode in gpio-loongson-64bit
 - only obtain the interrupt for a single instance of the chip controlled
   by gpio-mlxbf3
 - fix an invalid value return from probe() in gpio-pca953x
 - add missing MODULE_DEVICE_TABLE() to gpio-spacemit
 - update the HiSilicon GPIO driver maintainer entry
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmhVZb8ACgkQEacuoBRx
 13JphA//c0/UTOqmDcLOlkXinOvvfNkTVDskMw3caX+y9w0Kumms8DbXjHZ83yxz
 x+XqB6kGcYQhQW7RMlptZ+8vCFuRMaaa8H+oWIu9E//0XG3hmQSld46RhYphh047
 HnAcoZQV3cSDBNVxzl9egZORdZvjPUnu3ZC6Ajl6aZ6FkOSmmcjwXI66bteZ4U5m
 W977SVnr41mEVHESz7XYq6Hk0I9gSGjn3vIQrVcD7W+N+vUAaEDcoLNv8I4q0SeU
 8iHEC9Rblb8h9KeRXF55dgUYYcWlelusebhe0rgZxEJLGczkqigzyiqh5w+bm34W
 Qup8CuKxFZzIdYO4cd62sTq5fbNGbh94iIn7tygqm44Al7VZ0M+pxEI1CW/Uj4zV
 qF2rsv9gkc2Z7ei3ksMaVdLmMydHWpgz7bD8qNV8/Z72PnXls3wUOpcONLTPmJbP
 M1M5lS+u3VKTlAnF582b668aKf6Vw61DTOXllRnOMYzDr975aIKoOLFHrKZmUkxN
 AbB93r22TNldDfnQZYwjIo9D/EcONXx2PUjx4Kfv1kvmI11EZIEZOlQ322dIyiHU
 I4dYLYU9wJerZMDC9ZUi3aW9SC/4/fCzwGWG2c8bR/M7kYXgXo3D4YLv5/hqB6cu
 0pOAWj0rCwDx0EaXZGBs7zPv1ONJ9IDBJQrUIvtS8wSmBLm7Fp8=
 =CAzO
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - correct the ACPI GPIO access mode in gpio-loongson-64bit

 - only obtain the interrupt for a single instance of the chip
   controlled by gpio-mlxbf3

 - fix an invalid value return from probe() in gpio-pca953x

 - add missing MODULE_DEVICE_TABLE() to gpio-spacemit

 - update the HiSilicon GPIO driver maintainer entry

* tag 'gpio-fixes-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: mlxbf3: only get IRQ for device instance 0
  gpio: pca953x: fix wrong error probe return value
  gpio: spacemit: Add missing MODULE_DEVICE_TABLE
  gpio: loongson-64bit: Correct Loongson-7A2000 ACPI GPIO access mode
  MAINTAINERS: Update HiSilicon GPIO driver maintainer
2025-06-20 10:07:56 -07:00
Linus Torvalds
299f489f5b sound fixes for 6.16-rc3
A collection of small fixes.
 All changes are device-specific at this time.
 
 - Fixes for Cirrus codecs with SoundWire, including firmware name
   updates
 - Fix for i.MX8 SoC DSP
 - Usual HD-audio, USB-audio, and ASoC AMD quirks
 - Fixes for legendary SoundBlaster AWE32 ISA device (a real one, we
   still got a bug report after 25 years)
 - Minor build fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmhVUosOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9T2hAAg2h8KAHyHyBK0VR6uuvArOQLAMBYBWldgyfM
 qVo28xs7DFvgqOe/xiaPniMuTdUyQnqQm8NYhH4TEmPZ+GnbQk0jasXpzoufhoHg
 ZE9qtG1wAqwtI+A3/XSLr7TsznUbX5qCqhyGcbQYB74hs9d/3wGXPwfyvQ8z8zwu
 5TzgzhOY9HIzKfU2d3Tf0NxtzeDTDYDDJ8TCvETYMoJVaKMVN/xJLoIRI/rFHuK2
 BpLza31Ad6yIn/fAPkGSi7LMLad8l72dEomLxL5I2Yon34v+Gj9kcCRjauxxH6Qo
 JjoxDagaDMZdvQbj9l3yxj1q9drmg/Mt/9HxkfKNe1eFpaZPkQQPsCIzwgF3iqCU
 VRjclghSW0zMETh1PKf1Ijs0jzriG8fKf/ffYwz7Ya+NC9r0t//9iljFsHRsoFwU
 kJJmCUaxoZLcIGAn77aYAioOTa13FkPnIklKQv6qptjAznsdN5i6iOhtovSY8Omt
 kSvfNoQDnSfvsTeD9MESd+yriIM8sG+c3HEdfAjsJvweXr6LhIZsQ7eajR9KVjUy
 1PsROpHQClJBTwdVSL2pI7kSO1ddrNVlIzL86+kUUreNlloko4hgMPI3ljLuUCOv
 tZYCyGEX64tGMbzHltAnQ862Osg5b/kv2+MoCFeuwp7B3EOVhM/1xfD+d+zkZfds
 uZDo64I=
 =I27M
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes. All changes are device-specific at this
  time:

   - Fixes for Cirrus codecs with SoundWire, including firmware name
     updates

   - Fix for i.MX8 SoC DSP

   - Usual HD-audio, USB-audio, and ASoC AMD quirks

   - Fixes for legendary SoundBlaster AWE32 ISA device (a real one, we
     still got a bug report after 25 years)

   - Minor build fixes"

* tag 'sound-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
  ALSA: hda/realtek: Enable headset Mic on Positivo P15X
  ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count
  ASoC: doc: cs35l56: Add CS35L63 to the list of supported devices
  ASoC: SOF: imx8: add core shutdown operation for imx8/imx8x
  ALSA: hda/realtek: Add quirk for Asus GA605K
  ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  ASoC: amd: yc: update quirk data for HP Victus
  ASoC: apple: mca: Drop default ARCH_APPLE in Kconfig
  ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
  ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
  ASoC: doc: cs35l56: Update to add new SoundWire firmware filename suffix
  ASoC: cs35l56: Use SoundWire address as alternate firmware suffix on L56 B0
  ASoC: cs35l56: Use SoundWire address as firmware name suffix for new silicon
  ASoC: sdw_utils: Fix potential NULL pointer deref in is_sdca_endpoint_present()
  ALSA: sb: Force to disable DMAs once when DMA mode is changed
  ALSA: sb: Don't allow changing the DMA mode during operations
  ALSA: hda/realtek: Add quirk for Asus GU605C
  ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
  ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
  ALSA: ctxfi: Replace deprecated strcpy() with strscpy()
  ...
2025-06-20 09:59:20 -07:00
Linus Torvalds
d41fef1ce2 arm64 fixes for -rc3
- Suppress KASAN false positive in stack unwinding code.
 
 - Drop redundant reset of the GCS state on exec().
 
 - Don't try to descend into a !present PMD when creating a huge vmap()
   entry at the PUD level.
 
 - Fix a small typo in the arm64 booting Documentation.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmhUDbUQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNHmfB/9jJazW5qioi/pAQ2tOFilRBB8miRHmXjUt
 iaChiFa7cPSuqiv4IVRaY66CPkqgp22kTMb4y0Vc4E7WEdzUG21e5F52yhhZlwBB
 CuH0NSOclJ6vnqACyDOLYn7WWgiP+jachcvJlvMp+XiB2dE0z1UyQkwk59j7I/oT
 MHJLfNeIXpUb2k/LkJXAIWEGuNcg4pOREzKlbyl8iGwxvtC7+MjAfYuWSrKTIfLX
 0ixyaqfUY2wFrRsFLowJH/unIDW3Iv1HItCWEtz+j2n3Hh1sJaIo3YcWfG3/AVaO
 eg1atu7ZUYEr9sLaBqJH9JY8lN8UnsnkZ+iUQzciSUTwPJxSARXv
 =L3s/
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "There's nothing major (even the vmalloc one is just suppressing a
  potential warning) but all worth having, nonetheless.

   - Suppress KASAN false positive in stack unwinding code

   - Drop redundant reset of the GCS state on exec()

   - Don't try to descend into a !present PMD when creating a huge
     vmap() entry at the PUD level

   - Fix a small typo in the arm64 booting Documentation"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  arm64/gcs: Don't call gcs_free() during flush_gcs()
  arm64: Restrict pagetable teardown to avoid false warning
  docs: arm64: Fix ICC_SRE_EL2 register typo in booting.rst
2025-06-20 09:54:24 -07:00
Edson Juliano Drosdeck
33bdee1282 ALSA: hda/realtek: Enable headset Mic on Positivo P15X
Positivo P15X is equipped with ALC269VC, and needs a fix to make
the headset mic to work.
Also must to limits the internal microphone boost.

Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Link: https://patch.msgid.link/20250619191215.17203-1-edson.drosdeck@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-06-20 10:05:46 +02:00
Takashi Iwai
7213851924 ASoC: Fixes for v6.16
A relatively large collection of fixes and updates that came in since
 the merge window.  Of note are a couple of Cirrus ones which change the
 firmware naming for some newly added devices, and a fix from Laurentiu
 for issues booting firmwares on the DSPs on i.MX8 SoCs.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhUnx0ACgkQJNaLcl1U
 h9DKOAf/a73xsodyviWnmovKP9wMXbgQB0u7ubMDdkJm7HX91UEfIeh2kmfRhJtL
 Hc/C0gHjOK15s+TgFR4zuO5Oeb63Ok+nY+YF7TlFQ0OPR/BvAIALpQUwlW/EgVgC
 l+O9HJBysjNBtVf2aQTRvbs59kpoV1q31Ys5pGRN0nrUAvnrtosMtO3Py8UyS4Oy
 4XcMUxnu67+8LVinOXV2X8lmztCm2dsX2Z9pnsxvncCFkxWJpDcr0EhUo24LOR1E
 vDl7rAuI6fetUU8kHM7Noe7nyxa/4yiL6i5W/LWAfpCZiBkEdNU4WOVPRjBqXcY2
 GfRYJkEbi7JoWWhMhdmLxYnobFKCiA==
 =RZgv
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v6.16-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v6.16

A relatively large collection of fixes and updates that came in since
the merge window.  Of note are a couple of Cirrus ones which change the
firmware naming for some newly added devices, and a fix from Laurentiu
for issues booting firmwares on the DSPs on i.MX8 SoCs.
2025-06-20 09:58:57 +02:00
Linus Torvalds
75f5f23f87 block-6.16-20250619
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmhUFmcQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpiaZEACPwWddJeq0LZ/Km4UeyJCmDxQRgZ87uZxl
 DtTwmcpxabpl+eXG8d7jiem6d8T0v/XbugiqP7CmeRMQWsJ1pmBC/vvtyFTQsWNf
 WzD5iQp4IoBRuEzGzWVB7aso6hpOPTmClydko16+bDuKseTBla8/2iaTcIijs/64
 isfmMKUAtRRVqFHAvj5yifjMV17vfPbb/kYAV11YYR+STTijxa8lM9rW32QrxTM9
 oIByKBEECFJY+dmlN4VAOez0fGuufuh4IO+5YitRmMdwKipcXUF0H74CEmM8lefU
 b2smqwoyAz81Z+g1tAlc2kNsLsYBbCjJ+3uis00RGrK23AFY7ucg3wXRuBic01Mb
 sF3HFwo1t1ekIolH2TqDRMFyYxBQwJ9y8u8lN9w66ubLdtEUrjlnP1fhgHw7Ctj7
 7Wdgs+UAssxWE2Mj9JGz9stQrz3IfROrWy8p7LZs5IMEOR04spAackky+ehHhTPb
 Bp53d+du8UZkH4lwkiN2AnxfPL789ndHUPLs5Mo3NMbC4pduiHJGtJ8SozWwJ1GU
 slpinkg+hw2IMxuPDfboayZGpPkiQzMIbnhumcXPd4OCzhZupl1n8bEHKVeCVTfm
 bPJ6J7tQ2LVwFKe1SFVX/7OBger0n13joBuroi0mDa2R2Nve90oAO0AndR475y5q
 QQfWcKLfqw==
 =wuVQ
 -----END PGP SIGNATURE-----

Merge tag 'block-6.16-20250619' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - Two fixes for aoe which fixes issues dating back to when this driver
   was converted to blk-mq

 - Fix for ublk, checking for valid queue depth and count values before
   setting up a device

* tag 'block-6.16-20250619' of git://git.kernel.dk/linux:
  ublk: santizize the arguments from userspace when adding a device
  aoe: defer rexmit timer downdev work to workqueue
  aoe: clean device rq_list in aoedev_downdev()
2025-06-19 23:29:35 -07:00
Linus Torvalds
255da9b8d7 io_uring-6.16-20250619
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmhUFYEQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgplMoD/4u7Om+qQMQDBmOTbLeYZmst3NkZShEo0oj
 fNTlLnYmgeT44tM0LX9dYaLAwWPjCZJQObaxWdWEnlxk4AD1Zgairv54zGRlkJQK
 Sn81QDnDV6B1mW+VuqS24veK4fM9m5h9XQynnVOXRoKvIUPH5AEhRQj/aj1MCdD9
 mLQeE2EeR0mJxZDvLOL1G1RFDJa9EJ7m+eDFy/k3+1RCR3T+XH+YDz3EH2h1+mPd
 5gf3NHv5bCF8CGAzA9UixVN+2VBog0tgY1lL+DRKU9oNtqWXExD4i8dMt17Odg+p
 0DcVW3c1Wts/vOKGXCS0TSBLFM8aGraEb2tf0QIKrNNJQyRfsZpeLgn/hhEb8nTV
 ipJOsTbdgxjqPGvMqrLnhW8oC/RFLFyJbpW9nEkqSQVjncM5KJWxx5sxP08i/Ee/
 6HYkDUM4Z67Eh4bXBqiiqtsuxehM1PxA4i9Cb2obXKyR6IL/D6vhSsBqTexy3a0p
 j8jKrWXDUlQiTAU1A59+aeYKFNyk9Tin8VuQ+hxmWswu2T3VkhQwJTcOK3qNijo1
 ji71zNz/SVVzHwz+AF8dT08c448A8N/Xaaj8aXi+2xhpHCYj6/g2mDOEYa/tysrf
 wVAKUxeRYKTtHQM6LVB8q+VvXOW587D7gjsSETaVTeW0Bgmtbh2IntadxJnWRd5U
 ZiKpERpU6A==
 =cAEE
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.16-20250619' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:

 - Two fixes for error injection failures. One fixes a task leak issue
   introduced in this merge window, the other an older issue with
   handling allocation of a mapped buffer.

 - Fix for a syzbot issue that triggers a kmalloc warning on attempting
   an allocation that's too large

 - Fix for an error injection failure causing a double put of a task,
   introduced in this merge window

* tag 'io_uring-6.16-20250619' of git://git.kernel.dk/linux:
  io_uring: fix potential page leak in io_sqe_buffer_register()
  io_uring/sqpoll: don't put task_struct on tctx setup failure
  io_uring: remove duplicate io_uring_alloc_task_context() definition
  io_uring: fix task leak issue in io_wq_create()
  io_uring/rsrc: validate buffer count with offset for cloning
2025-06-19 23:25:28 -07:00
Linus Torvalds
5f2b6c5f6b drm fixes for 6.16-rc3
msm:
 - Display:
   - Fixed DP output on SDM845
   - Fixed 10nm DSI PLL init
 - GPU:
   - SUBMIT ioctl error path leak fixes
   - drm half of stall-on-fault fixes.
   - a7xx: Missing CP_RESET_CONTEXT_STATE
   - Skip GPU component bind if GPU is not in the device table.
 
 i915:
 - Fix MIPI vtotal programming off by one on Broxton
 - Fix PMU code for GCOV and AutoFDO enabled build
 
 xe:
 - A workaround update
 - Fix memset on iomem
 - Fix early wedge on GuC Load failure
 
 amdgpu:
 - DP tunneling fix
 - LTTPR fix
 - DSC fix
 - DML2.x ABGR16161616 fix
 - RMCM fix
 - Backlight fixes
 - GFX11 kicker support
 - SDMA reset fixes
 - VCN 5.0.1 fix
 - Reset fix
 - Misc small fixes
 
 amdkfd:
 - SDMA reset fix
 - Fix race in GWS scheduling
 
 nouveau:
 - update docs reference
 - fix backlight name buffer size
 - fix UAF in r535 gsp rpc msg
 - fix undefined shift
 
 mgag200:
 - drop export header
 
 ast:
 - drop export header
 
 malidp:
 - drop informational error
 
 ssd130x:
 - fix clear columns
 
 etnaviv:
 - scheduler locking fix
 
 v3d:
 - null pointer crash fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmhU0/8ACgkQDHTzWXnE
 hr780g//dzOqGoNqwd4nh7zHLYuxSmVvJXcaFwOoYbnhrB54rW3i06ROu28U8UPL
 xclwyYFjALd+ZwDw0QjN2hOfR8xnUcxbT+EpoQ/Eu2RoJiithpXkZzlkeZal0QPt
 icoy0GzZEymh3HnvkX+lRqnoX64if7K0UYXtVrJ+2ewiosA885uBqvA0AXsi24GU
 ExM3cRC+FOkKOSN5ZJlgtFHdSUk8bDMaovxhRCB8SZTbobG0eXWyn68urW+M/nGm
 vDhvJ9oxfIoZJ586Kvb7B1AEeIr3juOs6k3CnPvBG3g9ZUuxJi4OUUrY6n7XIWvx
 K/5noPH23kVrz7kvdAaPmX9uzsQPqF2g2cL+KpzE2AaQR4IZwsjt5cvYDaWLhBdX
 sPdynJOXoU2AbAal+k5y6sTb3vDTKbTo1RN8NW9N9N449Nnd0qfRsq6gVqsD15ok
 Ro8b2QGAQ6oBuvStGjC37AfleBal91+0U8LEgJO60tRrv1cNQhT1ic/bbaNjBNlZ
 kzVSiLRIpsmx2NBgpYKrq/ESjAmfr3ZVLwf8XW784HM6WJEcp0D4JJkIbtXLwauN
 qY3YTBP/pLC3+1LSnvtk2CbQiuAb8W8qhzfpl3UMO6PGDzt0xOnadTmmLMr6k+Gg
 SqD7bRFNjJ5jLwsD0zGtxoq/8jms/wxuQdwoMZxC0767CRD7NEg=
 =8R74
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-06-20' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Bit of an uptick in fixes for rc3, msm and amdgpu leading the way,
  with i915/xe/nouveau with a few each and then some scattered misc
  bits, nothing looks too crazy:

  msm:
   - Display:
      - Fixed DP output on SDM845
      - Fixed 10nm DSI PLL init
   - GPU:
      - SUBMIT ioctl error path leak fixes
      - drm half of stall-on-fault fixes
      - a7xx: Missing CP_RESET_CONTEXT_STATE
      - Skip GPU component bind if GPU is not in the device table

  i915:
   - Fix MIPI vtotal programming off by one on Broxton
   - Fix PMU code for GCOV and AutoFDO enabled build

  xe:
   - A workaround update
   - Fix memset on iomem
   - Fix early wedge on GuC Load failure

  amdgpu:
   - DP tunneling fix
   - LTTPR fix
   - DSC fix
   - DML2.x ABGR16161616 fix
   - RMCM fix
   - Backlight fixes
   - GFX11 kicker support
   - SDMA reset fixes
   - VCN 5.0.1 fix
   - Reset fix
   - Misc small fixes

  amdkfd:
   - SDMA reset fix
   - Fix race in GWS scheduling

  nouveau:
   - update docs reference
   - fix backlight name buffer size
   - fix UAF in r535 gsp rpc msg
   - fix undefined shift

  mgag200:
   - drop export header

  ast:
   - drop export header

  malidp:
   - drop informational error

  ssd130x:
   - fix clear columns

  etnaviv:
   - scheduler locking fix

  v3d:
   - null pointer crash fix"

* tag 'drm-fixes-2025-06-20' of https://gitlab.freedesktop.org/drm/kernel: (50 commits)
  drm/xe: Fix early wedge on GuC load failure
  drm/xe: Fix memset on iomem
  drm/xe/bmg: Update Wa_16023588340
  drm/amdgpu/sdma5.2: init engine reset mutex
  drm/amdkfd: Fix race in GWS queue scheduling
  drm/amdgpu/sdma5: init engine reset mutex
  drm/amdgpu: switch job hw_fence to amdgpu_fence
  drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
  drm/amdgpu: Release reset locks during failures
  drm/amd/display: Check dce_hwseq before dereferencing it
  drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
  drm/amdgpu: Use logical instance ID for SDMA v4_4_2 queue operations
  drm/amdgpu: Fix SDMA engine reset with logical instance ID
  drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
  drm/amdgpu: Add kicker device detection
  drm/amd/display: Export full brightness range to userspace
  drm/amd/display: Only read ACPI backlight caps once
  drm/amd/display: Fix RMCM programming seq errors
  drm/amd/display: Fix mpv playback corruption on weston
  drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
  ...
2025-06-19 23:18:59 -07:00
Linus Torvalds
0fa5248255 This push fixes a regression in ahash (broken fallback finup)
and reinstates a Kconfig option to control the extra self-tests.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmhSgQIACgkQxycdCkmx
 i6eWig//aNg4YL30eTh41eTWTCiA1PLZpyOE2/Wz7q/Yg4M0Refn85A+tREm18q+
 uwuZKAoFz8VaF0trqSQQ3PFzZaJWWRn0yLqeToxGyd7sY9kBh93FdQLub8wTxO0F
 qDPLnAR+Gt7VAGcYSjhyB/TCsJ5h6oRN87qMIr8g807SiIB6mHiuXxJAAKy1U7OD
 cXafp3HTkzUjgk/wbj7qSK6HJR3Cq3o/3JmsE/D7yvJRH1Bx7mNoiRpEX17CkgQX
 qVZmLj8lE4HzFpTLKBAY8sXlzxscN+rHnS5WUhTqWL1hAI2b52p1moJPzT9QM/Zb
 yI+x1DbO21Pvr4mZJ/hX18Y9VvTbea0hkD/wFD+hKJyQ9j70B8/bBeT/sOxKqDZn
 0G1o9UyVTNdw4m2m/6lYJBgG0yiuD3hZID+Wjgq6lOsfoVBThU3CWq11NW98HQKz
 0VUWztcG7JTqM1wUwwjlMXnm8+WKwiuYqYZCwBl8o0Ii29/Sm0pGMXtiDqmWFWLA
 a4FJNFxiKEfVA95yRuRPfEM7KMwRWdw2C9YGe6hk3kcUbfDYSJykUme/USFzz8X8
 5lmwWESNggggQEw9BxUAILIzRZwsDhCakgRjd11JRbNjrNTwXIbP9+nv+LH91mPK
 zm5DJqyqSUVr2iXeQYYH/etyRsMX+dAuWPrFvvjuDBb8/fgEce4=
 =6/TP
 -----END PGP SIGNATURE-----

Merge tag 'v6.16-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fixes from Herbert Xu:
 "This fixes a regression in ahash (broken fallback finup) and
  reinstates a Kconfig option to control the extra self-tests"

* tag 'v6.16-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: ahash - Fix infinite recursion in ahash_def_finup
  crypto: testmgr - reinstate kconfig control over full self-tests
2025-06-19 23:15:10 -07:00
Linus Torvalds
41687a5c6f spi: Fix for v6.16
One fix here from Thierry, fixing crashes caused by attempting to do
 cache sync operations on uncached memory on Tegra platforms.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhUnnkACgkQJNaLcl1U
 h9BTBQf9HtiCLOjTTVk2PJhdDxqwcgPS0KdXYjr8DHyAYgrOJ8n56+cEDoaRazhJ
 0lf9MUsypZMOnQVH86PRn8cSsRhHPjUpNlPuq/6DK2EM5dda8o9KlHRdlmtb9yqT
 HcgZRKuDFsqnxQLMvZIvAmziWKEINrquCK1ulTfOWC7Q5OGfxdb1NAxuV06tQ8o4
 W0k1j5Og7XQ6E65+nO5EQhDqcvrCIVmFMajHNvuSDkpdyXaUN5UIh2KVtGnXKuxy
 fap5vZRiTnX297urRxnkVuj/A5P03OgwQdmS9IKZS5VygKq92eWuyqqQyhH0gbGm
 BvQlnKPeAXImEaIcu9jBQ24zQqAs4A==
 =1pU9
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fix from Mark Brown:
 "One fix here from Thierry, fixing crashes caused by attempting to do
  cache sync operations on uncached memory on Tegra platforms"

* tag 'spi-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: tegra210-qspi: Remove cache operations
2025-06-19 17:46:08 -07:00
Linus Torvalds
e0990236bb regulator: Fix for v6.16
One patch here from Heiko which fixes stability issues on some Rockchip
 platforms by implementing soft start support and providing startup time
 information for their regulators.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhUnj4ACgkQJNaLcl1U
 h9Cj0wf+OMIwBdsiXOVGTaX7C3WLtllaKOJ004k+TnRTDJvu9LWXXS0uGFgqwCu2
 BPuqERnUxZZfWzAm+3sBRBVAaOkcyWTOOfEP173l8caQxw2dZ98kYc5FnSQom23v
 ckIPFjF65IgDlLYHfXR1e7q3roU4Bdd5uVr6MT/fFqElx7vsYHz2nWeP7fhBTZiT
 G0oORp0ik8EOxgLlWrlSb5FYYJaUXsMpYgIWI/RcMLY1kmgNxf48mMODoyu7sge+
 30lZ4+ZMpKUdljV2Si4vkOI2Xes3KYL+TfCmr9K0ksdsbeOpKAdzwkflv/s9SBSn
 mWH4ihP4I416W9IadF8ooPGdqJ6g3w==
 =G5rO
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "One patch here from Heiko which fixes stability issues on some
  Rockchip platforms by implementing soft start support and providing
  startup time information for their regulators"

* tag 'regulator-fix-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: fan53555: add enable_time support and soft-start times
2025-06-19 17:40:42 -07:00
Dave Airlie
b8de9b21e8 Driver Changes:
- A workaround update (Vinay)
 - Fix memset on iomem (Lucas)
 - Fix early wedge on GuC Load failure (Daniele)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCaFQ0RgAKCRC4FpNVCsYG
 v816AQDrIMgJ53fOLr8nEW6Ns8ZUct2zq+beuCbmi7na8IqBSQD/Rs6TSU5BTatq
 jQ9+J7M9xuVVV7mHmsvUKQNdKMxUYw4=
 =gD/V
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-06-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
- A workaround update (Vinay)
- Fix memset on iomem (Lucas)
- Fix early wedge on GuC Load failure (Daniele)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://lore.kernel.org/r/aFQ03kNzhbiNK7gW@fedora
2025-06-20 09:01:51 +10:00
Dave Airlie
97aadc161d Merge tag 'drm-misc-fixes-2025-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
drm-misc-fixes for v6.16-rc3:
- vivante scheduler fix.
- v3d null pointer crash fix.
- fix backlight, booting GSP-RM, and potential integer shift overflow in nouveau.
- fix compiler warnings about unused linux/export.h
- fix malidp unknown modifier spam.
- fix for ssd130x.

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://lore.kernel.org/r/d44bab7b-01f8-45a8-a7f4-5d3d563d2f9d@linux.intel.com
2025-06-20 08:57:11 +10:00
Linus Torvalds
5c8013ae2e Including fixes from wireless. The ath12k fix to avoid FW crashes
requires adding support for a number of new FW commands so
 it's quite large in terms of LoC. The rest is relatively small.
 
 Current release - fix to a fix:
 
  - ptp: fix breakage after ptp_vclock_in_use() rework
 
 Current release - regressions:
 
  - openvswitch: allocate struct ovs_pcpu_storage dynamically, static
    allocation may exhaust module loader limit on smaller systems
 
 Previous releases - regressions:
 
  - tcp: fix tcp_packet_delayed() for peers with no selective ACK support
 
 Previous releases - always broken:
 
  - wifi: ath12k: don't activate more links than firmware supports
 
  - tcp: make sure sockets open via passive TFO have valid NAPI ID
 
  - eth: bnxt_en: update MRU and RSS table of RSS contexts on queue reset,
    prevent Rx queues from silently hanging after queue reset
 
  - NFC: uart: set tty->disc_data only in success path
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmhUPLgACgkQMUZtbf5S
 IrvrXxAAvREuPy2BhCrQW77TeVW2ikBlGYYp+dCIL4r4kfqquHU3C+R/GZ5yRbcA
 fiRMkRv7J4xhHOT8AnFmFiWGz6QEJfESy3jSQUfcLssHeandEjJbcZ0qVunEpE4e
 rt0leygfY+axEP3ewoGQEP7Ds2Ku+L3BrIetwsUZPFo9pVAtGJ4XOV56SRYPP7vL
 7toaHcxXtx5vL9Wlb9vulom9kfZU4/hfDMS9/FES+aE4QnRDB+sh0v6wL4pocLrj
 7swSqWCY7vjd7vJck4Ta/O9+bL6kz1wG4Qvv5enXGJlksiBgCpShfbzGMZTbegeP
 8gCj4heAATCRmzCmfkRk5sWzPqedtLI5rzb7jUYYF4wiZpJwjwLzrDxopazFogXs
 kKDCD3lxDmUTV4AkT/5hn8Rlf4CApMrhPs+zhzQQ620Sj/G3k2lyepKmKjOUSAZ4
 fEFKmP9Mzt3fKt2sOi5ETlrpuiSv5CCAZfnCg7UoBXrQM1Rxyn+utLMeGM6oHXRa
 iH9GwVN2cycEXl16y8HVCui8lzBYyZKVbyiRBM6k3Pl6ZozDuHvCRmHgs8g9pTja
 3hGe2wjYcsi+HKrF1zDQrTJbhKzsNMpJej0KIZ06xjyXAgr1VV0noEq/iQsPEj4z
 033DotqhyoFXc6ERmOaca8LfE2kHolwT+0leO+i0sbdmVlSFxB8=
 =2mAa
 -----END PGP SIGNATURE-----

Merge tag 'net-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from wireless.

  The ath12k fix to avoid FW crashes requires adding support for a
  number of new FW commands so it's quite large in terms of LoC. The
  rest is relatively small.

  Current release - fix to a fix:

   - ptp: fix breakage after ptp_vclock_in_use() rework

  Current release - regressions:

   - openvswitch: allocate struct ovs_pcpu_storage dynamically, static
     allocation may exhaust module loader limit on smaller systems

  Previous releases - regressions:

   - tcp: fix tcp_packet_delayed() for peers with no selective ACK
     support

  Previous releases - always broken:

   - wifi: ath12k: don't activate more links than firmware supports

   - tcp: make sure sockets open via passive TFO have valid NAPI ID

   - eth: bnxt_en: update MRU and RSS table of RSS contexts on queue
     reset, prevent Rx queues from silently hanging after queue reset

   - NFC: uart: set tty->disc_data only in success path"

* tag 'net-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (59 commits)
  net: airoha: Differentiate hwfd buffer size for QDMA0 and QDMA1
  net: airoha: Compute number of descriptors according to reserved memory size
  tools: ynl: fix mixing ops and notifications on one socket
  net: atm: fix /proc/net/atm/lec handling
  net: atm: add lec_mutex
  mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
  net: airoha: Always check return value from airoha_ppe_foe_get_entry()
  NFC: nci: uart: Set tty->disc_data only in success path
  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  MAINTAINERS: Remove Shannon Nelson from MAINTAINERS file
  net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
  eth: fbnic: avoid double free when failing to DMA-map FW msg
  tcp: fix passive TFO socket having invalid NAPI ID
  selftests: net: add test for passive TFO socket NAPI ID
  selftests: net: add passive TFO test binary
  selftests: netdevsim: improve lib.sh include in peer.sh
  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  Octeontx2-pf: Fix Backpresure configuration
  net: ftgmac100: select FIXED_PHY
  net: ethtool: remove duplicate defines for family info
  ...
2025-06-19 10:21:32 -07:00
Pablo Martin-Gomez
6463cbe08b mtd: spinand: fix memory leak of ECC engine conf
Memory allocated for the ECC engine conf is not released during spinand
cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8):
  comm "swapper/0", pid 1, jiffies 4294937458
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc+0x30/0x40
    __kmalloc_cache_noprof+0x208/0x3c0
    spinand_ondie_ecc_init_ctx+0x114/0x200
    nand_ecc_init_ctx+0x70/0xa8
    nanddev_ecc_engine_init+0xec/0x27c
    spinand_probe+0xa2c/0x1620
    spi_mem_probe+0x130/0x21c
    spi_probe+0xf0/0x170
    really_probe+0x17c/0x6e8
    __driver_probe_device+0x17c/0x21c
    driver_probe_device+0x58/0x180
    __device_attach_driver+0x15c/0x1f8
    bus_for_each_drv+0xec/0x150
    __device_attach+0x188/0x24c
    device_initial_probe+0x10/0x20
    bus_probe_device+0x11c/0x160

Fix the leak by calling nanddev_ecc_engine_cleanup() inside
spinand_cleanup().

Signed-off-by: Pablo Martin-Gomez <pmartin-gomez@freebox.fr>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2025-06-19 19:13:21 +02:00
Linus Torvalds
24770983cc hwmon fixes for v6.16-rc3
- ltc4282: Avoid repeated register write operation
 
 - occ: Fix unaligned accesses, and rework attribute registration to reduce
   stack usage
 
 - ftsteutates: Fix TOCTOU race
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmhUFJUACgkQyx8mb86f
 mYEl1A//VVJVfpR6pbJ6NKbQkyeSx23QRsLk5Lg8/xufvkXPZljdkcsv3n1tzfyH
 syR4SB9n2tYSeiDVnfibVZfAHnHnvfFjR1SvpsnMI+Ome61EGBTD7ltA9bs8JeOf
 kpJKoyj4jBN5gDYqPSRRWIZMXK9uJUuqRMSMfdH2/gHZyldM4cLE8kW/qwBhGnLf
 Q8BlB1ebeImvu1Qjgu4LeCIY0mhC2gTE6GStRTTuDDz0XE/nOHg2rEh8tSff6Kgz
 kx0x0SktN6g+BZJcx3AjI9Y6nZ9KBFS0WxOiWiajjncy1E9NvigfTDCYIb51iweJ
 szldCs8LXzqOkVUHQcWHvzrYWAbcRba0HgCn3IBXV6V5fEQ4OWjNZJSlRccC9I/g
 LGsfH9pmoFu69ff+7kbXNnndid1YHHGK5ipMDkjZhHKpEVEHC2NYHm90i32oM/y1
 FJCXTdr0TILE5K8S90wuQgf0jmOjqbeMzLtEw6FZZ6yFjAhu0+o8WtMlBGtCLem7
 HYigEUDQ6183JDbhrFFNj+9ck6z1X1uTq0Dm6S8/+yVk8AKl0hXRGK0qpcI5uWgc
 zMeGNUln2dXuSODqqdFYsq2DXwTsN5XzWpIYFbJPmv111VuMdkFsTd+jphcNZdt7
 ZH+POxoJeCD9ml0vwldd8XMD0X3D/2Go/gfeXH5OAJJjCPwxkoo=
 =sgVj
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - ltc4282: Avoid repeated register write operation

 - occ: Fix unaligned accesses, and rework attribute registration to
   reduce stack usage

 - ftsteutates: Fix TOCTOU race

* tag 'hwmon-for-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ltc4282) avoid repeated register write
  hwmon: (occ) fix unaligned accesses
  hwmon: (occ) Rework attribute registration for stack usage
  hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
2025-06-19 09:09:40 -07:00
Jakub Kicinski
16ef63acb7 Merge branch 'net-airoha-improve-hwfd-buffer-descriptor-queues-setup'
Lorenzo Bianconi says:

====================
net: airoha: Improve hwfd buffer/descriptor queues setup

Compute the number of hwfd buffers/descriptors according to the reserved
memory size if provided via DTS.

Reduce the required hwfd buffers queue size for QDMA1.

v3: https://lore.kernel.org/20250618-airoha-hw-num-desc-v3-0-18a6487cd75e@kernel.org
v1: https://lore.kernel.org/20250615-airoha-hw-num-desc-v1-0-8f88daa4abd7@kernel.org
====================

Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-0-49600a9b319a@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:42:27 -07:00
Lorenzo Bianconi
7b46bdaec0 net: airoha: Differentiate hwfd buffer size for QDMA0 and QDMA1
EN7581 SoC allows configuring the size and the number of buffers in
hwfd payload queue for both QDMA0 and QDMA1.
In order to reduce the required DRAM used for hwfd buffers queues and
decrease the memory footprint, differentiate hwfd buffer size for QDMA0
and QDMA1 and reduce hwfd buffer size to 1KB for QDMA1 (WAN) while
maintaining 2KB for QDMA0 (LAN).

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-2-49600a9b319a@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:41:59 -07:00
Lorenzo Bianconi
edf8afeecf net: airoha: Compute number of descriptors according to reserved memory size
In order to not exceed the reserved memory size for hwfd buffers,
compute the number of hwfd buffers/descriptors according to the
reserved memory size and the size of each hwfd buffer (2KB).

Fixes: 3a1ce9e3d0 ("net: airoha: Add the capability to allocate hwfd buffers via reserved-memory")
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250619-airoha-hw-num-desc-v4-1-49600a9b319a@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:41:58 -07:00
Jakub Kicinski
dccf87ea49 More fixes:
- ath12k
    - avoid busy-waiting
    - activate correct number of links
  - iwlwifi
    - iwldvm regression (lots of warnings)
    - iwlmld merge damage regression (crash)
    - fix build with some old gcc versions
  - carl9170: don't talk to device w/o FW [syzbot]
  - ath6kl: remove bad FW WARN [syzbot]
  - ieee80211: use variable-length arrays [syzbot]
  - mac80211
    - remove WARN on delayed beacon update [syzbot]
    - drop OCB frames with invalid source [syzbot]
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmhSg10ACgkQ10qiO8sP
 aAD10w//fdel2PXhAT6weaNRXmpUStR/TWCcKeUy6pko1BanxVbJNK9DPsCmg9Ym
 ApDewdsmTF600VAW+/JpoHCckzIGhx8Q/i5DJ0Xi/sbLweFMeDcmAsHkqVu11wTn
 gatTXlwP0/iXCL/EEtuS8fS1vs7HF29Q4QVNHPtOEaoNSm7LpE20Ukve4fBB8eXr
 oG3l7bNxW4STIFJL1+EWIXXv+tuyfORsIoD65N+NephJvTYvdKocWjjjDgnsLrPR
 HOW7Yli9G7xebXvDhdUVzdDjG0KEcarEHbyIosiPCv/xSnFZlrq4pg2zz8psHG4H
 MxeHlDgKR2gSdAeX207vB2yZ884yrRtA2XuQ7t8JrVATvXI6LE9puB+P0ssqLsvz
 jO9LjU9cfg8EoaBnK1w6vjL+OH3z2D1D8CvrkRjAUxZUKcBfk/NIQu4zsei5GuL5
 fGDSowLiMUMMyecvKbLggxMEwp3qTs9zTb4w5Vn+QtbVFjj8+HgEb4AHrQM9tr/y
 GavBZvCnKqEnv/VgkTh2Z9KfVznFfXKi3N0XR6gotVDueMeG6fkXvwFTSg6dW0UX
 c1vHJTZ0H0AHelWoSz8/1FO6NXmqU76hnW7EwcYkwkGJ3/tji1Bzyt6ihknIttKl
 AVYno+nmAC1WJNzKxJDFE+HX/F1RwowKlek/nLUMU1Ti4kzgRWo=
 =Q6JR
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-06-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
More fixes:
 - ath12k
   - avoid busy-waiting
   - activate correct number of links
 - iwlwifi
   - iwldvm regression (lots of warnings)
   - iwlmld merge damage regression (crash)
   - fix build with some old gcc versions
 - carl9170: don't talk to device w/o FW [syzbot]
 - ath6kl: remove bad FW WARN [syzbot]
 - ieee80211: use variable-length arrays [syzbot]
 - mac80211
   - remove WARN on delayed beacon update [syzbot]
   - drop OCB frames with invalid source [syzbot]

* tag 'wireless-2025-06-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: iwlwifi: Fix incorrect logic on cmd_ver range checking
  wifi: iwlwifi: dvm: restore n_no_reclaim_cmds setting
  wifi: iwlwifi: cfg: Limit cb_size to valid range
  wifi: iwlwifi: restore missing initialization of async_handlers_list (again)
  wifi: ath6kl: remove WARN on bad firmware input
  wifi: carl9170: do not ping device which has failed to load firmware
  wifi: ath12k: don't wait when there is no vdev started
  wifi: ath12k: don't use static variables in ath12k_wmi_fw_stats_process()
  wifi: ath12k: avoid burning CPU while waiting for firmware stats
  wifi: ath12k: fix documentation on firmware stats
  wifi: ath12k: don't activate more links than firmware supports
  wifi: ath12k: update link active in case two links fall on the same MAC
  wifi: ath12k: support WMI_MLO_LINK_SET_ACTIVE_CMDID command
  wifi: ath12k: update freq range for each hardware mode
  wifi: ath12k: parse and save sbs_lower_band_end_freq from WMI_SERVICE_READY_EXT2_EVENTID event
  wifi: ath12k: parse and save hardware mode info from WMI_SERVICE_READY_EXT_EVENTID event for later use
  wifi: ath12k: Avoid CPU busy-wait by handling VDEV_STAT and BCN_STAT
  wifi: mac80211: don't WARN for late channel/color switch
  wifi: mac80211: drop invalid source address OCB frames
  wifi: remove zero-length arrays
====================

Link: https://patch.msgid.link/20250618210642.35805-6-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:38:41 -07:00
Jakub Kicinski
9738280aae tools: ynl: fix mixing ops and notifications on one socket
The multi message support loosened the connection between the request
and response handling, as we can now submit multiple requests before
we start processing responses. Passing the attr set to NlMsgs decoding
no longer makes sense (if it ever did), attr set may differ message
by messsage. Isolate the part of decoding responsible for attr-set
specific interpretation and call it once we identified the correct op.

Without this fix performing SET operation on an ethtool socket, while
being subscribed to notifications causes:

 # File "tools/net/ynl/pyynl/lib/ynl.py", line 1096, in _op
 # Exception|     return self._ops(ops)[0]
 # Exception|            ~~~~~~~~~^^^^^
 # File "tools/net/ynl/pyynl/lib/ynl.py", line 1040, in _ops
 # Exception|     nms = NlMsgs(reply, attr_space=op.attr_set)
 # Exception|                                    ^^^^^^^^^^^

The value of op we use on line 1040 is stale, it comes form the previous
loop. If a notification comes before a response we will update op to None
and the next iteration thru the loop will break with the trace above.

Fixes: 6fda63c45f ("tools/net/ynl: fix cli.py --subscribe feature")
Fixes: ba8be00f68 ("tools/net/ynl: Add multi message support to ynl")
Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Link: https://patch.msgid.link/20250618171746.1201403-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:37:39 -07:00
Jakub Kicinski
664f1b854f Merge branch 'with-a-mutex'
Eric Dumazet says:

====================
net: atm: protect dev_lec[] with a mutex

Based on an initial syzbot report.

First patch is adding lec_mutex to address the report.

Second patch protects /proc/net/atm/lec operations.

We probably should delete this driver, it seems quite broken.
====================

Link: https://patch.msgid.link/20250618140844.1686882-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:36:36 -07:00
Eric Dumazet
d03b79f459 net: atm: fix /proc/net/atm/lec handling
/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:36:31 -07:00
Eric Dumazet
d13a3824bf net: atm: add lec_mutex
syzbot found its way in net/atm/lec.c, and found an error path
in lecd_attach() could leave a dangling pointer in dev_lec[].

Add a mutex to protect dev_lecp[] uses from lecd_attach(),
lec_vcc_attach() and lec_mcast_attach().

Following patch will use this mutex for /proc/net/atm/lec.

BUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline]
BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008
Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142

CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:94 [inline]
  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
  print_address_description mm/kasan/report.c:408 [inline]
  print_report+0xcd/0x680 mm/kasan/report.c:521
  kasan_report+0xe0/0x110 mm/kasan/report.c:634
  lecd_attach net/atm/lec.c:751 [inline]
  lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Allocated by task 6132:
  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
  __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
  kasan_kmalloc include/linux/kasan.h:260 [inline]
  __do_kmalloc_node mm/slub.c:4328 [inline]
  __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015
  alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711
  lecd_attach net/atm/lec.c:737 [inline]
  lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6132:
  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
  poison_slab_object mm/kasan/common.c:247 [inline]
  __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
  kasan_slab_free include/linux/kasan.h:233 [inline]
  slab_free_hook mm/slub.c:2381 [inline]
  slab_free mm/slub.c:4643 [inline]
  kfree+0x2b4/0x4d0 mm/slub.c:4842
  free_netdev+0x6c5/0x910 net/core/dev.c:11892
  lecd_attach net/atm/lec.c:744 [inline]
  lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+8b64dec3affaed7b3af5@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6852c6f6.050a0220.216029.0018.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250618140844.1686882-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:36:13 -07:00
David Thompson
e7ea5f5b18 mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
The message "Error getting PHY irq. Use polling instead"
is emitted when the mlxbf_gige driver is loaded by the
kernel before the associated gpio-mlxbf driver, and thus
the call to get the PHY IRQ fails since it is not yet
available. The driver probe() must return -EPROBE_DEFER
if acpi_dev_gpio_irq_get_by() returns the same.

Fixes: 6c2a6ddca7 ("net: mellanox: mlxbf_gige: Replace non-standard interrupt handling")
Signed-off-by: David Thompson <davthompson@nvidia.com>
Reviewed-by: Asmaa Mnebhi <asmaa@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250618135902.346-1-davthompson@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:34:59 -07:00
Lorenzo Bianconi
78bd03ee1f net: airoha: Always check return value from airoha_ppe_foe_get_entry()
airoha_ppe_foe_get_entry routine can return NULL, so check the returned
pointer is not NULL in airoha_ppe_foe_flow_l2_entry_update()

Fixes: b81e0f2b58 ("net: airoha: Add FLOW_CLS_STATS callback support")
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250618-check-ret-from-airoha_ppe_foe_get_entry-v2-1-068dcea3cc66@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:34:13 -07:00
Krzysztof Kozlowski
fc27ab4890 NFC: nci: uart: Set tty->disc_data only in success path
Setting tty->disc_data before opening the NCI device means we need to
clean it up on error paths.  This also opens some short window if device
starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded
(broken hardware?).  Close the window by exposing tty->disc_data only on
the success path, when opening of the NCI device and try_module_get()
succeeds.

The code differs in error path in one aspect: tty->disc_data won't be
ever assigned thus NULL-ified.  This however should not be relevant
difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().

Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Fixes: 9961127d4b ("NFC: nci: add generic uart support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20250618073649.25049-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:33:54 -07:00
Kuniyuki Iwashima
10876da918 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
syzkaller reported a null-ptr-deref in sock_omalloc() while allocating
a CALIPSO option.  [0]

The NULL is of struct sock, which was fetched by sk_to_full_sk() in
calipso_req_setattr().

Since commit a1a5344ddb ("tcp: avoid two atomic ops for syncookies"),
reqsk->rsk_listener could be NULL when SYN Cookie is returned to its
client, as hinted by the leading SYN Cookie log.

Here are 3 options to fix the bug:

  1) Return 0 in calipso_req_setattr()
  2) Return an error in calipso_req_setattr()
  3) Alaways set rsk_listener

1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie
for CALIPSO.  3) is also no go as there have been many efforts to reduce
atomic ops and make TCP robust against DDoS.  See also commit 3b24d854cb
("tcp/dccp: do not touch listener sk_refcnt under synflood").

As of the blamed commit, SYN Cookie already did not need refcounting,
and no one has stumbled on the bug for 9 years, so no CALIPSO user will
care about SYN Cookie.

Let's return an error in calipso_req_setattr() and calipso_req_delattr()
in the SYN Cookie case.

This can be reproduced by [1] on Fedora and now connect() of nc times out.

[0]:
TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline]
RIP: 0010:sock_net include/net/sock.h:655 [inline]
RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806
Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b
RSP: 0018:ffff88811af89038 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400
RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030
RBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e
R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000
R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050
FS:  00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0
PKRU: 80000000
Call Trace:
 <IRQ>
 ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288
 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204
 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597
 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249
 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342
 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551
 security_inet_conn_request+0x50/0xa0 security/security.c:4945
 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825
 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275
 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328
 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781
 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667
 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904
 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436
 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491
 dst_input include/net/dst.h:469 [inline]
 ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
 ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0xf9/0x490 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12e/0x1f0 net/core/dev.c:5896
 __netif_receive_skb+0x1d/0x170 net/core/dev.c:6009
 process_backlog+0x41e/0x13b0 net/core/dev.c:6357
 __napi_poll+0xbd/0x710 net/core/dev.c:7191
 napi_poll net/core/dev.c:7260 [inline]
 net_rx_action+0x9de/0xde0 net/core/dev.c:7382
 handle_softirqs+0x19a/0x770 kernel/softirq.c:561
 do_softirq.part.0+0x36/0x70 kernel/softirq.c:462
 </IRQ>
 <TASK>
 do_softirq arch/x86/include/asm/preempt.h:26 [inline]
 __local_bh_enable_ip+0xf1/0x110 kernel/softirq.c:389
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
 __dev_queue_xmit+0xc2a/0x3c40 net/core/dev.c:4679
 dev_queue_xmit include/linux/netdevice.h:3313 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip6_finish_output2+0xd69/0x1f80 net/ipv6/ip6_output.c:141
 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
 ip6_finish_output+0x5dc/0xd60 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0x24b/0x8d0 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:459 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip6_xmit+0xbbc/0x20d0 net/ipv6/ip6_output.c:366
 inet6_csk_xmit+0x39a/0x720 net/ipv6/inet6_connection_sock.c:135
 __tcp_transmit_skb+0x1a7b/0x3b40 net/ipv4/tcp_output.c:1471
 tcp_transmit_skb net/ipv4/tcp_output.c:1489 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:4059 [inline]
 tcp_connect+0x1c0c/0x4510 net/ipv4/tcp_output.c:4148
 tcp_v6_connect+0x156c/0x2080 net/ipv6/tcp_ipv6.c:333
 __inet_stream_connect+0x3a7/0xed0 net/ipv4/af_inet.c:677
 tcp_sendmsg_fastopen+0x3e2/0x710 net/ipv4/tcp.c:1039
 tcp_sendmsg_locked+0x1e82/0x3570 net/ipv4/tcp.c:1091
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1358
 inet6_sendmsg+0xb9/0x150 net/ipv6/af_inet6.c:659
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0xf4/0x2a0 net/socket.c:733
 __sys_sendto+0x29a/0x390 net/socket.c:2187
 __do_sys_sendto net/socket.c:2194 [inline]
 __se_sys_sendto net/socket.c:2190 [inline]
 __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2190
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f06553c47ed
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0653a06fc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f0655605fa0 RCX: 00007f06553c47ed
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000b
RBP: 00007f065545db38 R08: 0000200000000140 R09: 000000000000001c
R10: f7384d4ea84b01bd R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0655605fac R14: 00007f0655606038 R15: 00007f06539e7000
 </TASK>
Modules linked in:

[1]:
dnf install -y selinux-policy-targeted policycoreutils netlabel_tools procps-ng nmap-ncat
mount -t selinuxfs none /sys/fs/selinux
load_policy
netlabelctl calipso add pass doi:1
netlabelctl map del default
netlabelctl map add default address:::1 protocol:calipso,1
sysctl net.ipv4.tcp_syncookies=2
nc -l ::1 80 &
nc ::1 80

Fixes: e1adea9270 ("calipso: Allow request sockets to be relabelled by the lsm.")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: John Cheung <john.cs.hey@gmail.com>
Closes: https://lore.kernel.org/netdev/CAP=Rh=MvfhrGADy+-WJiftV2_WzMH4VEhEFmeT28qY+4yxNu4w@mail.gmail.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://patch.msgid.link/20250617224125.17299-1-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:33:09 -07:00
Shannon Nelson
a1113cefd7 MAINTAINERS: Remove Shannon Nelson from MAINTAINERS file
Brett Creeley is taking ownership of AMD/Pensando drivers while I wander
off into the sunset with my retirement this month.  I'll still keep an
eye out on a few topics for awhile, and maybe do some free-lance work in
the future.

Meanwhile, thank you all for the fun and support and the many learning
opportunities :-).

Special thanks go to DaveM for merging my first patch long ago, the big
ionic patchset a few years ago, and my last patchset last week.

Redirect things to a non-corporate account.

Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Link: https://patch.msgid.link/20250616224437.56581-1-shannon.nelson@amd.com
[Jakub: squash in the .mailmap update]
Signed-off-by: Shannon Nelson <sln@onemain.com>
Link: https://patch.msgid.link/20250619010603.1173141-1-sln@onemain.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-19 08:29:23 -07:00
Daniele Ceraolo Spurio
a39d082c35 drm/xe: Fix early wedge on GuC load failure
When the GuC fails to load we declare the device wedged. However, the
very first GuC load attempt on GT0 (from xe_gt_init_hwconfig) is done
before the GT1 GuC objects are initialized, so things go bad when the
wedge code attempts to cleanup GT1. To fix this, check the initialization
status in the functions called during wedge.

Fixes: 7dbe8af13c ("drm/xe: Wedge the entire device")
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Jonathan Cavitt <jonathan.cavitt@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Zhanjun Dong <zhanjun.dong@intel.com>
Cc: stable@vger.kernel.org # v6.12+: 1e1981b16bb1: drm/xe: Fix taking invalid lock on wedge
Cc: stable@vger.kernel.org # v6.12+
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/20250611214453.1159846-2-daniele.ceraolospurio@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit 0b93b7dcd9)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-06-19 17:24:30 +02:00
Peter Ujfalusi
16ea4666bb
ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count
It is better to print out the non supported num_dmics than printing that
it is not matching with 2 or 4.

Fixes: 2fbeff3338 ("ASoC: Intel: add sof_sdw_get_tplg_files ops")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Link: https://patch.msgid.link/20250619104705.26057-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-06-19 15:44:42 +01:00
Lucas De Marchi
87a15c89d8 drm/xe: Fix memset on iomem
It should rather use xe_map_memset() as the BO is created with
XE_BO_FLAG_VRAM_IF_DGFX in xe_guc_pc_init().

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://lore.kernel.org/r/20250612-vmap-vaddr-v1-1-26238ed443eb@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit 21cf47d89f)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-06-19 16:14:56 +02:00
Vinay Belgaumkar
16c1241b08 drm/xe/bmg: Update Wa_16023588340
This allows for additional L2 caching modes.

Fixes: 01570b4469 ("drm/xe/bmg: implement Wa_16023588340")
Cc: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-2-94ba5dcc1e30@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit 6ab42fa03d)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-06-19 16:14:47 +02:00
Ronnie Sahlberg
8c84728558 ublk: santizize the arguments from userspace when adding a device
Sanity check the values for queue depth and number of queues
we get from userspace when adding a device.

Signed-off-by: Ronnie Sahlberg <rsahlberg@whamcloud.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Fixes: 71f28f3136 ("ublk_drv: add io_uring based userspace block driver")
Fixes: 62fe99cef9 ("ublk: add read()/write() support for ublk char device")
Link: https://lore.kernel.org/r/20250619021031.181340-1-ronniesahlberg@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-06-19 07:53:24 -06:00
Alexey Kodanev
e353b0854d net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value
is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).
This seems correct and aligns with the PTP interrupt status register
(PTP_INT_STS) specifications.

However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with
only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:

    lan743x_ptp_io_event_clock_get(..., u8 channel,...)
    {
        ...
        /* Update Local timestamp */
        extts = &ptp->extts[channel];
        extts->ts.tv_sec = sec;
        ...
    }

To avoid an out-of-bounds write and utilize all the supported GPIO
inputs, set LAN743X_PTP_N_EXTTS to 8.

Detected using the static analysis tool - Svace.
Fixes: 60942c397a ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Rengarajan S <rengarajan.s@microchip.com>
Link: https://patch.msgid.link/20250616113743.36284-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-19 15:32:14 +02:00
Jakub Kicinski
5bd1bafd44 eth: fbnic: avoid double free when failing to DMA-map FW msg
The semantics are that caller of fbnic_mbx_map_msg() retains
the ownership of the message on error. All existing callers
dutifully free the page.

Fixes: da3cde0820 ("eth: fbnic: Add FW communication mechanism")
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250616195510.225819-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-06-19 12:16:11 +02:00
Dave Airlie
453e6fd262 amd-drm-fixes-6.16-2025-06-18:
amdgpu:
 - DP tunneling fix
 - LTTPR fix
 - DSC fix
 - DML2.x ABGR16161616 fix
 - RMCM fix
 - Backlight fixes
 - GFX11 kicker support
 - SDMA reset fixes
 - VCN 5.0.1 fix
 - Reset fix
 - Misc small fixes
 
 amdkfd:
 - SDMA reset fix
 - Fix race in GWS scheduling
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaFMhQgAKCRC93/aFa7yZ
 2Bx4AQCTVGyAbfrApEaOGsLR/NANvug9v3oR7xMPZA6/H9XHVQEAoXJ+gCqryvak
 7DyDr4vNr3ZlLT4oY9AFeTljeYQs0Qc=
 =lEki
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.16-2025-06-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.16-2025-06-18:

amdgpu:
- DP tunneling fix
- LTTPR fix
- DSC fix
- DML2.x ABGR16161616 fix
- RMCM fix
- Backlight fixes
- GFX11 kicker support
- SDMA reset fixes
- VCN 5.0.1 fix
- Reset fix
- Misc small fixes

amdkfd:
- SDMA reset fix
- Fix race in GWS scheduling

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20250618203115.1533451-1-alexander.deucher@amd.com
2025-06-19 17:29:14 +10:00
Dave Airlie
bec8ff17ff Merge tag 'drm-intel-fixes-2025-06-18' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
- Fix MIPI vtotal programming off by one on Broxton
- Fix PMU code for GCOV and AutoFDO enabled build

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://lore.kernel.org/r/aFJfykDpUwtmpilE@jlahtine-mobl
2025-06-19 14:18:54 +10:00
Jakub Kicinski
9b70c362a9 Merge branch 'net-fix-passive-tfo-socket-having-invalid-napi-id'
David Wei says:

====================
net: fix passive TFO socket having invalid NAPI ID

Found a bug where an accepted passive TFO socket returns an invalid NAPI
ID (i.e. 0) from SO_INCOMING_NAPI_ID. Add a selftest for this using
netdevsim and fix the bug.

Patch 1 is a drive-by fix for the lib.sh include in an existing
drivers/net/netdevsim/peer.sh selftest.

Patch 2 adds a test binary for a simple TFO server/client.

Patch 3 adds a selftest for checking that the NAPI ID of a passive TFO
socket is valid. This will currently fail.

Patch 4 adds a fix for the bug.
====================

Link: https://patch.msgid.link/20250617212102.175711-1-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 18:30:55 -07:00
David Wei
dbe0ca8da1 tcp: fix passive TFO socket having invalid NAPI ID
There is a bug with passive TFO sockets returning an invalid NAPI ID 0
from SO_INCOMING_NAPI_ID. Normally this is not an issue, but zero copy
receive relies on a correct NAPI ID to process sockets on the right
queue.

Fix by adding a sk_mark_napi_id_set().

Fixes: e5907459ce ("tcp: Record Rx hash and NAPI ID in tcp_child_process")
Signed-off-by: David Wei <dw@davidwei.uk>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250617212102.175711-5-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 18:30:51 -07:00
David Wei
137e7b5cce selftests: net: add test for passive TFO socket NAPI ID
Add a test that checks that the NAPI ID of a passive TFO socket is valid
i.e. not zero.

Signed-off-by: David Wei <dw@davidwei.uk>
Link: https://patch.msgid.link/20250617212102.175711-4-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 18:30:51 -07:00
David Wei
c65b5bb232 selftests: net: add passive TFO test binary
Add a simple passive TFO server and client test binary. This will be
used to test the SO_INCOMING_NAPI_ID of passive TFO accepted sockets.

Signed-off-by: David Wei <dw@davidwei.uk>
Link: https://patch.msgid.link/20250617212102.175711-3-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 18:30:51 -07:00
David Wei
3168276591 selftests: netdevsim: improve lib.sh include in peer.sh
Fix the peer.sh test to run from INSTALL_PATH.

Signed-off-by: David Wei <dw@davidwei.uk>
Link: https://patch.msgid.link/20250617212102.175711-2-dw@davidwei.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-06-18 18:30:51 -07:00
Linus Torvalds
fb4d33ab45 three smb3 server fixes, including two important ones also for stable
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmhR3jgACgkQiiy9cAdy
 T1HWigv+JNzSJxgriJZMDHJcY3rJij01eyzewEkwzx04+vjZIRNpmnY//eC7u1MM
 T8qxLpb7nsQO487H0L8Kf1MDWnpOXa0Ilh8eP8dSs3SlxF8DTAmIHWXGhtl01McJ
 j0zJqpr9JPTuKQ6QkgweA7i98hdu27xl7qHLymB8co6BaoVSojBku2EZe/prGxBt
 bCXrfmlB+BOfW90zJpD9wQAHKB/TZx6nL5PNsyvIBJFIe84T1VtGrr/G2h5T70pM
 S7o+buoqXsiXoNbGneeBB3abvYhmEVlh0CKxCma54ZUQnMvnFHdXWQlk9m6pxuFJ
 XD78/xjDIHGYLY+4uoAvJ6dJuleBO5YK70SSrz37E3LKHtezWT3Ibj8l27dzwch4
 bOSb1tTGiQkPApOX0DwZ4IEtNFiNcJOY2q4NaTSN99JO3vryMT2dIEh3XNqCYcmU
 1bCA7e91+nl8lo4W+8RF+NVjLjN83FJzpDR84Qml/3DVPBG6eO4eiheUGbHVXLiy
 U/8czelb
 =igfH
 -----END PGP SIGNATURE-----

Merge tag '6.16-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix alternate data streams bug

 - Important fix for null pointer deref with Kerberos authentication

 - Fix oops in smbdirect (RDMA) in free_transport

* tag '6.16-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: handle set/get info file for streamed file
  ksmbd: fix null pointer dereference in destroy_previous_session
  ksmbd: add free_transport ops in ksmbd connection
2025-06-18 17:47:27 -07:00
Linus Torvalds
229f135e06 Driver core fixes for 6.16-rc3
- Fix a race condition in Devres::drop(). This depends on two other
     patches:
     - (Minimal) Rust abstractions for struct completion.
     - Let Revocable indicate whether its data is already being revoked.
 
   - Fix Devres to avoid exposing the internal Revocable.
 
   - Add .mailmap entry for Danilo Krummrich.
 
   - Add Madhavan Srinivasan to embargoed-hardware-issues.rst.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaFLtYAAKCRBFlHeO1qrK
 LsMRAP0XC/uvG5mvaRR2uE2yosEfbEEj+Qm/QBa7ebwfh0uspgD6A5UXFS7QRs8d
 FEBVpmuCmGtnqVFLmuKp02qj5csqEAc=
 =F5CN
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Fix a race condition in Devres::drop(). This depends on two other
   patches:
     - (Minimal) Rust abstractions for struct completion
     - Let Revocable indicate whether its data is already being revoked

 - Fix Devres to avoid exposing the internal Revocable

 - Add .mailmap entry for Danilo Krummrich

 - Add Madhavan Srinivasan to embargoed-hardware-issues.rst

* tag 'driver-core-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  Documentation: embargoed-hardware-issues.rst: Add myself for Power
  mailmap: add entry for Danilo Krummrich
  rust: devres: do not dereference to the internal Revocable
  rust: devres: fix race in Devres::drop()
  rust: revocable: indicate whether `data` has been revoked already
  rust: completion: implement initial abstraction
2025-06-18 14:31:16 -07:00