Commit Graph

1481443 Commits

Author SHA1 Message Date
Peter Drabik
c53f5bfc37 ALSA: usb-audio: Add mixer map quirk for Audient iD24
The Audient iD24 (2708:000d) exposes feature unit 12 as a 4-channel
"Speaker Playback Volume" control (cmask 0xf, -127..0 dB).  The device
does not actually apply this volume to all of its output channels: the
left main output ignores it and stays at 0 dB, while the right main
output honors it.

When userspace (PulseAudio / PipeWire in a stereo profile) adopts this
control as the master playback volume, any setting below maximum
produces a stereo imbalance on the main outputs.

This was verified against the device's internal meters: with the
control set to 107/127 (-20 dB) on all four channels and a digitally
identical L/R sine played back, both DAW return meters read the same
level while the right main output metered exactly 20 dB below the
left.  Restoring the control to 127 (0 dB) restored the balance.

Rename the control to "Monitor Mix Playback" so that it is not picked
up as the stream's master volume control, in line with similar quirks
for other devices.  The control remains accessible for manual use.

Signed-off-by: Peter Drabik <drabik.p@gmail.com>
Link: https://patch.msgid.link/20260831195855.1836617-1-drabik.p@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-09-01 12:39:37 +02:00
Xu Rao
32d7226e61 ALSA: hda: restore MFG widget enumeration after core split
Before commit 7639a06c23 ("ALSA: hda - Move a part of hda_codec stuff
into hdac_device"), widget enumeration selected the function group with

	codec->afg ? codec->afg : codec->mfg

and read subordinate nodes from that group.

The core split moved this logic into snd_hdac_refresh_widgets(), but
hard-coded codec->afg there. For an MFG-only codec, codec->afg is zero,
so the Root Node is queried and codec->start_nid/num_nodes are populated
from the function-group range instead of the MFG's subordinate nodes.

Restore the pre-split AFG-or-MFG selection.

Fixes: 7639a06c23 ("ALSA: hda - Move a part of hda_codec stuff into hdac_device")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/44809B8FF80DCCA2+20260901034024.2407783-1-raoxu@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-09-01 12:37:33 +02:00
HyeongJun An
e4637ce346 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
The snd_usbmidi_us122l_output() picks a count of 2 on anything slower
than high speed and never relates it to ep->max_transfer.  The URB
buffer holds exactly max_transfer bytes, so a device declaring a one
byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the
memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.

Only 0x800e and 0x800f are pinned to nine bytes.  The US-122MKII at
0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the
USB core only clamps downward.

The akai and novation output ops in this file were given the same guard
recently.  Do the same here.

Fixes: 030a07e441 ("ALSA: Add USB US122L driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260901090409.1478573-1-sammiee5311@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-09-01 12:36:53 +02:00
Yilin Zhang
9b110a9dce ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
with an mmap_count check performed under the PCM stream lock, but the
lock is released long before the buffer is actually freed:
snd_pcm_sync_stop(), constraint refinement and do_free_pages() all
happen in between.  snd_pcm_mmap_data(), on the other hand, takes no
lock at all: it validates against the old buffer's state and
dma_bytes, remaps its pages into the VMA, and only then increments
mmap_count.

A concurrent mmap() can therefore slip in between the check and the
free.  remap_pfn_range() installs writable PTEs for the old buffer's
pages without taking page references, and the subsequent
do_free_pages() returns those pages to the page allocator while the
VMA still maps them.  This leaves a stale, writable mapping of freed
pages: a page-level use-after-free that can be leveraged for local
privilege escalation.

Make snd_pcm_mmap_data() participate in the buffer-access scheme
introduced for hw_params/hw_free: acquire runtime->buffer_accessing
before validating and remapping, and release it afterwards.  Buffer
reallocation already fails with -EBUSY while accessors are active,
and the mmap side now fails with -EBUSY while a reallocation is in
progress, so the validate/remap sequence and the check/free sequence
can no longer interleave.

A reproducer that turns this race into a stale writable mapping of
the freed DMA buffer pages is available on request.

Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Fixes: 92ee3c60ec ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls")
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
Link: https://patch.msgid.link/20260831045506.889070-1-yilinzhang@moonshot.ai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:10:15 +02:00
Runyu Xiao
33abb7491e ALSA: harmony: initialize locks before requesting IRQ
snd_harmony_create() registers the IRQ before initializing h->lock and
h->mixer_lock. A pending interrupt can invoke the handler while these
locks are uninitialized.

Initialize both locks before requesting the IRQ so the handler always
sees valid lock state.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260830063411.2215691-1-runyu.xiao@seu.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:07:23 +02:00
Riku Matsumura
a565d82392 ALSA: hda/realtek: Add quirk for VAIO VJS131
The VAIO VJS131 with an ALC233 codec incorrectly selects the headset
microphone when no headset is connected. Add a PCI SSID quirk for
1d19:0006 to apply ALC233_FIXUP_ASUS_MIC_NO_PRESENCE, which configures
pin 0x19 as a headset microphone without its own jack detection.

Signed-off-by: Riku Matsumura <rick197.3@icloud.com>
Link: https://patch.msgid.link/20260830000008.22371-1-rick197.3@icloud.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:06:59 +02:00
Takashi Iwai
acac7b5e07 ALSA: pcm: Fix race between non-atomic ops and trigger-start
We protect the races of the concurrent state transitions between
atomic PCM ops, but the checks between the non-atomic ops (hw_params,
hw_free and prepare) and the atomic ops aren't perfect; there is a
check of the conflicting PCM state at the beginning of hw_params & co,
but the atomic PCM ops can be still issued during the non-atomic PCM
operations.  An example such scenario is that a thread A re-issues the
PREPARE or HW_PARAMS for the already prepared stream, while another
thread B triggers the PCM start in the middle of the prepare
operation.  Although this usually doesn't lead to much serious issues,
it can give some inconsistency as reported by syzkaller (such as
ODEBUG warning).

There are various atomic PCM ops, and basically the only problem is
the PCM start as it operates from the PREPARED state.  Other trigger
commands (stop, etc) are for the running or the other special state,
hence they are filtered as pre-condition.

This patch is for preventing the PCM trigger-start during the non-
atomic operations in order to address the problems above.
Fortunately, the hw_params, hw_free and prepare operations call
snd_pcm_buffer_access_lock(), and this can be used for checking the
concurrent operations at the PCM trigger -- which sets the
runtime->buffer_accessing to a negative (if possible), so the PCM
trigger just needs to check the runtime->buffer_accessing value; if
it's negative, it means the concurrent non-atomic PCM ops is running.

Reported-by: syzbot+225231fce6755d40d078@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/6a8f0de8.1d9ded08.62e62.00b5.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260828115542.3999-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:06:16 +02:00
Zhang Heng
34e08ad3a8 ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72
The Acer Predator PHN16-72 (subsystem ID 1025:1731) uses a Realtek
ALC245 codec. The PCI SSID and HDA codec SSID are both 0x10251731,
as confirmed in the system's ALSA diagnostic report. Apply
ALC2XX_FIXUP_HEADSET_MIC to enable the headset microphone.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221811
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260828101704.354406-2-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:05:48 +02:00
Zhang Heng
616fd322e0 ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10
The Lenovo Yoga Slim 9 14ILL10 (83CX) uses ALC287 with CS35L56
amplifiers. Without a matching SSID entry the bass speakers stay silent.
Add PCI SSID 17aa:380b (codec SSID 17aa:3905) to apply
ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221902
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260828101704.354406-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:05:36 +02:00
feng liu
7b9b202f15 ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up
Inside cx_codec_ops.set_power_state, implement a 1‑second delay after
resuming from the S3 state before sending the power command to the codec
AFG, thereby preventing potential transmission failures.

Signed-off-by: feng liu <feng.liu@senarytech.com>
Link: https://patch.msgid.link/20260828063456.1368-1-feng.liu@senaryTech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-31 10:04:54 +02:00
Will Porter
d476d5995c ALSA: usb-audio: Guard FCP protocol transfers
FCP meter and hwdep operations issue control transfers without
preventing runtime suspend or disconnect. Protect the central
request-and-response transport. One reference then covers the command,
acknowledgment wait, and response.

The initial step-zero request bypasses that transport. Hold an outer
reference across the complete initialization sequence so the device stays
active through step zero, notification-URB setup, and both initialization
commands. The central transport keeps its guard for calls outside
initialization; the existing active counter balances the nested calls.

FCP has no private resume callback. Its suspend callback only removes the
notification URB. Taking the initialization and transport guards under the
existing protocol mutex causes no resume-side lock inversion.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-7-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Will Porter
9d4ae593fc ALSA: usb-audio: Add PM guards to RME Digiface controls
The RME Digiface status and register helpers issue vendor requests
without preventing runtime suspend or disconnect. The volatile status
controls can repeatedly reach these unguarded paths while userspace
polls them.

Protect both helpers with snd_usb_lock. All Digiface get and put
callbacks then resume the device and hold the disconnect reference
across their transfer.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-6-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Will Porter
de01880473 ALSA: usb-audio: Guard Scarlett2 protocol transfers
Scarlett2 controls and hwdep operations reach the proprietary USB
transport without preventing runtime suspend or disconnect. Protect the
central request-and-response helper. One reference then covers the
command, acknowledgment wait, and response.

The runtime and system resume hook submits only the notification URB. It
takes no protocol mutex. Thus, the transport guard does not invert the
existing data_mutex or usb_mutex order. Keep the suspend-time config save
on the unguarded helper because it runs inside the USB suspend callback.

This change protects each USB transaction. It does not hold a runtime-PM
reference across the asynchronous flash-erase interval.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-5-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Will Porter
103da4a7bc ALSA: usb-audio: Add PM guard to Scarlett meter reads
The Scarlett Gen 1 meter callback reads the device without preventing
runtime suspend or disconnect. The transfer can fail when userspace
polls the volatile control after the device suspends.

Hold snd_usb_lock across the meter request. This matches the guarded
Forte and common mixer control paths in this file.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-4-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Will Porter
9e6c9d7531 ALSA: usb-audio: Add PM guards to US-16x08 transfers
The TASCAM control helpers submit vendor requests without preventing
runtime suspend or disconnect. This affects mixer writes and the
volatile meter path.

Protect both send and receive helpers with snd_usb_lock. Acquire the PM
guard before chip->mutex in the receive path so autoresume cannot invert
the mutex order.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-3-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Will Porter
077304dfa7 ALSA: usb-audio: Add PM guard to Studio 1810c controls
The Studio 1810c control callbacks issue vendor transfers without
preventing runtime suspend or disconnect. A transfer attempted after
runtime suspend can fail because the USB device cannot accept
submissions.

Take snd_usb_lock before the driver data and USB mutexes in both
callbacks. This resumes the device before either the state read or
control write. It also prevents disconnect cleanup from racing the
complete operation.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Will Porter <mrwillporter@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260827232143.149197-2-mrwillporter@gmail.com
2026-08-31 09:54:18 +02:00
Linus Torvalds
cee9395acd Linux 7.3-rc1 2026-08-30 13:34:40 -07:00
Linus Torvalds
78bb208b99 i2c-fixes for v7.3-rc1
Fixes mainly for teardown and resource handling, runtime PM and
 hardware-specific controller issues.
 
 - core: fix debugfs use-after-free when removing the adapter
 - designware: apply interrupt mask quirk for HJMC3001
 - imx-lpi2c: avoid target accesses on master-only controllers
 - mux: release channel node when adapter registration fails
 - qcom-cci: fix autosuspend and runtime PM cleanup on removal
 - qcom-geni: fix timing parameters for 32 MHz clock
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCapRFYgAKCRDaeAVmJtMt
 bpVsAQDz0v5x5AdiZQS224oErSA6vfd7ztavFkh8gg3tR+PgogEAhhV+xChRle4U
 DTwvfC2DYuzxJxYpuQbMGdvu39cuTgA=
 =t/+3
 -----END PGP SIGNATURE-----

Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull i2c fixes from Andi Shyti:
 "Fixes mainly for teardown and resource handling, runtime PM and
  hardware-specific controller issues:

   - fix debugfs use-after-free when removing the adapter

   - designware: apply interrupt mask quirk for HJMC3001

   - imx-lpi2c: avoid target accesses on master-only controllers

   - mux: release channel node when adapter registration fails

   - qcom-cci: fix autosuspend and runtime PM cleanup on removal

   - qcom-geni: fix timing parameters for 32 MHz clock"

* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: core: fix debugfs UAF on adapter removal
  i2c: imx-lpi2c: avoid accessing target registers on master-only controllers
  i2c: qcom-cci: fix autosuspend cleanup
  i2c: designware: Enable interrupt mask workaround for HJMC3001
  i2c: qcom-geni: update frequency table to fix timing parameters
  i2c: mux: Fix channel node leak on adapter add failure
2026-08-30 10:53:24 -07:00
Linus Torvalds
eea8bdcb59 Coccinelle patches for Linux v7.3
Sang-Heon Jeon <ekffu200098@gmail.com> has cleaned up a number
 of the semantic patches in the scripts/coccinelle directory,
 particularly with respect to functions that no longer exist in
 the kernel.  He and I have also done some reorganizations that
 improve performance.
 
 I eliminatd some false positives.
 
 相浦彰 / AIURA,AKIRA <akira.aiura.bj@hitachi.com> fixed an
 out of date URL.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEnGZC8gbRfLXdcpA0F+92B3f5RZ0FAmqUJzoACgkQF+92B3f5
 RZ1ZKA//XmJPmm4VapiaWb3Kd9R11JXEqUrkDMkexkwpa+844xC6XfUKsAJTsxff
 18UksaPH+GQyLInWtu271uPDL+3X/yXbSU0iQA675XVQsG9Bz9MJ3R7tDcmFiJR9
 Oflm7VwlG0QFVk1HVJRtY5+kfZ5ob54CZ82QltHCRIrPKQJ9JWqS8ffnNggLQu91
 D079YK9gL/SqTXsWSUg+oU/TN5zILAZ0XDAdqN5THuMtq3ADurlKoPFeGHTiXdDs
 rFlmbu3XX40aL06qun6B4WLD/86fpvaVQ9NwqJnTEoTA4GNwENY/wYY9GJdsWa7h
 N7bTB7R8g441orRx0CeGyFBJkNocg4V5ImT42aGtsxfgIxDvFPxcfVg3TnCSbO8/
 SYvvnzaIzdYkx41IIIHPLZHNbW96kbT8rI5s3DrkUoKvMePnCtrV/6bR1QFBHdiw
 I5/q4yhFjwvRh5ffiU5McqlYcM4NK1s3lHD+fk6oKf8XOgPzo6b1nBFky+P4Whw+
 Sy/uBM2TrafRlvRrctz0EdhKSQede/Q7OVFcJKOvUUwnYKRqmrM5qPIQvDg6s4zZ
 7NQWK7SsfWFKFUd1mljqN9Pe//fLIxfHKqyQwWtoPJwPmVaKSUTF/UDHu5HR4VVn
 wd4MxZj1ck3Dv/mtvAcJNxKw3+imD+284wPkpsrityMDpdYRHoc=
 =AgiL
 -----END PGP SIGNATURE-----

Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux

Pull Coccinelle updates from Julia Lawall:

 - Clean up a number of the semantic patches in the scripts/coccinelle
   directory, particularly with respect to functions that no longer
   exist in the kernel (Sang-Heon Jeon)

   He and I have also done some reorganizations that improve
   performance.

 - Eliminate some false positives (me)

 - Fix an out of date URL (相浦彰)

* tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
  coccinelle: ifnulldev_put: update error message
  coccinelle: ifnulldev_put: update outdated helper names
  coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
  coccinelle: kfree_mismatch: drop vmalloc_exec
  coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
  coccinelle: zalloc-simple: drop the kmem_alloc rules
  coccinelle: alloc_cast: drop removed allocators
  coccinelle: remove obsolete pci_free_consistent.cocci
  scripts: coccinelle: devm_free: reduce false positives
  coccinelle: misc: struct_size: drop unneeded parentheses
  coccinelle: mini_lock: improve performance when searching loops
  coccinelle: api: check for macro context
  coccinelle: update Coccinelle website URL
  coccinelle: misc: minmax: avoid unhelpful isomorphisms
  coccinelle: misc: minmax: check for the presence of if cases
  coccinelle: misc: minmax: drop unneeded parentheses
  coccinelle: misc: minmax: improve performance when no candidate exists
  coccinelle: double_lock: improve performance when no double lock exists
2026-08-30 10:42:40 -07:00
Darrick J. Wong
cbb4c6d9af CREDITS/mailmap: add some info about Darrick J. Wong
Add myself to CREDITS because apparently I've never done that; and
update mailmap so that all my old email addresses get remapped to the
kernel.org redirector.

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-08-30 10:29:08 -07:00
Linus Torvalds
a23cbb0574 - Fix UM build regression caused by the removal of the UM
specific timex.h header. (Thomas Weißschuh)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmUsRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iFihAAtSFpL6WKwu+eTTdTn/J41OCx6SWMw79O
 GRXfHX7HKVS52IhEnh3OWDVcMAqhNXe8oP/JwzBn4EuCv2LrsuBxpiTp6Bq4Y0Da
 Ws16Nb0CRH966L9E6z0kMZQBMsKrLGXGOE+/t9gzHpkTBzJ4a7Dzh1TZX2YudhRO
 lrnS+7azTb5XyshyMDo0C43AH6rUpt1ffYUz0MyACkbWPzQge42O3neN/2gKMDjq
 TM128Man3V4AX6K/9hC4vnvDNYdHsUqxHhc81826wVX7brF74uoYSiogn/AZK7RY
 CK9GQmAv7xo7AJTqe9AKt5dCy/cvVLp4vLqVYMQMGaFB05PF+1EMY69xrAkWnS4k
 1cYnU0hCHN/86XOShe1s0101UPD6ZxYo/WlU53VGRJMNi7Dm5OMFFOGzAK9WfTIB
 4UyOwuzq/505aA8dr5+Hk5PYikDvDXOA/zmqewAMonDrlTWhPBxWV6k+Dhks8WOt
 MIgjoX8wFlA7h0SUQH12XN/pxEBTgNl4P4k8YyHqVwOKN/XPZJ6XPGt2nIc8hnVc
 m3wHxP27x/68Ugpz1a8oADkC6lhDFgTE5XO6mmpfHKaVp/Fwdjrg8atwltHbixiV
 4mo5ZlcI759lN40EBJM4QbGRP8k5TjRGgkUnv7B2qpBBgAvPnCnlMZo0871J6VVz
 0CeKb6kxT+k=
 =eGi8
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Ingo Molnar:

 - Fix UM build regression caused by the removal of the UM
   specific timex.h header (Thomas Weißschuh)

* tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  um: Use asm-generic/timex.h over the host architecture one
2026-08-30 10:19:11 -07:00
Linus Torvalds
637836563d - Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
    caused a regression (Peter Zijlstra)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqTmG0RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iV+A/+J2IN9xHNPv0O9rLKaJvLsNnlMPQ4QJJB
 kTbEOLDrAE7ozTmP2sLfUu75w1FQz0Hp00/tf1V7VFYaSeMBdMoqJs3itCtuqBrU
 qkVFrx7splaNauvFgxdaHd5dYGszwFOjixMwhezQC1wn46ckW29bEHbIrmY5j1xC
 zF7iSTaVp2zHBbkh0n6ozN28zSbHZcLEAD8mvGoscv3Bnb+9HRMAr4weTHC94kq5
 4hDaRS48CgofxEfXT0erp6Rc7lS1YTUltSvkICORTv0tYtDqDf1GCiZKIjaW8FqW
 N7Nre77fSlH6HfzzujNgNOhGAGoVO+Ki9vfqgnYhnFRc864g9OTREmdNLlJ2V5XB
 yC0SCbAeAjOvbtTLQlRmDlKWJPlwKgXkatGupczkCna3EeL9eXx33fOO6kOGxNNs
 RpQXv+wPv0S9EDdIkkuMwhx0dq6yUCfrA22+wlXUzFhXvHTbhqZlDneI9OtzubZm
 kU+Vf8dgVU0z59C+2ZOwlp5YHVXquRfNXOz8lrRIeb0y0Iyvlo7pDuQ/t8w3Bh3c
 KVlAEEQsK8maBHgHHKMv8ml4W6XJHC9KG6x0TtKDv+ntmrNBDhvq2sxWrhBA7JT4
 kXdab1QG/hP2FEY3M6bChEadT64U1BeGlcI9xMkhX886PwrnOMzTd9xiAN7UtdCR
 dITQG+bHeQo=
 =EtPf
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fix from Ingo Molnar:

 - Revert a commit to spinlock cleanup guards that got caught up
   in the subtle limitations & fragility of guards (again...) and
   caused a regression (Peter Zijlstra)

* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking: Revert switching guards to _irq_{disable,enable}()
2026-08-30 09:57:35 -07:00
Linus Torvalds
f59c074e76 Rust fixes for v7.3
Toolchain and infrastructure:
 
  - Fix KCFI failures, such as in Rust doctests, by disabling function
    merging when CFI is enabled. Gary reported the LLVM bug to upstream
    and it is now fixed in their mainline.
 
  - Fix 'objtool' fallthrough warnings under the experimental
    'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
    helpers code) the LLVM options needed to preserve the unreachable
    traps that 'rustc' normally emits.
 
    In addition, fix 'objtool' errors when LTO is enabled on top, by
    also filtering out the LTO flags (for the combined Rust and helpers
    code) so that the traps are kept in place.
 
  - Fix 'objtool' warnings by adding one more 'noreturn' function.
 
  - Fix 'make rusttest' target when the 'rustc-dev' component is
    installed and Rust >= 1.82.0, <= 1.87.0 is used.
 
 'kernel' crate:
 
  - 'num' module: fix soundness issue in the 'Bounded' conversion from
    'bool' by restricting the conversions to unsigned 'Bounded'.
 
  - 'jump_label' module: fix future 'make rusttest' target failures when
    'ARCH=' is set to an arch different than the host's.
 
  - 'list' module: fix incorrect 'pop_back()' comment.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqT+BIACgkQGXyLc2ht
 IW0vRRAAmR1E04gT5HFDH+iNJgLlyticVsHs0rH46ICYgQWs+gpGGiJsPpnNBJxM
 M5+VGauMPch5kIBKYwD/XrUe6cDDNqIfY8Eq+BnJiTxDe6U68K4cSnmPe478wZIn
 15AIteCHN2x9vf49KpfI3fH/xoriS5XVEC915bQ9APXOYJv7iXZCFDzxw9dXnYu/
 TE3YleA32oJ9COBT3s8ovtzNpEOtZPKhWFd2lOCaGbxBLWygu5X/PSEZs6ikmqgR
 BqHrbhzSco8aYKCrbFbQrdgtwFPr3PQ8pRn44TPU6/siZNVBk83IpcxdtXrQ2gRi
 wOwZfMsH2K/cEZWMXPz16hp+4onWUr1bgkfLUAzPtyqUX6rOEaBrliSXGs+yCl40
 KNx5BefrhzH6UL+/pbLGVXzC5q1VLTsgS6u66piUyvhf52Wmvzc7AExGml/BWA/q
 jomwnxpgLiBjO61cH4dnfrm3AtXHAWGzG/dd0BnVcpT+8HEr2W4WWRSydmPtkB+f
 hXXmwAOF3sgVueJ2nxlPVcqt3LdsinCwBrQQmO8J+TtPyNW9sh72OfFSOkF/wybw
 o5tcqFG7ZSNGR7pli5pYsnG4Gfv3vIraLwhiVciGXZ+es+FkKtOpaOMunUcQwKP6
 +uFpdMqXVQmH4l3Adc0rG1lq6zRHnGvZ96R5PlmPhl6RVDZuv0E=
 =EBLX
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix KCFI failures, such as in Rust doctests, by disabling function
     merging when CFI is enabled. Gary reported the LLVM bug to upstream
     and it is now fixed in their mainline.

   - Fix 'objtool' fallthrough warnings under the experimental
     'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
     helpers code) the LLVM options needed to preserve the unreachable
     traps that 'rustc' normally emits.

     In addition, fix 'objtool' errors when LTO is enabled on top, by
     also filtering out the LTO flags (for the combined Rust and helpers
     code) so that the traps are kept in place.

   - Fix 'objtool' warnings by adding one more 'noreturn' function.

   - Fix 'make rusttest' target when the 'rustc-dev' component is
     installed and Rust >= 1.82.0, <= 1.87.0 is used.

  'kernel' crate:

   - 'num' module: fix soundness issue in the 'Bounded' conversion from
     'bool' by restricting the conversions to unsigned 'Bounded'.

   - 'jump_label' module: fix future 'make rusttest' target failures
     when 'ARCH=' is set to an arch different than the host's.

   - 'list' module: fix incorrect 'pop_back()' comment"

* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
  rust: num: restrict bool conversion to unsigned Bounded
  kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
  kbuild: rust: preserve unreachable traps with inline helpers
  rust: cfi: disable function merging if CFI is enabled
  rust: jump_label: skip arch-specific asm in `testlib` builds
  objtool/rust: add one more `noreturn` Rust function
  rust: kernel: list: fix incorrect pop_back example comment
2026-08-30 09:47:39 -07:00
Linus Torvalds
0fe792fa9b ARM updates for 7.3-rc1
- add module description for kprobes testing module
 - remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
 - expand comment in ARM's __switch_to()
 
 Also a number of fixes that missed 7.2:
 
 - disable broken eBPF on RiscPC
 - more BKPT fixes (guys, it's a *very* bad idea when everyone uses
   the BKPT instruction for their own differing purposes.)
 - another preempt-rt fix, this time for siglock / CPU timers
 - fix another path where we try to send signals to processes
   with interrupts disabled
 - acquire mmap write lock for show_pte() with user faults
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuNNh8scc2k/wOAE+9OeQG+StrGQFAmqUOjQACgkQ9OeQG+St
 rGR5DBAAki6o4y1sATQh+ZIHIspR0t8lcQZn31lWoGup1T1KoI7f2S48vJwvd17p
 CryOuHmc8H0W5Z7MoiJ9Vkg4BsQzagr28xjvYO2uLYyrOqLgyJvUyNQm2POVa9nB
 296/hCQjBR8VrEszJr6mvpac2pmYo9tlK3FcHKa1jO+iJbkQW1/4i5njhWqK7g0v
 cG1ezSsaa1zZsOvFtJhBb8FQca7fpF1tRKd4F7s/w1mV4v7hETMaaXuYGMzHYVw2
 zrln7CvGs5vlskrnbAxwMHyJdvdZI80Sm/QvIqxdTbYgZmfHYS43MKJp8E0HRz90
 1oLUfWRxLMI1hql/hxraZEnMICa4uLKbhifqDN3H59WLb+S12gRrqb1WFIdr6SUv
 P+xIkSaJu24Nb6LCvaVYLV24enMx2oGG76h2itXXKyDCiYTWVz2fMmAQiajbkxnh
 iCoHBqvfTGu8Qio0Ndrp9XMn1pFCtPkb2eaBGfIfTKB08FxdwqR7rcWePygS83j5
 BwXgeGCNh4oV5J5isZ3bRcwa7QkqbdsTrYhXcoDUcRzZgo/GAuEjP1AzsxOdV8hh
 NKpBXrzNYfy78PkYc+vBe0piiuJUykKaRNfMX2WRK8u/fj4yCtkKuMZY02WA4X2M
 I5N0bcdXmeE/d4KqJcx9WXtdji16w7G15xhfKKZRdlnvs0Oy2Uw=
 =KcxS
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux

Pull arm updates from Russell King:
 "Updates for 7.3:

   - add module description for kprobes testing module

   - remove references to CONFIG_CPU_ARM92x_CPU_IDLE options

   - expand comment in ARM's __switch_to()

  Also a number of fixes that missed 7.2:

   - disable broken eBPF on RiscPC

   - more BKPT fixes (guys, it's a *very* bad idea when everyone uses
     the BKPT instruction for their own differing purposes)

   - another preempt-rt fix, this time for siglock / CPU timers

   - fix another path where we try to send signals to processes with
     interrupts disabled

   - acquire mmap write lock for show_pte() with user faults"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
  ARM: 9480/1: entry: expand comment in __switch_to
  ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
  ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
  ARM: 9484/1: enable interrupts when unhandled user faults are triggered
  ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
  ARM: 9481/2: breakpoint: CFI breakpoints only on demand
  ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
  ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION
2026-08-30 09:43:01 -07:00
Linus Torvalds
fb5b59a6a6 OpenRISC 7.3 updates
One small item and one bug fix.
 
  * The bug fix is to fix an unchecked access in our or1k_atomic syscall,
    I am debating if we should just deprecate this as there is minimal
    need for it.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqSfncACgkQw7McLV5m
 J+TprRAAuyxaYmmnTQqJacQt8OEaVJ5DPsZfCtENwEg9BkXpvzo1F/uK4Enp+YEf
 VABscIWCAEKY2BCbn6TYdq6uDAHg9GY0fRUcJ7ERUH9pZt7RD24R6uP0oTIffYL4
 wzD5E7DOkVdKHrw5KHB75K4BTPgHPLK2aJxhnS9eX/tYS2yDLQNyFvH5OxZ/uezp
 6wJlZhdSdcTTNNBu/ZLj0YHa/22RixqxWHB0Wax061LU4QFjbYo8qufSA1sdP5Do
 qz/zjW6fr6ieJOwNKsM6n9BLcCS1OqTNKRrWUbxUYqeni8jX2qXWxnwjOK0RrXH2
 nmraEviXMrYGg29BIi914nG1uePp0MeX8LE2+GrBQ8iEMmnJeVk+TDNqGiXT4Zg1
 1NTeQaGDJu2aggPlNC2DnnJyKb7KkTceBcpBC1amUco6co7m+TbFzcnqpUcTsVSu
 HhH72NGnKmY7aFuMaw6Apl6pqw8C38moXhDo45XkucQzRQJADlIkm4amm8gV+MFk
 ivP6OMuW4I08DxUlZw/thUdG6qMXVUKCrVqlohjQFXNKuFeHJM+rfJFXGnEmoSCW
 AkFtgCH2wMDcW5BsM1d3YV3Bj4OFYR/YaElx0T83fcTUvGNbwdFQOlmGy06Jo2Hj
 Vr/5pvoYbTUdL0uJMLPEG6mZuB5LmW5K4ktGTMTPosunXRQipIk=
 =DkYR
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of https://github.com/openrisc/linux

Pull OpenRISC updates from Stafford Horne:
 "One small trivial macro cleanup and one bug fix.

  The bug fix is to fix an unchecked access in our or1k_atomic syscall,
  I am debating if we should just deprecate this as there is minimal
  need for it"

* tag 'for-linus' of https://github.com/openrisc/linux:
  openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
  openrisc: drop unneeded semicolon
2026-08-30 09:26:54 -07:00
Linus Torvalds
034dd340b0 tracing fixes for v7.3:
- Fix error output of boot instance creation failure
 
   Currently if a boot instance creation fails, instead of printing out the
   name of the instance that failed, it prints "(null)". That is because it
   prints "cur_str" that had already been processed by strsep(). Print the
   saved name instead.
 
   While at it, print the error code of the failure.
 
 - Fix use-after-free for same named historgrams
 
   Histograms can be named so that they can be used in multiple events. But
   if the named histogram has a variable attached, the second event that uses
   the named histogram which duplicates it and needs to free the original
   after duplication leaves the old variable in place and still visible. If
   another histogram uses than variable, it will use the stale one which will
   try to reference the freed duplicate histogram and crash the kernel.
 
   Free the duplicate variables along with the duplicated histogram data.
 
 - Check return value of kthread_run() in event self test
 
   The events self tests uses a kthread for testing but does not check if it
   succeeded in creating a kthread. If the kthread creation were to fail, the
   code will still try to call kthread_stop() on the error returned.
 
 - Fix race between reading trace_pipe and updating subbuffer size
 
   If a user is reading the trace_pipe file at the same time they update the
   ring buffer sub-buffer size, can cause the trace_pipe read to read stale
   data. Add trace_access_lock() around updating the ring buffer sub-buffer
   size.
 
 - Fix eventfs_inode on failure path in creation of the events directory
 
   In the creation of the "events" directory, if after allocating the
   eventfs_inode a failure is detected, it calls cleanup_ei() which calls
   free_ei(). The free_ei() will test if eventfs_inode being freed has no
   children. It is a bug if it does. But on the failure case of the creation
   of the "events" directory, the children lists have not yet been
   initialized and the free will trigger a warning because list_empty() on an
   uninitialized list returns false.
 
   Move the initialization into init_ei() where it makes more sense and makes
   sure that a created eventfs_inode has its lists initialized upon creation.
 
 - Check return value of kthread_run() in ftrace direct sample code
 
   The sample code that shows how to use the ftrace direct calls does not
   test the return of kthread_run() to see if it succeeds. Return a failure
   if the kthread_run() doesn't succeed.
 
 - Clear user events state on fork in case of alloc failure
 
   On fork, the child gets a pointer to the parent's user events state. It
   makes a copy of it then updates the child's pointer to it. But if the
   allocation fails, the duplication function leaves the child with a pointer
   to its parent's descriptor. When the child cleans up its data, it will free
   the parent's descriptor while the parent is still using it.
 
   In the duplication function, set the child's user_event_mm to NULL before
   testing if the allocation succeeded, and when it exits it will not free
   the parent's descriptor.
 
 - Fix retry exhaustion in simple ring buffer reader swap
 
   simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
   post-decrements it only after a failed link replacement. On the final
   attempt, a successful replacement leaves retry at zero, while a failed
   replacement leaves it at -1.
 
   But the check for success expects the retry value to be non-zero and exits
   with an error on zero. This is the opposite result. Fix it.
 
 - Fail nicely when the remote swap_reader_page() returns an error
 
   Currently, if the swap_reader_page() of a remote buffer fails, it triggers
   a WARN_ON_ONCE() and continues normally. Instead, have it exit with an
   error and a pr_warn() print instead of a full WARNING.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCapOC3hQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qvjkAQCGVuyK980rwiBnfenWLpeB3QjfHA8B
 mV0mJSlGWm1t1gEA9WWzMGbp+OHeRV2xyA+xW7OS1S58VO9OIGrzXCGqbAM=
 =TrF5
 -----END PGP SIGNATURE-----

Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fixes from Steven Rostedt:

 - Fix error output of boot instance creation failure

   Currently if a boot instance creation fails, instead of printing out
   the name of the instance that failed, it prints "(null)". That is
   because it prints "cur_str" that had already been processed by
   strsep(). Print the saved name instead.

   While at it, print the error code of the failure.

 - Fix use-after-free for same named historgrams

   Histograms can be named so that they can be used in multiple events.
   But if the named histogram has a variable attached, the second event
   that uses the named histogram which duplicates it and needs to free
   the original after duplication leaves the old variable in place and
   still visible. If another histogram uses than variable, it will use
   the stale one which will try to reference the freed duplicate
   histogram and crash the kernel.

   Free the duplicate variables along with the duplicated histogram
   data.

 - Check return value of kthread_run() in event self test

   The events self tests uses a kthread for testing but does not check
   if it succeeded in creating a kthread. If the kthread creation were
   to fail, the code will still try to call kthread_stop() on the error
   returned.

 - Fix race between reading trace_pipe and updating subbuffer size

   If a user is reading the trace_pipe file at the same time they update
   the ring buffer sub-buffer size, can cause the trace_pipe read to
   read stale data. Add trace_access_lock() around updating the ring
   buffer sub-buffer size.

 - Fix eventfs_inode on failure path in creation of the events directory

   In the creation of the "events" directory, if after allocating the
   eventfs_inode a failure is detected, it calls cleanup_ei() which
   calls free_ei(). The free_ei() will test if eventfs_inode being freed
   has no children. It is a bug if it does. But on the failure case of
   the creation of the "events" directory, the children lists have not
   yet been initialized and the free will trigger a warning because
   list_empty() on an uninitialized list returns false.

   Move the initialization into init_ei() where it makes more sense and
   makes sure that a created eventfs_inode has its lists initialized
   upon creation.

 - Check return value of kthread_run() in ftrace direct sample code

   The sample code that shows how to use the ftrace direct calls does
   not test the return of kthread_run() to see if it succeeds. Return a
   failure if the kthread_run() doesn't succeed.

 - Clear user events state on fork in case of alloc failure

   On fork, the child gets a pointer to the parent's user events state.
   It makes a copy of it then updates the child's pointer to it. But if
   the allocation fails, the duplication function leaves the child with
   a pointer to its parent's descriptor. When the child cleans up its
   data, it will free the parent's descriptor while the parent is still
   using it.

   In the duplication function, set the child's user_event_mm to NULL
   before testing if the allocation succeeded, and when it exits it will
   not free the parent's descriptor.

 - Fix retry exhaustion in simple ring buffer reader swap

   simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
   post-decrements it only after a failed link replacement. On the final
   attempt, a successful replacement leaves retry at zero, while a
   failed replacement leaves it at -1.

   But the check for success expects the retry value to be non-zero and
   exits with an error on zero. This is the opposite result. Fix it.

 - Fail nicely when the remote swap_reader_page() returns an error

   Currently, if the swap_reader_page() of a remote buffer fails, it
   triggers a WARN_ON_ONCE() and continues normally. Instead, have it
   exit with an error and a pr_warn() print instead of a full WARNING.

* tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Stop remote reader update when page swap fails
  tracing: Fix retry exhaustion in simple ring buffer reader swap
  tracing/user_events: Clear copied tracing state before fork duplication
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
  eventfs: Initialize ei->children and ei->list in init_ei()
  tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
  tracing: Fix crash passing ERR_PTR to kthread_stop()
  tracing: Fix use-after-free with same-name named triggers
  tracing: Fix logged instance name on creation failure
2026-08-30 09:22:00 -07:00
Russell King (Oracle)
1a89abc009 Merge branches 'fixes' and 'misc' into for-linus 2026-08-30 15:05:54 +01:00
Julia Lawall
ef6a1dca8d coccinelle: ifnulldev_put: update error message
Update the report and org mode messages to reflect the new
function names.

Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
2026-08-30 14:36:11 +02:00
Sang-Heon Jeon
f83b8a5869 coccinelle: ifnulldev_put: update outdated helper names
dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit d62607c3fe ("net: rename reference+tracking
helpers").

So update the names.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
2026-08-30 14:34:22 +02:00
Sang-Heon Jeon
5264281879 coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
atomic_long_dec_and_lock() has never existed. So drop it from the rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
2026-08-30 14:17:25 +02:00
Sang-Heon Jeon
3beb6e620f coccinelle: kfree_mismatch: drop vmalloc_exec
vmalloc_exec() was removed by commit 7a0e27b2a0 ("mm: remove
vmalloc_exec").

So drop it from the rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
2026-08-30 14:09:27 +02:00
Sang-Heon Jeon
729eb52aa1 coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
88dee3b0ef ("PCI: Remove unused pci_pool wrappers").

So drop the pci_pool_alloc rules.

No functional change.

Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
2026-08-30 11:19:01 +02:00
Linus Torvalds
08dbfad3f5 SCSI updates for 7.3
Remaining updates for the 7.3 merge window. The only core change is
 enabling context analysis for the SCSI layer and UFS. The remaining
 changes are either bug fixes or hardening.
 
 Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZOpW2gUwxXeCmhkh7ulgGnXF3j0FAmqTH1UACgkQ7ulgGnXF
 3j2EhA//VAZ4F5A4McmtwYMnCdUCjaPihX9JC7i0GHnBqloX/Scc97xs7/Gzzf7u
 5HcQjoYArPYpHkGMT+KuqEpfzRiiYe41XpiPMQf7EkW4VAwYbuwLqPn4z2ma9HIS
 LAmxSdi1RDU3KBo9hYm4GTsvY+FYDpmrjNcYNvR5Ajf1H3O1+2EBlA54FJ92Ct1v
 NuxgR8F9cY2JM9cB84qhjCd1/49NEOfAQjBA32OFGbLC/9TbF83g1pgyClmOyglD
 WTzmzQkIq7kmq0BKWleRUKwgj9EQmOHpe4VGdvHC4n2G8vTBscsXRMqt4l1pM/UY
 B7c7MfCT8Ar3EnUBO1m9QAADMj9DMqIWZ7SJRDyJL0BLabhxaxDx+yrdkN0dM4SZ
 n/GW5f8uNO/jxLumk0OfrUChGhKnsNTjQKDnbQZ8jLPjgaj2bx8UZg/8JglOxfaZ
 +vV3GGsClxjIANqY6pNwvCuXFxatG1o7HUk+JwX08DQT+k7iKkHRLM/4tpiIIwWm
 xLvAhrX7SJRYjISZm54bPumMscjkzSaUt6CoHqSIJ9iO5AJWBUqFQqaki+lBqF43
 DgIUzdEn/OYk9PGKcpjKoeXbEkBPkogHF2YI848z0bdlgb1ae+FHzkDoYH58mDKZ
 wVt+kQQ3iQgwgB2x9NN+wtxlGFMh6nyPS5GpWopUJXEEvm2WygY=
 =tfy0
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi

Pull more SCSI updates from Martin Petersen:
 "Remaining updates for the 7.3 merge window. The only core change is
  enabling context analysis for the SCSI layer and UFS.

  The remaining changes are either bug fixes or hardening"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits)
  scsi: snic: Fix SCSI host leak on workqueue allocation failure
  scsi: MAINTAINERS: Update my email address
  scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers
  scsi: leapraid: Standardize NCQ priority sysfs attributes
  scsi: leapraid: Serialize firmware log mmap with teardown
  scsi: leapraid: Balance host references for firmware log VMAs
  scsi: lpfc: Remove unnnecessary NULL check
  scsi: qla2xxx: Fix an loop timeout test
  scsi: qla2xxx: Fix an error code in qla_get_tmf()
  scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()
  scsi: core: Enable context analysis for hosts.o
  scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions
  scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers
  scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report()
  scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name()
  scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()
  scsi: core: Enable context analysis
  scsi: core: Protect host state changes with the host lock
  scsi: core: Add lock context annotations
  scsi: core: Pass the SCSI host pointer directly to scanning functions
  ...
2026-08-29 11:55:36 -07:00
Ali Ahmet Memis
78004e9a87 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.

    l.lwz   r29,0(r4)
    l.lwz   r27,0(r5)
    l.sw    0(r4),r27
    l.sw    0(r5),r29

The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.

A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.

This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.

Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.

[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
2026-08-29 07:32:26 +01:00
Linus Torvalds
cf72cbb39d io_uring-7.3-20260828
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqR/ZwQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpr6GD/9uEDS/3lBXkP5r6qO4E5v/6eN7Sz1F/gZ4
 vkH4reHh3U3VSjwOaWJHLXCkJV06JmlJAggCn0dq+P8cXWKH9VpwppzpedY/Ua05
 oiDXgyoaAzhgYzE/seCALdFR0zOyvhSlluDiucrwWCcx0h4HOEnysZ3Q4RQ8gXXx
 2mQ+M/n2WdXPPUHPEGezPL9PvtitFjUFr8WBeWksCtFQ+Ycyk6+NDPSanxeOjJCI
 FhgQDxiUIWSEItEniuwq4lUQFtImkRyUvBPPbPb51ahzkCc1QSjr8WVtfO0RJtON
 uiUU9hkTcKis/ufR+esikrjV2nwxo3fv2WkknrBfJ5jNFiLp/CR+FPZRwH3A/AoH
 Onoi3qcpcHrXzQD4j/UhyUcaIM7sntwour4PBg8cKUh/lwZkt94+orp6lniiV/Dd
 aS3IKmCymQjpf5N3b0QnQSi2lOGk6bUKyQD8YUnA/N3rw3olfkzSGBDz6Y4gQxAY
 XpvmuPDXndhfn17JSGpsCjohWkWEUuSQh1fx5JLsV9XkaPaeA89/epUzu2+b1Kxw
 c+/uaCkQsGGLpHa6xWhJLGocyYZViDUYeIPz8C7gqTDXTMU70mtZvILl+aZjVrjF
 iU2aSWDuS9oD0g16yT7FY8pBQvB8RnuNCUmS92QIr+VMqnp7793DPD5gwN88k+8L
 4x4gInB+ag==
 =I3ma
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:
 "A few smaller fixes for io_uring that should go into the 7.3-rc1
  kernel, all three headed to stable as well. This contains:

   - A few fixes around cancellation and teardown for waitid

   - Cap the user size for the query interface copy-out"

* tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/waitid: avoid siginfo copy during ring teardown
  io_uring/waitid: honor task_work cancellation
  io_uring/query: cap user size passed to copy_struct_to_user
2026-08-28 16:51:14 -07:00
Linus Torvalds
a99d741df7 drm next/fixes for 7.3-rc1
core:
 - use drm_warn instead of warn
 
 msm:
 - Bindings:
   - Added Shikra support
   - Document a840, a704, a722
 - Core:
   - Use drm_client buffers for fbdev emulation
   - teardown fixes
   - ARM32 DMA fixup
   - Remove objects from evict list when re-validated
   - Bunch of corner case and error path fixes
 - DPU:
   - Dropped dev_pm_opp_set_rate(0) preventing burnout
   - Fixed SSPP offsets of Kaanapali
 - DP:
   - Dropped dev_pm_opp_set_rate(0) preventing burnout
   - Cleaned up core code in preparation for MST support
   - Fixed prepare() to let Pipewire continue in case of the unplugged cable
 - GPU:
   - Add support for a704
   - Add support for a722
 - HDMI:
   - Simplifed register access
 
 amdgpu:
 - eGPU fixes
 - Runtime PM fix
 - UserQ fixes
 - Backlight fix
 - Discovery sysfs fix
 - Reset handling fixes
 - Buffer func handling fix for xgmi
 - VCN boundary check fix
 - DC lut handling fixes
 - MES fixes
 - UVD fix
 - VCE 3 fix
 - Enforce isolation fix
 - HPD fix for VGA/LVDS
 - DML fix
 - DCN 6 fixes
 - DC gpu reset fix
 
 amdkfd:
 - Fix return value
 - CU occupancy for GFX 11
 - CU occupancy for GFX 12/12.1
 - Queue bounds checking fix
 - SVM fixes
 - CRIU bounds checking fix
 
 radeon:
 - iMac display fix
 
 xe:
 - error message cleanups
 - i2c global register definitions as dependency for xe/i2c fixes
 - Media workardound
 - Add CCS to gt_idle debugfs print
 - Page fault related fix
 - i2c related fixes
 - System Controller mailbox bit fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmqR+2wACgkQDHTzWXnE
 hr5VPRAAhJpCnUEOUnhiBRfQB3lqHuKV4N9XQGVoaAZHYLxNkZD6I99ScpIznEr9
 sHG0ViBqz2PHyM2XoJzPZDzm8Us0moVUMMdV56IH7h11l8E7Az2Sd/Ji+AQvZEBT
 /qh9Py0/fjibfDm0ueMROFRhuD8RA2sJqzkGMZUBvErh+zmEQvkIDkIT6A5RpHD8
 B3XEGN+UCxPBzCnKNixyNDgY2i4ipFAe0MDj9+Mh0b9BM9BoV8+Eb7sjkBz+ROMH
 tl57Mjjd37FaYM9MgtEt9m7eOBf266V9Xb9tbIfqShwO1aZa0Vfzuih/3Ck53Nwc
 VkwepP7NHZZKFHIxFgcRCVjzyA3HpZJmLot8YYOyZDJOG6KKp2X0ZUFBog5Uiv8o
 7exd95FLUtIsnUtmLxlermOYJwrokgcVoigcalhLCB2+KZ5/BznutzcCSvrd8vI2
 LzEGnLMgzuEKeOmiWZjagID51TYwHfPogULUlwWT4XB62dKih7/uselCObj4m/Lc
 kRSbiXWz1pxisfiFRsK2GECwsbEb/8qOYgSOQBgppuPbSWpX+2P4IApomRBesQ8E
 Db+i6hptauOwT0/1ZBo8gkOfb0XIWsjg9iV6pVuUIS80hOlr7Zj1MR7mMrWgL0nM
 Chs4/Nq8jWU1ESbmKPBINIXCGOGuev4lJO/pBjfySLpTUhWOQcw=
 =wbEZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm updates from Dave Airlie:
 "As mentioned last week, an msm pull request fell down the side of the
  couch or whatever the email equivalent of that is. This has the msm
  next stuff + the usual fixes for amd/intel.

  core:
   - use drm_warn instead of warn

  msm:
   - Bindings:
      - Added Shikra support
      - Document a840, a704, a722
   - Core:
      - Use drm_client buffers for fbdev emulation
      - teardown fixes
      - ARM32 DMA fixup
      - Remove objects from evict list when re-validated
      - Bunch of corner case and error path fixes
   - DPU:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Fixed SSPP offsets of Kaanapali
   - DP:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Cleaned up core code in preparation for MST support
      - Fixed prepare() to let Pipewire continue in case of the unplugged cable
   - GPU:
      - Add support for a704
      - Add support for a722
   - HDMI:
      - Simplifed register access

  amdgpu:
   - eGPU fixes
   - Runtime PM fix
   - UserQ fixes
   - Backlight fix
   - Discovery sysfs fix
   - Reset handling fixes
   - Buffer func handling fix for xgmi
   - VCN boundary check fix
   - DC lut handling fixes
   - MES fixes
   - UVD fix
   - VCE 3 fix
   - Enforce isolation fix
   - HPD fix for VGA/LVDS
   - DML fix
   - DCN 6 fixes
   - DC gpu reset fix

  amdkfd:
   - Fix return value
   - CU occupancy for GFX 11
   - CU occupancy for GFX 12/12.1
   - Queue bounds checking fix
   - SVM fixes
   - CRIU bounds checking fix

  radeon:
   - iMac display fix

  xe:
   - error message cleanups
   - i2c global register definitions as dependency for xe/i2c fixes
   - Media workardound
   - Add CCS to gt_idle debugfs print
   - Page fault related fix
   - i2c related fixes
   - System Controller mailbox bit fix"

* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
  drm/xe/sysctrl: Read mailbox phase bit from hardware
  drm/xe/i2c: Keep the i2c controller always enabled
  drm/xe/i2c: Fix the interrupt handling
  i2c: designware: Global register definitions
  drm/xe: Reject page faults from non-fault-mode scratch VMs
  drm/xe/xe_gt_idle: Add CCS to the powergating info print
  drm/xe: Do not apply WA 14025883347 to media 3503
  drm/amd/display: fix dc_lock leak on GPU reset error paths
  drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
  drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
  drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
  drm/amdgpu/userq: fix lock missing for userq fence error set
  drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
  drm/amd/display: Log details when failing to register HPD IRQ
  drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
  drm/amdgpu: clamp the isolation index for rings outside a partition
  drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
  drm/amdgpu: Fix VCE 3 ring align_mask
  drm/kfd: Add CU occupancy support to GFX12.1
  ...
2026-08-28 16:37:55 -07:00
Linus Torvalds
4cc4cc367f ipmi: Fix some minor issues, add async init
Several cleanup on error fixes and a missing RCU wait and proper
 validation on a received message in one place.
 
 The biggest change is the initialization of the driver can be done
 asynchronously on a work queue.  That saves significant boot time.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmqR5uMACgkQYfOMkJGb
 /4HmSw//behOuqAjgDZ8kwxs/WCfdXz4Tz+hr/tFUkHgCMpq5XFKZVBonY5s6eEB
 y4Wei0JXURTt+Yex7aH7y22g5lIwaOYA8KGklnPGsHerPR9Xpr9PucNq7YjL8EN2
 hfND4jHjWtIl/8Z61/D24Dq7zbzY2oNcBt2rnAboKpEQuGOrCR4imuRkVZ182XzL
 wtsoMwcWYhUIpCvQ87vhUJy9IyJrwHBPRe8ziUoDfxAjQdgKBCcJ2g9hDOQY910A
 UphBIyAaXfap5QEBhiV4bYJd3+HM0FC/G7zH5MX6+AP19253ODuN8jlq1zCKYiwx
 h3uEweshhTrEQJPUh5YClRPKs4h3dkRfUPEzzW5UXtoCS75Slcdtoc/A/mf7YTTB
 dRKaeqyJq6WboVOcLllO6EyJtk8Wrp4YwtMHXwDpi86sHtqcPPuAQMwt5uPomJDU
 kTvsxfGGaLV+G+pKvjfKH6iLEAPI3gNGcjMJXdH9WPqP+w7lsGDwJR3BCIOZsFoV
 8oB4rzjtlkNOTo/WD8Ijo1VU5QT4yhzDC2SYhaoJCL95fMxaay5AIlbN8k3gDalE
 eIlTgbcyi2qyyTV4+JjjqXdCQwI9AGSoW7B0Y8mJgt5CzY0vl3A1kKa884d5tEOm
 auJAUgt4oXE2E5qLL5gMgqkiay8ofNNIEMhRpjY0g/yGSUnPPa0=
 =Nbl3
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi

Pull ipmi updates from Corey Minyard:
 "Several cleanup on error fixes and a missing RCU wait and proper
  validation on a received message in one place.

  The biggest change is the initialization of the driver can be done
  asynchronously on a work queue. That saves significant boot time"

* tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi:
  ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
  ipmi:msghandler: Cancel work cleanly on an error
  ipmi:si: Add async init to ipmi_si
  char: ipmi: use named initializers for acpi_device_id
  ipmi: Fix leak in __ipmi_bmc_register
  ipmi: Remove all sysfs files on registration failure
  ipmi: si: Fix NULL pointer dereference after failed registration
  ipmi: ipmb: validate write message length
2026-08-28 16:32:12 -07:00
Linus Torvalds
548e7bcd0c A wide variety of mostly CephFS fixes and cleanups, split between
changes that address edge cases (Sam, Xiubo, Matthew), efficiency
 improvements (Max) and AI-assisted hardening (Michael, Jeremy).
 
 One thing that stands out is Alex's change to how CephFS behaves in
 NEARFULL scenarios: the long-standing "make all writes synchronous"
 behavior has become opt-in.  It was always somewhat controversial and
 doesn't make much sense for modern deployments; the new default is to
 continue normal operation (i.e. buffer writes as MDS allows, etc).  The
 behavior in case the cluster reaches any FULL state remains the same as
 before.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmqRz9QTHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi/63CACpEmwY/3lOZ4M0IQV2UJqSWzNNtUDI
 Hdq7hosk5gRXP/gG1bV63i935Ibe/Sp6Cb/XkTRcrPIxy/1eky8PDZN3knPlPocM
 TMAdLKUOzzpmehqORWdVsEGSYIXuIfVhrey30pfHVLQc86orTj7worDZydYl8r3L
 K6nAM8gfcT9l9Sd4jtquaT61kqCcjXKPANlvUtt8oqniMRdpL63GnFHaU33n3XTE
 5Dalh4YHtIL4gTA6xZLbZqOq+99QbmmqlqlMiwFNtrfpVtPO7HWHrEy61mYrKW7U
 Nr7HRF6X+MeUngZVI5AgrH5K6HtlE0SeHZt2XSKuMKGMG+I4dcygUcSr
 =F8+z
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client

Pull ceph updates from Ilya Dryomov:
 "A wide variety of mostly CephFS fixes and cleanups, split between
  changes that address edge cases (Sam, Xiubo, Matthew), efficiency
  improvements (Max) and AI-assisted hardening (Michael, Jeremy).

  One thing that stands out is Alex's change to how CephFS behaves in
  NEARFULL scenarios: the long-standing "make all writes synchronous"
  behavior has become opt-in. It was always somewhat controversial and
  doesn't make much sense for modern deployments; the new default is to
  continue normal operation (i.e. buffer writes as MDS allows, etc). The
  behavior in case the cluster reaches any FULL state remains the same
  as before"

* tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client: (32 commits)
  ceph: force a cap message when a deferred revoke can't be acked immediately
  libceph: reject buckets with mismatched CRUSH ids
  ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
  ceph: fix leaked inode reference on writeback abort at umount
  libceph: remove ceph_put_page_vector()
  libceph: validate banner payload length
  ceph: make nearfull sync writes opt-in
  ceph: do not repeat ceph_trim_dentries() if no progress possible
  ceph: drop mdsc->mutex before decoding the MDS reply
  ceph: fix UAF in check_new_map() on session freed during unlock
  ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
  ceph: pass inode pointer around instead of reloading it
  ceph: mark cap remove with RB_CLEAR_NODE() instead of setting ci=NULL
  ceph: add helper function ceph_cap_is_removed()
  ceph: make __ceph_remove_cap() static
  ceph: cap delegated inode count in ceph_parse_deleg_inos()
  ceph: bound num_export_targets array for mds info v2/v3
  ceph: bound MDSCapAuth path and fs_name decode in handle_session()
  ceph: bound xattr value length in __build_xattrs()
  ceph: bound copied dentry name length in NFS export get_name
  ...
2026-08-28 11:51:05 -07:00
Linus Torvalds
ce727a090b This pull request contains updates for UBI and UBIFS:
UBI:
 - Support for a per-device wear-leveling threshold
 - Various fixes and cleanups of error paths
 - Correctly preserve torture flag up wear-leveling
 
 UBIFS:
 - Various fixes and cleanups of error paths and kernel-doc
 -----BEGIN PGP SIGNATURE-----
 
 iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmqRnEsbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ
 hesYu8HaKhAAuU11eCVhmQk9jpIdaOnFKwokE/PIj23SRz13jc7PWmFbAIHiaVt4
 0p1Xd59kPfdFqsfBo6ZgSr+f0cQu2N1MjzZYSmaklG5iJk2+IuMOIvNdve/GFzNg
 X86J7yxLtrCq+ULNNgGv0m89G/uYoFP27Su0rAid4D2T5gYEOisXpPw5AhAL6+bS
 FLRMlt0QWCAtb66FmSeDgTW042NPoSCZNOsxF35X9hQ6RxvftB8mbggmTummmlgb
 K9Nsuwkarterq7JhS4X+RL6aZG7yDPfHVpdCDD6Ui4W0SP59W0oSokikm1myw6Yg
 9NH67jUD03s0y/z3QaNiTVPuQXz5dpUyxGzK/FCT8y2aiycCDmwWF0VG8MVMhC0j
 TmNiuSWAljweaPSsgF176ISRG63++zwMGtz/JclVlkUwkVKYFbpEv5lcT0EzfCqh
 ahBlpM2aCLgJaYExd6LSVKEu0tT3+x+2MJDnRWcZM2OPMuL65IQw5V2lbdJN78Gb
 XFX6bfolhneptc2JwQKJx8E72iW7zuFovprTyS/J+TNcceFbfQTTcFt9EFZaXWnh
 +wiWm7rL7Xp9t8MA4Sc979oKFJMkAMl3Z6WTUHJWUZicX2hK+3OQaCVNO8LO/izu
 nPanrTeBnRiBKuAc5skQN5ywaAD3GgG/5ERWP/tdHkdsx34pcvuPnHQ=
 =+fCs
 -----END PGP SIGNATURE-----

Merge tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs

Pull UBI and UBIFS updates from Richard Weinberger:
 "UBI:
   - Support for a per-device wear-leveling threshold
   - Various fixes and cleanups of error paths
   - Correctly preserve torture flag up wear-leveling

  UBIFS:
   - Various fixes and cleanups of error paths and kernel-doc"

* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  UBI: support per-device wear-leveling threshold
  UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
  mtd: ubi: Release device reference on busy detach
  ubi: Fix rollback for explicit UBI device numbers
  ubifs: fix out-of-bounds read in signature length check
  UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
  UBI: Preserve torture flag when rescheduling failed erasures
  ubifs: ubifs.h: clean up kernel-doc comments
  ubifs: key.h: use correct function parameter name
  ubifs: debug.h: fix kernel-doc struct prototypes
2026-08-28 10:59:07 -07:00
Linus Torvalds
115bd364ab f2fs-for-7.3-rc1
In this round, key enhancements focus on reducing inode management memory
 overhead, introducing resizable tail sections with unified pinned allocation,
 and boosting I/O throughput via parallel multi-device flushes and asynchronous
 f2fs_write_end_io() execution. We also add dynamic device alias reservations to
 allow on-the-fly space donation from user partitions.
 
 Alongside these features, critical bug fixes resolve folio race conditions,
 lingering dirty flags, dentry and block counter leaks, and potential deadloops
 in f2fs_fsync_node_pages(). Additional stability patches address error-path
 handling across symlink, sync, and rename/unlink operations, prevent pinned file
 fragmentation, and correct segment migration and free section accounting in
 free_segment_range.
 
 Enhancement:
  - reduce memory footprint of ino management
  - support dynamic reserve/release for device aliasing
  - issue multi-device flushes in parallel
  - add a way to run f2fs_write_end_io() asynchronously
  - support resizable tail section and unify pinned allocation
 
 Bug fix:
  - fix to pass folio->index to f2fs_sanity_check_node_footer()
  - fix folio_nr_pages() race after put in large folio invalidate
  - fix to clear dirty flag on folio in error path
  - accurately adjust free_sections during free_segment_range
  - fix to avoid potential deadloop in f2fs_fsync_node_pages()
  - fix the error path in symlink, device alias in rename/unlink,
    f2fs_sync_fs,
  - fix to migrate all curseg types during free_segment_range
  - fix to avoid pinfile fragment on fragment:{block, segment} mode
  - fix valid block count leak on data block allocation failure
  - fix dentry folio leak in find_in_level
  - reject overlapping move range after len expansion
  - fix some bugs related to file pinning, GC functions, i_size.
 
 And, the series includes a number of minor bug fixes.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE00UqedjCtOrGVvQiQBSofoJIUNIFAmqPybMACgkQQBSofoJI
 UNKp2g/+OP6XZi56hNTqscnKyKrDdVJnOcS/YOe7d1BR+070qmPTpyFjLgjng05K
 exu55rz9vJ3DlpFLsjMEo60DRlDEc5rR4AqymMjqFJH9424ZlxPpdDn6ofCVT0Ck
 D6RTf3y1HFSi4x7//gPQofR9y4MlDrH2Q7NPDriipqbymuNXEjrx/vdr2nq/kHUu
 2lbf7QQs08qYiyDxQcxOFdCdxUTrsEW/tkYZiwgbU2nCJ/eG2R59amgtYJg3SlVt
 xdrf+IaSS7kE5+mGCoBm0WooPpB507kHaoQpZYDj2uueFvEw7nFcSfOCXapOvg8U
 wFkRR0F/rZ4+AW/u4n8Ye7N4a7WjWMTBwfR3WJ2j+arhfn87vJZK6LQQlYwq16l4
 tRcQFcCrKsXHh5HY2OGj8DzTd40zryXujH566YioBCAXU312My1yFjeTJzjobbUW
 TclkfMl689iTr9pqBhIjKT2tTvZFLROYSLk5UBNFNSfA4PtsAAhqlUrE1ck3AuTA
 8kIjLmppfZEBqVuZCF0T1z9TXk0Bg0eM8qHbl/8SdDavmf1pF1BupLqchfdZp6Jr
 4iV1weK4dzmCF6++YDsNlvnBGyTbhiFdN7C5cMlv89PTSTUQZ45Me6JmNwrRDqyU
 MSTyiSSpI+3rAMO0h58PHi+QAOtM0f+S7C24ySkBBerBCbMTK6A=
 =xQ77
 -----END PGP SIGNATURE-----

Merge tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

Pull f2fs updates from Jaegeuk Kim:
 "In this round, key enhancements focus on reducing inode management
  memory overhead, introducing resizable tail sections with unified
  pinned allocation, and boosting I/O throughput via parallel
  multi-device flushes and asynchronous f2fs_write_end_io() execution.
  We also add dynamic device alias reservations to allow on-the-fly
  space donation from user partitions.

  Alongside these features, critical bug fixes resolve folio race
  conditions, lingering dirty flags, dentry and block counter leaks, and
  potential deadloops in f2fs_fsync_node_pages(). Additional stability
  patches address error-path handling across symlink, sync, and
  rename/unlink operations, prevent pinned file fragmentation, and
  correct segment migration and free section accounting in
  free_segment_range.

  Enhancements:
   - reduce memory footprint of ino management
   - support dynamic reserve/release for device aliasing
   - issue multi-device flushes in parallel
   - add a way to run f2fs_write_end_io() asynchronously
   - support resizable tail section and unify pinned allocation

  Bug fixes:
   - fix to pass folio->index to f2fs_sanity_check_node_footer()
   - fix folio_nr_pages() race after put in large folio invalidate
   - fix to clear dirty flag on folio in error path
   - accurately adjust free_sections during free_segment_range
   - fix to avoid potential deadloop in f2fs_fsync_node_pages()
   - fix the error path in symlink, device alias in rename/unlink,
     f2fs_sync_fs
   - fix to migrate all curseg types during free_segment_range
   - fix to avoid pinfile fragment on fragment:{block, segment} mode
   - fix valid block count leak on data block allocation failure
   - fix dentry folio leak in find_in_level
   - reject overlapping move range after len expansion
   - fix some bugs related to file pinning, GC functions, i_size

  And, the series includes a number of minor bug fixes"

* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
  f2fs: support resizable tail section and unify pinned allocation
  f2fs: don't leave the hashed inode while it's unlinked
  f2fs: accurately adjust free_sections during free_segment_range
  f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
  f2fs: use adjusted write range after f2fs_write_checks()
  f2fs: fix to propagate error from f2fs_sync_fs()
  f2fs: return symlink writeback errors
  f2fs: fix error handling on device alias check in rename and unlink
  f2fs: fix to reset all pinned status during fggc
  f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
  f2fs: reduce memory footprint of ino management
  f2fs: fix i_size when pinned fallocate partially fails
  f2fs: fix to migrate all curseg types during free_segment_range
  f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
  f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
  f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
  f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
  f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
  f2fs: unify add/remove ino entry API for all ino types
  f2fs: fix to zero post-EOF data when extending file size
  ...
2026-08-28 10:48:48 -07:00
Linus Torvalds
c20313e98b sound fixes for 7.3-rc1
A collection of various small fixes since the last PR.
 Most changes are device-specific fixes, while there are a few fixes
 addressing the issues reported recently by fuzzers.
 
 Here are highlights:
 
 * ALSA Core:
 - Prevent adding invalid kcontrols to the LED layer
 - Workaround for a false-positive mutex lockdep warning in rawmidi
 
 * USB-audio:
 - Relaxed the sticky mixer behavior check that caused regressions
 - Fix an OOB write in Novation MIDI output
 - Proper cleanup after system-resume errors
 - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
   Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3
 
 HD-audio:
 - Conexant headset plugin fixes
 - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
   TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9
 
 ASoC:
 - DAPM: Fix off-by-one check on the second enum channel
 - Tegra: Fix and sort register defaults
 - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
   HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
 - Fixes Qualcomm TDM handling
 - Fix double put_device() on SoundWire
 - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926
 
 Misc:
 - Fix card leak on probe error on ice1712 driver
 - Hardening for legacy aoa, mtpav and pcxhr drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmqROH8OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/7Xg/9Ec3MYiAC8f60hMck0YwCxeOEABtSwRI5omKy
 tYpRiKtLgjDRQ2i7Cbtaq9c3P0QOMLhr3ht01oQli+Bo8B/ojsG0oF1H+AjoN7c3
 oyLMKWB18CTUCKWomyOEXjpYniKEjoTZNF/KjAuGPHo+fOPT9jOLJvwEmULS5OQq
 +kYUen745xwu096TI9qK18I6W/uuasEDzgN7lv/RFOMH0IpT7Rm4BY9W37kFoGgz
 IWGFz/+rsTl8D9LBf66SRp/Bes1nqNqXNkFISVkYDkAA+7Uii0H4nwFOrPa/pqqT
 PucRknZT/oALkdtsTk2pR0gksu4Z6uVz1NjafeuLJSgdX9D9xKa3CYmLFVJQaLS2
 acOXZaQDMPTNe3M7J+Ut+yD+7S+vMXf/HiQqjyDLasAr26DBqSb0SeBMOgQk0YJd
 +467H+gH6AWl/TDc0bSuqoX0MMYQ2CSb1Wz0iyxCCQEY1brlsO/kSRTGpVnoSqvY
 6sD21QQjaiIe1CkMXOELoD5g4c2WnZ2X0jEJq12wHMXW9ZkKaXX6Yu9HyfrI4KAX
 /hISULNVeyxcrZcAUI7rbEuSTJ3fC7O5smfPASaCoytvA01flTxXx6NYJJKPbcNA
 4bqWeymN0xtE7CHAkvFG/gCK9xC4oMCZEMgEK2/kVCqaUUsCR4GhJotupo2IKZ3k
 HstnykY=
 =odYe
 -----END PGP SIGNATURE-----

Merge tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of various small fixes since the last PR. Most changes
  are device-specific fixes, while there are a few fixes addressing the
  issues reported recently by fuzzers.

  Here are highlights:

  ALSA Core:
   - Prevent adding invalid kcontrols to the LED layer
   - Workaround for a false-positive mutex lockdep warning in rawmidi

  USB-audio:
   - Relaxed the sticky mixer behavior check that caused regressions
   - Fix an OOB write in Novation MIDI output
   - Proper cleanup after system-resume errors
   - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
     Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3

  HD-audio:
   - Conexant headset plugin fixes
   - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
     TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9

  ASoC:
   - DAPM: Fix off-by-one check on the second enum channel
   - Tegra: Fix and sort register defaults
   - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
     HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
   - Fixes Qualcomm TDM handling
   - Fix double put_device() on SoundWire
   - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926

  Misc:
   - Fix card leak on probe error on ice1712 driver
   - Hardening for legacy aoa, mtpav and pcxhr drivers"

* tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
  ALSA: control: Don't add invalid kcontrols to LED layer
  ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
  ALSA: hda/conexant: Always enable the headset-mic pin on plugin
  ASoC: dapm: Fix off-by-one check on the second enum channel
  ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
  ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
  ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
  ASoC: soc-generic-dmaengine: Fix DMA channel request warning
  ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning
  ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
  ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
  ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt
  ALSA: usb-audio: Complete cleanup after system-resume errors
  ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
  ALSA: aoa: i2sbus: Check IRQ before requesting it
  ALSA: usb-audio: Skip mixer creation on M-Audio Venom
  ALSA: usb-audio: Skip reading sample rate on M-Audio Venom
  ASoC: rt766: add RT766/RT767 VA1 device IDs
  ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
  ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
  ...
2026-08-28 10:01:02 -07:00
Linus Torvalds
275bc4eedf RTC for 7.3
Subsystem:
  - patchwork project is moving to kernel.org
  - fully initialize clk_init_data
  - add missing MODULE_DEVICE_TABLE()
  - DT bindings conversions to DT schema
 
 Drivers:
  - ds1307: fix WADA bit for alarms on RX8130
  - rzn1: add support for RZ/T2H and RZ/N2H, many fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmqQtsEACgkQY6TcMGxw
 OjJlIhAAoIwDLpLYkKfiZ+WIEcYOQkEnU7TYGD9R01oNSlGFEUkKEd5oATm4Dmz7
 DfNYEFi6oPF+GJVQyVFQVxOroaKdfG80KW1ydXQVk7oMUuqW6L/juivjncGm17r+
 rzMOUaSFYOCGJkvsEqTNZBz6aBHV89pTIeuwDqeTrZvkJOUHDwcKvHh401AKnIif
 cylLWGu72ai8+qz/9+wBY7lVDEEnW4DsYc4JjLhpc5p7B/rtHgaiyuI57KvAOZLr
 QP3nO+Ffoj5D+WSuT/eebVujEj7FM8cGbQwDUqgGKfAvZg4HDqcnMwUp6j3/Z1nQ
 Zt3DRq760oZoW9lXZEKZEOcvGh7AY/xNwNjF5kG/vAYLuHzlsne4T50BvtijUHUP
 KvDN6yt3acWOnr/VTikuf84lpZEgm6lxBj2ek7uxMBkSm+L22LPXl0zIhrymiHLQ
 dyq/DLADmpKuJPhogRhqEcQ0xEh30R46oxR4+84rjMLW7kTjNoX52oZ+n7vDctmJ
 Z5Tgup65WfR3T4AKgB/DHAQYomisaAEXn+mw+QuwsIV3xrBoMaxuMVwqdN/nM6yY
 cu20yTZK5Ap/o0oFPDoYT9jQqmyipTvHVba0Q3XCD63qg5zGW3DU77KpbEDyIgSa
 g5uvWQHQMafJrhnCsTKJw8plMKxec63KWyIrDOXHFAppypZYBPA=
 =Br8X
 -----END PGP SIGNATURE-----

Merge tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

Pull RTC updates from Alexandre Belloni:
 "The RZN1 driver got a fairly comprehensive cleanup. More DT binding
  are converted to DT schema, leaving only 5 remaining files to convert.

  Subsystem:
   - patchwork project is moving to kernel.org
   - fully initialize clk_init_data
   - add missing MODULE_DEVICE_TABLE()
   - DT bindings conversions to DT schema

  Drivers:
   - ds1307: fix WADA bit for alarms on RX8130
   - rzn1: add support for RZ/T2H and RZ/N2H, many fixes"

* tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (42 commits)
  MAINTAINERS: update rtc subsystem patchwork location
  rtc: msc313: Select by default on MSTARV7
  rtc: microcrystal: Make sure clk_init_data is fully initialized
  rtc: philips: Make sure clk_init_data is fully initialized
  rtc: nct3018y: Make sure clk_init_data is fully initialized
  rtc: m41t80: Make sure clk_init_data is fully initialized
  rtc: hym8563: Make sure clk_init_data is fully initialized
  rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCs
  rtc: rzn1: Drop trailing comma from OF match table sentinel
  rtc: rzn1: Add OF match data to gate SUBU register access
  rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register access
  rtc: rzn1: Consistently use dev_err_probe()
  rtc: rzn1: Use temporary variable for struct device
  rtc: rzn1: Dynamically calculate synchronization delay based on clock rate
  rtc: rzn1: Replace remove callback with devm_add_action_or_reset()
  rtc: rzn1: Use pm_runtime_put_sync()
  rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESAS
  rtc: rzn1: Fix malformed MODULE_AUTHOR string
  rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
  rtc: rzn1: Fix alarm range check truncation on 32-bit systems
  ...
2026-08-28 09:53:43 -07:00
Linus Torvalds
afe0579334 Hi,
I had to think a lot how to put this into few paragraphs.  I hope this will
 makes sense to you and I'm not too confusing.
 
 The bulk of this pull request are Ross Philipson's TPM enablers for the
 Trenchboot patch series.  The commits expose TPM constants, and decouple
 and improve robustness of tpm_buf a bit in order to implement a minimal
 early TPM driver.
 
 Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on Intel
 before jumping into kernel's entry point.  They re-initalize TPM PCRs but
 leave up to the early boot code measure initrd, boot_params and Trenchboot
 associated metadata.
 
 The motivation here is just that we would want in future iterations of the
 series put our full focus to the x86 part of the review, and call it a day
 as per TPM changes.  Further, even if Trenchboot turned out to be empty
 lottery the worst possible outcome for TPM driver is that things get
 cleaned up a bit.
 
 BR, Jarkko
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCapClFwAKCRAaerohdGur
 0vM5AQDnmMUmfGD4aNBKx/b2gxPIgBy8KTGLDUp5sUSHGVGjuAEAzMLSz3BtTXSV
 7GaPKWp81egVjgp5/zxTbA83mEwfAwk=
 =Pq4i
 -----END PGP SIGNATURE-----

Merge tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull TPM updates from Jarkko Sakkinen:
 "The bulk of this is Ross Philipson's TPM enablement for Trenchboot.
  That exposes TPM constants, and decouple and improve robustness of
  tpm_buf a bit in order to implement a minimal early TPM driver.

  Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on
  Intel before jumping into kernel's entry point. They re-initalize TPM
  PCRs but leave up to the early boot code measure initrd, boot_params
  and Trenchboot associated metadata.

  The motivation here is just that we would want in future iterations of
  the series put our full focus to the x86 part of the review, and call
  it a day as per TPM changes. Further, even if Trenchboot turned out to
  be empty lottery the worst possible outcome for TPM driver is that
  things get cleaned up a bit"

* tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm-buf: Add TPM buffer support header for standalone reuse
  tpm-buf: Memory-safe allocations
  tpm-buf: Remove chip parameter from tpm_buf_append_handle()
  tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
  tpm: Remove main TPM header from TPM event log header
  tpm: Move platform specific definitions to the new PTP header
  tpm: Move TPM common base definitions to the command header
  tpm: Move TPM2 specific definitions to the command header
  tpm: Move TPM1 specific definitions to the command header
  tpm: Initial step to reorganize TPM public headers
  tpm: st33zp24: Validate locality read result
  tpm: st33zp24: Return zero on status read failure
  tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
  tpm: atmel: depend on X86
  tpm: Remove redundant dev_err()
  tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
2026-08-28 09:36:27 -07:00
Linus Torvalds
9df08cdd33 This push fixes a memory allocation overrun in crypto acomp.
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmqRLjEACgkQxycdCkmx
 i6dErxAApAYijF83H3Lg+dxKoLispqaTjT5yZKXZES19WBViPhuigDoxOA9Ca5EB
 L5UkSdC3hTKKd5f6DfyHpv44rnUSc178h+DpIaprHFHG3XJcl7pgPi87dNc7RkgD
 e9rBUi95VcJdT8OfTuGNd5xw/xL4IJA9uOJ93vLZduh8YzN0UzjYioMzIFFhbKNu
 gl6mGKfqh17DWRc44/WJYtH0Yu9wEQ06d1mXcLNILwshcLnv++5P0aRRMqTgtVib
 S6npHnci9LJW8f4zxJhfJzPKhA6Ln/GUOpCloSLhamqOVyrbaR9EVnD2TizRhQDy
 0VL6eardJBjJbclLTSt686+JMx6KVVqIWo81KgXlrXuEBPH1plrS5MRgv/yr595C
 1dVjqrJCivh6L4qWJLIxcb2NF1fWj6n7WV16Bxw69xW7I8FAJXZjSPN3UzB7PaQz
 Ei9+IL/Cz3n7oj52hatR1T3LO2yrhgzUaVfkvWqumlNH8wILPWHAbZz4/07uwEo7
 v8XqDXuChgn8JJH0fZ31tYEx8K1KfU09FdBqaTcZlMVOBDfKbfXovw0uONs1P+8h
 YJii2CdHrvOZxdLrta5NO7z2ZpNISpjmjvqendkExGV+7v/dxhesYKY98Js8WCBB
 z7ax+7sGzkEDMtzdxiXmCBl+PQoYazH9uiC8k9MXaFR/xo93Jgs=
 =fR1o
 -----END PGP SIGNATURE-----

Merge tag 'v7.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto fix from Herbert Xu:
 "Fix a memory allocation overrun in crypto acomp"

* tag 'v7.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: acomp - allocate async request context when cloning
2026-08-28 09:28:40 -07:00
Linus Torvalds
344be13211 ACPI support fix for 7.3-rc1
Revert an incomplete recent commit that may cause ACPI device
 power management to stop working.
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmqRrBQSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1msIIAKj2Xn9VA93zUk/XANzhM/k0yrapAuPx
 qrimF5LyaCLcNEQwfdlHQMK9gOwLIjWon89JQ/7qK1ynG1Bqc+1X60n+lD066cMh
 s2h24QXvMfO2Ax9TqexXxQuD4TW8v23mUZBXKE6CSjH5rtUuhqL5AspsibSTQiPK
 p1YN9e1SZjLlvx1L1e7ctvQmp3wOiTlhAfYzPzjp18P6LHI4taae+l97MXPIVWQU
 7vL6AbLZRt8UdGFiADkTtRpu+jA7ppTiCzA0r3i1WKkShLVuHioPXYG7eytSC2Tk
 pS026hi9qin7zMtAJxh2wwz1ZS/TzVtLhL5e7ZMUd425zRLy+RSR+Sc=
 =Q3HL
 -----END PGP SIGNATURE-----

Merge tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI support fix from Rafael Wysocki:
 "Revert an incomplete recent commit that may cause ACPI device power
  management to stop working"

* tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "ACPI: scan: Defer device power initialization"
2026-08-28 09:09:01 -07:00
Linus Torvalds
9d607ae0f7 arm64 fixes for -rc1
- Fix address handling of final memory region in ptdump
 
 - Fix emulation of decrementing load/store multiple from 32-bit task
 
 - Fix SCTLR context-switching for store-only MTE mode
 
 - Fix numerous issues in MTE selftests
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmqRTQQQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNAXpCADI7oz3aSuRJ3aRmMz5Vv4EvPjTrNcc5gi0
 H91Qkl+UMN0DJGqt+1ZZBhm6Kv3rvrtj6UaEk1SycEV+jg2IWbhd1C1UTZCd5Lf9
 0jiJdsoOgeTKahhFX9pU+QJCNpFqI+DORc+TYWB2uwN39OWPrHOXgJtdePNNYb1h
 UyCIRK+PEbXnA6LDxWokuzO70EddRIcpW2eT7WOWpgA2FNwN5DzsXdviosylZAtp
 xhjvpTJv/LNbMeBXalH91IKDbRCAWEvEY8j2BSOkcFxGFOA3aXrVh5sWKdFeqKis
 VoWZQTDtpHj1Mw0eCMn77H0r6uxXn/skCcd8pwfIFA7EnGguAcBB
 =/QWC
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
 "A mixture of ptdump, compat and MTE fixes that came in during the
  merge window:

   - Fix address handling of final memory region in ptdump

   - Fix emulation of decrementing load/store multiple from 32-bit task

   - Fix SCTLR context-switching for store-only MTE mode

   - Fix numerous issues in MTE selftests"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  selftests/arm64: Add MTE test config fragment
  selftests/arm64: Fix MTE prctl TAP plan
  selftests/arm64: Treat KSM merge_across_nodes as optional
  selftests/arm64: Print missing MTE TAP headers
  arm64: compat: Fix decrementing LDM/STM alignment emulation
  arm64: process: Fix context switching MTE store-only tag check
  KVM: arm64: ptdump: Flush the last region
  arm64: ptdump: Make note_page_flush() range aware
2026-08-28 09:02:04 -07:00
Linus Torvalds
72ecc30d60 Xtensa updates for v7.3
- use strnlen() to improve iss_console_write()
 - remove unused function setup_profiling_timer()
 - fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAmqRXFYTHGpjbXZia2Jj
 QGdtYWlsLmNvbQAKCRBR+cyR+D+gRJ0MD/4tuDraKBOimGv/U23u8Aphgc7z8TSH
 fyy6kHKLMfAX4rJ1ks/91urzOCZ9xX81DNNGF4KxGeB+YAEhUn7Su+dA5v2Aay8O
 o9oZaT9IZybxu+OF54N4HBYmbVKA6qh283daW7ZBDtKNPQUmmmxKnCjoZv1bJF4D
 Qa8cmmRsgK/t9S5MUmgqpij3d4EnD8zK6uRRNy5r1NPPRi+TPWugDt9h/ZaSQ9+/
 nReqRu8q3xn9Xuy3zus27kd5KdnUDKM51boBEvh74OpPbL58HINlyPf3VdyHTOfH
 ZM2RQS8UZWmlHpbVNlrH+zRMShQKSIPWDEidP5P4oGs+jiEnuYUKDuRQlUQwdIbL
 BSxuRXe18AWN1kDbZkdCuLtKPL9ayxBD0/tgFIdUpropET77jGl7VnVDxCtOvJxk
 cfAM+qG9kER6+HsAzGo0T0o4n7oTNQ++TIaDRI+E1Yvd+E5FKfQhbG+kWaM9SB+y
 T/Ht4OTgF2QSflCg5T+4PBJmrTC9AUHDpZFp/SIF5agTsNCEU6x4jcYYiaREAIDK
 E5S2xBONUBdakNWevzT/c0M3NxbcTf0Zkmxx2y/A9HtrmPMjdIRPRaMBc2csO5he
 M70l70SLoOtmQFLIAOP3FuCc5CuiWaxMFj8nCvVu7UUiBHOr6Q939n5+j8h1EsXJ
 qsDBz6otDoR6Cg==
 =Lvt4
 -----END PGP SIGNATURE-----

Merge tag 'xtensa-20260828' of https://github.com/jcmvbkbc/linux-xtensa

Pull Xtensa updates from Max Filippov:

 - use strnlen() to improve iss_console_write()

 - remove unused function setup_profiling_timer()

 - fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment

* tag 'xtensa-20260828' of https://github.com/jcmvbkbc/linux-xtensa:
  xtensa: remove unused setup_profiling_timer function
  xtensa: correct CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment
  tty: xtensa/iss: use strnlen to improve iss_console_write
2026-08-28 08:55:47 -07:00
Linus Torvalds
874b43b9f3 m68knommu: updates and fixes for v7.3
, new defconfigs for 2 more ColdFire boards
 . change to use linux/gpio/legacy.h
 . add platform setup for reset device of the 5441x SoC boards
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmqQ02gQHGdlcmdAa2Vy
 bmVsLm9yZwAKCRBOJBWpob0vgLezD/9e8dYKwAtkclfd6wkSBVoBIG2f3yFWKDaf
 0lAV/oZJjvo4lEAbS4ADzQUnFjn+MIQBRi9QL4TaekDJx612BNK3OF71etOT/7o6
 h0EylRBoZ6SDSjFlm9jEtf+nu1XzlfAwRkE229pKAmPK0OBI9+z0/XQTjCh8Ag8h
 1afRS3DoPDpku8vIU24LlbUtD89m1YjesRayL2KI7mBS4TTatGo+IeGPNlmJGIcz
 03SytqwhxK3r1QNecOOVDOpxx9efPHWNkgo5fDi+N3XkPRm2X3ruAlsGbfvbNeZG
 pi30nugw57oAzBrUGSKYetdd9v/452Q336+CiDG1rVTQiJomgcW6Gu+Ps5jS9JpD
 b8aujjCnGVmfD7r3VQG4o96dgQFvB2hM4zQtslTagbTAWUYOBcDNSgtClGkfS2OB
 gxBTPGS0Ulos2CzQWoPW4LqP3k+8EcEsLUb5CNZGX3XlAWeoFOunS4lmtdxqJ7hD
 ndtINEBUE74C6+ns3RvIKhUKKZOIqwkqxYdw2ScsPxJlupDZssFdBEVEh4AQkFz8
 UywfPwG6pWXD2Qj/FPpX3miU79jl9gawfnZv+KT9VZy+KjoZrS05WfrFFu9AB4rI
 BR8kXnynUCpn4RWqWVF+z+sJSPwWqJbQmZU5uyithMUb0OFyWzKFvggVja4B0Qit
 nbb09BEuWA==
 =JjnP
 -----END PGP SIGNATURE-----

Merge tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu

Pull m68knommu updates from Greg Ungerer:
 "This includes a couple more new defconfigs to improve test build
  coverage, changes to use the more correct linux/gpio/legacy.h and
  platform setup for the reset device of the ColdFire 5441x SoC
  hardware.

   - new defconfigs for 2 more ColdFire boards

   - change to use linux/gpio/legacy.h

   - add platform setup for reset device of the 5441x SoC boards"

* tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68k: coldfire/5441x: register mcf-rcm-reset platform device
  m68k/coldfire: replace linux/gpio.h inclusions
  m68k: defconfig: add config for M5282EVB board
  m68k: defconfig: add config for M52358EVB board
2026-08-28 08:44:36 -07:00
Dave Airlie
a8b02aa825 amd-drm-next-7.3-2026-08-27:
amdgpu:
 - MES fixes
 - Userq fixes
 - UVD fix
 - VCE 3 fix
 - Enforce isolation fix
 - HPD fix for VGA/LVDS
 - DML fix
 - DCN 6 fixes
 - DC gpu reset fix
 
 amdkfd:
 - CU occupancy for GFX 11
 - CU occupancy for GFX 12/12.1
 - Queue bounds checking fix
 - SVM fixes
 - CRIU bounds checking fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCapCelwAKCRC93/aFa7yZ
 2FOmAP9u55LTGI137PLTeFN9INERvW8NcYsyhW2BHRR60cA9mQEAmvepnMcTMrtC
 yYey6hwuRp/8KYCbxk2bd7TK+ZUbGQE=
 =rLPa
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-7.3-2026-08-27' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-7.3-2026-08-27:

amdgpu:
- MES fixes
- Userq fixes
- UVD fix
- VCE 3 fix
- Enforce isolation fix
- HPD fix for VGA/LVDS
- DML fix
- DCN 6 fixes
- DC gpu reset fix

amdkfd:
- CU occupancy for GFX 11
- CU occupancy for GFX 12/12.1
- Queue bounds checking fix
- SVM fixes
- CRIU bounds checking fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260827203610.3249084-1-alexander.deucher@amd.com
2026-08-28 13:31:33 +10:00
Dave Airlie
1dd31281a6 Cross-subsystem Changes:
- i2c global register definitions as dependency for xe/i2c fixes. (Heikki)
 
 Driver Changes:
 - Media workardound (Daniele)
 - Add CCS to gt_idle debugfs print (Bala)
 - Page fault related fix (Arvind)
 - i2c related fixes (Heikki)
 - System Controller mailbox bit fix (Anoop)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmqQaxYACgkQ+mJfZA7r
 E8qk4Af/bhSe/FRSilbfWyH++BqBM2141oAtR2TXyZCEdRPSEr4sBLAJ0UlZyrKE
 50gVsvnmwpBMnb/h4AQWRnAEjs8FahgkDeRECwj8HXfBvAM5i/jA3v7r3DnP8WOL
 cNmdv8l+Bs6JO60bjsfjiDo6HFQfvfvk52Tbn1xw/zX9jlugm18Vl4tg5U7H0jaK
 60QCgRNN3CJtFFW7Xb9qwJuVkchOxijnx5o9N57ms/6riXLSquwFvCxTqvRMO5mJ
 RVJpMgaU3qRz0XWi8eA+jF5a8bBUksrf3xiDhOpO3jSdzgIoXXkHPer+nDJFld15
 H4K0WtUwGuULXjL6euh7AC/e9GOrSw==
 =3/XE
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-next-fixes-2026-08-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

Cross-subsystem Changes:
- i2c global register definitions as dependency for xe/i2c fixes. (Heikki)

Driver Changes:
- Media workardound (Daniele)
- Add CCS to gt_idle debugfs print (Bala)
- Page fault related fix (Arvind)
- i2c related fixes (Heikki)
- System Controller mailbox bit fix (Anoop)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/apBrVgvZwIRIfuhR@intel.com
2026-08-28 13:14:52 +10:00