In order to let userspace detect such error rather than suffering
silent failure.
Fixes: 4354994f09 ("f2fs: checkpoint disabling")
Cc: stable@kernel.org
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Change the type of the unlock parameter of f2fs_put_page to bool.
All callers should consistently pass true or false. No logical change.
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
F2FS can mount filesystems with corrupted directory depth values that
get runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT
operations are performed on such directories, f2fs_rename performs
directory modifications (updating target entry and deleting source
entry) before attempting to add the whiteout entry via f2fs_add_link.
If f2fs_add_link fails due to the corrupted directory structure, the
function returns an error to VFS, but the partial directory
modifications have already been committed to disk. VFS assumes the
entire rename operation failed and does not update the dentry cache,
leaving stale mappings.
In the error path, VFS does not call d_move() to update the dentry
cache. This results in new_dentry still pointing to the old inode
(new_inode) which has already had its i_nlink decremented to zero.
The stale cache causes subsequent operations to incorrectly reference
the freed inode.
This causes subsequent operations to use cached dentry information that
no longer matches the on-disk state. When a second rename targets the
same entry, VFS attempts to decrement i_nlink on the stale inode, which
may already have i_nlink=0, triggering a WARNING in drop_nlink().
Example sequence:
1. First rename (RENAME_WHITEOUT): file2 → file1
- f2fs updates file1 entry on disk (points to inode 8)
- f2fs deletes file2 entry on disk
- f2fs_add_link(whiteout) fails (corrupted directory)
- Returns error to VFS
- VFS does not call d_move() due to error
- VFS cache still has: file1 → inode 7 (stale!)
- inode 7 has i_nlink=0 (already decremented)
2. Second rename: file3 → file1
- VFS uses stale cache: file1 → inode 7
- Tries to drop_nlink on inode 7 (i_nlink already 0)
- WARNING in drop_nlink()
Fix this by explicitly invalidating old_dentry and new_dentry when
f2fs_add_link fails during whiteout creation. This forces VFS to
refresh from disk on subsequent operations, ensuring cache consistency
even when the rename partially succeeds.
Reproducer:
1. Mount F2FS image with corrupted i_current_depth
2. renameat2(file2, file1, RENAME_WHITEOUT)
3. renameat2(file3, file1, 0)
4. System triggers WARNING in drop_nlink()
Fixes: 7e01e7ad74 ("f2fs: support RENAME_WHITEOUT")
Reported-by: syzbot+632cf32276a9a564188d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=632cf32276a9a564188d
Suggested-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/all/20251022233349.102728-1-kartikey406@gmail.com/ [v1]
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
As Hong Yun reported in mailing list:
loop7: detected capacity change from 0 to 131072
------------[ cut here ]------------
kmem_cache of name 'f2fs_xattr_entry-7:7' already exists
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 kmem_cache_sanity_check mm/slab_common.c:109 [inline]
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 __kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
CPU: 0 UID: 0 PID: 24426 Comm: syz.7.1370 Not tainted 6.17.0-rc4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:109 [inline]
RIP: 0010:__kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
Call Trace:
__kmem_cache_create include/linux/slab.h:353 [inline]
f2fs_kmem_cache_create fs/f2fs/f2fs.h:2943 [inline]
f2fs_init_xattr_caches+0xa5/0xe0 fs/f2fs/xattr.c:843
f2fs_fill_super+0x1645/0x2620 fs/f2fs/super.c:4918
get_tree_bdev_flags+0x1fb/0x260 fs/super.c:1692
vfs_get_tree+0x43/0x140 fs/super.c:1815
do_new_mount+0x201/0x550 fs/namespace.c:3808
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount+0x298/0x2f0 fs/namespace.c:4324
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x8e/0x3a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The bug can be reproduced w/ below scripts:
- mount /dev/vdb /mnt1
- mount /dev/vdc /mnt2
- umount /mnt1
- mounnt /dev/vdb /mnt1
The reason is if we created two slab caches, named f2fs_xattr_entry-7:3
and f2fs_xattr_entry-7:7, and they have the same slab size. Actually,
slab system will only create one slab cache core structure which has
slab name of "f2fs_xattr_entry-7:3", and two slab caches share the same
structure and cache address.
So, if we destroy f2fs_xattr_entry-7:3 cache w/ cache address, it will
decrease reference count of slab cache, rather than release slab cache
entirely, since there is one more user has referenced the cache.
Then, if we try to create slab cache w/ name "f2fs_xattr_entry-7:3" again,
slab system will find that there is existed cache which has the same name
and trigger the warning.
Let's changes to use global inline_xattr_slab instead of per-sb slab cache
for fixing.
Fixes: a999150f4f ("f2fs: use kmem_cache pool during inline xattr lookups")
Cc: stable@kernel.org
Reported-by: Hong Yun <yhong@link.cuhk.edu.hk>
Tested-by: Hong Yun <yhong@link.cuhk.edu.hk>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Use f2fs_filemap_get_folio() instead of __filemap_get_folio() in:
- f2fs_find_data_folio
- f2fs_write_begin
- f2fs_read_merkle_tree_page
So that, we can trigger fault injection in those places.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Let's use f2fs_filemap_get_folio() instead of f2fs_pagecache_get_page() in
ra_data_block() and move_data_block(), then remove f2fs_pagecache_get_page()
since it has no user.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
In add_bio_entry(), adding a page to newly allocated bio should never fail,
let's use bio_add_folio_nofail() instead of bio_add_page() & unnecessary
error handling for cleanup.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
On 32-bit architectures, when GFP_NOFS is used, the file cache for write
operations cannot be allocated from the highmem and CMA.
Since mapping->gfp_mask is set to GFP_HIGHUSER_MOVABLE during inode
allocation, using mapping_gfp_mask(mapping) as the GFP flag of getting file
cache for writing is more efficient for 32-bit architectures.
Additionally, use FGP_NOFS to avoid potential deadlock issues caused by
GFP_FS in GFP_HIGHUSER_MOVABLE
Signed-off-by: Jiucheng Xu <jiucheng.xu@amlogic.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
folio_nr_pages() is a faster helper function to get the number of pages when
NR_PAGES_IN_LARGE_FOLIO is enabled.
Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Zoned storage devices provide marginal over-capacity space, typically
around 10%, for filesystem level storage control.
By utilizing this extra capacity, we can safely reduce the default
'valid_thresh_ratio' to 80. This action helps to significantly prevent
excessive garbage collection (GC) and the resulting power consumption,
as the filesystem becomes less aggressive about cleaning segments
that still hold a high percentage of valid data.
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
The current version missed setting one time GC for normal zoned GC
cycle. So, valid threshold control is not working. Need to fix it to
prevent excessive GC for zoned devices.
Fixes: e791d00bd0 ("f2fs: add valid block ratio not to do excessive GC for one time GC")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmj62psQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpjMiD/0cTxemB2tYk5Nd1QIAda8cwO0fn1jLgamH
tjQfy0uq4kxzSY4QWWx8HkA8sEybAOpAwP2u+F3RN/CsW3//TMA+H8JGW1h0k5OG
dh+0asF0iru9euyAePTLUExOw2V3VgEajjvt/2ezkjussNki6vcXBoIzGfeZKQ5E
MSx6LTbnpzAy+SUydYFpLFtFcokXzUyp/TKZY+QgsIzsqo/ReUm3Caa/KbxQBPQm
7MhpUpnTdI1PjYZZE/Y/p4iWtesCSpiSOayYKhtBQX4FzMo12MZw5nRkJkliLUvm
EtPuSYBSCQEKnYVlfCqLuVd8r7drgMgwZOmNhOsdtUHLigtkPolxQOqQKniX3u70
ycMqn3b1BdEFSqVe/eXhIRZ3YCL3xEAJUYTBRvwbf7XVC804F8VV+CqAey835A4D
IIcIh8vYrkw0HD5HP3aILKlWPHilArDqjcuU260Qd9i79EV7zVRUJrySc0mZ9zK9
XVKX0csETx1SrdH9vRlwBaeJzQyF9J18fuYMD7JV1dK0FhkEX6+pF5dY5rE6S+0r
/tjZgEwSS4siQYhsOM+q3J/ZoLMP2RmW10rYYcKiS9NrqYm1b5VNenBVm7bX6SQO
P29JtDJG374ygPiFn7opMbY79LDJ8JNS5g+vq0en8HtEGwtWuFM3vVCYyerPkiCl
IgVxWd/xYQ==
=Zqjz
-----END PGP SIGNATURE-----
Merge tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Fix dma alignment for PI
- Fix selinux bogosity with nbd, where sendmsg would get rejected
* tag 'block-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
block: require LBA dma_alignment when using PI
nbd: override creds to kernel when calling sock_{send,recv}msg()
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmj62oUQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpnetEADMURwZNV1BxAHXRgEogOpRRYZskwDYKH6h
KvDl9gcaDs+PXc5t1NRyOyjnW1O+tuQoa2LrM1QybF+cVnnaKAzGYm4RF7XbSrO9
lxfBwXDEkVsbDOPzshwGL79hoSOpOTpQUw4BM2admqp3V31DQMp6q+RCLxf+yP2S
jM4RyO9/HuyWDij4IXOfcGuOD/AhXOlOh7hJegOV6t9YulFmK6KGxOWPITDAUGpf
S6zJ88UjyLbjzyKbQK6L7ZxA/IxThb6WeSP+U3w36CYuOxhq07vAJIREi/HkJWFG
9ltrRK6rqlxl6IDUbnN8KYBZcDt4SUzRe7dpj5obnXoInvVGpDXb0M9XnDYZKfQU
wU4YkoZTsWQijS4MBWrNqyvo8xUwgL0QstF7pxlCcRuDNB2v+RzdY0eXU7gF6rDP
Njrwf4gRzpcoOselK2iubP6KEPApM9QKCr919+qcJEFj13IaROJ2O3ah5cgtLTkK
Nz57PPJtuMzUd3BEW3PbKmu9wr7NqmRxJ2Aougo2cMzRDh9Nlffg+UJHYfGV2Y6S
SjlOchxSCcpQhtsjCBLFFFEC9AMqi+/YwIOtiw9DZPxkIkQ2RiXRDqbG9JA9MCEK
MLFfRKXzMmPiuYRlvvp9k0D8bTn6or0NhbSuN/olIcKVORV2yLsf0qnEp8BuxaAA
gBimJG7p5w==
=1UMr
-----END PGP SIGNATURE-----
Merge tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Add MAINTAINERS entry for zcrx, mostly so that netdev gets
automatically CC'ed by default on any changes there too.
- Fix for the SQPOLL busy vs work time accounting.
It was using getrusage(), which was both broken from a thread point
of view (we only care about the SQPOLL thread itself), and vastly
overkill as only the systime was used. On top of that, also be a bit
smarter in when it's queried. It used excessive CPU before this
change. Marked for stable as well.
- Fix provided ring buffer auto commit for uring_cmd.
- Fix a few style issues and sparse annotation for a lock.
* tag 'io_uring-6.18-20251023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix buffer auto-commit for multishot uring_cmd
io_uring: correct __must_hold annotation in io_install_fixed_file
io_uring zcrx: add MAINTAINERS entry
io_uring: Fix code indentation error
io_uring/sqpoll: be smarter on when to update the stime usage
io_uring/sqpoll: switch away from getrusage() for CPU accounting
io_uring: fix incorrect unlikely() usage in io_waitid_prep()
-----BEGIN PGP SIGNATURE-----
iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmj7Wb0bFIAAAAAABAAO
bWFudTIsMi41KzEuMTEsMiwyAAoJELvgsHXSRYiaXgoH/RvZHUHzvACGosCOb2uc
YVKIkxmPd3Feww+0oyQox+/BrBdri1eZ93Vfsl/udX7ZT5NBwC/pWT40SJUvyO+M
fICYdoM/f+Qkknja7FSVuQXho252JPZYZ37erFeB3J+lardHyPOMMjWX2YnRQZvW
EUwyKUH31DJnVa2IN9R1tT64ulY79KGmeMiSdQxaQc8SSM5idZ7/sQHjz4UcbOh1
kLsh3EQOgvVegzefLiTgKkcwT8Lry92X3bjeOrdvTqInDZj1aZWMDlQSFb31+XbS
1aeCrl3PpnD8EeEo7MIVmDzEAM4c2z4tYzpOVDa8rglkL7IRLwpK7t4DzK+zZhqq
e0Q=
=Y2Sq
-----END PGP SIGNATURE-----
Merge tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab fixes from Vlastimil Babka:
- Two fixes for race conditions in obj_exts allocation (Hao Ge)
- Fix for slab accounting imbalance due to deferred slab decativation
(Vlastimil Babka)
* tag 'slab-for-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
slab: Fix obj_ext mistakenly considered NULL due to race condition
slab: fix slab accounting imbalance due to defer_deactivate_slab()
slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
- Fix handling of GICv5 ITS MSI properties on platforms with
'msi-parent' as well as a of_node refcounting fix. This is also
preparation for further refactoring in 6.19 to use common DT parsing
of MSI properties.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmj7sTQACgkQ+vtdtY28
YcMaZBAApdmGtPtHFZEQi2elL346LAvcTZTisNgc9b4zKkqvvM/T9inTzepcSj5F
v7oL3cZMBUyVh/ZS4RcX2rZfUrJuYdOdCGqHqi01S9pbXToT8XQL1fgOxVex6xPX
NnfADw/HNL/T2PAkRXd/XKwBGv5hwUyKlj4ftj67S4xhNaScJy0M7TBGlaH1Jlu/
87W5vXgyljZm5k0ugwg6vw63NemF06arvrgBGB3kuDGcSAS5/USF2kegbDAOufFy
W07V2D1BLRedf6oWBolce3R6rSdLLpHrtyFMbOr5qfcxEwEHP3jzzhfvixeUjOtz
NE3wu+LIyRfjCqbJTXFIth8Cve1lkS6XXpHjiJ2MdnoUN/ZSLfXWnXXU/L08gG2i
iAssDqYwavDe6CLWl3uQ04ie9ZzMUueGNim95tNaSOYDUFLvfDRNWAyCS/XUmHK8
1/fz4bhd9YTrn6algxl+phthNbL3DmKm2ed/7viTBaSyWn7UScl+F2JqMrR5ayRN
Ds5T8LhlLumKwc3GQfnRcXOWmwfnbtG2nr0rmYp/Lo4pECJQhd7Hg3tN92neYrKk
oYEAxvdBPhrSlojnPpS0Wy0nKgv1ZhMM1+YceDS3MF4mqANupvraMOMZM4DD7agB
xTAFkbvuEI5r8glf7MC9/93QYBQzYSYDy5RbUyiJHQvMdkTSzXE=
=u/tb
-----END PGP SIGNATURE-----
Merge tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree fixes from Rob Herring:
- Fix handling of GICv5 ITS MSI properties on platforms with
'msi-parent' as well as a of_node refcounting fix.
This is also preparation for further refactoring in 6.19 to use
common DT parsing of MSI properties.
* tag 'devicetree-fixes-for-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
of/irq: Export of_msi_xlate() for module usage
of/irq: Fix OF node refcount in of_msi_get_domain()
of/irq: Add msi-parent check to of_msi_xlate()
The main change this time is an update to the MAINTAINERS file,
listing Krzysztof Kozlowski, Alexandre Belloni, and Linus Walleij as
additional maintainers for the SoC tree, in order to go back to a group
maintainership. Drew Fustini joins as an additional reviewer for the
SoC tree.
Thanks to all of you for volunteering to help out.
On the actual bugfixes, we have a few correctness changes for firmware
drivers (qtee, arm-ffa, scmi) and two devicetree fixes for Raspberry Pi.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj7sFUACgkQmmx57+YA
GNnMZBAAls4wXi3LTno6sJrHCSA697dNnTEAyUpZqTca5PNLw9Rz+ZvAZQ8+c1MW
wDRlfjJ+x2wBfsib9M4+XxziaPWBe+x2Qgizk7VTfszhVtq66slckpLNBJUBvaQx
+6WDVVJDHHq455e2sJy8a8brIdyMeojRfwEVLzBGgJnYB55QzwTCTPhJ3XPpMyA5
gDeed7ZTf35D6aDwmWMVzwMJDePt7SnMbh9ylsRCtxRE8cwz1duBftKtaD/gf3Pp
N78F8H+TS9EK1BfCbAZpMVr5WzUS+Orhcp0OgBHUWldHllAuTWuXif45HQnpTqTz
vQRxgXoQxLGY7mYSXacENKcNG4o0iDXRppRceUpO1hiX+Vl6a0s07ylb6GCRoL7x
n8Zy/sGUwYRTaphcP2OWT6Mg4Wy8Y1VdldLhZ/yFFWh425SCCtMxzOOzWW8Mpoop
4Hm4igXc9UE9raiJmgpbOvV0fN1OW5/A0hzYrV4cxjL3OgZuoxR+TAoe7RKANN03
IJbg5mjqZanHG2oIIBAbfTQKRPUnZFnuUCfy95C2RbHe0rHIM5ExC4/GDcD5pyuH
hvD2K9y/kpHhMD40gW0Cfzu5v9JlUGSDrlmQwQ3f/pA3KrJA5eJ8y3XS/31iDRwY
ll7Kehhg82O0SN082iQ5Xb2zEy95tr/L8v5jaWxbvZDMG0JDwBo=
=pc4V
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"The main change this time is an update to the MAINTAINERS file,
listing Krzysztof Kozlowski, Alexandre Belloni, and Linus Walleij as
additional maintainers for the SoC tree, in order to go back to a
group maintainership. Drew Fustini joins as an additional reviewer for
the SoC tree.
Thanks to all of you for volunteering to help out.
On the actual bugfixes, we have a few correctness changes for firmware
drivers (qtee, arm-ffa, scmi) and two devicetree fixes for Raspberry
Pi"
* tag 'soc-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
soc: officially expand maintainership team
firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
firmware: arm_scmi: Skip RAW initialization on failure
include: trace: Fix inflight count helper on failed initialization
firmware: arm_scmi: Account for failed debug initialization
ARM: dts: broadcom: rpi: Switch to V3D firmware clock
arm64: dts: broadcom: bcm2712: Define VGIC interrupt
firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
tee: QCOMTEE should depend on ARCH_QCOM
tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails
tee: qcom: prevent potential off by one read
A moderately large collection of device specific changes here, mostly
fixes but also including a few new quirks and device IDs. This is all
fairly routine even for the affected devices.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmj7d0kACgkQJNaLcl1U
h9DNGgf+KWDwiPttn2gYGm4h5uEDix23aO7FOaRTAoFihWDaqvCz4V+wukRqdRE2
eyxfwQmupdQV+X+/a+ufBnQfHerHUjt2MUxZgBQTMgZ+JwFYVAtiyJszuCPw7LJH
h88UUIhQhkbtshDScNIzwTaEZ7ZMubULKIayxuweHIV0tToTrDpra5WQbMzApcyb
chvfY15sVncZizGxxgfdkFgK4MjKWzDzQNws4ik4XBq+aIX/AxgndoV8wgQW7pyq
CXNsYWE70J9n+pSqBFpSSlEYvOlx/Tca4s342rRZyY7lKZHwq3PkhhGqp4BsQcMj
t6+mpgdgmhQpT6fu42RxHM40y/XfWA==
=3b9V
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A moderately large collection of device specific changes here, mostly
fixes but also including a few new quirks and device IDs. This is all
fairly routine even for the affected devices"
* tag 'spi-fix-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: dt-bindings: spi-rockchip: Add RK3506 compatible
spi: intel-pci: Add support for Intel Wildcat Lake SPI serial flash
spi: intel-pci: Add support for Arrow Lake-H SPI serial flash
spi: intel: Add support for 128M component density
spi: airoha: fix reading/writing of flashes with more than one plane per lun
spi: airoha: switch back to non-dma mode in the case of error
spi: airoha: add support of dual/quad wires spi modes to exec_op() handler
spi: airoha: return an error for continuous mode dirmap creation cases
spi: amlogic: fix spifc build error
spi: cadence-quadspi: Fix pm_runtime unbalance on dma EPROBE_DEFER
spi: spi-nxp-fspi: limit the clock rate for different sample clock source selection
spi: spi-nxp-fspi: add extra delay after dll locked
spi: spi-nxp-fspi: re-config the clock rate when operation require new clock rate
spi: dw-mmio: add error handling for reset_control_deassert()
spi: rockchip-sfc: Fix DMA-API usage
spi: dt-bindings: cadence: add soc-specific compatible strings for zynqmp and versal-net
- fix regressions in regmap cache initialization in gpio-104-idio-16 and
gpio-pci-idio-16
- configure first 16 GPIO lines of the IDIO-16 as fixed outputs
- fix duplicated IRQ mapping that can lead to an RCU stall in gpio-ljca
- fix printf formatters passed to dev_err() and make failure to set
debounce period non fatal
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmj7Zk4ACgkQEacuoBRx
13IEFw/+LOZL8/ECWZljbgwHWt0ou8zfNeo9pFg5dXaBDEvsf9pn+S9i+7dYAJxA
7N8WdYFjfEXeeqeJv8DTnHP3yUKJGsmdasBZGo0+w25Om7IhCvhuAvzMKQAxtTV3
52uvMjidbp9xNNsF/ioHdDSKMG6fDAJmIHqAT02x4AugqpEM8IuzxNEnUn2XliSM
ESgRs7Wh8MTQEcEELB6l/tsgIy8u3XEDU6wcK7lkewFNaLaWdahe1lSisMbujutm
0WOkf+BxahxqIAuhjqOebOhjZcOHdWq7GbWnlsKB9I52eVqztWxOVA6Wi3vQX/UZ
I649IKjgUdHvfQwH/J12c+r/qUalqGBkbm9DxNk0aADt63TBdLt77QRbkozaRrcZ
qEjHj7FOlKf3KuSkKsYXOx+f3OKY0AjPpu7QTOtoaxkEZ3TPAAIs1+/J4hT2AP8w
0tIim+wJd8f1Jp9gTI01z3tt2uyVx5rwo0U5+zNmmZawPtrIAHPBK04OdOxpr+Xt
HdGQk14OHXUwn00ia7Vyvj7aCW7InTPHDIigwGJgOjc8Le5aUvSNpqgf9ehP9pjU
1qWOCnr5+MmirsvdYA/tc0IpvPbfQ6bCIXbp9obYAHaUEt/AS1/4hwO5n6ZJTynZ
mXlrGV7dol8m/bXIqWbAdQ+DcDRbhKSaAmHfuAscAUDVrJsZDsY=
=QIqB
-----END PGP SIGNATURE-----
Merge tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- fix regressions in regmap cache initialization in gpio-104-idio-16
and gpio-pci-idio-16
- configure first 16 GPIO lines of the IDIO-16 as fixed outputs
- fix duplicated IRQ mapping that can lead to an RCU stall in gpio-ljca
- fix printf formatters passed to dev_err() and make failure to set
debounce period non fatal
* tag 'gpio-fixes-for-v6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
gpio: ljca: Fix duplicated IRQ mapping
gpiolib: acpi: Use %pe when passing an error pointer to dev_err()
gpiolib: acpi: Make set debounce errors non fatal
gpio: idio-16: Define fixed direction of the GPIO lines
gpio: regmap: add the .fixed_direction_output configuration parameter
gpio: pci-idio-16: Define maximum valid register address offset
gpio: 104-idio-16: Define maximum valid register address offset
Since Olof moved on from the soc tree maintenance, Arnd has mainly taken
care of the day-to-day activities around the SoC tree by himself, which
is generally not a good setup.
Krzysztof, Linus and Alexandre have volunteered to become co-maintainers
of the SoC tree, with the plan of taking turns to do merges and reviews
to spread the workload. In addition, Drew joins as another reviewer.
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Drew Fustini <fustini@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
of_msi_xlate() is required by drivers that can be configured
as modular, export the symbol.
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: Rob Herring <robh@kernel.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20251021124103.198419-4-lpieralisi@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
If two competing threads enter alloc_slab_obj_exts(), and the one that
allocates the vector wins the cmpxchg(), the other thread that failed
allocation mistakenly assumes that slab->obj_exts is still empty due to
its own allocation failure. This will then trigger warnings with
CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path.
Therefore, let's check the result of cmpxchg() to see if marking the
allocation as failed was successful. If it wasn't, check whether the
winning side has succeeded its allocation (it might have been also
marking it as failed) and if yes, return success.
Suggested-by: Harry Yoo <harry.yoo@oracle.com>
Fixes: f7381b9116 ("slab: mark slab->obj_exts allocation failures unconditionally")
Cc: <stable@vger.kernel.org>
Signed-off-by: Hao Ge <gehao@kylinos.cn>
Link: https://patch.msgid.link/20251023143313.1327968-1-hao.ge@linux.dev
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Commit 620a50c927 ("io_uring: uring_cmd: add multishot support") added
multishot uring_cmd support with explicit buffer upfront commit via
io_uring_mshot_cmd_post_cqe(). However, the buffer selection path in
io_ring_buffer_select() was auto-committing buffers for non-pollable files,
which conflicts with uring_cmd's explicit upfront commit model.
This way consumes the whole selected buffer immediately, and causes
failure on the following buffer selection.
Fix this by checking uring_cmd to identify operations that handle buffer
commit explicitly, and skip auto-commit for these operations.
Cc: Caleb Sander Mateos <csander@purestorage.com>
Fixes: 620a50c927 ("io_uring: uring_cmd: add multishot support")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Mark has been kindly helping fill in when I have been unavailable over
the past several years. He has also put his hand up to take over
linux-next maintenance when I finally decide to stop (which may be some
time yet ;-) ).
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
- A bug caused a kernel panic when reading enabled_monitors was reported.
Change callbacks functions to always use list_head iterators and by
doing so, fix the wrong pointer that was leading to the panic.
- The rtapp/pagefault monitor relies on the MMU to be present
(pagefaults exist) but that was not enforced via kconfig, leading to
potential build errors on systems without an MMU. Add that kconfig
dependency.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaPqYBRQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qrZjAQC02FScGQM+TTQ2kvIFAscKEfZddks9
iiodkKWxMTZoxwD/VxXKQUD8CP2HW9uSpJw/O3Zv+NAU80Eq8V2f7/0d9gw=
=AnZN
-----END PGP SIGNATURE-----
Merge tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
"A couple of fixes for Runtime Verification:
- A bug caused a kernel panic when reading enabled_monitors was
reported.
Change callback functions to always use list_head iterators and by
doing so, fix the wrong pointer that was leading to the panic.
- The rtapp/pagefault monitor relies on the MMU to be present
(pagefaults exist) but that was not enforced via kconfig, leading
to potential build errors on systems without an MMU.
Add that kconfig dependency"
* tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
rv: Make rtapp/pagefault monitor depends on CONFIG_MMU
rv: Fully convert enabled_monitors to use list_head as iterator
for 6.18, please pull the following:
- Peter describes the VGIC interrupt line such that KVM can be used on
Raspberry Pi 5 systems.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmjtOFUACgkQh9CWnEQH
BwQBPA//Vprvr5vayscbrpCdKkzpvSIR1S5TRn8DUfVsW6qjniPsjSLn16NN/uDp
6KuC7DQYg5w0QIbEwsGFr6m8byTRgckDcYTHmE95FRTcVfvnZAozbI27WZDjj3z6
4uSRxgDhST9QK2XFD5N9+uTqXG09UrH/Re3UBVUgrJwUto2LHaH58SS5njrNunmW
TtNPYDvhYWASlT6kHAG0Y2LaqRaBnykAbE3scr1Bds3EzNds9BdOh4JmaN55lqci
fp4cOiIc0Zj8IAg+QZH4bWI0ap9YnDIQJrPfx/atgfLpMqKAAKOWo/XZ+Q8B/iUd
bfqggHTHNszVJIl8vMHccfAG3gsYPRxtzK3NmP9T375xJnLH+7ke5oEmfMh6Gwzd
WpuFQf7INpKYP/558HNyLW5oCB8EvgG49PyWsamSlX7BVOEvUFiAbEPGVFaf8IV4
EDDSlyg+E3XiTF9O87QxeFnAmHwPDT6cB7ru+xbPai9kdWegx35RNPFxGfHWnKaO
mp2K+lHwkUZfcyllU4JecGvFGFr+MY5WTZCO6qpdNmvO8Jw7ST9lYQhfb1Kw3BWO
MoV23+uPMd5IbciI4jKM0OmskkZT0cHfrsqtF7qkEWDoZJLUfFpBQnUETVEs0pHX
JE7dg82ZOjUAfQw2y9Ie9gVz2F3cTXNZ5jvdximhhqp4kpkHoEE=
=4aSE
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kHMACgkQmmx57+YA
GNn2tg//cdqODIOrDtkRVkNDRpdoCnVtoMI+gE/S4hujOd1zd9CvNGryHoabJjnV
WVZ+CR0nU893hKrJ3j0sYMbeTjrSA5ZkmF5CsRyBKpy2l2REH/32JhjwVYryIgHL
s8kXHDaNyRl1YXEeXc0S4G8larU8gJjceiuAiB7ECJ/AdPV3VcD5mkq6OcXPB/Zz
KtwkIcoFsjL96QNNlXvk6n0MSuH04oHA4H1zxuCU7nJiEM5RJvH6mMUcya+Ot16e
LJlLEiG5sdCMzIp4rDabEoV6CBptLHnk1zdhByZS5Wetuf0oyW7TzFO1znm/ZwPR
AYp/K1rzIrcvtiufM/wJZ2id07szUx/EGisFRmRPWFhZlkjwbUg7YtflxmdphqMJ
UQF5WEprJalZPLCSg8Tcorgg4vKIqKe7RDeLIvv2oqWXCPGgScBPpyVuYuZANU0X
l1yuGBG0sqlF1b+fgKXtIu++SuRuHSqWPSiNiuj/4CM5omZlsVjrvPc8YKVDWKXQ
f9xTs+YsbY7+PtdU3LpeAEOXLDgiL7Ch5G8k6nnY/O2k+NEg66axBaQ2lv7cFf66
1b80cftYTv5Po/dovI1vTIC9ycut+xu8n5motFXH2Zwk0xsck2BAWqBy9n+QJXCo
hVzbRNezwWsw51FuMvk32VmOTKb5sBmtTQAKmq+o/FFlc/9MQIs=
=5veY
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 6.18, please pull the following:
- Peter describes the VGIC interrupt line such that KVM can be used on
Raspberry Pi 5 systems.
* tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux:
arm64: dts: broadcom: bcm2712: Define VGIC interrupt
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
6.18, please pull the following:
- Stefan switches the V3D block to use the firmware clock, rather than
the bare metal clock. This fixes hangs on boot after recent changes to
the V3D driver clocking went in.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmjtOAIACgkQh9CWnEQH
BwQSaQ/+I3bSYTyUX0VufFlcGZkS1klGNjLppijn8Vm/4i1rWYOFnkRHjOaXS0Zy
gBgyke7FaqGGFf40pgucVYsC8LmcOu2mQ72NjNcbSNpwbCn9/1vG+FMeVjne+zij
r7ICmKYwLf8vHbMwI+ggkd50muW1xhjPe7CPZn2Qj6FApAzvUW4s8W9TKj1DqzsS
tIEuQbYup96VoFLS8sL5BcNbkVkvkriQ9Zk/p8DzgdVh72F0i7u2d01/Lj9Mktlr
nfFBE9EWRrudkEi6HdVxyHORfF69Zt+/3zE8Q7b+3u/PpQWE7f+bQWMK8hT+ukvu
b5br9K35w4oC5Zsy+9CIsnkagYvgw3VrPBybguqmQZ0rjuEuJK4VX7vRkywpZ3Al
GFC+dCtljeK3kD1cXREhwxfBqLGlnUeU6Wauii6A82HRSfSKpFg9n7yFsoqiKUyL
YgEm9eg0fihlJ0DL/C96K75Qez+x9aaD+P4cXZED3M4P+ovme2vV7viIPUKFvpzI
5sCl9jW7kvEJoN7t0Y9cDzYQwFTbvc1l/g+zF4qAV9H5tgUBNoi5ha02VbAduk9C
M+JfMYYUM875wH1WTcm51iUGN6xsKIGbHxXzOEztipePwatst5/ancRAoGNq2Zjs
m7rdmHhUoCCSxxo1jsN1O+tuZWjIvfwjAR7d2i3ToZiJbhfz4Us=
=3g/p
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kGcACgkQmmx57+YA
GNnryxAAjU4l7AgkepcXlOdya4LpQZXmKQICOSo78QSbnFdqW7Y7DHGU/uUVI1JH
C7A+keTUCiVSvyfUKkRY/bDn57MPoK7HJwquGqPdqD9F8BJJBciVmiaUlXiF+K5u
Z17dY5n9TjAu6HeH/2e+wuoK9qWHe3SSTaopC667so1gw/c0ZnKEVeAruDCu3230
+ZJ08VUDQta8Ti9bojee2G67aS/kNdSCQCWKaDErp233bJcq89VTsbQ6/1HGdWA+
Xwh12zZCTB7mcOZmxA0WzEOxR30LkrKnwZlxW52X0O1aNzZt5qQeagSfdtcSR7hS
gkvql/Dolw3qPbBsSfT/DVUxSqPvSxevY6k4Q5Wsh/gjzEf1NZxQd58/8LaZq+dS
TWYpoOlOEoNWAH7P+vBWX6lKkM/XJhn/PugBk6/+QnRdhcAZL7tWUN0vNFQ5Is9K
FBh6RMKBmy7jpEtY5/1YdCDjBdmd5FsoFbM7i7sQTTtY4PsLYAzWVXRB2021dxZ7
S6OqEZxHsMQLmb3/V+3GQiqYkOrtwjzFWo5ELo+yks58lxYHf+Y2DLfNGMJr+Cry
hLU7adMDxDxKWeC1J/RumdgFp6crsDkFMbGui/vUmoNXdVtT0akjfUQteB2CdzRG
iPsEARJiqNZ6dnVhdIRs9GKFMLMb0r1A+20Oi0cEWmwlbO0y+nc=
=O7I1
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
6.18, please pull the following:
- Stefan switches the V3D block to use the firmware clock, rather than
the bare metal clock. This fixes hangs on boot after recent changes to
the V3D driver clocking went in.
* tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux:
ARM: dts: broadcom: rpi: Switch to V3D firmware clock
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This series contains a set of small, focused fixes that address
robustness and lifecycle issues in the Arm SCMI core and debug support,
ensuring safer handling of debug initialization failures, correct flag
management in raw mode, and consistent inflight counter tracking.
Brief summary:
- Fix raw xfer flag clearing
- Skip RAW debug initialization on failure
- Make inflight counter helpers null-safe, preventing crashes if debug
initialization fails
- Account for failed debug initialization globally
There is no functional change for standard SCMI operation, but these
fixes improve stability in debug and raw modes, particularly in error
paths.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmjvtCIACgkQAEG6vDF+
4phtFw//em6TYEkBTgJVq94ULfLcuzOVRwH+WmhK1VaXKz0jLlzrN6sVEiJnwQA3
p9gDIJ+TjXozgVZzBa5eZIfeP/BmbPSPtsSGDlvhQl5smT4r/CG7fS17VhFNGx/o
6DYP8X44Fx3qGuDe3tJiuw9F7IaXmDE03uslD7a9MdtPR2K1KwfD/Y6fXmZbx36B
M67E48dyWQymE0gDnYupQtUe7+JENDHYXuLySMfAEjk7+Fjis/u5aFXH2aCWAM5P
PV1VVAq4f8QEs2sI3Lwd45cJsYBu4dEpKTTWEpBc1vASkdFhUIXJ9FUKVvNunwi1
yW038FsyRsmnc+4Aq7Aj0hAJsyaFEogHMS6zqoTX/0QGjKPdrHgS+CkBNk7OTDyo
WlBAi4HbInIzYDC8tbo1hiXBvcZzZnPvbFCEpi521W1bJN79hhflC09mNg5uRI+T
obkmVMjlYq4vH+kY56cfVTVoejG38T3S5UYp97NmmP4/ilxpJ7oeoSLO3vC2IE7F
GN9mOqHpbwdpN4zN259bepBkrRbySUlPi9MB+HvdBJZqxEbedkuOPtBQUiYA2Opf
Xcg1WcHEdImrMyjJkYPk92MtWaHpTDZ6WlKe00oK7YJS+qpNaO5uOTvtbtOZsMwW
MBvrdxBBcmZpZiosjMQPNXHMi/P8UeswLBrjqjzznUnwteOLyUE=
=2mq1
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kE0ACgkQmmx57+YA
GNlItw/+KprSMkb+gVY8DgCgMXpku4ObDwryI16UbBxjIVlLlhE0mc58vooY43nz
NQLZ9GU7rQygVr8mEK0LxWMt7Fm0x8w/omvwgsKuPVifNCGWEvOlEXqJGGLoThGB
msU3CJDPDo0C3bgXDu9sbQZOxEYMnIwqnBzUuuzHxiftGP14XevSjy/dlCjSRy0K
DlfIxZaQY0Rwhe5XoH6TLC99QHNRvvP1MmoMyerzTi91Lwvcx98URgZta7N230Me
R9uQLStxKyBRDIW+Z0uDnCDAltQvy3UHtGd240GS9aK1Cs2tbBQ9G79hHEMfj/us
N7cgDFZHEHuTk8d71bMSiwmoQLFsmjbAAS6pBUbE3K3WP76w37N7/cIA78WVvG1O
FcIDM0cTePHimlI9bDF12GJ1tT6punh6NtjBJVGx1NIjo9LFJaTx1rBC/BgQzIY7
Um1eF76/ciZK3gOnlPRrYSuAEIhoPSxRIgOBlWLCuAZmjW5v/F3SdqNPkZ8i5Oo/
PkJEIPIT2nFEtvGg34RcRsh/9OtGQi03HM7/iFuc8dCUuJDwj/h7luN5FOCwcQqE
Cu1eEqWIWiE0rdI4pjmzTXRHqH8LrWk7oTakrvL9WWGdjF72Ceay3Z0disFDPN1c
85N5mXohiznQsdv+p62DnyW4ZoRn6uOy9YpJjRAN+5PezV5nXDc=
=12z8
-----END PGP SIGNATURE-----
Merge tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes
Arm SCMI fixes for v6.18
This series contains a set of small, focused fixes that address
robustness and lifecycle issues in the Arm SCMI core and debug support,
ensuring safer handling of debug initialization failures, correct flag
management in raw mode, and consistent inflight counter tracking.
Brief summary:
- Fix raw xfer flag clearing
- Skip RAW debug initialization on failure
- Make inflight counter helpers null-safe, preventing crashes if debug
initialization fails
- Account for failed debug initialization globally
There is no functional change for standard SCMI operation, but these
fixes improve stability in debug and raw modes, particularly in error
paths.
* tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
firmware: arm_scmi: Skip RAW initialization on failure
include: trace: Fix inflight count helper on failed initialization
firmware: arm_scmi: Account for failed debug initialization
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The FF-A driver was updated to support specification version 1.2 but omitted
support for the 16-byte implementation-defined (IMPDEF) field introduced in
FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission
breaks all memory interfaces.
This change updates the EMAD sizing and offset logic to correctly handle the
FF-A v1.2 layout while preserving backward compatibility with older versions.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmjvqvQACgkQAEG6vDF+
4pjTlBAAqdtLdU5yPTZF5twgMD0FFIZYXKAFrp6u9DuSAnI8bJkMuLdl67SFarSP
csOOLg8OmHCmRIQ0I45UGUbz+IfgxzBIPi/A9zxxAVuOzMgWH5aE6zewlH01bz+X
sfxsN/zluj2jF/WgDDH0vMsUwYDancfJBvm9Smf7mLuaHEo5KQJiqWPnMIgApyZL
dx0Lh54cB3DYUHxZi7yE8ZOrzqKIwnGrzL020npcHLUCCZFdPi2kDMYhFVDqH32r
X0PoYKHuclG3PnWZOLRzYr0n+FnsNMip1Cx52dPkzeOiNdB+rH39e3/Mba0FQ4yt
2cTHV6kjXvACCbYKVoZHATeBXrX8HBYnn12x90OUYDxGlbMnrQpDBvVSRdUnZ74g
CQ3k2E8dH8IvSY+z4Yixh1BYmF0n1kkcJTjJ92DfF1GsN5QNO0wv7S24p4mdweu6
YOhI7WcvRrFMudrsgds9i0BtJpHgKv7sWcdJRD8h0riTiF2vsjWwTPBEWgf7j2+T
1/IWWvjgDr1CrBib2+3eHRlMdmUqOqxStFmFz8GrnTvHoZr2LVTEhr4hJ/vopuB2
N/4mf5naoDepnmDd+CtAdjnYFGbiwlOc/o4jDk2vPhcBcryvPMXfeYKrNye6lHCH
4l8S8KcMwUf+Hvn4seEFoqt8XP3HHC9Ru2mZRXCZA5C1z2VbqoQ=
=RowC
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kD8ACgkQmmx57+YA
GNl6Rw/+Ipy2jWp+QD5uWb7isFoiUYicxYlIfqxRO9RvNLTflDJ5vt4V2O5uwxmH
hSg3NCUYr103kQey51y2i2efWHILpCX394kNqPZv3g9pYdFBJbqMSfUXeawJjeMu
4Jn14kPzfb2zxXH88Y3NbkGT3wAlI00UAZTPT5pBGe5MWncptJTk1EJRZAdA5cV/
D8oL1DEuSQjHXhkn46uaIepIG42AMX27PwwjHIGD+UfNHleaRI/c2mff68Pcm1kv
9WDnC2RXnXRn5Z6XlskvcGp/fKQ/6mUSgOxPfB/sXCAMn/iwx+kDkgvemprEo2yR
pi8YZ40+p4FYpyZ8oTIu0v4brwWeoJpf9qTQ7aRig5UD8cFLm/eKA5tjWIaDvhzx
+d89PYGDRHApPZI4r8BIo1FjJFxooEnfb3gbGhrvqk1VNm5PIGtyySMzr0p9Y+TN
iNwjzJxE6Pga6RBu3uxGPbinqVqqVndwYJPJ8UW8Ur3xFyXpWgF/ltAo4cU0M6VN
GvmyEn4tWkNaV9/xU98gB0rNmcZI3IP9DptWlm5lqu7aw3vXadMlJ7y7VFpKYmcZ
kKrKnHkoxs/B/vVpV3nvoFptelfxkSfrJP6VUGAX7FZiPlZ2jtmDLzGz7scxQtNy
hT4Ccx0DHIPSfRrFCCeL9NAdE2nomJYRAZwnKQ4a9EHvA6FCrJ4=
=ChU3
-----END PGP SIGNATURE-----
Merge tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes
Arm FF-A fix for v6.18
The FF-A driver was updated to support specification version 1.2 but omitted
support for the 16-byte implementation-defined (IMPDEF) field introduced in
FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission
breaks all memory interfaces.
This change updates the EMAD sizing and offset logic to correctly handle the
FF-A v1.2 layout while preserving backward compatibility with older versions.
* tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- Do not make a clean PTE dirty in pte_mkwrite()
The Arm architecture, for backwards compatibility reasons (ARMv8.0
before in-hardware dirty bit management - DBM), uses the PTE_RDONLY
bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The
arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this
inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE
writable also invoke pte_mkdirty() but do_swap_page() does not and we
end up with dirty, freshly swapped in, writeable pages.
- Do not warn if the destination page is already MTE-tagged in
copy_highpage()
In the majority of the cases, a destination page copied into is
freshly allocated without the PG_mte_tagged flag set. However, the
folio migration may be restarted if __folio_migrate_mapping() failed,
triggering the benign WARN_ON_ONCE().
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmj6bJwACgkQa9axLQDI
XvF/Kg//TumWHlM3o07ol2yhK+EXUTMW8DNwzGwKAqPKl19iElZ+F3yVSfgXOxAi
hjZk9qIPGNokKulKX0drJahuhaXVW30ynh9EX6xPhXN6+faqCv8JR7zSABvMXm9E
FYmqEz678RNkIrfSn0uJw6kF3Dakn6IrZbarD2WRWg9kcwQIZCHfdxbiSbuBKQ+m
oXk5pjndTjuKujMWAhZbmuWGPNc1EfzulwhgpARgQNUxtvToLR/aS+TLykGKXPTL
GieHWR3/AiN1Jhwvsp4ElxLvnM1cau/QhnMX9kCAUjwRfnPBUa+jt/OPziO7s9Gh
NeImrwdtSBi/B5a7GaozZwsyeTAahrmSpaTjzQOrw3jr+Scn7seXtRJMFwYBiXNv
7GGDKsNXc6qmmrdC1Epqvzk6EDFpv2SPkeXIUJVxxaM7qpkhTgxnScqZzaYYmTu+
0CPKMmVtRfHr4GJqkhFcfHQMEHtxpOsA803t4w5iIgVQQQciEcHM7v21h5PWBIqO
vZydWITX/cGk2rwXtfZ4EATG1fl8jt1gwUD6FSUz73gBueLD1DHBhS3AkRCptdeR
AraXxdxdUZAH/7k1k0WOzBCoVBmbT8yjyTdKLH7KlHVaHIQDp+dmcR9mj1VoF5VP
sQXl9pG/WqrIz7pBBWEW83eeSlDK0mD7R9n8k9yHpsEy/ditFXI=
=3tTN
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
- Do not make a clean PTE dirty in pte_mkwrite()
The Arm architecture, for backwards compatibility reasons (ARMv8.0
before in-hardware dirty bit management - DBM), uses the PTE_RDONLY
bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The
arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this
inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE
writable also invoke pte_mkdirty() but do_swap_page() does not and we
end up with dirty, freshly swapped in, writeable pages.
- Do not warn if the destination page is already MTE-tagged in
copy_highpage()
In the majority of the cases, a destination page copied into is
freshly allocated without the PG_mte_tagged flag set. However, the
folio migration may be restarted if __folio_migrate_mapping() failed,
triggering the benign WARN_ON_ONCE().
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mte: Do not warn if the page is already tagged in copy_highpage()
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
really started testing.
Current release - new code bugs:
- eth: mlx5e:
- psp: avoid 'accel' NULL pointer dereference
- skip PPHCR register query for FEC histogram if not supported
Previous releases - regressions:
- bonding: update the slave array for broadcast mode
- rtnetlink: re-allow deleting FDB entries in user namespace
- eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path
Previous releases - always broken:
- can: drop skb on xmit if device is in listen-only mode
- gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()
- eth: mlx5e
- RX, fix generating skb from non-linear xdp_buff if program
trims frags
- make devcom init failures non-fatal, fix races with IPSec
Misc:
- some documentation formatting "fixes"
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmj6QcgACgkQMUZtbf5S
IrsRvw/+N4rc/M7X6kYXftxW+DchJ9daXVFFXDR6/L05LyOhNL6wDi0TNT0MM2f0
RLQQ6ReOyCGhDGDzUJN6FNdn6B75HSzoeZKDoCVBoCpHg8C55X2YXMpTZILlKxH+
A7yI8H6Zb5ljiXlOwhqSrIzth6orNxjqUBAOIiu0JUhvfvuYnRh1RZPYX+3babjS
2DcEGK36GLe671PR6S33tu2q/xcmPonbBtQjplEtDKyGrV6+/BtvHSJ/bnKjtnar
5DR1yJE8PdtujdXyxzaS7x2xfVnbnX/huNepqY3K0d5ZXJphQGxCEfY5DTWAsooF
zX7Q/lRe56bmNzjg+LRhYzIeKaSFlXw23FQe2b+Dpz/qPMKkm4F2LdIq1C9GOXom
StX0zz7v6C332N/fABAzCUbklaclZA+HyVmjEJYIdK037xaIpYdh9AfkX0Byd8xP
JOGFeVtqlW/Vg7yqmiJ8N66yaMKOtmzfA3yyQid0F0CVwy/h3z/fDp78rfTjgORp
tXX2DO9jF5aUZXE5p6VAWQGHOylpVP83GHKzTZtLxDgzK0d4VBXUGslwifn1rhTz
yzr//qwt18Rcbv7ezmpsLT+Q2S7pTXtEblWZgf/IM5HE0AGdJIItbhYm3sjUYMiM
UGZgBr0AwWywXcUmtiD/IdA85UJLUGjDKx88Du356VGPBizIG3A=
=rD+V
-----END PGP SIGNATURE-----
Merge tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from can. Slim pickings, I'm guessing people haven't
really started testing.
Current release - new code bugs:
- eth: mlx5e:
- psp: avoid 'accel' NULL pointer dereference
- skip PPHCR register query for FEC histogram if not supported
Previous releases - regressions:
- bonding: update the slave array for broadcast mode
- rtnetlink: re-allow deleting FDB entries in user namespace
- eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path
Previous releases - always broken:
- can: drop skb on xmit if device is in listen-only mode
- gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()
- eth: mlx5e
- RX, fix generating skb from non-linear xdp_buff if program
trims frags
- make devcom init failures non-fatal, fix races with IPSec
Misc:
- some documentation formatting 'fixes'"
* tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
net/mlx5: Fix IPsec cleanup over MPV device
net/mlx5: Refactor devcom to return NULL on failure
net/mlx5e: Skip PPHCR register query if not supported by the device
net/mlx5: Add PPHCR to PCAM supported registers mask
virtio-net: zero unused hash fields
net: phy: micrel: always set shared->phydev for LAN8814
vsock: fix lock inversion in vsock_assign_transport()
ovpn: use datagram_poll_queue for socket readiness in TCP
espintcp: use datagram_poll_queue for socket readiness
net: datagram: introduce datagram_poll_queue for custom receive queues
net: bonding: fix possible peer notify event loss or dup issue
net: hsr: prevent creation of HSR device with slaves from another netns
sctp: avoid NULL dereference when chunk data buffer is missing
ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
net: ravb: Ensure memory write completes before ringing TX doorbell
net: ravb: Enforce descriptor type ordering
net: hibmcge: select FIXED_PHY
net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb
Documentation: networking: ax25: update the mailing list info.
net: gro_cells: fix lock imbalance in gro_cells_receive()
...
- Fix a recent coding mistake causing __acpi_node_get_property_reference()
arguments to be put in an incorrect order (Sunil V L)
- Work around bogus -Wstringop-overread warning on LoongArch since
GCC 11 in ACPICA (Xi Ruoyao)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmj6IhISHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1XNoIAJHXoSu9daR9x8GgxYj4fKRDv4NEeVJF
W2ilgU1WUSIOR4YBRPiqjWqi2jGNVMP3gycmoMmusQnfIJYBVQH/Q5AtxkT4HLYB
jaNlQYUiUYi6KWwhnLs+NJu6ey5SvuxOffyIKnlvyl5N2tVDLF/50vLsknSEdR/z
3/g5RGkQ7oZTQrt9OguWq2lsn/c/FSPED/wBv4GjzNAgRLx2TGoHlflaDxN9le5o
2gDFk8gfVvaP/z7qcpsgmTx3RwVpelxV9MUgWur65i2YCkOWBlJL0a4Sr1JWKyzL
dJij0f/KH5RezuGzcDeGn2YgdttwV3dBhTn3bEvxmgpXvLLZcj0V6jk=
=SGjm
-----END PGP SIGNATURE-----
Merge tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fixes from Rafael Wysocki:
"These fix a fallout of a recent ACPI properties management update and
work around a compiler bug in ACPICA:
- Fix a recent coding mistake causing __acpi_node_get_property_reference()
arguments to be put in an incorrect order (Sunil V L)
- Work around bogus -Wstringop-overread warning on LoongArch since
GCC 11 in ACPICA (Xi Ruoyao)"
* tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
ACPI: property: Fix argument order in __acpi_node_get_property_reference()
- Add missing _RET == 0 condition to recently introduced conditional
guard definitions for runtime PM (Rafael Wysocki)
- Revert a cpuidle menu governor change that introduced a serious
performance regression on Chromebooks with Intel Jasper Lake
processors (Rafael Wysocki)
- Fix an amd-pstate driver regression leading to EPP=0 after
hibernation (Mario Limonciello)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmj6D/ASHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1+eoIAJ1sl2E0tpzsThg4yEjcPH+6Xa4KdYbQ
dHQ1vvdIMZ9D+mi0ububT6fjmd9CsIcZElst9aEeXqLO1BoQrtApHWXuJ6RRkLWz
iEeMusB2wNkUBv/I3jgtYJCOsSdwFEpl8172qrG9RBQftOO3rsUv1RVgTZ+8C8fM
Fb1BpoSgYFCq1nBXhHMaJZElAIECGwEpTQOQ2/DlfTf6uVVIm20ijmLb2idgcgnt
ijeu2qGHUQK4ZaABDL/60CbA7+f21AmtzRX7VV95h2ALv5sPnCa5o/ZKthhGhR2b
wcPejPeVqJc9XHSEFUdOtLGnjZl7xBrW/HeyclAozdqG/ma4zUADHXA=
=z5JQ
-----END PGP SIGNATURE-----
Merge tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These revert a cpuidle menu governor commit leading to a performance
regression, fix an amd-pstate driver regression introduced recently,
and fix new conditional guard definitions for runtime PM.
- Add missing _RET == 0 condition to recently introduced conditional
guard definitions for runtime PM (Rafael Wysocki)
- Revert a cpuidle menu governor change that introduced a serious
performance regression on Chromebooks with Intel Jasper Lake
processors (Rafael Wysocki)
- Fix an amd-pstate driver regression leading to EPP=0 after
hibernation (Mario Limonciello)"
* tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: runtime: Fix conditional guard definitions
Revert "cpuidle: menu: Avoid discarding useful information"
cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmj50JgACgkQxWXV+ddt
WDvXYg//SPHH0s7DEnPgMEz/RE9wQXVtvJhzzICDzTk2hawc05K9P1p/2mB2Etio
CFya4Cuzs9sfw5HW5BYZcyi1bzMkAOMA5lPI+sHOqGdKhomYXj/5TlxMVNuh83uP
Bk/Ycw4k5pIQRtIlen6Km9ViM9Zi7xFqn41c5c8V7GtYXrcgB5ob2LVL5UIEw/y1
RpaXlNZ+/DVRiH+UcvdqvnsdasjzVeugqb7aGiEhSIhm851D6UvBb+X5lqxWwcxY
GEBUqU8+FnkuTnru1V3Y/WlHE7NnXyDPYJaLkta3Wru9f2faOEdT4rvnIe4uQHPc
NNZ4B/fxRjqzFWCZ+T9s/Rm7jOxIpgPj1UZPqDMiq87bqy5AWxH3PIq+rmsu8nVF
rVB7qNdP3iW0CtA7U68D0Y4xYOQIEsVHfx7LY+Q+P/4epTFOZBix51vPoCF73CCY
uoQ6gMbeUp109CzQAYa8rGPv+nn7cFLDkl4wSWWg2LssAqEKQLkHK0goHjLCu6mp
qHW1gw97qonTtmoUURIzJUYTuMWOlvC90r/e4C46ZTOhM9ndfuZJc28thRCJPsvD
P+suVPMDuBBwdcGIOCy+uS9vOnm+KfZp10zQ0uAnYU35foUnE8V/4uaxHlzE0jmb
wPFIu07Rb/O3hx4cvSSckevrjBbK8M0TCG5JuhQIEYqXiU1utP0=
=YN21
-----END PGP SIGNATURE-----
Merge tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
- in send, fix duplicated rmdir operations when using extrefs
(hardlinks), receive can fail with ENOENT
- fixup of error check when reading extent root in ref-verify and
damaged roots are allowed by mount option (found by smatch)
- fix freeing partially initialized fs info (found by syzkaller)
- fix use-after-free when printing ref_tracking status of delayed
inodes
* tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree()
btrfs: fix delayed_node ref_tracker use after free
btrfs: send: fix duplicated rmdir operations when using extrefs
btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
The arm64 copy_highpage() assumes that the destination page is newly
allocated and not MTE-tagged (PG_mte_tagged unset) and warns
accordingly. However, following commit 060913999d ("mm: migrate:
support poisoned recover from migrate folio"), folio_mc_copy() is called
before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the
copy will be done again to the same destination page. Since
copy_highpage() already set the PG_mte_tagged flag, this second copy
will warn.
Replace the WARN_ON_ONCE(page already tagged) in the arm64
copy_highpage() with a comment.
Reported-by: syzbot+d1974fc28545a3e6218b@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/68dda1ae.a00a0220.102ee.0065.GAE@google.com
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Will Deacon <will@kernel.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: stable@vger.kernel.org # 6.12.x
Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Since commit af92793e52 ("slab: Introduce kmalloc_nolock() and
kfree_nolock().") there's a possibility in alloc_single_from_new_slab()
that we discard the newly allocated slab if we can't spin and we fail to
trylock. As a result we don't perform inc_slabs_node() later in the
function. Instead we perform a deferred deactivate_slab() which can
either put the unacounted slab on partial list, or discard it
immediately while performing dec_slabs_node(). Either way will cause an
accounting imbalance.
Fix this by not marking the slab as frozen, and using free_slab()
instead of deactivate_slab() for non-frozen slabs in
free_deferred_objects(). For CONFIG_SLUB_TINY, that's the only possible
case. By not using discard_slab() we avoid dec_slabs_node().
Fixes: af92793e52 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
Link: https://patch.msgid.link/20251023-fix-slab-accounting-v2-1-0e62d50986ea@suse.cz
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Devcom device and component registration isn't always critical to the
functionality of the caller, hence the registration can fail and we can
continue working with an ERR_PTR value saved inside a variable.
In order to avoid that make sure all devcom failures return NULL.
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Check the PCAM supported registers mask before querying the PPHCR
register, as it is not supported in older devices.
Fixes: 44907e7c8f ("net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR")
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add the PPHCR bit to the port_access_reg_cap_mask field of PCAM
register to indicate that the device supports the PPHCR register
and the RS-FEC histogram feature.
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-2-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to
initialize the tunnel metadata but forget to zero unused rxhash
fields. This may leak information to another side. Fixing this by
zeroing the unused hash fields.
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: a2fb4bc4e2 ("net: implement virtio helpers to handle UDP GSO tunneling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Link: https://patch.msgid.link/20251022034421.70244-1-jasowang@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP
clock gets actually set, otherwise the function will return before setting
it.
This is an issue as shared->phydev is unconditionally being used when IRQ
is being handled, especially in lan8814_gpio_process_cap and since it was
not set it will cause a NULL pointer exception and crash the kernel.
So, simply always set shared->phydev to avoid the NULL pointer exception.
Fixes: b3f1a08fcf ("net: phy: micrel: Add support for PTP_PF_EXTTS for lan8814")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Tested-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Link: https://patch.msgid.link/20251021132034.983936-1-robert.marko@sartura.hr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Syzbot reported a potential lock inversion deadlock between
vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.
The issue was introduced by commit 687aa0c558 ("vsock: Fix
transport_* TOCTOU") which added vsock_register_mutex locking in
vsock_assign_transport() around the transport->release() call, that can
call vsock_linger(). vsock_assign_transport() can be called with sk_lock
held. vsock_linger() calls sk_wait_event() that temporarily releases and
re-acquires sk_lock. During this window, if another thread hold
vsock_register_mutex while trying to acquire sk_lock, a circular
dependency is created.
Fix this by releasing vsock_register_mutex before calling
transport->release() and vsock_deassign_transport(). This is safe
because we don't need to hold vsock_register_mutex while releasing the
old transport, and we ensure the new transport won't disappear by
obtaining a module reference first via try_module_get().
Reported-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Tested-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Fixes: 687aa0c558 ("vsock: Fix transport_* TOCTOU")
Cc: mhal@rbox.co
Cc: stable@vger.kernel.org
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251021121718.137668-1-sgarzare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Ralf Lici says:
====================
fix poll behaviour for TCP-based tunnel protocols
This patch series introduces a polling function for datagram-style
sockets that operates on custom skb queues, and updates ovpn (the
OpenVPN data-channel offload module) and espintcp (the TCP Encapsulation
of IKE and IPsec Packets implementation) to use it accordingly.
Protocols like the aforementioned one decapsulate packets received over
TCP and deliver userspace-bound data through a separate skb queue, not
the standard sk_receive_queue. Previously, both relied on
datagram_poll(), which would signal readiness based on non-userspace
packets, leading to misleading poll results and unnecessary recv
attempts in userspace.
Patch 1 introduces datagram_poll_queue(), a variant of datagram_poll()
that accepts an explicit receive queue. This builds on the approach
introduced in commit b50b058, which extended other skb-related functions
to support custom queues. Patch 2 and 3 update espintcp_poll() and
ovpn_tcp_poll() respectively to use this helper, ensuring readiness is
only signaled when userspace data is available.
Each patch is self-contained and the ovpn one includes rationale and
lifecycle enforcement where appropriate.
====================
Link: https://patch.msgid.link/20251021100942.195010-1-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
openvpn TCP encapsulation uses a custom queue to deliver packets to
userspace. Currently it relies on datagram_poll, which checks
sk_receive_queue, leading to false readiness signals when that queue
contains non-userspace packets.
Switch ovpn_tcp_poll to use datagram_poll_queue with the peer's
user_queue, ensuring poll only signals readiness when userspace data is
actually available. Also refactor ovpn_tcp_poll in order to enforce the
assumption we can make on the lifetime of ovpn_sock and peer.
Fixes: 11851cbd60 ("ovpn: implement TCP transport")
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251021100942.195010-4-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
