mirror of
https://github.com/torvalds/linux.git
synced 2026-05-12 16:18:45 +02:00
d78ceee1e6
1428475 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Askar Safin
|
d78ceee1e6 |
.get_maintainer.ignore: add myself
I don't want get_maintainer.pl to automatically print my email. Signed-off-by: Askar Safin <safinaskar@gmail.com> Link: https://patch.msgid.link/20260324082928.3473789-1-safinaskar@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Ivan Vera
|
f9b88613ff |
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
Buffer size used in dma allocation and memcpy is wrong.
It can lead to undersized DMA buffer access and possible
memory corruption. use correct buffer size in dma_alloc_coherent
and memcpy.
Fixes:
|
||
|
Christian Eggers
|
48b5163c95 |
nvmem: imx: assign nvmem_cell_info::raw_len
Avoid getting error messages at startup like the following on i.MX6ULL:
nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4
nvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4
This shouldn't cause any functional change as this alignment would
otherwise be done in nvmem_cell_info_to_nvmem_cell_entry_nodup().
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Xingjing Deng
|
6a502776f4 |
misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
In the SDSP probe path, qcom_scm_assign_mem() is used to assign the
reserved memory to the configured VMIDs, but its return value was not checked.
Fail the probe if the SCM call fails to avoid continuing with an
unexpected/incorrect memory permission configuration.
This issue was found by an in-house analysis workflow that extracts AST-based
information and runs static checks, with LLM assistance for triage, and was
confirmed by manual code review.
No hardware testing was performed.
Fixes:
|
||
|
Xingjing Deng
|
ba2c83167b |
misc: fastrpc: possible double-free of cctx->remote_heap
fastrpc_init_create_static_process() may free cctx->remote_heap on the
err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()
frees cctx->remote_heap again if it is non-NULL, which can lead to a
double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg
device is subsequently removed/unbound.
Clear cctx->remote_heap after freeing it in the error path to prevent the
later cleanup from freeing it again.
This issue was found by an in-house analysis workflow that extracts AST-based
information and runs static checks, with LLM assistance for triage, and was
confirmed by manual code review.
No hardware testing was performed.
Fixes:
|
||
|
Deepanshu Kartikey
|
93853512f5 |
comedi: dt2815: add hardware detection to prevent crash
The dt2815 driver crashes when attached to I/O ports without actual hardware present. This occurs because syzkaller or users can attach the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl. When no hardware exists at the specified port, inb() operations return 0xff (floating bus), but outb() operations can trigger page faults due to undefined behavior, especially under race conditions: BUG: unable to handle page fault for address: 000000007fffff90 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:dt2815_attach+0x6e0/0x1110 Add hardware detection by reading the status register before attempting any write operations. If the read returns 0xff, assume no hardware is present and fail the attach with -ENODEV. This prevents crashes from outb() operations on non-existent hardware. Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Cc: stable <stable@kernel.org> Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc Tested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/] Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/ Link: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Edward Adam Davis
|
29f644f14b |
comedi: runflags cannot determine whether to reclaim chanlist
syzbot reported a memory leak [1], because commit |
||
|
Ian Abbott
|
4b9a9a6d71 |
comedi: Reinit dev->spinlock between attachments to low-level drivers
`struct comedi_device` is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member `spinlock` containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit |
||
|
Ian Abbott
|
cc797d4821 |
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards. Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
Fixes:
|
||
|
Ian Abbott
|
3fb43a7a5b |
comedi: me4000: Fix potential overrun of firmware buffer
`me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Note: The firmware loading was totally broken before commit |
||
|
Ian Abbott
|
101ab946b7 |
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
If the driver's COMEDI "attach" handler function (`atmio16d_attach()`)
returns an error, the COMEDI core will call the driver's "detach"
handler function (`atmio16d_detach()`) to clean up. This calls
`reset_atmio16d()` unconditionally, but depending on where the error
occurred in the attach handler, the device may not have been
sufficiently initialized to call `reset_atmio16d()`. It uses
`dev->iobase` as the I/O port base address and `dev->private` as the
pointer to the COMEDI device's private data structure. `dev->iobase`
may still be set to its initial value of 0, which would result in
undesired writes to low I/O port addresses. `dev->private` may still be
`NULL`, which would result in null pointer dereferences.
Fix `atmio16d_detach()` by checking that `dev->private` is valid
(non-null) before calling `reset_atmio16d()`. This implies that
`dev->iobase` was set correctly since that is set up before
`dev->private`.
Fixes:
|
||
|
Adam Crosser
|
d1857f8296 |
gpib: fix use-after-free in IO ioctl handlers
The IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor pointer after board->big_gpib_mutex has been released. A concurrent IBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during this window, causing a use-after-free. The IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly release big_gpib_mutex before calling their handler. wait_ioctl() is called with big_gpib_mutex held, but ibwait() releases it internally when wait_mask is non-zero. In all four cases, the descriptor pointer obtained from handle_to_descriptor() becomes unprotected. Fix this by introducing a kernel-only descriptor_busy reference count in struct gpib_descriptor. Each handler atomically increments descriptor_busy under file_priv->descriptors_mutex before releasing the lock, and decrements it when done. close_dev_ioctl() checks descriptor_busy under the same lock and rejects the close with -EBUSY if the count is non-zero. A reference count rather than a simple flag is necessary because multiple handlers can operate on the same descriptor concurrently (e.g. IBRD and IBWAIT on the same handle from different threads). A separate counter is needed because io_in_progress can be cleared from unprivileged userspace via the IBWAIT ioctl (through general_ibstatus() with set_mask containing CMPL), which would allow an attacker to bypass a check based solely on io_in_progress. The new descriptor_busy counter is only modified by the kernel IO paths. The lock ordering is consistent (big_gpib_mutex -> descriptors_mutex) and the handlers only hold descriptors_mutex briefly during the lookup, so there is no deadlock risk and no impact on IO throughput. Signed-off-by: Adam Crosser <adam.crosser@praetorian.com> Cc: stable <stable@kernel.org> Reviewed-by: Dave Penkler <dpenkler@gmail.com> Tested-by: Dave Penkler <dpenkler@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Johan Hovold
|
5cefb52c1a |
gpib: lpvo_usb: fix memory leak on disconnect
The driver iterates over the registered USB interfaces during GPIB
attach and takes a reference to their USB devices until a match is
found. These references are never released which leads to a memory leak
when devices are disconnected.
Fix the leak by dropping the unnecessary references.
Fixes:
|
||
|
Dave Penkler
|
579af7204d |
gpib: Fix fluke driver s390 compile issue
The following errors were reported for a s390 randconfig build
of the fluke gpib driver:
>> drivers/gpib/eastwood/fluke_gpib.c:1002:23: error: call to undeclared function 'ioremap'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
1002 | nec_priv->mmiobase = ioremap(e_priv->gpib_iomem_res->start,
| ^
>> drivers/gpib/eastwood/fluke_gpib.c:1002:21: error: incompatible integer to pointer conversion assigning to 'void *' from 'int' [-Wint-conversion]
1002 | nec_priv->mmiobase = ioremap(e_priv->gpib_iomem_res->start,
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1003 | resource_size(e_priv->gpib_iomem_res));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpib/eastwood/fluke_gpib.c:1036:33: error: incompatible integer to pointer conversion assigning to 'void *' from 'int' [-Wint-conversion]
1036 | e_priv->write_transfer_counter = ioremap(e_priv->write_transfer_counter_res->start,
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1037 | resource_size(e_priv->write_transfer_counter_res));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Add HAS_IOMEM dependency to Kconfig for fluke driver option
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601221748.AFAqHieJ-lkp@intel.com/
Fixes:
|
||
|
Greg Kroah-Hartman
|
3e68690a2a |
Counter fixes for 7.0
Two fixes for rz-mut3-cnt: synchronize runtime PM usage count to toggle state of the counter, and set counter->parent during probe to ensure the current dev pointer is accessed during driver operation. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSNN83d4NIlKPjon7a1SFbKvhIjKwUCac0KswAKCRC1SFbKvhIj KwpdAP96icPtsP5KIdKeCvozhO32RxVGBCgxgvVLDeZyiAovPgEAnpR9jSfLKEoe M+2hXectvTu0B7FQkuUFrg+z40q/Qgw= =j3fm -----END PGP SIGNATURE----- Merge tag 'counter-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 7.0 Two fixes for rz-mut3-cnt: synchronize runtime PM usage count to toggle state of the counter, and set counter->parent during probe to ensure the current dev pointer is accessed during driver operation. * tag 'counter-fixes-for-7.0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member counter: rz-mtu3-cnt: prevent counter from being toggled multiple times |
||
|
Ard Biesheuvel
|
f40b1401b6 |
lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided
The lis3lv02d started triggering a WARN in the IRQ code because it passes IRQF_ONESHOT to request_threaded_irq() even when thread_fn is NULL, which is an invalid combination. So set the flag only if thread_fn is non-NULL. Cc: Eric Piel <eric.piel@tremplin-utc.net> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Link: https://patch.msgid.link/20260326180436.14968-2-ardb@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Randy Dunlap
|
8c0ef7b56d |
lis3lv02d: fix kernel-doc warnings
Use the correct kernel-doc format to avoid kernel-doc warnings: Warning: include/linux/lis3lv02d.h:125 struct member 'st_min_limits' not described in 'lis3lv02d_platform_data' Warning: include/linux/lis3lv02d.h:125 struct member 'st_max_limits' not described in 'lis3lv02d_platform_data' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260312051400.682991-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Geert Uytterhoeven
|
6933515291 |
misc/mei: INTEL_MEI should depend on X86 or DRM_XE
The Intel Management Engine Interface is only present on x86 platforms
and Intel Xe graphics cards. Hence add a dependency on X86 or DRM_XE,
to prevent asking the user about this driver when configuring a kernel
for a non-x86 architecture and without Xe graphics support.
Fixes:
|
||
|
Alexander Usyskin
|
8c27b1bce0 |
mei: me: reduce the scope on unexpected reset
After commit |
||
|
Alice Ryhl
|
ec327abae5 |
rust_binder: use AssertSync for BINDER_VM_OPS
When declaring an immutable global variable in Rust, the compiler checks
that it looks thread safe, because it is generally safe to access said
global variable. When using C bindings types for these globals, we don't
really want this check, because it is conservative and assumes pointers
are not thread safe.
In the case of BINDER_VM_OPS, this is a challenge when combined with the
patch 'userfaultfd: introduce vm_uffd_ops' [1], which introduces a
pointer field to vm_operations_struct. It previously only held function
pointers, which are considered thread safe.
Rust Binder should not be assuming that vm_operations_struct contains no
pointer fields, so to fix this, use AssertSync (which Rust Binder has
already declared for another similar global of type struct
file_operations with the same problem). This ensures that even if
another commit adds a pointer field to vm_operations_struct, this does
not cause problems.
Fixes:
|
||
|
Greg Kroah-Hartman
|
80ffc54d04 |
IIO: 3rd set of fixes for the 7.0 cycle.
Note that this pull is in addition to the 2nd set of such fixes that are waiting to be picked up. Absolutely fine to queue these for the merge window if that makes more sense. Usual mixed back of ancient issues surfacing and newer problems. adi,ad57770r - Stop eating an error in read_raw. adi,adxl313 - Check return of regmap_write() instead of ignoring it in one place. adi,adxl355 - Fix the description of the temperature channel to be unsigned rather than signed. bosch,bmi160 - Avoid use of uninitialized data. - Fix validation of small reference voltages. hid-sensor-rotation: - The timestamp location in this driver has unfortunately been broken for a long time. Given it was correct for 6 years and then broken for the next 6 years, use a one off hack to duplicate it in both locations. The issue was as a result of the unique nature of quaternion representation combined with large precision resulting in an 128 bit aligned channel. nxp,sar-adc - Avoid leaking a dma channel. rfdigital,rfd77402 - Close a race between reinit_completion() and the irq happening. ti,adc161s626 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. - Ensure a DMA safe buffer is used. vishay,vcnl4035 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. vishay,veml6070 - Fix return value mess up that occurred when doing a guard() conversion. -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmnJGFwRHGppYzIzQGtl cm5lbC5vcmcACgkQVIU0mcT0Foiz2Q//aVj7yTLqyki8lyjRIC6sJZBjELz1SOym NNtcKZMvhXQvFWmBXfZf2/3XcIgvaXqST+FVnUItTfoWFRKueduB4P02rRw9linG 0oyZYVOJVBR9T4PK22IDdOEzS786UpkvIhuVUbYm2zFQrEl9aClU3tW8rNrc3lQu 4FaHDH52OJAMumzbwmejLgR+AKywyzIPJwyB3PBux592Y+h5gkWMPqVBSRueGG8G JwI/vM3X9OkEYabSgitWnR9HpJwXMomF0p0g9tpjb7xvdzYD2qOb1X9QP0SZKWDS z+aacE2c2OqjQ+YALCkVAH1qzsnm1VIDIklZ4U9776LejII4ap6QObgNebNJdWV2 ziUg1zlBuzXnnEdxaiWy1N+JZT7hpG8kHgzgmZj+yvETKfwt/ZGCbHvTaNsBAfNc i3O88OQJDiHIC9tlKJzjw+eXBgVkvjb3mJt0fnJlolfj6Tm/e08MO+bXsQtFVA4o DAcFW2aaKGWQ4OjvrTXlGoeN9ExE3hMRWC4j4wq2GpnZ1kzBwtUVB21O80H95FTl Cjgbqqe9YjSDXFzAZNSMY9ElLcfrwjVpq2PXp5hCblSOI77GFcxr+lN73u6XrtkM 0VInTc/J5CqizIywanMB27XUe1c1o7e5vqWlUX+SSK2b193E0qnKZNYeptBUjve0 txhekWre+Kg= =AXzp -----END PGP SIGNATURE----- Merge tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: 3rd set of fixes for the 7.0 cycle. Note that this pull is in addition to the 2nd set of such fixes that are waiting to be picked up. Absolutely fine to queue these for the merge window if that makes more sense. Usual mixed back of ancient issues surfacing and newer problems. adi,ad57770r - Stop eating an error in read_raw. adi,adxl313 - Check return of regmap_write() instead of ignoring it in one place. adi,adxl355 - Fix the description of the temperature channel to be unsigned rather than signed. bosch,bmi160 - Avoid use of uninitialized data. - Fix validation of small reference voltages. hid-sensor-rotation: - The timestamp location in this driver has unfortunately been broken for a long time. Given it was correct for 6 years and then broken for the next 6 years, use a one off hack to duplicate it in both locations. The issue was as a result of the unique nature of quaternion representation combined with large precision resulting in an 128 bit aligned channel. nxp,sar-adc - Avoid leaking a dma channel. rfdigital,rfd77402 - Close a race between reinit_completion() and the irq happening. ti,adc161s626 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. - Ensure a DMA safe buffer is used. vishay,vcnl4035 - Fix up buffer handling on big endian hosts which was broken due to casting of pointers to different sized integers. vishay,veml6070 - Fix return value mess up that occurred when doing a guard() conversion. * tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: light: veml6070: fix veml6070_read() return value iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode iio: accel: adxl313: add missing error check in predisable iio: dac: ad5770r: fix error return in ad5770r_read_raw() iio: accel: fix ADXL355 temperature signature value iio: light: vcnl4035: fix scan buffer on big-endian iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() iio: adc: ti-adc161s626: fix buffer read on big-endian iio: dac: mcp47feb02: Fix Vref validation [1-999] case iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace iio: proximity: rfd77402: Fix completion race condition in IRQ mode |
||
|
Greg Kroah-Hartman
|
37276dd6b6 |
IIO: 2nd set of fixes for the 7.0 cycle
Usual mixed bag of fixes for recent code and much older issues that have surfaced. Biggest group are continued resolution of IRQF_ONE_SHOT being used incorrectly (which now triggers a warning) adi,ad4062 - Replace IRQF_ONESHOT (as no threaded handler) with IRQF_NO_THREAD as the caller makes use of iio_trigger_poll() which cannot run from a thread. adi,ade9000 - Move mutex_init() earlier to ensure it is available if spurious IRQ occurs. adi,adis16550 - Fix swapped gyro and accel filter functions. adi,adxl3380 - Fix some bit manipulation that was always resulting in 0. - Fix incorrect register map for calibbias on the active power channel. - Fix returning IRQF_HANDLED from a function that should return 0 or -ERRNO. aspeed,adc - Clear a reference voltage bit that might be set prior to driver load. bosch,bno055 - Off by one channel buffer sizing. Benine due to padding prior to the subsequent timestamp. hid-sensors - A more complex fix to IRQF_ONESHOT warning as this driver had a trigger that was never actually used but the ABI that exposed had to be maintained to avoid regressions. hid-sensors-rotation - An obscure buffer alignment case that applies to quaternions only was recently broken resulting in writes beyond the end of the channel buffer. Add a new core macro and apply it in this driver to make it very clear what was going on. honeywell,abp2030pa - Remove meaningless IRQF_ONESHOT from a non threaded IRQ handler. Warning fix only. invense,mpu3050 - Fix token passed to free_irq() to match the one used at setup. - Fix an irq resource leak in error path. - Reorder probe so that userspace interfaces are exposed only after everything else has finished. - Reorder remove slightly to cleanup the buffer only after irq removed ensuring reverse of probe sequence. microchip,mcp47feb02 - Fix use of mutex before it was initialized by not performing unnecessary lock that was early enough in probe that all code was serial. st,lsm6dsx - Ensure that FIFO ODR is only controllable for accel and gyro channels avoiding incorrect register accesses. - Restrict separation of buffer sampling from main sampling rate to accelerometer. It is only useful for running event detection faster than the fifo and the only events are on the accelerometer. ti,ads1018 - Fix overflow of u8 which wasn't big enough to store max data rate value. ti,ads1119: - Fix unbalanced pm in an error path. - IRQF_ONESHOT (as no threaded handler) replaced with IRQF_NO_THREAD (needed for iio_trigger_poll()). - Ensure complete reinitialized before reuse. Previously it would have completed immediate after the first time. ti,ads7950 - Fix return value of gpio_get() to be 0 or 1. - Avoid accidental overwrite of state resulting in gpio_get() only returning 0 or -ERRNO but never 1. -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmm1PpURHGppYzIzQGtl cm5lbC5vcmcACgkQVIU0mcT0FojACQ/8CkIpTOWqybGXUSiuv/MWkyaTrlh7wfAg esL4Wf1kfbtfnZ30uh8k8oLF3b40k1AjjjqtKVkc0Bu3SuOG9+KsSlgztbBxkBs4 WWhBBW1ZFEOn6Yldu0zjF99CrnsK03uYbFruMUTh2H/dV47UX4e48ZoVmP5BZsjt zdwIvSf+GYZCP0LcYMeLJECknVEBMK7tpa1OMffVsyWcmt7b3FpTk25q4jrhvM6Z PaZLVkBBFxKdYDBBr2eIboS8+Lo55I1s6/FghY9MnlDFM41lPKlBT+GH0bUT2ion LIOjIyUVlN6+mZHCTB2TPUR0ywibG/IsjoSR8zYkJMQ1FBW6zUAItMyCofbQHL2e NrmviAUcSReEhvGjnOK4+OZlSGQbLMu8eoYFU857x0QVg7hcNzrVviIVZie1WlQS 8Hd3Lm3sXaDC6oN1ULxDmXriOvaPDFxUqzn8AhlvAiOXNqnbBWFmdGosQ3q5rklW vjpZh/1YRJ1wActcGJoMCTfbfOuyCc7Xt4E8fqk3tNfJlXHEY0DYc5agjjdrGhzA mVtfm3Ab8glz/vcq72SUVcxL/qVqvZHjEVho701bySIMj+aZwQGwM8KnG/5QaazQ euBr5hcfc12JtbrjN3Jpn6Wog7pF+Xzqza7mUnkUYrNQ3s0mGewRgBr2EzeXvnot KWiLytre94M= =JTTZ -----END PGP SIGNATURE----- Merge tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linux Jonathan writes: IIO: 2nd set of fixes for the 7.0 cycle Usual mixed bag of fixes for recent code and much older issues that have surfaced. Biggest group are continued resolution of IRQF_ONE_SHOT being used incorrectly (which now triggers a warning) adi,ad4062 - Replace IRQF_ONESHOT (as no threaded handler) with IRQF_NO_THREAD as the caller makes use of iio_trigger_poll() which cannot run from a thread. adi,ade9000 - Move mutex_init() earlier to ensure it is available if spurious IRQ occurs. adi,adis16550 - Fix swapped gyro and accel filter functions. adi,adxl3380 - Fix some bit manipulation that was always resulting in 0. - Fix incorrect register map for calibbias on the active power channel. - Fix returning IRQF_HANDLED from a function that should return 0 or -ERRNO. aspeed,adc - Clear a reference voltage bit that might be set prior to driver load. bosch,bno055 - Off by one channel buffer sizing. Benine due to padding prior to the subsequent timestamp. hid-sensors - A more complex fix to IRQF_ONESHOT warning as this driver had a trigger that was never actually used but the ABI that exposed had to be maintained to avoid regressions. hid-sensors-rotation - An obscure buffer alignment case that applies to quaternions only was recently broken resulting in writes beyond the end of the channel buffer. Add a new core macro and apply it in this driver to make it very clear what was going on. honeywell,abp2030pa - Remove meaningless IRQF_ONESHOT from a non threaded IRQ handler. Warning fix only. invense,mpu3050 - Fix token passed to free_irq() to match the one used at setup. - Fix an irq resource leak in error path. - Reorder probe so that userspace interfaces are exposed only after everything else has finished. - Reorder remove slightly to cleanup the buffer only after irq removed ensuring reverse of probe sequence. microchip,mcp47feb02 - Fix use of mutex before it was initialized by not performing unnecessary lock that was early enough in probe that all code was serial. st,lsm6dsx - Ensure that FIFO ODR is only controllable for accel and gyro channels avoiding incorrect register accesses. - Restrict separation of buffer sampling from main sampling rate to accelerometer. It is only useful for running event detection faster than the fifo and the only events are on the accelerometer. ti,ads1018 - Fix overflow of u8 which wasn't big enough to store max data rate value. ti,ads1119: - Fix unbalanced pm in an error path. - IRQF_ONESHOT (as no threaded handler) replaced with IRQF_NO_THREAD (needed for iio_trigger_poll()). - Ensure complete reinitialized before reuse. Previously it would have completed immediate after the first time. ti,ads7950 - Fix return value of gpio_get() to be 0 or 1. - Avoid accidental overwrite of state resulting in gpio_get() only returning 0 or -ERRNO but never 1. * tag 'iio-fixes-for-7.0b' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (25 commits) iio: imu: adis16550: fix swapped gyro/accel filter functions iio: adc: aspeed: clear reference voltage bits before configuring vref iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() iio: adc: ti-ads1018: fix type overflow for data rate iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() iio: adc: ti-ads7950: normalize return value of gpio_get iio: orientation: hid-sensor-rotation: fix quaternion alignment iio: add IIO_DECLARE_QUATERNION() macro iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one iio: hid-sensors: Use software trigger iio: adc: ad4062: Replace IRQF_ONESHOT with IRQF_NO_THREAD iio: gyro: mpu3050: Fix out-of-sequence free_irq() iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Fix incorrect free_irq() variable iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only iio: dac: mcp47feb02: Fix mutex used before initialization iio: adc: ade9000: fix wrong return type in streaming push ... |
||
|
Greg Kroah-Hartman
|
76dd7c74fd |
interconnect fix for v7.0-rc
This contains one driver fix for the current cycle. - interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() Signed-off-by: Georgi Djakov <djakov@kernel.org> -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEExQ4tCsdmOu34XfMFgNDMCsbYFmMFAmnCqX8ACgkQgNDMCsbY FmP7/hAAgyciZSmTF38nkOxsQokFogqVZ8YVygD0mG9CK2JL3cESaDVTPRg88fgX gAYqtnNDxNzdvTY2ZFk5JX60aym/PPn2eGHPRLSqrOTeVsCIi/SMAT8TxQ4tqCuY RofCKrktUEXpJy3gsP7Q4mLm/yCtKELLhxq8vc0ko9/35A+GgqWJtzyWOkW/3qnW XLORjLPwLJx5/hc+TqtQbGJzYfh9OhfJYXZU01auWeArlFp8Y3LLR/LJx9aySfkq g9IdGX7h6HHrEpOhMoZYNnUWGauMb4qMo7B5r9Cgr5KnW56Hk6sOBdvIszu283EM K3gxna2hLcua9JbgVLm1XUlLgu5fXb1K/+oh89qiSPSAwUK2f6dMD83uVS3FsGxG HvryvOyg748L8u8qnulctdmRY++yg1yfH5lTdfoYInkml1YVQ+kJZZ0la2jJoCpJ wkvpZP0LBlHeejGMyJ/q2r7aMcJLLO8UJi96YZtU1FU824jIxXwmokm3l9JtPcAR 0Fg0DE3dULGPULJ89b4nwPKVFUN34GqcfqmMMZmXCJtubPV4yy+PvE6KS7PlzG4o eWxMU7eTFh8tTlG2EiRZoAC36CCwOsKDV82BESn6Qkvd/pVQ+NubrmbhBRAaCMXP 1Wp3eUXK05JoCo9gOql2hJH34/tPQfmq9W14oZfDPeo87+Gz2TY= =3arT -----END PGP SIGNATURE----- Merge tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus interconnect fix for v7.0-rc This contains one driver fix for the current cycle. - interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() Signed-off-by: Georgi Djakov <djakov@kernel.org> * tag 'icc-7.0-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() |
||
|
Aldo Conte
|
d0b224cf9a |
iio: light: veml6070: fix veml6070_read() return value
veml6070_read() computes the sensor value in ret but
returns 0 instead of the actual result. This causes
veml6070_read_raw() to always report 0.
Return the computed value instead of 0.
Running make W=1 returns no errors. I was unable
to test the patch because I do not have the hardware.
Found by code inspection.
Fixes:
|
||
|
Felix Gu
|
2452969ca1 |
iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode
The DMA channel was requested in nxp_sar_adc_buffer_postenable() but
was only released in nxp_sar_adc_buffer_software_do_predisable().
This caused a DMA channel resource leak when operating in trigger mode.
Fix this by moving dma_request_chan() from
nxp_sar_adc_buffer_postenable() into
nxp_sar_adc_buffer_software_do_postenable(), ensuring the DMA channel
is only requested in software mode.
Fixes:
|
||
|
Antoniu Miclaus
|
9d3fa23d5d |
iio: accel: adxl313: add missing error check in predisable
Check the return value of the FIFO bypass regmap_write() before
proceeding to disable interrupts.
Fixes:
|
||
|
Antoniu Miclaus
|
c354521708 |
iio: dac: ad5770r: fix error return in ad5770r_read_raw()
Return the error code from regmap_bulk_read() instead of 0 so
that I/O failures are properly propagated.
Fixes:
|
||
|
Valek Andrej
|
4f51e6c0ba |
iio: accel: fix ADXL355 temperature signature value
Temperature was wrongly represented as 12-bit signed, confirmed by checking
the datasheet. Even if the temperature is negative, the value in the
register stays unsigned.
Fixes:
|
||
|
Cosmin Tanislav
|
2932095c11 |
counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
The counter driver can use HW channels 1 and 2, while the PWM driver can
use HW channels 0, 1, 2, 3, 4, 6, 7.
The dev member is assigned both by the counter driver and the PWM driver
for channels 1 and 2, to their own struct device instance, overwriting
the previous value.
The sub-drivers race to assign their own struct device pointer to the
same struct rz_mtu3_channel's dev member.
The dev member of struct rz_mtu3_channel is used by the counter
sub-driver for runtime PM.
Depending on the probe order of the counter and PWM sub-drivers, the
dev member may point to the wrong struct device instance, causing the
counter sub-driver to do runtime PM actions on the wrong device.
To fix this, use the parent pointer of the counter, which is assigned
during probe to the correct struct device, not the struct device pointer
inside the shared struct rz_mtu3_channel.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Cosmin Tanislav
|
67c3f99bed |
counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
Runtime PM counter is incremented / decremented each time the sysfs
enable file is written to.
If user writes 0 to the sysfs enable file multiple times, runtime PM
usage count underflows, generating the following message.
rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!
At the same time, hardware registers end up being accessed with clocks
off in rz_mtu3_terminate_counter() to disable an already disabled
channel.
If user writes 1 to the sysfs enable file multiple times, runtime PM
usage count will be incremented each time, requiring the same number of
0 writes to get it back to 0.
If user writes 0 to the sysfs enable file while PWM is in progress, PWM
is stopped without counter being the owner of the underlying MTU3
channel.
Check against the cached count_is_enabled value and exit if the user
is trying to set the same enable value.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
David Lechner
|
fdc7aa54a5 |
iio: light: vcnl4035: fix scan buffer on big-endian
Rework vcnl4035_trigger_consumer_handler() so that we are not passing
what should be a u16 value as an int * to regmap_read(). This won't
work on bit endian systems.
Instead, add a new unsigned int variable to pass to regmap_read(). Then
copy that value into the buffer struct.
The buffer array is replaced with a struct since there is only one value
being read. This allows us to use the correct u16 data type and has a
side-effect of simplifying the alignment specification.
Also fix the endianness of the scan format from little-endian to CPU
endianness. Since we are using regmap to read the value, it will be
CPU-endian.
Fixes:
|
||
|
David Lechner
|
768461517a |
iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
Add a DMA-safe buffer and use it for spi_read() instead of a stack
memory. All SPI buffers must be DMA-safe.
Since we only need up to 3 bytes, we just use a u8[] instead of __be16
and __be32 and change the conversion functions appropriately.
Fixes:
|
||
|
David Lechner
|
24869650df |
iio: adc: ti-adc161s626: fix buffer read on big-endian
Rework ti_adc_trigger_handler() to properly handle data on big-endian
architectures. The scan data format is 16-bit CPU-endian, so we can't
cast it to a int * on big-endian and expect it to work. Instead, we
introduce a local int variable to read the data into, and then copy it
to the buffer.
Since the buffer isn't passed to any SPI functions, we don't need it to
be DMA-safe. So we can drop it from the driver data struct and just
use stack memory for the scan data.
Since there is only one data value (plus timestamp), we don't need an
array and can just declare a struct with the correct data type instead.
Also fix alignment of iio_get_time_ns() to ( while we are touching this.
Fixes:
|
||
|
Linus Torvalds
|
f338e77383 | Linux 7.0-rc4 | ||
|
Linus Torvalds
|
5c2fe8d11a |
SCSI fixes on 20260315
The one core change is a re-roll of the tag allocation fix from the last pull request that uses the correct goto to unroll all the allocations. The remianing fixes are all small ones in drivers. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCabbZ8xsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIW4hAEAyEbXcyUa4tNTsQfRPeJitgq4WDyPDv83 lnAvY/J5IEoBAJel9hRJ8lJfwziXVhMsxU3XHSXqQdA22N8tS7n4gTtq =IGTE -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The one core change is a re-roll of the tag allocation fix from the last pull request that uses the correct goto to unroll all the allocations. The remianing fixes are all small ones in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hisi_sas: Fix NULL pointer exception during user_scan() scsi: qla2xxx: Completely fix fcport double free scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend scsi: core: Fix error handling for scsi_alloc_sdev() |
||
|
Linus Torvalds
|
d9bf296c39 |
Probes fixes for v7.0-rc3
- kprobes: avoid crash when rmmod/insmod after ftrace killed This fixes a kernel crash caused by kprobes on the symbol in a module which is unloaded after ftrace_kill() is called. - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() Remove unneeded WARN messages which can be kicked if the kprobe is using ftrace and it fails to enable the ftrace. Since kprobes correctly handle such failure, we don't need to warn it. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmm2hk8bHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bBZkH+gP3OllhdIU3AUB+vXEb UEE3VE5IZRufSgtjbbJnYI3b8U2dWXw7wmb+fBJ0i0Zf6F+2IUr3hUg1pHNARvlL MMu1YW7PG8gKGUsNc7jpHBVXrnefA4XpzXe7wtxaGvqAV16nL/6xhZlanGgL50Gv +F9cETMIGZ8duF6XVgEMmUUCg88Iwpp9MjzDQOjpRK7z41LND3ccJ2V88ODzDevj idnRbnk12Q9b7xZwGL5P5Ab163kHPFExsXQQnPmy/0fLcyGi8U3hY5EwYhOT85J0 qRZVHpR1yrXqBpaxD/7as5/pfuUluxdzwmDkyRuQGYW6y7xkhlVNEGWqsWZeYLuW IZU= =Zkm3 -----END PGP SIGNATURE----- Merge tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Avoid crash when rmmod/insmod after ftrace killed This fixes a kernel crash caused by kprobes on the symbol in a module which is unloaded after ftrace_kill() is called. - Remove unneeded warnings from __arm_kprobe_ftrace() Remove unneeded WARN messages which can be triggered if the kprobe is using ftrace and it fails to enable the ftrace. Since kprobes correctly handle such failure, we don't need to warn it. * tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() kprobes: avoid crash when rmmod/insmod after ftrace killed |
||
|
Linus Torvalds
|
62cda74c79 |
Bootconfig fixes for v7.0-rc3
- lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error; This fixes a wrong error place in unclosed brace error message. - lib/bootconfig: check bounds before writing in __xbc_open_brace(); This fixes to check the array index before setting array, so that the bootconfig can support 16th-depth nested brace correctly. - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after(); This fixes to handle the return value of snprintf() correctly in case of the return value == size. - bootconfig: Add bootconfig tests about braces Add test cases for checking error position about unclosed brace and ensuring supporting 16th depth nested braces correctly. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmmz2oUbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bVUsH/RZ1L9qQzbUH5gFtnKuP cv8R84lVOf9+Yg9H+RCT689qCOTtLIVuK6LaDCChhbeiaF05hXIvRu0Dr1WmVrxc O7ur1LucRNbEsB2O2UCWZjW1SBbNa9zvgaYGMFhBbkViGUUfj9uJgyn5zin0A6Pl nwHuN3BNqEmR2aayikdLESwJ3IBYyrtPWg0/lBT+Dy5lcnh6h5+2HP1u70W3i7+c 4psAqA0A+a1nY9yQD+tw8kzUb8ZXgyTrkGkWECRkb/M7K843X/Csi64GYCGNlmuw FXcIwxgGk5X3yQgDOoPHB6sBB7Cgo6jokxUJwrCiJintZJEQj5Ryzun8FmAi9vvO NmU= =15kg -----END PGP SIGNATURE----- Merge tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fixes from Masami Hiramatsu: - fix off-by-one in xbc_verify_tree() unclosed brace error. This fixes a wrong error place in unclosed brace error message - check bounds before writing in __xbc_open_brace(). This fixes to check the array index before setting array, so that the bootconfig can support 16th-depth nested brace correctly - fix snprintf truncation check in xbc_node_compose_key_after(). This fixes to handle the return value of snprintf() correctly in case of the return value == size - Add bootconfig tests about braces Add test cases for checking error position about unclosed brace and ensuring supporting 16th depth nested braces correctly * tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Add bootconfig tests about braces lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() lib/bootconfig: check bounds before writing in __xbc_open_brace() lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error |
||
|
Linus Torvalds
|
11e8c7e947 |
ARM:
- Correctly handle deeactivation of interrupts that were activated from
LRs. Since EOIcount only denotes deactivation of interrupts that
are not present in an LR, start EOIcount deactivation walk *after*
the last irq that made it into an LR.
- Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when
pKVM is already enabled -- not only thhis isn't possible (pKVM
will reject the call), but it is also useless: this can only
happen for a CPU that has already booted once, and the capability
will not change.
- Fix a couple of low-severity bugs in our S2 fault handling path,
affecting the recently introduced LS64 handling and the even more
esoteric handling of hwpoison in a nested context
- Address yet another syzkaller finding in the vgic initialisation,
where we would end-up destroying an uninitialised vgic with nasty
consequences
- Address an annoying case of pKVM failing to boot when some of the
memblock regions that the host is faulting in are not page-aligned
- Inject some sanity in the NV stage-2 walker by checking the limits
against the advertised PA size, and correctly report the resulting
faults
PPC:
- Fix a PPC e500 build error due to a long-standing wart that was exposed by
the recent conversion to kmalloc_obj(); rip out all the ugliness that
led to the wart.
RISC-V:
- Prevent speculative out-of-bounds access using array_index_nospec()
in APLIC interrupt handling, ONE_REG regiser access, AIA CSR access,
float register access, and PMU counter access
- Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(),
kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr()
- Fix potential null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei()
- Fix off-by-one array access in SBI PMU
- Skip THP support check during dirty logging
- Fix error code returned for Smstateen and Ssaia ONE_REG interface
- Check host Ssaia extension when creating AIA irqchip
x86:
- Fix cases where CPUID mitigation features were incorrectly marked as
available whenever the kernel used scattered feature words for them.
- Validate _all_ GVAs, rather than just the first GVA, when processing
a range of GVAs for Hyper-V's TLB flush hypercalls.
- Fix a brown paper bug in add_atomic_switch_msr().
- Use hlist_for_each_entry_srcu() when traversing mask_notifier_list,
to fix a lockdep warning; KVM doesn't hold RCU, just irq_srcu.
- Ensure AVIC VMCB fields are initialized if the VM has an in-kernel local
APIC (and AVIC is enabled at the module level).
- Update CR8 write interception when AVIC is (de)activated, to fix a bug
where the guest can run in perpetuity with the CR8 intercept enabled.
- Add a quirk to skip the consistency check on FREEZE_IN_SMM, i.e. to allow
L1 hypervisors to set FREEZE_IN_SMM. This reverts (by default) an
unintentional tightening of userspace ABI in 6.17, and provides some
amount of backwards compatibility with hypervisors who want to freeze
PMCs on VM-Entry.
- Validate the VMCS/VMCB on return to a nested guest from SMM, because
either userspace or the guest could stash invalid values in memory
and trigger the processor's consistency checks.
Generic:
- Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from being
unnecessary and confusing, triggered compiler warnings due to
-Wflex-array-member-not-at-end.
- Document that vcpu->mutex is take outside of kvm->slots_lock and
kvm->slots_arch_lock, which is intentional and desirable despite being
rather unintuitive.
Selftests:
- Increase the maximum number of NUMA nodes in the guest_memfd selftest to
64 (from 8).
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmmy6n8UHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroNX7ggAhWoCG+AE6P3yrp6Mi+nRYpeRGC3q
q2IiZCn0UoCg6q3c2kgn7b/N2zLJs0Q8FZRCEp2Je+2uvptpmdp/BMEfiIU3n2/a
61z+Dydbpyc+kUmhJzUJ+aotq5FnMNmAAmqSKoc19GhAx2OQhQmBP/JOZ0P/eqLE
Is0qNBgr/Zms2ib3GFf/JT+urysL2mX47qe92HTzq1T9EEG0KleID0Jz8vYQI8Fr
I5N9+lTxagQDi8ytwOM85Cn8K7wh+CQIgzmciHcVErpAvAWkrEjrPlQltpEz2C5B
aWEcRgw46utEaAiwPQGJRW6TeoKUG0pUR3v6T90nBkjjJ1npm6gPVE6TBA==
=7nQ9
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"Quite a large pull request, partly due to skipping last week and
therefore having material from ~all submaintainers in this one. About
a fourth of it is a new selftest, and a couple more changes are large
in number of files touched (fixing a -Wflex-array-member-not-at-end
compiler warning) or lines changed (reformatting of a table in the API
documentation, thanks rST).
But who am I kidding---it's a lot of commits and there are a lot of
bugs being fixed here, some of them on the nastier side like the
RISC-V ones.
ARM:
- Correctly handle deactivation of interrupts that were activated
from LRs. Since EOIcount only denotes deactivation of interrupts
that are not present in an LR, start EOIcount deactivation walk
*after* the last irq that made it into an LR
- Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when pKVM
is already enabled -- not only thhis isn't possible (pKVM will
reject the call), but it is also useless: this can only happen for
a CPU that has already booted once, and the capability will not
change
- Fix a couple of low-severity bugs in our S2 fault handling path,
affecting the recently introduced LS64 handling and the even more
esoteric handling of hwpoison in a nested context
- Address yet another syzkaller finding in the vgic initialisation,
where we would end-up destroying an uninitialised vgic with nasty
consequences
- Address an annoying case of pKVM failing to boot when some of the
memblock regions that the host is faulting in are not page-aligned
- Inject some sanity in the NV stage-2 walker by checking the limits
against the advertised PA size, and correctly report the resulting
faults
PPC:
- Fix a PPC e500 build error due to a long-standing wart that was
exposed by the recent conversion to kmalloc_obj(); rip out all the
ugliness that led to the wart
RISC-V:
- Prevent speculative out-of-bounds access using array_index_nospec()
in APLIC interrupt handling, ONE_REG regiser access, AIA CSR
access, float register access, and PMU counter access
- Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(),
kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr()
- Fix potential null pointer dereference in
kvm_riscv_vcpu_aia_rmw_topei()
- Fix off-by-one array access in SBI PMU
- Skip THP support check during dirty logging
- Fix error code returned for Smstateen and Ssaia ONE_REG interface
- Check host Ssaia extension when creating AIA irqchip
x86:
- Fix cases where CPUID mitigation features were incorrectly marked
as available whenever the kernel used scattered feature words for
them
- Validate _all_ GVAs, rather than just the first GVA, when
processing a range of GVAs for Hyper-V's TLB flush hypercalls
- Fix a brown paper bug in add_atomic_switch_msr()
- Use hlist_for_each_entry_srcu() when traversing mask_notifier_list,
to fix a lockdep warning; KVM doesn't hold RCU, just irq_srcu
- Ensure AVIC VMCB fields are initialized if the VM has an in-kernel
local APIC (and AVIC is enabled at the module level)
- Update CR8 write interception when AVIC is (de)activated, to fix a
bug where the guest can run in perpetuity with the CR8 intercept
enabled
- Add a quirk to skip the consistency check on FREEZE_IN_SMM, i.e. to
allow L1 hypervisors to set FREEZE_IN_SMM. This reverts (by
default) an unintentional tightening of userspace ABI in 6.17, and
provides some amount of backwards compatibility with hypervisors
who want to freeze PMCs on VM-Entry
- Validate the VMCS/VMCB on return to a nested guest from SMM,
because either userspace or the guest could stash invalid values in
memory and trigger the processor's consistency checks
Generic:
- Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from
being unnecessary and confusing, triggered compiler warnings due to
-Wflex-array-member-not-at-end
- Document that vcpu->mutex is take outside of kvm->slots_lock and
kvm->slots_arch_lock, which is intentional and desirable despite
being rather unintuitive
Selftests:
- Increase the maximum number of NUMA nodes in the guest_memfd
selftest to 64 (from 8)"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (43 commits)
KVM: selftests: Verify SEV+ guests can read and write EFER, CR0, CR4, and CR8
Documentation: kvm: fix formatting of the quirks table
KVM: x86: clarify leave_smm() return value
selftests: kvm: add a test that VMX validates controls on RSM
selftests: kvm: extract common functionality out of smm_test.c
KVM: SVM: check validity of VMCB controls when returning from SMM
KVM: VMX: check validity of VMCS controls when returning from SMM
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers()
KVM: VMX: Fix a wrong MSR update in add_atomic_switch_msr()
KVM: x86: hyper-v: Validate all GVAs during PV TLB flush
KVM: x86: synthesize CPUID bits only if CPU capability is set
KVM: PPC: e500: Rip out "struct tlbe_ref"
KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type
KVM: selftests: Increase 'maxnode' for guest_memfd tests
KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug
KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail
KVM: arm64: Remove the redundant ISB in __kvm_at_s1e2()
...
|
||
|
Linus Torvalds
|
4f3df2e5ea |
powerpc fixes for 7.0 #3
- Fix KUAP warning in VMX usercopy path - Fix lockdep warning during PCI enumeration - Fix to move CMA reservations to arch_mm_preinit - Fix to check current->mm is alive before getting user callchain Thanks to: Aboorva Devarajan, Christophe Leroy (CS GROUP), Dan Horák, Nicolin Chen, Nilay Shroff, Qiao Zhao, Ritesh Harjani (IBM), Saket Kumar Bhaskar, Sayali Patil, Shrikanth Hegde, Venkat Rao Bagalkote, Viktor Malik, -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmm2KVsACgkQpnEsdPSH ZJT6VBAAlmediTysFMpS6qnxrhJ/ZbERskIvfGkcW4i8lPr5yluPjQhj75Q9RYIy eRFS5eYssQVXbhS1/YWfsQKcG2tH7ucl0ocYfl8xvGGCgpSEu+wYTwECj2OVSF7T BiQ6VsHcOLJJ1SxCoS17n+sl8WGuIGikWKYM2ECeNx7iysrFczcj4RQ9Z4aYWT91 xmgDyQwrNmxSy85OXq5ITLcY5IcVLtwnpjyTp4z94fP2Ho/R/muL9i3Sven7Iiqm a5I5XDozMFxtFtOxYlh7y8cKisDEYqinqoA/9P59kEtZ5XML8yp/s7rJ7Gjl/AmF O3fEAbtevTz2XvpVpx6XiRAXDtdRyR+YFUZMTABawDFlHZffD7m4eg/9A4JvDJ/8 LxklCGLECZes+dEULGG/kXoOD7e2jJKDBsGYjgGWXU5+ZI8qjhfSWdiXAcl1DEHd gYZ2N6eYNWP/m2wqs5FUiabdB0yPdcpI7ukxmECpQDdS4TCA4sU3DI0FRyGktABV nNaYBZezZhlCWzNo/NBxFAvj6OHmo8WYHX1G6piE6nJKYyPlbjLyV5/tvkW9oxlM HlejFBKF4Us9ZotNgWxQdJzZCJ3qWmuxDgukzShX4mDbGdK8+4Vv9Qjk1SwsCypS HQ/ff0SNcHVdDJkw41jOJxoTv/2+vEB+1FmytmZ7s/fxUs/qW04= =OrN9 -----END PGP SIGNATURE----- Merge tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix KUAP warning in VMX usercopy path - Fix lockdep warning during PCI enumeration - Fix to move CMA reservations to arch_mm_preinit - Fix to check current->mm is alive before getting user callchain Thanks to Aboorva Devarajan, Christophe Leroy (CS GROUP), Dan Horák, Nicolin Chen, Nilay Shroff, Qiao Zhao, Ritesh Harjani (IBM), Saket Kumar Bhaskar, Sayali Patil, Shrikanth Hegde, Venkat Rao Bagalkote, and Viktor Malik. * tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/iommu: fix lockdep warning during PCI enumeration powerpc/selftests/copyloops: extend selftest to exercise __copy_tofrom_user_power7_vmx powerpc: fix KUAP warning in VMX usercopy path powerpc, perf: Check that current->mm is alive before getting user callchain powerpc/mem: Move CMA reservations to arch_mm_preinit |
||
|
Linus Torvalds
|
13af67f599 |
Work around S2RAM hang if the firmware unexpectedly re-enables
the x2apic hardware while it was disabled by the kernel. Force-disable it again and issue a warning into the syslog. Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2KNoRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hfDA/+O/SDkyk/FWwe7loZJ0A2jZCJgHfyJakS aaIkIqtOWLt2L5TtPDMBzPr/bwER+aj4sXBqAJA37Ky+UGwTkTLDHOO6t/WFc/Ef 4R+XdcLl64QNmqsm2bAi9PP2G7N6xDT6HKoRwKml/URM6Hfi0R63Mh8BG0FAY5RU oAMQg8V36TWb9FBMjU4XgoVOAu4Eec1Vx65wYdoxsOZn+M6eL55gTdTd5FR2Nc0p WZLakpjGnxAsu9QH6XJ5uD4G7lJkMauyxStHig1nG4C9U0briTS0D5V+95TWTmO0 8DBelOr3zDZ11DB/rVsFS54nxH66uWkA7jbZFC3xyHq53GbAHIuYqZAl2Q8ZmVY/ wEy1nbEF7NIidT1pZuczJ69eGGooiMrPAEF10HmBxlzYx367SI3hFhSblRODwPiH cdD0cmQhraUfWKhLJBBT2/+URFbjZnUtA+O/3P3V6XODIDGESFU5yYKGLlEdi+wV HBxMIXAVbbXXqzZ1nsahnvCjgFr1nwRpbDw8l5wapjbFwso2+RSe2pPUPKzbgt0I /IrPKr8p7UepDe4EPytLwWotSuok4GQRMFIX4V1OLxcQSQvk+IfLwjmMvyOm3UU+ OaWRplD3oGXrJvMqtsPgs6itu3SW7DjshBLbSpTOc/Eee8OlDpFJ13X0JqimOzj/ RfPPSpD3iyE= =VNhj -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Work around S2RAM hang if the firmware unexpectedly re-enables the x2apic hardware while it was disabled by the kernel. Force-disable it again and issue a warning into the syslog" * tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Disable x2apic on resume if the kernel expects so |
||
|
Linus Torvalds
|
164cb546e9 |
Fix function tracer recursion bug by marking jiffies_64_to_clock_t()
notrace. Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2J6MRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hQ9g//Qwq0Esh58yP0UkySArlf7xrOEBrfIF2R W7aLDRevhTCklN5z4BlkCaT7XyfZL19CF2AXW1PZ9fSJKlM/vK0xkFToSiKuG6Pc 2BvfYOvePrmT+8AMnhFe2ekzJclUi9s+ars3H0i59Xu6D+CCOqDvvdGoVkdfuL5+ eYlxVZK2TtrZEDkdXkBD0vPvcrXqYxDnZD3Pkpys9NQBxSyIDwVdCr+uNVv3hCsf L6TAnOzUbI7jWp805izAgdQ4E0P2ywb83nK8op++p4J8PpVaGSnW6LmfDmBsKvRG V+cyqXdMToZjEayBdjDgk3GH6M4K2lFWsg1TVfqE1K05fwEdNDYJY7G7eKvhrLH1 2oNvsEMKLXNVSTgn7gSr63IQBC7+J0eKkmBp1Lv9WWjqYC4QYacrFm4Fc5OCmec0 GI3QQwPvNa+i7GByvLbXe8+8q/BLIWOIcCutlU8GRdYaghA1lOynI8dQmKfSdM+j O1TMIqI56ymffsiBe4d9iUyzCWUdB1LXR0Hm36wm+SJmydc6/Ael1gUlFjqXpGKq Ui4h5rRtNvZgsqmsGGgjMvdiZ9dN/e7tz4tdyp4oCcpKhfDT7qNLdHeoyvDxhDs/ uTvpAK5iH6Wxa91DXt4M+17gf97Ws1dIHU6G9og4B1l5bptyXmrMuVPmK8L/wxDu POJGsxuIStA= =Obpb -----END PGP SIGNATURE----- Merge tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix function tracer recursion bug by marking jiffies_64_to_clock_t() notrace" * tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time/jiffies: Mark jiffies_64_to_clock_t() notrace |
||
|
Linus Torvalds
|
63724e9519 |
More MM-CID fixes, mostly fixing hangs/races:
- Fix CID hangs due to a race between concurrent forks
- Fix vfork()/CLONE_VM MMCID bug causing hangs
- Remove pointless preemption guard
- Fix CID task list walk performance regression on large systems
by removing the known-flaky and slow counting logic using
for_each_process_thread() in mm_cid_*fixup_tasks_to_cpus(),
and implementing a simple sched_mm_cid::node list instead
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2JvIRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hTqg/+K7b4LDOi3nVblmoj6q+mQj2i8DFPbi10
zeAWJJnamYWPvUi+Wxq30JjZJ9v+15Ddcmbhea9m/3u1YO6nAL5TbGeQcJ2LU/7p
Ynu9cznv9PfqO4X7WQc3gJC9xx8PbcM00E3JzGxDX/3NDmDBaTOwwuTp41ymcbhm
cGfnUQWGt81sMummVzqehszfIRMZHnWflYDJ2gC66rcGXMNBlEX125F8jybOm66n
Ez6gO7e9EGn28+hZIufySsxaeeK/3NFVKj1UjGP/FMuBwQFAjHPv61nic33nOKXT
yrw7U8DIaYUqFN4d1lplTG72j2YSUj7snn3Q+ubxpzFmOt7RmouVqwlVGEoey5fh
cEe2VYSQFoZKQioWWyms1LP1hTOa2JkNVhdjBfRZ8IM+Wp47OaDiw1h1+zwwMDbJ
xpDAXEuU+sBZiv2SeBLFQgrGj58gb8pdjN4o47X89mx8TKYWtStrCMsD+MF10LBm
dz780Eiinbw5D8JBsxU/ehETpgrAAVmo1KbFx2Q2grAgkJs7jSqBN2KF8NpmH/ZS
Jk8SpQOn4Vp8iO32TbpsV/GErG9EQgixQxnkTukv2Qd9kguhmjwbi/blN3rLBlBb
XbmR9rRAMfAjlPrk84tn9ecXNWO0NV83IYheAwjip36alSbOs+OcxdhrZ78nxh8C
EsKqGl3PeOk=
=ce5G
-----END PGP SIGNATURE-----
Merge tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"More MM-CID fixes, mostly fixing hangs/races:
- Fix CID hangs due to a race between concurrent forks
- Fix vfork()/CLONE_VM MMCID bug causing hangs
- Remove pointless preemption guard
- Fix CID task list walk performance regression on large systems
by removing the known-flaky and slow counting logic using
for_each_process_thread() in mm_cid_*fixup_tasks_to_cpus(), and
implementing a simple sched_mm_cid::node list instead"
* tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/mmcid: Avoid full tasklist walks
sched/mmcid: Remove pointless preempt guard
sched/mmcid: Handle vfork()/CLONE_VM correctly
sched/mmcid: Prevent CID stalls due to concurrent forks
|
||
|
Linus Torvalds
|
9745031130 |
Miscellaneous objtool fixes:
- Fix cross-build bug by using HOSTCFLAGS for HAVE_XXHASH test - Fix klp bug by fixing detection of corrupt static branch/call entries - Handle unsupported pr_debug() usage more gracefully - Fix hypothethical klp bug by avoiding NULL pointer dereference when printing code symbol name - Fix data alignment bug in elf_add_data() causing mangled strings - Fix confusing ERROR_INSN() error message - Handle unexpected Clang RSP musical chairs causing false positive warnings - Fix another objtool stack overflow in validate_branch() Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2I2QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hcbQ/9F77gitPLuQ0RHujGYXrGMrPs+msXC+kN IlCJekmVck2v7QKXO45WKLs5kRHePWlRb6KAbpx5Yhzrt6LEUsxzM/Qk6kxdrlaK w5sRbIPDkrV7vr1Lk28NyniJCtllA1xRSQ8pAfzqmiAwI7qpNuqOtNDmNQwEK61S CF3YQnUSg1AmJ8R4yuXLOAGExrnfuLwxLA4AZVm42q5Ind9cRSNPXT5K/llhAmer GyXEVRY+w+7al7/3uuSRvP6X4XxLswefYMcaYY6ZPCwe3Kv+eivqgxU8sde3y4Cy txRkrLWswOazMzIhkxfMh5XEjg32bFqjMq9OqY/ntVBXwGFIwZv9r9mgJdYTgVdg URZgo275yyYZyCl5am5N3hYUH4PNGY6trrzU58WpIuxZ4wy4//DXH8Z0IahQ4QNV NdN9ovXPbjlIpN3r/XtSTIjMIuTzTEMRiwuh1ffLd2GM+DidKfmoiiMULyOljhyN b+nprW8om4jd552Dbtoi7MzzfY23c+gbJE3YJd4QQ72iAQntUoafBbsDGM+XmRlj bjki8kDlQhhmH61cGEZffw2nw1TrPYZQvx3qWYnZXBtpUXswT91tNeomFlFvKJsh Fi8llS6g6yoIDmOeSwgUak4HLiRdcgLqZCa8OjoJ6tXZ86gvEAv4NJpeAzMbvE3W p935MRCK0bo= =JEz6 -----END PGP SIGNATURE----- Merge tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: - Fix cross-build bug by using HOSTCFLAGS for HAVE_XXHASH test - Fix klp bug by fixing detection of corrupt static branch/call entries - Handle unsupported pr_debug() usage more gracefully - Fix hypothetical klp bug by avoiding NULL pointer dereference when printing code symbol name - Fix data alignment bug in elf_add_data() causing mangled strings - Fix confusing ERROR_INSN() error message - Handle unexpected Clang RSP musical chairs causing false positive warnings - Fix another objtool stack overflow in validate_branch() * tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix another stack overflow in validate_branch() objtool: Handle Clang RSP musical chairs objtool: Fix ERROR_INSN() error message objtool: Fix data alignment in elf_add_data() objtool: Use HOSTCFLAGS for HAVE_XXHASH test objtool/klp: Avoid NULL pointer dereference when printing code symbol name objtool/klp: Disable unsupported pr_debug() usage objtool/klp: Fix detection of corrupt static branch/call entries |
||
|
Linus Torvalds
|
be2e3750ce |
Two fixes for the riscv-aplic irqchip driver:
- Fix probing dependency bug on probing failure - Fix double register_syscore() bug Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2H2YRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hPXhAApm61pOCQ18dxPgRLzJ0Q2+NSFWsI+C7w epAxScujo7f0FcwpztxFLRUuRkUgnU1lujW1QoEdnZWm0rWnyrfQiibX/8V774VH 5d7+QQWNMp/0B7UcEE/zN0x4ceCn9PSCgSqR72n7STNlNH052yJyMKzfCXDJ8Evl rY7WdOKFv+QtCcYVoVr9Z7qIhDzBv1cHqpLsymq9ZutJSvO5VlkChBt/InxKwR8K 2z/gsn1CG08DnXQi2QFog9iwnSDeozEuBlpj6w8KdhMDp9qUgdj1RO0N7bSjQw7s sXtH2cX6aKb6cDdd6BMb0RK1yAFx7me/iIZ/8Q1s3q/aCAJnd99SPSJvIcEp9Rf1 h+kPUtzWdhO+L7rAh2l6lqMAhd2aAgug5DoR3WgnryUCwC4iW7snZsMjoarqE4Hb pmrXeay5HGXDswqUesSfaFAwfEPLGUO2dSprBDEoEBNDNEDh3ymsRrOE6XHuNJk5 FadOEJyHT+12M/902HknFleHd05RRT5mGr78Snlg9vS0tVX5uEMgMUT0QZIfQVoj zzwkRN1IolY4vt60nXFHNIlD4twS2P1PYG3xQpElP5k2046dPz2MCmxadDvziQ8L bNhMAfXKZP7nas2Zq4FP3NcLe8d5JKoU7yZzlF0KFADQh+G2t4VJ1y80iJo4HqXd GGnib/X+G5o= =E4U3 -----END PGP SIGNATURE----- Merge tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Two fixes for the riscv-aplic irqchip driver: - Fix probing dependency bug on probing failure - Fix double register_syscore() bug" * tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-aplic: Register syscore operations only once irqchip/riscv-aplic: Do not clear ACPI dependencies on probe failure |
||
|
Ariana Lazar
|
dd154646d2 |
iio: dac: mcp47feb02: Fix Vref validation [1-999] case
Store reference voltages in uV instead of mV to avoid invalid error code
in dev_err_probe() call. Vref variables store the actual value returned by
devm_regulator_get_enable_read_voltage() function instead of the results of
dividing it by MILLI. The corner case [1-999] divided by MILLI of the
voltage reference variable value would become 0 is covered too.
Fixes:
|
||
|
Josh Poimboeuf
|
c05a87d9ec |
iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
If 'pin' is not one of its expected values, the value of
'int_out_ctrl_shift' is undefined. With UBSAN enabled, this causes
Clang to generate undefined behavior, resulting in the following
warning:
drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume()
Prevent the UB and improve error handling by returning an error if 'pin'
has an unexpected value.
While at it, simplify the code a bit by moving the 'pin_name' assignment
to the first switch statement.
Fixes:
|
||
|
Linus Torvalds
|
9a48d4a130 |
I3C fixes for 7.0
Subsystem: - simplify combined i3c/i2c dependencies Drivers: - dw: handle 2C properly, fix possible race condition - mipi-i3c-hci: many DMA related fixes -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmm13MwACgkQY6TcMGxw OjJ9EQ//ZoiUxGeiLkfqHDWq0uEQVuOnYXFhcpNkDrxBB9GUJvt3FWgrAHFt/VqV rSgzC1PfPs7TVRoRtpOXoxcj7J97a5m3BgnqeoDtKXM4aiYx5PoUf7WmOGVSGp+m 9QsQZdJre4WJz7Q4Ozb+XMO4WEgHyZYn2GPVjg2k99S45IfbKXxT5WpAeymdLqL4 Hyz1RpVqhLPdQItQMp6/AIc99L+CDCso4rrwDsRa62fPUFQdLfYPG9XdC/VRexi2 p9EUgmBg8Dw9CzniXknxzB24ZsmCsHwBhK2lfrjmTwElvHG0sUUrVttG2QbMl7MC u3KcKr8ZDAETC7498wkcgdeDA6a5gX7DKRWl9lJ7CCa4QUcCHhdKtLgLSDIhDOLf LPU0AfPZQfZd2g3ErZt6pt8nXstcqAJrbcOBbwe1bHvE4VNl947B+STyfsYTdJOD qyFKe2Qb2ZUUFWyjiAO+lN5QJBxX4fjqJPkCe+PakXxkRhrKGrCBf647UbUNcwjV qs1kdfmH4JYi7WwL1AFmWKkBAEtPGKUXBoVb2nmfArrXawYhYjyWRhAZqthg/gaj iyH/SWe0bOw3sf/bHgxYlzUP3mwqwtln6DihKHlEq3OeW6DoBkE29rc7NhuphTW0 Os9epJIbaKsbvmSV7TA3izpgZHg6qDXliprrvfP/ahSh7w/Gl6g= =Ojo2 -----END PGP SIGNATURE----- Merge tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c fixes from Alexandre Belloni: "This introduces the I3C_OR_I2C symbol which is not a fix per se but is affecting multiple subsystems so it is included to ease synchronization. Apart from that, Adrian is mostly fixing the mipi-i3c-hci driver DMA handling, and I took the opportunity to add two fixes for the dw-i3c driver. Subsystem: - simplify combined i3c/i2c dependencies Drivers: - dw: handle 2C properly, fix possible race condition - mipi-i3c-hci: many DMA related fixes" * tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter i3c: mipi-i3c-hci: Fallback to software reset when bus disable fails i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization i3c: mipi-i3c-hci: Fix race in DMA error handling in interrupt context i3c: mipi-i3c-hci: Consolidate common xfer processing logic i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler i3c: mipi-i3c-hci: Fix race in DMA ring dequeue i3c: mipi-i3c-hci: Fix race in DMA ring enqueue for parallel xfers i3c: mipi-i3c-hci: Consolidate spinlocks i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path i3c: mipi-i3c-hci: Fix Hot-Join NACK i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors i3c: simplify combined i3c/i2c dependencies |
||
|
Linus Torvalds
|
f26de90c68 |
i2c-for-7.0-rc4
designware: DT binding maintainer update -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmm1zpcACgkQFA3kzBSg Kbbl8A//c3ZI9AQKm2DU3Real5nMdM7QyYxU4cai1xjEiZDDoodNNpkeZOn1aUyc xGC7XCH8BemqGQVxrrlT5XJM5lU/tWUxFa8VF43ARr/8yiH/X9dlLvwXwek22Bvj 4wDoCkL122QFaA6qm2PwyvjMRvRaLaoWuoQOUykrXTSYcoNc7xEU1KN6HjyiS48i wuSW1uDALrmDX39n3zRsf3wTgvAzSjsF5BJpagt16uWcHxGQLJIVPYe5EgkECTz6 5UgO2TIpNt62H7aY9MQ1DIUVzNsjFrFxIDlcGEFy5zOTGfC1MRwAL9RlYm0scPK2 ESWM1Ux9qt4vfXB0fqBEEWN8/pDpRVIyrqP0c5P37KDmdIkcvpCUAqQ76Z0TU1Ss RDxRZPpxk0uKr+OFfJlizYhaXphI009ImdfZKYpawortfRogJYklQybi5z9H32wy jHshZlU4+yUcGer+t/5Zhw8goOEtHtDeS2z76YecOA17/zADyxOW/qZ1ejSRXOys 0VpB8tXhYohCUhoXGrX46K92kyqIkx3U8Jy6vuvVSw9G8vBRrk8wzWaXFZmMo4OA USJ/de7LTZgeP5P2065jFxcyqC1FAmlDxh9EhwYcHtbRetKnot8D8pWVPZqLy8k4 IbTkxACIqPy+IEqiRzrBzC0PgOsvzCSS6swV2cBuXXbvqL0fMrU= =6eyN -----END PGP SIGNATURE----- Merge tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "Designware DT binding maintainer update" * tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: dw: Update maintainer |
||
|
Linus Torvalds
|
267594792a |
Rust fixes for v7.0 (2nd)
Toolchain and infrastructure:
- Remap paths to avoid absolute ones starting with the upcoming Rust
1.95.0 release. This improves build reproducibility, avoids leaking
the exact path and avoids having the same path appear in two forms.
The approach here avoids remapping debug information as well, in
order to avoid breaking tools that used the paths to access source
files, which was the previous attempt that needed to be reverted.
- Allow 'unused_features' lint for the upcoming Rust 1.96.0 release.
While well-intentioned, we do not benefit much from the new lint.
- Emit dependency information into '$(depfile)' directly to avoid
a temporary '.d' file (it was an old approach).
'kernel' crate:
- 'str' module: fix warning under '!CONFIG_BLOCK' by making
'NullTerminatedFormatter' public.
- 'cpufreq' module: suppress false positive Clippy warning.
'pin-init' crate:
- Remove '#[disable_initialized_field_access]' attribute which was
unsound. This means removing the support for structs with unaligned
fields (through the 'repr(packed)' attribute), for now.
And document the load-bearing fact of field accessors (i.e. that they
are required for soundness).
- Replace shadowed return token by 'unsafe'-to-create token in order
to remain sound in the face of the likely upcoming Type Alias Impl
Trait (TAIT) and the next trait solver in upstream Rust.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmm1r2MACgkQGXyLc2ht
IW17OhAAoRMLTOf/iTNu29njOtjG5iYABeC5zMnxYUErWGLOooz8D82UEiB85Whs
uhVeW6YZ1jCcizglmbXOduKUOmSvEUYSv5/wj1w5OIF0FWW/6BA/aNdgDijHTbSU
v/x5NfKwxZ7JD8ivl+Z7RxtA3ggEODr/pn8USIKaZr0wEjEcnP1xBedZR6+NXuBT
CUXYm9g0BMfBbHsaI6DgD6/aj3TuHjbp1GGFlMmKd7YJGzFihhxU7nKtzkRDxAUd
HROY1Pi+iEUXFYmeXbgObVgRqzcTYV37CkbMfPk1SoIdXXhtPcO8TJ1GguAMuVMO
alAaVEAGFBKvnNGFoocCoxRt8U9hhiOiqlP+QMu2sbVWxWdmdBRcXlB+t4YIqFWy
6Icp/5K8C6Tf7ZrDZhccn6T6jqp+mvNzfanppi0/DFlZiN+1oSABQgEV3YtAiEIW
UHLT5bO5YEkHW73S9mSKhBhbH58h8IX7oGv/wteovI3gjMA9of/8/6MArWXbLpxj
o6ws7p595/xRV+xZURm7YQm6wtbjBr4Eipgd3vIoc0Z+VbCnDLEs/n8cEYY2CtIg
9Ze+MbBaqnf58qvhwj9Zy8ncQVnCtpQmybUE/i/YfdXo7AMsKtdUppv09xfz4fMC
NWRqJttuWiUttGsLvi/GTxzkz5bT6Y6ZHHNqTyIKWXEIBTtRxK8=
=7LgC
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Remap paths to avoid absolute ones starting with the upcoming Rust
1.95.0 release. This improves build reproducibility, avoids leaking
the exact path and avoids having the same path appear in two forms
The approach here avoids remapping debug information as well, in
order to avoid breaking tools that used the paths to access source
files, which was the previous attempt that needed to be reverted
- Allow 'unused_features' lint for the upcoming Rust 1.96.0 release.
While well-intentioned, we do not benefit much from the new lint
- Emit dependency information into '$(depfile)' directly to avoid a
temporary '.d' file (it was an old approach)
'kernel' crate:
- 'str' module: fix warning under '!CONFIG_BLOCK' by making
'NullTerminatedFormatter' public
- 'cpufreq' module: suppress false positive Clippy warning
'pin-init' crate:
- Remove '#[disable_initialized_field_access]' attribute which was
unsound. This means removing the support for structs with unaligned
fields (through the 'repr(packed)' attribute), for now
And document the load-bearing fact of field accessors (i.e. that
they are required for soundness)
- Replace shadowed return token by 'unsafe'-to-create token in order
to remain sound in the face of the likely upcoming Type Alias Impl
Trait (TAIT) and the next trait solver in upstream Rust"
* tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: kbuild: allow `unused_features`
rust: cpufreq: suppress clippy::double_parens in Policy doctest
rust: pin-init: replace shadowed return token by `unsafe`-to-create token
rust: pin-init: internal: init: document load-bearing fact of field accessors
rust: pin-init: internal: init: remove `#[disable_initialized_field_access]`
rust: build: remap path to avoid absolute path
rust: kbuild: emit dep-info into $(depfile) directly
rust: str: make NullTerminatedFormatter public
|
||
|
Linus Torvalds
|
69237f8c1f |
USB fixes for 7.0-rc4
Here is a large chunk of USB driver fixes for 7.0-rc4. Included in here
are:
- usb gadget reverts due to reported issues, and then a follow-on fix
to hopefully resolve the reported overall problem
- xhci driver fixes
- dwc3 driver fixes
- usb core "killable" bulk message api addition to fix a usbtmc driver
bug where userspace could hang the driver for forever
- small USB driver fixes for reported issues
- new usb device quirks
All except the last USB device quirk change have been in linux-next with
no reported issues. That one came in too late, and is "obviously
correct" :)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCabVKjw8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ynxIACfUxlNXBrfcAz2xTRqEvFSFKiLscoAoMnGZG1U
l7DU2htiO4Gacf5g6Yvj
=wXSL
-----END PGP SIGNATURE-----
Merge tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here is a large chunk of USB driver fixes for 7.0-rc4. Included in
here are:
- usb gadget reverts due to reported issues, and then a follow-on fix
to hopefully resolve the reported overall problem
- xhci driver fixes
- dwc3 driver fixes
- usb core "killable" bulk message api addition to fix a usbtmc
driver bug where userspace could hang the driver for forever
- small USB driver fixes for reported issues
- new usb device quirks
All except the last USB device quirk change have been in linux-next
with no reported issues. That one came in too late, and is 'obviously
correct' :)"
* tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits)
USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
usb: roles: get usb role switch from parent only for usb-b-connector
Revert "tcpm: allow looking for role_sw device in the main node"
usb: gadget: f_ncm: Fix net_device lifecycle with device_move
Revert "usb: gadget: u_ether: add gether_opts for config caching"
Revert "usb: gadget: u_ether: use <linux/hex.h> header file"
Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device"
Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind"
Revert "usb: legacy: ncm: Fix NPE in gncm_bind"
Revert "usb: gadget: f_ncm: Fix atomic context locking issue"
usb: typec: altmode/displayport: set displayport signaling rate in configure message
usb: dwc3: pci: add support for the Intel Nova Lake -H
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
usb: gadget: uvc: fix interval_duration calculation
xhci: Fix NULL pointer dereference when reading portli debugfs files
usb: xhci: Prevent interrupt storm on host controller error (HCE)
usb: xhci: Fix memory leak in xhci_disable_slot()
usb: class: cdc-wdm: fix reordering issue in read code path
usb: renesas_usbhs: fix use-after-free in ISR during device removal
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
...
|