mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-14 06:22:34 +02:00
185a4caeecabc150106deda1da170b09f2ad803f
1464154
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Linus Torvalds
|
42eb3a5ef6 |
Merge tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit updates from Shuah Khan: "Fixes to tool and kunit core and new features to both to support JUnit XML (primitive) and backtrace suppression API: - Core support for suppressing warning backtraces - Parse and print the reason tests are skipped - Add (primitive) support for outputting JUnit XML - Don't write to stdout when it should be disabled - Add backtrace suppression self-tests - Suppress intentional warning backtraces in scaling unit tests - Add documentation for warning backtrace suppression API - Fix spelling mistakes in comments and messages - gen_compile_commands: Ignore libgcc.a - qemu_configs: Add or1k / openrisc configuration" * tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit:tool: Don't write to stdout when it should be disabled kunit: tool: Add (primitive) support for outputting JUnit XML kunit: tool: Parse and print the reason tests are skipped kunit: Add documentation for warning backtrace suppression API drm: Suppress intentional warning backtraces in scaling unit tests kunit: Add backtrace suppression self-tests bug/kunit: Core support for suppressing warning backtraces kunit: Fix spelling mistakes in comments and messages kunit: qemu_configs: Add or1k / openrisc configuration gen_compile_commands: Ignore libgcc.a |
||
 Bartosz Golaszewski
|
86c04b2960 |
Merge tag 'intel-gpio-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current
intel-gpio for v7.1-1 * Only trigger interrupts that defined ActiveBoth in ACPI on boot |
||
 Sayali Patil
|
42f252f5a6 |
powerpc/fadump: define MIN_RMA in bytes rather than MB
The MIN_RMA size checks in fadump_setup_param_area() use (MIN_RMA * 1024 * 1024), which is evaluated in int and can overflow when MIN_RMA is increased to values such as SZ_2G, triggering compiler warnings such as: warning: integer overflow in expression of type 'int' results in '0' [-Woverflow] Define MIN_RMA directly in bytes using SZ_1M and update the callers accordingly. This avoids repeated unit conversions and prevents integer overflow. Also convert MIN_RMA back to MB when populating the firmware architecture vector, since firmware expects the value in MB. Suggested-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Sayali Patil <sayalip@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/310b040acef712fdc79e3e37d0f4c2213938b556.1781589284.git.sayalip@linux.ibm.com |
||
 Mukesh Kumar Chaurasiya (IBM)
|
4e1187e12d |
powerpc: Restore KUAP registers on syscall restart exit
During a syscall restart, block KUAP so that pending interrupts can be
replayed. The original KUAP state is not restored before returning to
userspace, causing subsequent userspace accesses to fault and eventually
trigger bad_access_pkey(), crashing the kernel.
The original KUAP register values are already saved in
arch_enter_from_user_mode(). Restore them on the syscall restart exit
path before returning to userspace.
Fixes:
|
||
|
Linus Torvalds
|
b1cbabe84c |
Merge tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper updates from Mikulas Patocka: - small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata - rework of dm-ima - introduce dm-inlinecrypt - fix wrong return value in dm-ioctl - fix rcu stall when polling * tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-zoned-metadata: Use strscpy() to copy device name dm cache: make smq background work limit configurable dm-inlinecrypt: add support for hardware-wrapped keys dm: limit target bio polling to one shot dm-ioctl: report an error if a device has no table dm: add documentation for dm-inlinecrypt target dm-inlinecrypt: add target for inline block device encryption block: export blk-crypto symbols required by dm-inlinecrypt dm-ima: use active table's size if available dm-ima: Fail more gracefully in dm_ima_measure_on_* dm-ima: Handle race between rename and table swap dm-ima: Fix issues with dm_ima_measure_on_device_rename dm-ima: remove new_map from dm_ima_measure_on_device_clear dm-ima: Fix UAF errors and measuring incorrect context dm-ima: don't copy the active table to the inactive table dm-ima: Remove status_flags from dm_ima_measure_on_table_load() dm-ima: remove broken last_target_measured logic dm-ima: remove dm_ima_reset_data() dm-raid: only requeue bios when dm is suspending dm vdo: use get_random_u32() where appropriate |
||
 Pengpeng Hou
|
0482862a90 |
gpio: mlxbf3: fail probe if gpiochip registration fails
mlxbf3_gpio_probe() logs a devm_gpiochip_add_data() failure but still
returns success. That leaves the platform device bound even though the
GPIO chip was not registered.
Return the registration error so probe failure matches the missing
gpiochip state.
Fixes:
|
||
|
Linus Torvalds
|
ba9c792c82 |
Merge tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe pull request via Keith:
- Per-controller admin and IO timeout sysfs attributes, and
letting the block layer set request timeouts (Maurizio,
Maximilian)
- Multipath passthrough iostats, and PCI P2PDMA enablement for
multipath devices (Keith, Kiran)
- A new diag sysfs attribute group exporting per-controller
counters (retries, multipath failover, error counters, requeue
and failure counts, reset and reconnect events) (Nilay)
- FDP configuration validation and bounds check fixes (liuxixin)
- Various nvmet fixes, including a pre-auth out-of-bounds read in
the Discovery Get Log Page handler, auth payload bounds
validation, and tcp error-path leak fixes (Bryam, Tianchu,
Geliang)
- nvme-tcp lockdep and workqueue fixes (Shin'ichiro, Kuniyuki,
Eric)
- Assorted other fixes and cleanups (John, Yao, Chao, Mateusz,
Achkinazi, Wentao)
- MD pull request via Yu Kuai:
- raid1/raid10 fixes for a deadlock in the read error recovery
path, error-path detection and bio accounting with cloned bios,
and an nr_pending leak in the REQ_ATOMIC bad-block error path
(Abd-Alrhman)
- PCI P2PDMA propagation from member devices to the RAID device
(Kiran)
- dm-raid bio requeue fix, and various smaller fixes and cleanups
(Benjamin, Chen, Li, Thorsten)
- Enable Clang lock context analysis for the block layer, with the
accompanying annotations across queue limits, the blk_holder_ops
callbacks, crypto, cgroup, iocost, kyber and mq-deadline (Bart)
- Block status code infrastructure work: a tagged status table, a
str_to_blk_op() helper, a bio_endio_status() helper, and on top of
that a new configurable block-layer error injection facility
(Christoph)
- DRBD netlink rework, replacing the genl_magic machinery with explicit
netlink serialization and moving the DRBD UAPI headers to
include/uapi/linux/ (Christoph Böhmwalder)
- bvec improvements: a bvec_folio() helper and making the bvec_iter
helpers proper inline functions (Willy, Christoph)
- ublk cleanups and a canceling-flag fix for the disk-not-allocated
case (Caleb, Ming)
- Partition handling fixes: bound the AIX pp_count scan, fix an of_node
refcount leak, and replace __get_free_page() with kmalloc() (Bryam,
Wentao, Mike)
- Convert numa_node to int in blk_mq_hw_ctx and ->init_request, and add
WQ_PERCPU to the block workqueue users (Mateusz, Marco)
- Block statistics and tracing: propagate in-flight to the whole disk
on partition IO, export passthrough stats, and a new
block_rq_tag_wait tracepoint (Tang, Keith, Aaron)
- A round of removals, unexports and cleanups across bio, direct-io and
the bvec helpers (Christoph)
- Various driver fixes (mtip32xx use-after-free, rbd snap_count
validation and strscpy conversion, nbd socket lockdep reclassify,
virtio-blk zone report clamp, floppy) and a batch of MAINTAINERS
email/list updates (Coly, Li, Yu, Christoph Böhmwalder)
- Other little fixes and cleanups all over
* tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (117 commits)
MAINTAINERS: Update Coly Li's email address
block: check bio split for unaligned bvec
nbd: Reclassify sockets to avoid lockdep circular dependency
block: add configurable error injection
block: add a str_to_blk_op helper
block: add a "tag" for block status codes
block: add a macro to initialize the status table
floppy: Drop unused pnp driver data
block: propagate in_flight to whole disk on partition I/O
virtio-blk: clamp zone report to the report buffer capacity
block: optimize I/O merge hot path with unlikely() hints
drivers/block/rbd: Use strscpy() to copy strings into arrays
partitions: aix: bound the pp_count scan to the ppe array
block: Enable lock context analysis
block/mq-deadline: Make the lock context annotations compatible with Clang
block/Kyber: Make the lock context annotations compatible with Clang
block/blk-mq-debugfs: Improve lock context annotations
block/blk-iocost: Inline iocg_lock() and iocg_unlock()
block/blk-iocost: Split ioc_rqos_throttle()
block/crypto: Annotate the crypto functions
...
|
||
|
Linus Torvalds
|
9b40ba14ed |
Merge tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring updates from Jens Axboe: - Rework the task_work infrastructure. Both the local (DEFER_TASKRUN) and the normal (tctx) task_work lists were llist based, which is LIFO ordered, and hence each run had to do an O(n) list reversal pass first to restore queue order. Additionally, to cap the amount of task_work run, each method needed a retry list as well. Add a lockless MPCS FIFO queue (based on Dmitry Vyukov's intrusive MPSC algorithm) and switch both task_work lists to it. It performs better than llists and we can then also ditch the retry lists as well as entries are popped one-at-the-time. On top of those changes, run the tctx fallback task_work directly and remove the now-unused per-ctx fallback machinery entirely. - zcrx user notifications. Add a mechanism for zcrx to communicate conditions back to userspace via a dedicated CQE, with the initial users being notification on running out of buffers and on a frag copy fallback, plus shared-memory notification statistics. Alongside that, a series of zcrx reliability and cleanup fixes: more reliable scrubbing, poisoning pointers on unregistration, dropping an extra ifq close, adding a ctx back-pointer, reordering fd allocation in the export path, and killing a dead 'sock' member. - Allow using io_uring registered buffers for plain SEND and RECV, not just for the zero-copy send path. This enables targets like ublk's NBD backend to push/pull IO data directly to/from a registered buffer over a plain send/recv on a TCP socket. - Registered buffer improvements: account huge pages correctly, bump the io_mapped_ubuf length field to size_t, and raise the previous 1GB registered buffer size limit. - Restrict the ctx access exposed to io_uring BPF struct_ops programs by handing them an opaque type rather than the full io_ring_ctx, and add a separate MAINTAINERS entry for the bpf-ops code. - Allow opcode filtering on IORING_OP_CONNECT. - Validate ring-provided buffer addresses with access_ok(), and align the legacy buffer add limit with MAX_BIDS_PER_BGID. - Various other cleanups and minor fixes, including avoiding msghdr async data on connect/bind, dropping async_size for OP_LISTEN, making the POLL_FIRST receive side checks consistent, re-checking IO_WQ_BIT_EXIT for each linked work item, and using trace_call__##name() at guarded tracepoint call sites. * tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (31 commits) io_uring/bpf-ops: add a separate maintainer entry io_uring/net: make POLL_FIRST receive side checks consistent io_uring: remove the per-ctx fallback task_work machinery io_uring: run the tctx task_work fallback directly io_uring: switch normal task_work to a mpscq io_uring: switch local task_work to a mpscq io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue io_uring: grab RCU read lock marking task run io_uring/zcrx: kill dead 'sock' member in struct io_zcrx_args io_uring/kbuf: validate ring provided buffer addresses with access_ok() io_uring/net: support registered buffer for plain send and recv io_uring/nop: Drop a wrong comment in struct io_nop io_uring/net: Remove async_size for OP_LISTEN io_uring/net: Avoid msghdr on op_connect/op_bind async data io_uring/bpf-ops: restrict ctx access to BPF io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item io_uring/kbuf: align legacy buffer add limit with MAX_BIDS_PER_BGID io_uring/zcrx: add shared-memory notification statistics io_uring/zcrx: notify user on frag copy fallback io_uring/zcrx: notify user when out of buffers ... |
||
 Rob Herring (Arm)
|
4910aa198d |
gpio: pisosr: Read "ngpios" as u32
The generic "ngpios" property is encoded as a normal uint32 cell. The pisosr driver stores it in the gpio_chip field, but reading it with a u16 helper does not match the DT property encoding. Read "ngpios" as u32 and keep the existing assignment to the chip field. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260612215216.1887485-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> |
||
|
Linus Torvalds
|
d29fd593e6 |
Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
Pull hfs/hfsplus updates from Viacheslav Dubeyko:
"Several fixes in HFS/HFS+ of syzbot reported issues and HFS//HFS+
fixes of xfstests failures.
- fix a null-ptr-deref issue reported by syzbot (Edward Adam Davis)
If the attributes file is not loaded during system mount
hfsplus_create_attributes_file can dereference a NULL pointer.
Also, add a b-tree node size check in hfs_btree_open() with the
goal to prevent an uninit-value bug reported by syzbot for the case
of corrupted HFS+ image.
- fix __hfs_bnode_create() by using kzalloc_flex() instead of
kzalloc() (Rosen Penev)
- fix early return in hfs_bnode_read() (Tristan Madani)
hfs_bnode_read() can return early without writing to the output
buffer when is_bnode_offset_valid() fails or when
check_and_correct_requested_ length() corrects the length to zero.
Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass
stack-allocated buffers and use the result unconditionally, leading
to KMSAN uninit-value reports.
The rest fix (1) generic/637, generic/729 issue for the case of HFS+
file system, (2) generic/003, generic/637 for the case of HFS file
system"
* tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
hfs: rework hfsplus_readdir() logic
hfs: disable the updating of file access times (atime)
hfs: fix incorrect inode ID assignment in hfs_new_inode()
hfsplus: rework hfsplus_readdir() logic
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
hfsplus: Add a sanity check for btree node size
hfsplus: fix issue of direct writes beyond end-of-file
hfs/hfxplus: use kzalloc_flex()
hfsplus: Remove the duplicate attr inode dirty marking action
|
||
|
Linus Torvalds
|
6f60a6033c |
Merge tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2
Pull nilfs2 updates from Viacheslav Dubeyko:
"Fixes of syzbot reported issue and various small fixes in NILFS2
functionality.
- fix hung task in nilfs_transaction_begin() (Deepanshu Kartikey)
Reported by syzbot. The root cause is that user-supplied segment
numbers were not validated before nilfs_clean_segments() began
doing work; the range check on each segnum was performed deep
inside the call chain by nilfs_sufile_updatev(), which emits a
nilfs_warn() per invalid entry while still holding the segctor lock
and the sufile mi_sem.
Fix it by validating the contents of kbufs[4] in
nilfs_clean_segments() immediately after acquiring ns_segctor_sem
via nilfs_transaction_lock().
- fix a smatch warning in nilfs_mkdir() warn (Hongling Zeng)
This corrects a semantic issue related to the use of the
ERR_PTR macro that arose from a recent VFS change.
- fix a backing_dev_info reference leak (Shuangpeng Bai)
setup_bdev_super() initializes sb->s_bdev and takes a reference on
the block device backing_dev_info when assigning sb->s_bdi.
nilfs_fill_super() takes another reference to the same
backing_dev_info and stores it in sb->s_bdi again. The extra
reference is not paired with a matching bdi_put(), since
generic_shutdown_super() releases sb->s_bdi only once.
Drop the redundant bdi_get() in nilfs_fill_super(). The single
reference taken by setup_bdev_super() is enough and is released
during superblock shutdown"
* tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
nilfs2: Fix return in nilfs_mkdir
nilfs2: fix backing_dev_info reference leak
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
|
||
|
Linus Torvalds
|
31b706da2c |
Merge tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs updates from David Sterba:
"The most noticeable change is to enable large folios by default, it's
been in testing for a few releases. Related to that is huge folio
support (still under experimental config). Otherwise a few ioctl
updates, performance improvements and usual fixes and core changes.
User visible changes:
- enable large folios by default, added in 6.17 (under experimental
build), no feature limitations, a big change internally
- new ioctl to return raw checksums to userspace (a bit tricky given
compression and tail extents), can be used for mkfs and
deduplication optimizations
- provide stable UUID for e.g. overlayfs and temp_fsid, also
reflected in statvfs() field f_fsid, internal dev_t is hashed in to
allow cloning
- add 32bit compat version of GET_SUBVOL_INFO ioctl
- in experimental build, support huge folios (up to 2M)
Performance related improvements/changes:
- limit bio size to the estimated optimum derived from the queue,
this prevents build up of too much data for writeback, which could
cause latency spikes (reported improvement 15% on sequential
writes)
- don't force direct IO to be serialized, forgotten change during
mount API port, brings back +60% of throughput
- lockless calculation of number of shrinkable extent maps, improve
performance with many memcg allocated objects
Notable fixes:
- in zoned mode, fix a deadlock due to zone reclaim and relocation
when space needs to be flushed
- don't trim device which is internally not tracked as writeable
(e.g. when missing device is being rescanned)
- fix deadlock when cloning inline extent and mounted with
flushoncommit
- fix false IO failures after direct IO falls back to buffered write
in some cases
Core:
- remove COW fixup mechanism completely; detect and fix changes to
pages outside of filesystem tracking, guaranteed since 5.8, grace
period is over
- remove 2K block size support, experimental to test subpage code on
x86_64 but now it would block folio changes
- tree-checker improvements of:
- free-space cache and tree items
- root reference and backref items
- extent state exceptions in reloc tree
- subpage mode updates:
- code optimizations, simplify tracking bitmaps
- re-enable readahead of compressed extent
- extend bitmap size to cover huge folios
- add tracepoints related to sync, tree-log and transactions
- device stats item tracking unification, remove item if there are no
stats recorded, also don't leave stale stats on replaced device
- allow extent buffer pages to be allocated as movable, to help page
migration
- added checks for proper extent buffer release
- btrfs.ko code size reduction due to transaction abort call
simplifications
- several struct size reductions
- more auto free conversions
- more verbose assertions"
* tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (130 commits)
btrfs: fix use-after-free after relocation failure with concurrent COW
btrfs: move WARN_ON on unexpected error in __add_tree_block()
btrfs: move locking into btrfs_get_reloc_bg_bytenr()
btrfs: lzo: reject compressed segment that overflows the compressed input
btrfs: retry faulting in the pages after a zero sized short direct write
btrfs: fix incorrect buffered IO fallback for append direct writes
btrfs: fix false IO failure after falling back to buffered write
btrfs: use verbose assertions in backref.c
btrfs: print a message when a missing device re-appears
btrfs: do not trim a device which is not writeable
btrfs: return real error after lookup failure in btrfs_ioctl_default_subvol()
btrfs: use mapping shared locking for reading super block
btrfs: use lockless read in nr_cached_objects shrinker callback
btrfs: switch local indicator variables to bools
btrfs: send: pass bool for pending_move and refs_processed parameters
btrfs: use shifts for sectorsize and nodesize
btrfs: fix deadlock cloning inline extent when using flushoncommit
btrfs: allocate eb-attached btree pages as movable
btrfs: add 32-bit compat ioctl for BTRFS_IOC_GET_SUBVOL_INFO
btrfs: derive f_fsid from on-disk fsid and dev_t
...
|
||
|
Linus Torvalds
|
477c122f8c |
Merge tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm
Pull dlm updates from David Teigland: "There are four fixes/cleanups in this series; none are likely to be issues in real usage: - improve debugfs error exit path - fix sequence number ordering in an artificial test case - fix usercopy_abort for lvb data - use hlist_for_each_entry_srcu for srcu lists" * tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: init per node debugfs before add to node hash dlm: fix add msg handle in send_queue ordered dlm: add usercopy whitelist to dlm_cb cache dlm: use hlist_for_each_entry_srcu for SRCU protected lists |
||
|
Linus Torvalds
|
974b3dec2b |
Merge tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf, isofs, ext2, and quota updates from Jan Kara: - Assorted udf & isofs fixes for maliciously formatted devices - Cleanups to use kmalloc() instead of __get_free_page() - Removal of deprecated DAX code from ext2 * tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: validate VAT inode size for old VAT format udf: validate VAT header length against the VAT inode size udf: validate sparing table length as an entry count, not a byte count isofs: bound Rock Ridge symlink components to the SL record ext2: fix ignored return value of generic_write_sync() ext2: Remove deprecated DAX support isofs: replace __get_free_page() with kmalloc() quota: allocate dquot_hash with kmalloc() udf: validate free block extents against the partition length |
||
|
Linus Torvalds
|
59b1c2aa06 |
Merge tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull fsnotify updates from Jan Kara: - fanotify improvements for pidfd reporting - small cleanup in fanotify_error_event_equal * tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: allow reporting pidfds for reaped tasks fanotify: report thread pidfds for FAN_REPORT_TID fanotify: simplify fanotify_error_event_equal |
||
|
Linus Torvalds
|
6271f6ea7f |
Merge tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs updates from Carlos Maiolino: "The main highlight is the removal of experimental tag of the zone allocator feature. Besides that, this contains a collection of bug fixes and code refactoring but no new features have been added" * tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (29 commits) xfs: shut down the filesystem on a failed mount xfs: skip inode inactivation on a shut down mount xfs: move XFS_LSN_CMP to xfs_log_format.h xfs: shut down zoned file systems on writeback errors xfs: cleanup xfs_growfs_compute_deltas xfs: pass back updated nb from xfs_growfs_compute_deltas xfs: fix pointer arithmetic error on 32-bit systems xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap xfs: only log freed extents for the current RTG in zoned growfs xfs: add newly added RTGs to the free pool in growfs xfs: factor out a xfs_zone_mark_free helper xfs: mark struct xfs_imap as __packed xfs: store an agbno in struct xfs_imap xfs: massage xfs_imap_to_bp into xfs_read_icluster xfs: remove im_len field in struct xfs_imap xfs: cleanup xfs_imap xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_map xfs: remove the i_ino field in struct xfs_inode xfs: remove xfs_setup_existing_inode xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt ... |
||
 Bryam Vargas
|
66725039f7 |
Input: mms114 - reject an oversized device packet size
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer
struct mms114_touch touch[MMS114_MAX_TOUCH];
which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:
packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
if (packet_size <= 0)
goto out;
...
error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
(u8 *)touch);
packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.
A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.
Fixes:
|
||
|
Linus Torvalds
|
481329ec5b |
Merge tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:
- lkdtm:
- Add case to provoke a crash in EFI runtime services (Ard Biesheuvel)
- add PPC_RADIX_TLBIEL test and missed isync (Sayali Patil)
- stddef: Document designated initializer semantics for
__TRAILING_OVERLAP() (Gustavo A. R. Silva)
- strarray: drop redundant allocation, add __counted_by_ptr (Thorsten
Blum)
* tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
lkdtm/powerpc: add PPC_RADIX_TLBIEL test for radix MCE validation
lkdtm/powerpc: add isync after slbmte to enforce SLB update ordering
lkdtm: Add case to provoke a crash in EFI runtime services
lib/string_helpers: annotate struct strarray with __counted_by_ptr
lib/string_helpers: drop redundant allocation in kasprintf_strarray
MAINTAINERS: add kernel hardening keyword __counted_by_ptr
stddef: Document designated initializer semantics for __TRAILING_OVERLAP()
|
||
|
Linus Torvalds
|
673f72944d |
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library updates from Eric Biggers: - Drop the last architecture-specific implementation of MD5 - Mark clmul32() as noinline_for_stack to improve codegen in some cases * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: gf128hash: mark clmul32() as noinline_for_stack lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code |
||
|
Linus Torvalds
|
ef3b7426a6 |
Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull CRC updates from Eric Biggers: "Accelerate CRC64-NVME for 32-bit ARM by refactoring the arm64 NEON intrinsics implementation to be shared by 32-bit and 64-bit. Also apply a similar cleanup to the 32-bit ARM NEON implementation of xor_gen(), where it now reuses code from the 64-bit implementation" * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: aegis128 - Use neon-intrinsics.h on ARM too lib/crc: arm: Enable arm64's NEON intrinsics implementation of crc64 lib/crc: Turn NEON intrinsics crc64 implementation into common code xor/arm64: Use shared NEON intrinsics implementation from 32-bit ARM xor/arm: Replace vectorized implementation with arm64's intrinsics ARM: Add a neon-intrinsics.h header like on arm64 |
||
|
Linus Torvalds
|
0d8c113493 |
Merge tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
"API:
- Drop support for off-CPU cryptography in af_alg
- Document that af_alg is *always* slower
- Document the deprecation of af_alg
- Remove zero-copy support from skcipher and aead in af_alg
- Cap AEAD AD length to 0x80000000 in af_alg
- Free default RNG on module exit
Algorithms:
- Fix vli multiplication carry overflow in ecc
- Drop unused cipher_null crypto_alg
- Remove unused variants of drbg
- Use lib/crypto in drbg
- Use memcpy_from/to_sglist in authencesn
- Allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
- Disallow RSA PKCS#1 SHA-1 sig algs in FIPS mode
- Filter out async aead implementations at alloc in krb5
- Fix non-parallel fallback by rstoring callback in pcrypt
- Validate poly1305 template argument in chacha20poly1305
Drivers:
- Add sysfs PCI reset support to qat
- Add KPT support for GEN6 devices to qat
- Remove unused character device and ioctls from qat
- Add support for hw access via SMCC to mtk
- Remove prng support from crypto4xx
- Remove prng support from hisi-trng
- Remove prng support from sun4i-ss
- Remove prng support from xilinx-trng
- Remove loongson-rng
- Remove exynos-rng
Others:
- Remove support for AIO on sockets"
* tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (196 commits)
crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
crypto: rng - Free default RNG on module exit
crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
hwrng: jh7110 - fix refcount leak in starfive_trng_read()
crypto: atmel-ecc - drop dead code in atmel_ecdh_max_size
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
MAINTAINERS: make myself the maintainer of the Qualcomm QCE driver
crypto: amcc - convert irq_of_parse_and_map to platform_get_irq
crypto: sun4i-ss - Remove insecure and unused rng_alg
hwrng: xilinx - Move xilinx-rng into drivers/char/hw_random/
crypto: xilinx-trng - Replace crypto_drbg_ctr_df() with HMAC-SHA512
crypto: xilinx-trng - Fix return value of xtrng_hwrng_trng_read()
crypto: xilinx-trng - Remove crypto_rng interface
crypto: exynos-rng - Remove exynos-rng driver
hwrng: hisi-trng - Move hisi-trng into drivers/char/hw_random/
crypto: hisi-trng - Remove crypto_rng interface
crypto: loongson - Remove broken and unused loongson-rng
crypto: crypto4xx - Remove insecure and unused rng_alg
crypto: qat - validate RSA CRT component lengths
...
|
||
|
Linus Torvalds
|
f8115f0e8a |
Merge tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab updates from Vlastimil Babka: - Support for "allocation tokens" (currently available in Clang 22+) for smarter partitioning of kmalloc caches based on the allocated object type, which can be enabled instead of the "random" per-caller-address-hash partitioning. It should be able to deterministically separate types containing a pointer from those that do not (Marco Elver) - Improvements and simplification of the kmem_cache_alloc_bulk() and mempool_alloc_bulk() API. This includes adaptation of callers (Christoph Hellwig) - Performance improvements and cleanups related mostly to sheaves refill (Hao Li, Shengming Hu, Vlastimil Babka) - Several fixups for the slabinfo tool (Xuewen Wang) * tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled mm/slub: preserve original size in _kmalloc_nolock_noprof retry path mm: simplify the mempool_alloc_bulk API mm/slab: improve kmem_cache_alloc_bulk mm/slub: detach and reattach partial slabs in batch mm/slub: introduce helpers for node partial slab state mm/slub: use empty sheaf helpers for oversized sheaves tools/mm/slabinfo: remove redundant slab->partial assignment tools/mm/slabinfo: remove dead assignment in get_obj_and_str() tools/mm/slabinfo: Fix trace disable logic inversion MAINTAINERS: add slab-related scripts and tools to SLAB ALLOCATOR mm/slub: fix typo in sheaves comment mm, slab: simplify returning slab in __refill_objects_node() mm, slab: add an optimistic __slab_try_return_freelist() slab: fix kernel-docs for mm-api slab: improve KMALLOC_PARTITION_RANDOM randomness slab: support for compiler-assisted type-based slab cache partitioning mm/slub: defer freelist construction until after bulk allocation from a new slab |
||
|
Linus Torvalds
|
a87bbc4578 |
Merge tag 'docs-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull documentation updates from Jonathan Corbet:
"Things have calmed down a bit on the docs front, with no earthshaking
changes this time around:
- Ongoing work on the Japanese and Portuguese translations
- Better integration of the MAINTAINERS file into the rendered
documents, including a search interface
- A seemingly infinite supply of fixes for typos, minor grammatical
issues, and related problems that LLMs find with abandon"
* tag 'docs-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (93 commits)
docs: pt_BR: Translate 3.Early-stage.rst into Portuguese
docs: pt_BR: update "Purpose of Defconfigs" section in maintainer-soc.rst
Documentation: bug-hunting.rst: fix grammar
docs/ja_JP: translate submitting-patches.rst (interleaved-replies)
docs: Fix minor grammatical error
docs/{it_it,sp_SP,zh_CN,zh_TW}: update references to removed CONFIG_DEBUG_SLAB
Documentation: process: fix brackets
Documentation: arch: fix brackets
docs/dyndbg: explain flags parse 1st
docs/dyndbg: update examples \012 to \n
docs: kernel-parameters: Fix stale sticore file paths
docs: real-time: Fix duplicated sched(7) text
docs: kgdb: Fix stale source file paths
docs: sonypi: Fix stale header file path
docs: kernel-parameters: Remove sa1100ir IrDA parameter
iommu: Documentation: rearrange, update kernel-parameters
docs: md: fix grammar in speed_limit description
docs: changes.rst: restore pahole 1.26 minimum (regressed by sort)
Documentation: Fix syntax of kmalloc_objs example in coding style doc
docs: pt_BR: update maintainer-handbooks
...
|
||
|
Linus Torvalds
|
bd77e50c9a |
Merge tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev updates from Helge Deller:
"Beside the removal of the Hercules monochrome ISA graphics driver and
the corresponding text console driver, there is just the typical
maintanance with smaller driver fixes and cleanups:
Removal of drivers:
- Hercules monochrome ISA graphics adapter driver (Ethan Nelson-Moore)
- Hercules mdacon console driver (Ethan Nelson-Moore)
Changes affecting many drivers at once:
- possible memory leak fixes in various drivers (Abdun Nihaal)
- many conversions to use strscpy() (David Laight)
- Use named initializers in drivers (Uwe Kleine-König)
Code fixes:
- fbcon: don't suspend/resume when vc is graphics mode (Lu Yao)
- modedb: fix a possible UAF in fb_find_mode() (Tuo Li)
- modedb: Fix entry for 1920x1080-60 mode (Steffen Persvold)
- arm: Export acorndata_8x8 font symbol for bootloader (Helge Deller)
- omap2: fix use-after-free in omapfb_mmap (Hongling Zeng)
Cleanups:
- pxa168fb: use devm_ioremap_resource() (Alberto Arostegui)
- provice helpers for fb_set_var() and fb_blank() and fbcon updates
(Thomas Zimmermann)
- fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
- chipsfb: add missing MODULE_DESCRIPTION() macro (Rahman Mahmutović)
- sunxvr2500: replace printk with device-aware logging functions
(Rahman Mahmutović)
- sm712: Fix operator precedence in big_swap macro (Li RongQing)
- imxfb: Use of_device_get_match_data() (Rosen Penev)
- atmel_lcdfb: Use of_device_get_match_data() (Rosen Penev)
Documentation fixes:
- grvga: Fix CLUT register address offset in comment (Eduardo Silva)
- omap/dss: Fix stale modedb.c path (Costa Shulyupin)
- correct CONFIG_FB_TILEBLITTING macro name in #endif comment (Ethan
Nelson-Moore)"
* tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (43 commits)
fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
fbdev: modedb: fix a possible UAF in fb_find_mode()
fbdev: s3fb: Use strscpy() to copy strings into arrays
fbdev: sm501fb: Fix buffer errors in OF binding code
fbcon: correct CONFIG_FB_TILEBLITTING macro name in #endif comment
fbdev/arm: Export acorndata_8x8 font symbol for bootloader
fbdev: mmpfb: Use strscpy() to copy device name
fbdev: sisfb: Replace strlen() strcpy() pair with strscpy()
fbdev: rivafb: Use strscpy() to copy device name
fbdev: cyber2000fb: Use strscpy() to copy device name
fbdev: atmel_lcdfb: Use strscpy() to copy device name
fbdev: Do not export fbcon from fbdev
fbdev: Wrap fbcon updates from vga-switcheroo in helper
fbdev: Wrap user-invoked calls to fb_blank() in helper
fbdev: Wrap user-invoked calls to fb_set_var() in helper
fbdev: omap2: fix use-after-free in omapfb_mmap
docs: omap/dss: Fix stale modedb.c path
fbdev: pxa168fb: use devm_ioremap_resource() for MMIO
fbdev: grvga: Fix CLUT register address offset in comment
fbdev: sunxvr2500: replace printk with device-aware logging functions
...
|
||
|
Linus Torvalds
|
464e2f089e |
Merge tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC updates from Ulf Hansson:
"MMC core:
- Validate host's max_segs to fail gracefully
MMC host:
- davinci:
- Avoid potential NULL dereference in the IRQ handler
- Call mmc_add_host() in the correct order during probe
- dw_mmc-exynos:
- Increase DMA threshold for exynos7870
- renesas_sdhi:
- Add support for RZ/G2E, RZ/G2N and R-Car M3Le variants
- sdhci-msm:
- Add support for Hawi, Eliza and Shikra variants
- sdhci-of-k1:
- Add support for SD UHS-I modes
- Add support for tuning for eMMC HS200 and SD UHS-I"
* tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (24 commits)
mmc: dw_mmc: Add desc_num field for clarity
dt-bindings: mmc: sdhci-msm: Rename the binding to include 'qcom' prefix
mmc: sdhci-of-dwcmshc: use dev_err_probe() to simplify error paths
mmc: sdhci-of-dwcmshc: remove redundant IS_ERR() check
dt-bindings: mmc: sdhci-msm: qcom: Add Hawi compatible
mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
dt-bindings: mmc: sdhci-msm: Add Eliza compatible
mmc: davinci: fix mmc_add_host order in probe
dt-bindings: mmc: sdhci-msm: Document the Shikra compatible
mmc: sdhci-of-k1: add comprehensive SDR tuning support
mmc: sdhci-of-k1: add regulator and pinctrl voltage switching support
mmc: sdhci-of-k1: enable essential clock infrastructure for SD operation
dt-bindings: mmc: spacemit,sdhci: add pinctrl support for voltage switching
mmc: via-sdmmc: Simplify initialisation of pci_device_id array
mmc: davinci: avoid NULL deref of host->data in IRQ handler
memstick: Constify the driver id_table
mmc: host: Move MODULE_DEVICE_TABLE next to the table itself
mmc: renesas_sdhi: add R-Car M3Le compatibility string
dt-bindings: mmc: renesas,sdhi: Document R-Car M3Le support
...
|
||
|
Linus Torvalds
|
fc2ce3ee10 |
Merge tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon updates from Guenter Roeck:
"New drivers for the following chips:
- Analog Devices LTC4283 Swap Controller
- Analog Devices MAX20830
- Analog Devices MAX20860A
- ARCTIC Fan Controller
- Delta E50SN12051
- Luxshare LX1308
- Microchip EMC1812/13/14/15/33
- Monolithic MP2985
- Murata D1U74T PSU
New chip support added to existing drivers:
- asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX
B850-E GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
- dell-smm: Add Dell Latitude 7530 to fan control whitelist
- nct6683: Support for ASRock Z890 Pro-A
- pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
- pmbus/max34440: Support for ADPM12250
- pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
reported by Sashiko
New functionality:
- Add support for update_interval_us chip attribute, and support it
in ina238 driver
- Add support for guard() and scoped_guard() for subsystem locks, and
use it in adt7411, ina2xx, and lm90 drivers
- emc2305: Support configurable fan PWM at shutdown
- lm63: Expose PWM frequency and LUT hysteresis as writable
- lm75: Support active-high alert polarity
- nct7802: Add time step attributes for tweaking responsiveness
- pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
clear_blackbox, and firmware_revision
- raspberrypi: Fix delayed-work teardown race, add voltage input
support as well as voltage domain IDs
- mcp9982: Add support for reporting external diode faults
Miscellaneous bug fixes, changes and improvements:
- Use named initializers for platform_device_id arrays and
i2c_device_data, and remove unused driver data
- Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
- ads7871: Convert to hwmon_device_register_with_info(), and use
DMA-safe buffer for SPI writes
- adt7411: document supported sysfs attributes
- adt7462: Add of_match_table to support devicetree
- adt7475: Add explicit header include
- coretemp; Fix outdated documentation, coding style issues, and
replace hardcoded core count with dynamic value
- cros_ec: Drop unused assignment of platform_device_id driver data
- emc2305: Fix fan channel index handling
- gpd-fan: Reject EC PWM value 0 as invalid, fix race condition
between device removal and sysfs access, upgrade log level from
warn to err for platform device creation failure, initialize EC
before registering hwmon device, drop global driver data and use
per-device allocation
- htu31: document debugfs serial_number
- ina238: Add support for samples and update_interval
- it87: Clamp negative values to zero in set_fan()
- lm75: Add explicit header include, Add explicit default cases in
lm75_is_visible(), and add section for sysfs interface to
documentation
- pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
- tmp102: Use device_property_read_string API
- tmp401: Read "ti,n-factor" as signed
- Convert zyxel,nsa320-mcu to DT schema"
* tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (81 commits)
hwmon: tmp401: Read "ti,n-factor" as signed
hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
hwmon: (gpd-fan) Reject EC PWM value 0 as invalid
hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
hwmon: temperature: add support for EMC1812
dt-bindings: hwmon: temperature: add support for EMC1812
hwmon: (gpd-fan): fix race condition between device removal and sysfs access
hwmon: (gpd-fan): upgrade log level from warn to err for platform device creation failure
hwmon: (gpd-fan): Initialize EC before registering hwmon device
hwmon: (gpd-fan): drop global driver data and use per-device allocation
hwmon: (pmbus/max34440): add support adpm12250
hwmon: (ina238) Add update_interval_us attribute
hwmon: Add update_interval_us chip attribute
hwmon: (ina238) Add support for samples and update_interval
gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
hwmon: ltc4283: Add support for the LTC4283 Swap Controller
dt-bindings: hwmon: Document the LTC4283 Swap Controller
hwmon: (pmbus/xdp720) Fix driver issues xdp720/730
hwmon: (pmbus/xdp720) Add support for efuse xdp730
dt-bindings: hwmon/pmbus: Add Infineon xdp730
...
|
||
|
Linus Torvalds
|
7e54cdd056 |
Merge tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog updates and fixes from Guenter Roeck:
"Subsystem:
- Unregister PM notifier on watchdog unregister
- Various documentation fixes and improvements
Removed drivers:
- Remove AMD Elan SC520 processor watchdog driver
- Drop SMARC-sAM67 support
- Remove driver for integrated WDT of ZFx86 486-based SoC
New drivers:
- Driver for Andes ATCWDT200
- Driver for Gunyah Watchdog
Added support to existing drivers:
- Add "apple,t8103-wdt" and "apple,t8122-wdt" compatibles to Apple
watchdog driver
- Add rockchip,rk3528-wdt and rockchip,rv1103b-wdt to snps,dw-wdt.yaml
- Document IPQ9650, IPQ5210, Shikra, Nord, and Hawi in qcom-wdt.yaml
Also document sram property and add support to get the bootstatus
to qcom wdt driver
- lenovo_se10_wdt: Fix use-after-rfree and add support for SE10 Gen 2
platform
- ti,rti-wdt: Add ti,am62l-rti-wdt compatible
- renesas: Document RZ/G3L support and rework example for
renesas,r9a09g057-wdt
Other bug fixes and improvements:
- Use named initializers (sc1200, ziirave_wdt)
- Allow pic32-dmt and pic32-wdt to be built with COMPILE_TEST
- realtek-otto: enable clock before using I/O, and prevent PHASE2 underflows
- rti_wdt: Add reaction control
- renesas,rzn1-wdt: Drop interrupt support and other cleanup
- gpio_wdt: Add ACPI support
- imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
- sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
- bcm2835_wdt: Switch to new sys-off handler API
- sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
- hpwdt: Refine hpwdt message for UV platform
- Convert TS-4800 bindings to DT schema
- menz069_wdt: drop unneeded MODULE_ALIAS
- sp5100_tco: Use EFCH MMIO for newer Hygon FCH"
* tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (58 commits)
watchdog: sc1200: Drop unused assignment of pnp_device_id driver data
watchdog: unregister PM notifier on watchdog unregister
dt-bindings: watchdog: qcom-wdt: Document IPQ5210 watchdog
watchdog: dev: convert to kernel-doc comments
watchdog: core: clean up some comments
watchdog: uapi: add comments for what bit masks apply to
watchdog: linux/watchdog.h: repair kernel-doc comments
watchdog: add devm_watchdog_register_device() to watchdog-kernel-api
watchdog: ziirave_wdt: Use named initializers for struct i2c_device_id
watchdog: realtek-otto: enable clock before using I/O
watchdog: realtek-otto: prevent PHASE2 underflows
dt-bindings: watchdog: qcom-wdt: Document IPQ9650 watchdog
dt-bindings: watchdog: renesas,rzn1-wdt: interrupts are not required
dt-bindings: watchdog: apple,wdt: Add t8122 compatible
watchdog: apple: Add "apple,t8103-wdt" compatible
watchdog: rzn1: remove now obsolete interrupt support
dt-bindings: watchdog: Add watchdog compatible for RK3528
watchdog: convert the Kconfig dependency on OF_GPIO to OF
watchdog: Remove AMD Elan SC520 processor watchdog driver
watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
...
|
||
|
Linus Torvalds
|
c41cfae42c |
Merge tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"This has been quite a busy release, mainly due to the subsystem wide
work Johan Hovold has done to modernise resource allocation for the
subsystem on probe, the subsystem did some very clever allocation
management pre devm which didn't quite mesh comfortably with managed
allocations and made it far too easy to introduce error handling and
removal bugs.
- Cleanup and simplification of controller struct allocation, moving
everything over to devm and making the devm APIs more robust, from
Johan Hovold
- Support for spi-mem devices that don't assert chip select and
support for a secondary read command for memory mapped flashes,
some commits for this are shared with mtd.
- Support for SpacemiT K1"
* tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (118 commits)
spi: Fix mismatched DT property access types
spi: xilinx: use FIFO occupancy register to determine buffer size
spi: spi-mem: Fix spi_controller_mem_ops kdoc
spi: xilinx: let transfers timeout in case of no IRQ
spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schema
spi: meson-spifc: fix runtime PM leak on remove
spi: Use named initializers for platform_device_id arrays
spi: rzv2h-rspi: Add suspend/resume support
spi: dw-pci: remove redundant pci_free_irq_vectors() calls
spi: ep93xx: fix double-free of zeropage on DMA setup failure
spi: cadence-xspi: Revert COMPILE_TEST support
spi: cadence-xspi: Support 32bit and 64bit slave dma interface
spi: tegra210-quad: Allocate DMA memory for DMA engine
spi: imx: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
spi: atmel: fix DMA channel and bounce buffer leaks
spi: omap2-mcspi: Use of_device_get_match_data()
spi: Use named initializers for arrays of i2c_device_data
spi: aspeed: Replace VLA parameter with flat pointer in calibration helper
...
|
||
|
Linus Torvalds
|
1e66d46f6d |
Merge tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator updates from Mark Brown:
"The development of the regulator subsystem continues to be quite
quiet, we've got several new devices, removal of one old device and
some kernel wide cleanup of platform devices but nothing in the core.
- Cleanups of platform_device_id usage
- Filling out and fixing of the description of the MediaTek MT6359
- Removal of the PCAP regulator driver, the MFD has been removed
- New device support for Qualcomm Nord RPMH, PM8109, PM8150 and
PMAU0102, and SG Micro SGM3804"
* tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (23 commits)
regulator: dt-bindings: mt6311: Convert to DT schema
regulator: qcom_smd-regulator: Add PM8019
regulator: dt-bindings: qcom,smd-rpm-regulator: Add PM8019
regulator: mt6359: Fix vbbck default internal supply name
regulator: bq257xx: drop confusing configuration of_node
regulator: Unify usage of space and comma in platform_device_id arrays
regulator: Use named initializers for platform_device_id arrays
regulator: Drop unused assignment of platform_device_id driver data
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
regulator: remove used pcap regulator driver
regulator: add SGM3804 Dual Output driver
regulator: dt-bindings: document the SGM3804 Dual Output regulator
regulator: mt6359: Add proper ldo_vcn33_[12] regulators
regulator: mt6359: Add regulator supply names
regulator: mt6359: const-ify regulator descriptions
regulator: dt-bindings: mt6359: Deprecate bogus vcn33_[12]_* split regulators
regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
regulator: palmas: Move MODULE_DEVICE_TABLE next to the table itself
regulator: qcom_smd: Add PM8150 regulators
regulator: dt-bindings: qcom,smd-rpm-regulator: Document PM8150 IC
...
|
||
|
Linus Torvalds
|
aaee7820e2 |
Merge tag 'regmap-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap update from Mark Brown: "This time around we just have a single fix for a sparse warning" * tag 'regmap-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-i2c: fix sparse warning in regmap_smbus_word_write_reg16 |
||
|
Linus Torvalds
|
2779759c09 |
Merge tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c updates from Andi Shyti:
"This pull request is mostly made of cleanups and small infrastructure
improvements across the I2C core, drivers and bindings. It also adds
support for three drivers and a few new compatibles.
Two major cleanup across drivers and core code:
- use named initializers in device ID tables
- replace dev_err() with dev_err_probe()
Drivers:
- at24: use named initializers for arrays of i2c_device_data
- at91: add MCHP_LAN966X_PCI dependency
- cadence: add shutdown callback
- k1: enable by default on SpacemiT
- mxs: improve documentation
- qcom-geni: use pm_runtime_force_suspend/resume for system sleep
- tegra:
- disable fair arbitration on non-MCTP buses
- allocate DMA buffers from the correct DMA device
- designware:
- handle active target shutdown cleanly
- add shutdown callbacks for platform and PCI drivers
- adopt the new PM_RUNTIME_ACQUIRE() helpers
DT bindings:
- convert davinci bindings to DT schema
Core and muxes:
- acpi: report missing I2C resources as -ENOENT
- gpiolib: add gpiod_is_single_ended() helper for I2C GPIO users
- i2c-mux-reg: add generic firmware node support
- a set of 10 patches from Johan Hovold fixing adapter registration
races, cleanup paths and resource management issues
New support:
- DesignWare LECA0003 (ACPI ID)
- Loongson LS2K0300 I2C controller (new driver)
- Qualcomm CCI Glymur and Shikra compatibles"
* tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (46 commits)
i2c: mxs: add missing kernel-doc for struct mxs_i2c_dev members
i2c: qcom-geni: Use pm_runtime_force_{suspend,resume} helpers
dt-bindings: i2c: qcom-cci: Document Glymur compatible
dt-bindings: i2c: qcom-cci: Document Shikra compatible
i2c: mux: reg: use device property accessors
i2c: acpi: Return -ENOENT when no resources found in i2c_acpi_client_count()
i2c: at91: Add MCHP_LAN966X_PCI dependency
i2c: eg20t: Consistently define pci_device_ids using named initializers
i2c: designware-pcidrv: Consistently define pci_device_ids using named initializers
i2c: bcm-kona: fix spelling mistake in timeout-check comment
i2c: cadence: Add shutdown handler
i2c: tegra: Disable fair arbitration for non-MCTP buses
i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation
i2c: busses: make K1 driver default for SpacemiT platforms
i2c: Use named initializers for arrays of i2c_device_data
i2c: core: clean up adapter registration error label
i2c: core: clean up bus id allocation
i2c: core: fix adapter deregistration race
i2c: core: fix adapter registration race
i2c: core: disable runtime PM on adapter registration failure
...
|
||
|
Linus Torvalds
|
31e6aeafcd |
Merge tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing updates from Bartosz Golaszewski:
"A set of extensions to the M.2 pwrseq driver allowing it to work with
more cards than just the one from Qualcomm we supported initially.
There's also a tweak to debugfs output and a new function that will be
used by a bluetooth driver in the next cycle.
Power Sequencing core:
- Add a helper allowing consumers to access the struct device object
associated with a pwrseq provider
- Print the power sequencing device's parent in debugfs to add more
debugging information
Driver updates:
- Extend/rework the M.2 power sequencing driver in order to allow it
to support more M.2 cards, not just WCN7850"
* tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: pcie-m2: Add PCI ID 0x1103 for WCN6855 Bluetooth
power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
power: sequencing: pcie-m2: Improve PCI device ID check
power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
power: sequencing: pcie-m2: Fix inconsistent function prefixes
power: sequencing: print power sequencing device parent in debugfs
|
||
 David Yang
|
72dfa4700f |
net: dsa: sja1105: fix lastused timestamp in flower stats
flow_stats_update() takes an absolute timestamp for lastused, not delta. Fix that. Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260614141320.1133321-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
 Arnd Bergmann
|
57a6ed0b41 |
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
bfa_fcs_fdmi_get_portattr() gets inlined into multiple places and has
two fairly large variables on the stack, to the point of causing a
warning in some randconfig builds:
drivers/scsi/bfa/bfa_fcs_lport.c:2198:1: error: stack frame size (1560) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_portattr_block' [-Werror,-Wframe-larger-than]
2198 | bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
| ^
drivers/scsi/bfa/bfa_fcs_lport.c:1856:1: error: stack frame size (1600) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_rhba_pyld' [-Werror,-Wframe-larger-than]
1856 | bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
| ^
Mark the inner function as noinline_for_stack to keep it separate from
the other variables and prevent multiple copies of the same variable to
get inlined here.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260611125601.3385418-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
||
|
Linus Torvalds
|
77d084d66b |
Merge tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"There's one new driver, one legacy driver removed, a kunit test-suite
for the GPIO core, support for new models in existing drivers and a
slew of various changes in many places though I can't think of
anything controversial that would stand out - it's been a relatively
calm cycle.
GPIO core:
- Add an initial set of kunit test cases for the GPIO subsystem
- Use the devres owner as the GPIO chip's parent in absence of any
other parent
- Fix const-correctness of GPIO chip SRCU guards
- Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
fwnode_gpiod_get()
- Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
- Use __ro_after_init where applicable
New drivers:
- Add driver for the GPIO controller on Waveshare DSI TOUCH panels
Removed drivers:
- Remove the obsolete ts5500 GPIO driver
Driver updates:
- Modernize gpio-timberdale: remove platform data support and use
generic device property accessors
- Extend test build coverage by enabling COMPILE_TEST for more GPIO
drivers
- Add some missing dependencies in Kconfig
- Add support for sparse fixed direction to gpio-regmap
- Remove dead code from gpio-nomadik
- use BIT() in gpio-mxc
- use bitmap_complement() in gpio-xilinx and gpio-pca953x
- Use more appropriate printing functions where applicable
- Use named initializers for platform_device_id and i2c_device_id
arrays
- Convert gpio-altera to using the generic GPIO chip helper library
- Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
gpio-tegra186
- Unify the naming convention for Qualcomm in GPIO drivers
- Fix interrupt bank mapping to GPIO chips in gpio-mt7621
- Add support for the lines-initial-states property to gpio-74x164
- Switch to using dynamic GPIO base in gpio-ixp4xx
- Move the handling of an OF quirk from ASoC to gpiolib-of.c where
other such quirks live
- Use handle_bad_irq() in gpio-ep93xx
- Some other minor tweaks and refactorings
Devicetree bindings:
- Document the Waveshare GPIO controller for DSI TOUCH panels
- Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in
gpio-zynq
- Add new properties for gpio-dwapb and fairchild,74hc595
- Fix whitespace issues
- Sort compatibles alphabetically in gpio-zynq
Documentation:
- Fix kerneldoc warnings in gpio-realtek-otto
Misc:
- Attach software nodes representing GPIO chips to the actual struct
device objects associated with them in some legacy platforms
enabling real firmware node lookup instead of string matching
- Drop unneeded dependencies on OF_GPIO from bus and staging drivers"
* tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (62 commits)
gpio: nomadik: remove dead DB8540 code from <gpio/gpio-nomadik.h>
gpio: mt7621: fix interrupt banks mapping on gpio chips
bus: ts-nbus: drop unneeded dependency on OF_GPIO
staging: media: max96712: drop unneeded dependency on OF_GPIO
gpiolib: Replace strcpy() with memcpy()
gpio: remove obsolete UAF FIXMEs from lookup paths
gpio: core: fix const-correctness of gpio_chip_guard
gpio: mxc: use BIT() macro
gpio: realtek-otto: fix kernel-doc warnings
gpio: max77620: Unify usage of space and comma in platform_device_id array
gpio: Use named initializers for platform_device_id arrays
gpio: cros-ec: Drop unused assignment of platform_device_id driver data
ARM: omap1: enable real software node lookup of GPIOs on Nokia 770
ARM: omap1: use platform_device_register_full() for GPIO devices on OMAP 16xx
ARM: omap1: drop unused variable from omap16xx_gpio_init()
gpio: gpiolib: use seq_puts() for plain strings
gpio: ts5500: remove obsolete driver
gpio: add kunit test cases for the GPIO subsystem
kunit: provide kunit_platform_device_unregister()
kunit: provide kunit_platform_device_register_full()
...
|
||
 Jakub Kicinski
|
2c53418347 |
Merge branch 'extend-netkit-io_uring-zc-selftests'
Daniel Borkmann says: ==================== Extend netkit io_uring ZC selftests Small follow-up to the HW net selftests, in particular to add a selftest showing that also large rx_buf_len for io_uring ZC is supported with netkit queue leasing. ==================== Link: https://patch.msgid.link/20260614102607.863838-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
 Daniel Borkmann
|
74ac711839 |
selftests/net: Add hugepage kernel config dependency for zcrx
test_iou_zcrx_large_buf in drivers/net/hw/nk_qlease.py runs iou-zcrx with rx_buf_len > page size, backed by a hugepage-mapped area. Thus add to the Kconfig. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260614102607.863838-5-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Borkmann
|
5024cfc8a3 |
selftests/net: Add netkit io_uring ZC test for large rx_buf_len
Add test_iou_zcrx_large_buf, which runs iou-zcrx with rx_buf_len > page size (-x 2) through a netkit-leased RX queue. The netkit ifindex is opaque to io_uring, but rx_page_size is honoured by the leased physical qops via netif_mp_open_rxq()'s lease redirect. Originally, I also added a BIG TCP variant on top, but dropped it here as fbnic (and the QEMU fbnic model) has no BIG TCP support to exercise it as this point. Tested against the QEMU fbnic emulation. The new test exercises the > page rx_buf_len path only when the leased NIC advertises QCFG_RX_PAGE_SIZE; otherwise it skips. For fbnic, I used Bjorn's patches locally [0]: # ./nk_qlease.py TAP version 13 1..5 ok 1 nk_qlease.test_iou_zcrx ok 2 nk_qlease.test_iou_zcrx_large_buf ok 3 nk_qlease.test_attrs ok 4 nk_qlease.test_attach_xdp_with_mp ok 5 nk_qlease.test_destroy # Totals: pass:5 fail:0 xfail:0 xpass:0 skip:0 error:0 Without those patches (aka not advertising QCFG_RX_PAGE_SIZE): # ./nk_qlease.py TAP version 13 1..5 ok 1 nk_qlease.test_iou_zcrx ok 2 nk_qlease.test_iou_zcrx_large_buf # SKIP Large chunks are not supported -95 ok 3 nk_qlease.test_attrs ok 4 nk_qlease.test_attach_xdp_with_mp ok 5 nk_qlease.test_destroy # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:1 error:0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://lore.kernel.org/netdev/20260522113225.241337-1-bjorn@kernel.org/ [0] Link: https://patch.msgid.link/20260614102607.863838-4-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Borkmann
|
96fda937b4 |
selftests/net: Use public NetDrvContEnv API in nk_qlease fixtures
Expose the netkit host ifname as a public attribute nk_host_ifname (symmetric with the already-public nk_guest_ifname), rename _attach_bpf to a public attach_bpf, and add a public detach_bpf helper that encapsulates the tc-filter teardown bookkeeping. Switch the fixtures to this public API. No functional change and keeps pylint happy. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260614102607.863838-3-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Borkmann
|
bc5c25c8f6 |
selftests/net: Move netkit lease hw setup into per-test fixtures
The HW counterpart of nk_qlease.py was carrying its lease setup in main()
and stashing src_queue / nk_queue / nk_*_ifname on cfg, which had drawbacks
called out during the review at [0].
This is the deferred half of the cleanup that landed in commit
|
||
|
Linus Torvalds
|
6b617c8258 |
Merge tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König: "The usual mixture of minor fixes, a few cleanups, a new driver and dt updates for the pwm subsystem. Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus, Ronaldo Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual changes and Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski and Rob Herring for reviews and acks" * tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: th1520: Remove requirement for mul_u64_u64_div_u64_roundup dt-bindings: pwm: stmpe: Drop legacy binding pwm: pca9685: Use named initializers for struct i2c_device_id pwm: pxa: Add optional bus clock dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K3 PWM support pwm: ipq: Add missing module description pwm: stm32: Make use of mul_u64_u64_div_u64_roundup() pwm: Consistently define pci_device_ids using named initializers pwm: Driver for qualcomm ipq6018 pwm block pwm: imx27: Fix variable truncation in .apply() pwm: mediatek: correct mt7628 clock source setting pwm: mediatek: set mt7628 pwm45_fixup flag to false pwm: atmel-tcb: Remove unneeded semicolon |
||
 Michael Bommarito
|
66aefc277e |
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
scsiback_device_action() obtains a command tag in
scsiback_get_pend_req() and submits a task-management request with
target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
scsiback jumps to the err: label, which sends a response but frees
nothing, leaking the tag.
Impact: a pvSCSI guest can leak the command tags of a LUN's session,
stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
whenever target_submit_tmr() fails.
transport_generic_free_cmd() cannot be used here. By the time
target_submit_tmr() returns an error it has already run
__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
pointer dangling. Letting the command release run target_free_cmd_mem()
would then double-free se_tmr_req.
Use the same helper, which returns just the tag, on this path too.
Fixes:
|
||
|
Michael Bommarito
|
ca978f8a93 |
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the se_cmd is initialised (kref_init() via target_init_cmd()) only
later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB
path. The two error paths in scsiback_do_cmd_fn() taken before the
command is submitted -- a failed scsiback_gnttab_data_map() and an
unknown ring_req.act -- call
transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a
refcount of 0. That underflows it ("refcount_t: underflow;
use-after-free") and, as the release function is not run, leaks the
command tag.
Impact: a pvSCSI guest can leak every command tag of a LUN's session,
stopping the LUN, by submitting requests with a bad grant reference or
an unknown request type; under panic_on_warn the refcount underflow
panics the host.
Add a helper that just returns the tag with target_free_tag() and sends
the error response. It frees the tag while the v2p reference still pins
the session, and snapshots the response fields beforehand because
freeing the tag can let another ring reuse the pending_req slot.
Fixes:
|
||
|
Linus Torvalds
|
fd1878584d |
Merge tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome-platform firmware updates from Tzung-Bi Shih: - Add bound checks when iterating the coreboot table - Skip failing entries only instead of aborting the whole device populate from the coreboot table * tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: firmware: google: Skip failing entries instead of aborting populate firmware: google: Add bounds checks in coreboot_table_populate() |
||
|
Linus Torvalds
|
2b5f5609ae |
Merge tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome-platform updates from Tzung-Bi Shih:
"Improvements:
- Use named initializers for struct i2c_device_id
Fixes:
- Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs
- Check for the presence of ACPI_COMPANION() for drivers converted
from acpi_driver to platform_driver to avoid issues where
device_match_driver_override() might forcibly match the driver to
the device
- Fix a possible UAF in cros_ec_chardev
- Prevent build for big-endian systems as CHROME_PLATFORMS drivers
are only running and testing under little-endian systems
Cleanups:
- Drop some redundant bits in cros_kbd_led_backlight and Kconfig"
* tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
platform/chrome: Prevent build for big-endian systems
platform/chrome: Remove superfluous dependencies from CROS_EC
platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
platform/chrome: cros_ec_chardev: Add event relayer
platform/chrome: cros_ec_chardev: Move data to chardev_pdata
platform/chrome: cros_ec_chardev: Introduce chardev_data
platform/chrome: Use named initializers for struct i2c_device_id
platform/chrome: wilco_ec: event: Check ACPI_COMPANION()
platform/chrome: chromeos_tbmc: Check ACPI_COMPANION()
platform/chrome: chromeos_privacy_screen: Check ACPI_COMPANION()
platform/chrome: cros_kbd_led_backlight: Drop CONFIG_MFD_CROS_EC_DEV ifdeffery
platform/chrome: cros_kbd_led_backlight: Pass keyboard_led as parameter
platform/chrome: cros_kbd_led_backlight: Drop max_brightness from driver data
platform/chrome: Resolve kb_wake_angle visibility race
|
||
 Catalin Iacob
|
e81f1079f9 |
scsi: core: Remove export for scsi_device_from_queue()
Commit
|
||
 Arnaldo Carvalho de Melo
|
d669529868 |
perf trace: Guard __probe_ip suppression with evsel__is_probe()
trace__fprintf_tp_fields() compares every field name against "__probe_ip" for all tracepoint events, but this field is only implicitly added by the Ftrace subsystem to bare dynamic probes. Add an evsel__is_probe() check before the strcmp so the string comparison is skipped entirely for non-probe events. Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> |
||
|
Arnaldo Carvalho de Melo
|
9212e395c6 |
perf evsel: Add lazy-initialized probe type detection helpers
Several places in perf need to check whether an evsel is a kprobe or uprobe, which requires looking up the PMU by name via evsel__find_pmu(). This lookup walks the PMU list each time, which is wasteful when the same evsel is checked repeatedly. Add evsel__is_kprobe(), evsel__is_uprobe(), and evsel__is_probe() that resolve the probe type on first call via evsel__pmu_name() and cache the result in a 3-bit field (probe_type) in struct evsel. The field fits in existing padding after the bool fields, so struct size does not grow. The enum uses PROBE__UNKNOWN (0) as the uninitialized sentinel — explicitly set in evsel__init() — so the lookup happens on first use. PROBE__NOPE (1) caches "not a probe" to avoid repeated negative lookups. PMU-based probes (kprobe/uprobe PMU) are detected by PMU name. Ftrace-based dynamic probes (created via tracefs, reported as PMU "tracepoint") are detected by the __probe_ip field that the kernel adds to all dynamic probe formats. This covers kprobes, uprobes, and fprobes regardless of their group/system name. Cc: Aaron Tomlin <atomlin@atomlin.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> |
||
|
Arnaldo Carvalho de Melo
|
e22a422854 |
perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field()
When building without libtraceevent (NO_LIBTRACEEVENT=1), evsel__field() and evsel__common_field() are declared but never defined, causing link errors in any code path that references them. Add inline stubs that return NULL when HAVE_LIBTRACEEVENT is not defined, matching the pattern used by other evsel accessor functions. Cc: Aaron Tomlin <atomlin@atomlin.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> |
||
|
Arnaldo Carvalho de Melo
|
542e88a4c6 |
perf cs-etm: Reject CPU IDs that would overflow signed comparison
metadata[j][CS_ETM_CPU] is a u64 from perf.data, but the comparison
with max_cpu casts it to (int). A crafted value like 0xFFFFFFFF becomes
-1 after the cast, which compares less than max_cpu (0), so the queue
array is never sized to accommodate it. When the value is later passed
to cs_etm__get_queue(), it indexes queue_array with the original large
value, causing an out-of-bounds access.
Validate that CS_ETM_CPU fits in an int before using it in the signed
comparison.
Fixes:
|