summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-09-10usb: core: set mod_name in driver registrationShashank Balaji
The driver core only creates the sysfs "module" symlink for a built-in driver when its struct device_driver has mod_name set (see module_add_driver()). This registration path left mod_name unset, so built-in drivers using it had no such symlink. Set mod_name to KBUILD_MODNAME during driver registration. Built-in drivers now gain the symlink, while loadable modules are unaffected. Co-developed-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com> Reviewed-by: Bastien Nocera <hadess@hadess.net> Link: https://patch.msgid.link/20260722-mod_name_usb-v1-2-96d781530f3f@sony.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-09-10usb: core: pass THIS_MODULE implicitly through a macroShashank Balaji
Rename usb_register_device_driver() to __usb_register_device_driver() and replace it with a macro wrapper that passes THIS_MODULE implicitly. This is in line with what other buses do. Co-developed-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Rahul Bukte <rahul.bukte@sony.com> Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com> Reviewed-by: Bastien Nocera <hadess@hadess.net> Link: https://patch.msgid.link/20260722-mod_name_usb-v1-1-96d781530f3f@sony.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-09-10media: vim2m: give vim2m a proper control ID rangeHans Verkuil
The vim2m driver has two driver-specific controls, but the control IDs were never reserved in v4l2-control.h. While these control IDs clash with the range reserved for the old meye driver, since that meye driver has been removed from the kernel quite a long time ago we just officially claim that range for the vim2m driver. Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Reported-by: Nicolas Dufresne <nicolas@ndufresne.ca> Closes: https://lore.kernel.org/linux-media/71a3fa9710cf1afbb80ebe850878557c3e95a1b2.camel@ndufresne.ca/ Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
2026-09-10RDMA: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907065047.26773-2-hemanth.selam@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-09-10mmc: core: Allow host driver to control the re-programming of crypto keysNeeraj Soni
The register context for the crypto profile belongs to the sdhci/cqhci host and not the mmc card, hence re-programming should be managed by the host driver itself. Add the flag MMC_CAP2_CRYPTO_NO_REPROG as part of host->caps2 to control reprogramming keys to crypto engine for SoCs which do not require this feature. Signed-off-by: Seshu Madhavi Puppala <quic_spuppala@quicinc.com> Co-developed-by: Ram Prakash Gupta <quic_rampraka@quicinc.com> Signed-off-by: Ram Prakash Gupta <quic_rampraka@quicinc.com> Co-developed-by: Sarthak Garg <quic_sartgarg@quicinc.com> Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com> Signed-off-by: Debraj Mukhopadhyay <quic_dmukhopa@quicinc.com> Reviewed-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Neeraj Soni <neeraj.soni@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-09-10kexec_file: remove unused arch_kexec_locate_mem_hole hookSourabh Jain
No architecture provides an implementation of arch_kexec_locate_mem_hole(). Use kexec_locate_mem_hole() directly and remove the unused fallback wrapper from the kexec header. This simplifies the kexec memory allocation path without changing its behavior. No functional changes intended. The arch hook was introduced by commit f891f19736bd ("kexec_file: Allow archs to handle special regions while locating memory hole"), and its last user was removed by commit 6e5250eaa665 ("powerpc/crash: use generic APIs to locate memory hole for kdump"). Cc: Albert Ou <aou@eecs.berkeley.edu> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Mike Rapoport <rppt@kernel.org> Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Pasha Tatashin <pasha.tatashin@soleen.com> Cc: Paul Walmsley <pjw@kernel.org> Cc: Pratyush Yadav <pratyush@kernel.org> Cc: linux-riscv@lists.infradead.org Cc: kexec@lists.infradead.org Acked-by: Baoquan He <baoquan.he@linux.dev> Reviewed-by: Mukesh Pilaniya <mpilaniy@redhat.com> Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com> Link: https://patch.msgid.link/20260905145835.501635-1-sourabhjain@linux.ibm.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-09-10net: stmmac: Add common internal RGMII delay handlingJia Wang
Some DWMAC integrations add fixed RGMII clock delays internally. Glue drivers need to account for these delays before passing the interface mode to the PHY. Add TX and RX delay capability flags to the common platform data. Apply phy_fix_phy_mode_for_mac_delays() in stmmac_pltfr_probe() when either capability is present. This lets glue drivers describe the MAC capabilities without duplicating the interface-mode validation and conversion. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-1-9a39bf8db313@ultrarisc.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-10sched/eevdf: Fix rb augmented with multi fieldsVincent Guittot
The eevdf rb tree maintains 3 augmented fields but only one is currently copied when balancing the tree. Add a more generic define that can be used when there are several augmented fields. In this case, we provide a function that takes care of copying all fields. Fixes: aef6987d8954 ("sched/eevdf: Propagate min_slice up the cgroup hierarchy") Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com> Tested-by: K Prateek Nayak <kprateek.nayak@amd.com> Link: https://patch.msgid.link/20260909150522.858312-1-vincent.guittot@linaro.org
2026-09-10fs: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907063252.21433-1-hemanth.selam@gmail.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10fs/dax: Make dax_layout_busy_page_range() staticKaitao Cheng
dax_layout_busy_page_range() no longer has callers outside fs/dax.c. Keeping the range helper exported unnecessarily exposes a low-level implementation detail. Make the helper static and remove its export and header definitions. Also fix the stale dax_layout_busy_page_range() comment to match the implementation. Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Link: https://patch.msgid.link/20260904152749.84493-3-kaitao.cheng@linux.dev Acked-by: Muchun Song <muchun.song@linux.dev> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10fs/dax: Remove unused dax_layout_busy_page()Kaitao Cheng
dax_layout_busy_page() used to let filesystems scan an entire DAX mapping for pinned pages. All callers now use dax_break_layout(), which also handles waiting for busy pages and deleting DAX mapping entries once the range becomes idle. The remaining function is only a wrapper around dax_layout_busy_page_range() and has no in-tree users. Remove it together with its declaration, !CONFIG_FS_DAX stub, and exported symbol. Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Link: https://patch.msgid.link/20260904152749.84493-2-kaitao.cheng@linux.dev Acked-by: Muchun Song <muchun.song@linux.dev> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10net: run netdev work under the ops-compat lockJakub Kicinski
netdev_work_proc() took rtnl_lock() for the whole batch, forcing even ops-locked drivers onto rtnl just to run their rx_mode / ndo_work callbacks. Take the per-device ops-compat lock instead: the instance lock for ops-locked drivers, rtnl_lock for the rest. That's what the callbacks already assert (e.g. netif_rx_mode_run() asserts netdev_assert_locked_ops_compat()), and non-ops-locked work such as vlan ndo_work keeps rtnl, since its compat lock resolves to rtnl anyway. Without this adding more uses of ndo_work, for cases which don't need rtnl_lock feels like a step back. We can drop the comment about the extra ref now, with the relocking it's a necessity. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260904180058.3803849-1-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-10Merge patch series "vfs: Annotate struct fdtable's fd field with ↵Christian Brauner
__counted_by_ptr" Annotate struct fdtable's fd field with __counter_by_ptr and add Kunit tests for struct fdtable. * patches from https://patch.msgid.link/20260827041732.188707-1-morbo@google.com: vfs: Add KUnit tests for fdtable vfs: Annotate struct fdtable's fd field with __counted_by_ptr Link: https://patch.msgid.link/20260827041732.188707-1-morbo@google.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10vfs: Annotate struct fdtable's fd field with __counted_by_ptrBill Wendling
The 'struct fdtable' holds the file descriptor table information, including the current file descriptor array 'fd' and its size 'max_fds'. To harden the kernel against out-of-bounds accesses, we can annotate the 'fd' pointer field with the '__counted_by_ptr' attribute, referencing 'max_fds'. The compiler uses the '__counted_by_ptr' attribute to track the size of the memory allocated for the pointer field, enabling runtime bounds checks under KASAN and fortified functions. There are three places where a 'struct fdtable' is initialized, and in all of them, 'max_fds' is set before the 'fd' pointer is accessed or assigned in all allocation and initialization places. No accesses to 'fd' occur before 'max_fds' is set, preventing any potential runtime false-positives or panics due to uninitialized count fields. Signed-off-by: Bill Wendling <morbo@google.com> Link: https://patch.msgid.link/20260827041732.188707-1-morbo@google.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10buffer: Document sb_bread(), sb_bread_unmovable() and sb_breadahead()Matthew Wilcox (Oracle)
Add kernel-doc for these three functions. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Link: https://patch.msgid.link/20260828205429.3678204-4-willy@infradead.org Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10jbd2: point the shadow buffer at the frozen data directlyChao Shi
When a metadata buffer has to be copied out before it can be journalled, jbd2_journal_write_metadata_buffer() writes jh->b_frozen_data rather than the page cache copy. b_frozen_data is kmalloc()ed, so folio_set_bh() makes the shadow buffer point at a slab folio. That is not something the buffer_head layer can reason about. A slab folio overloads ->mapping, so a shadow buffer looks like it belongs to an address_space when it does not. buffer_set_crypto_ctx() already has to work around this, and it is the reason mark_buffer_write_io_error() cannot be called on a shadow buffer today. Point the shadow buffer at the frozen data itself instead: leave b_folio NULL, which it already is out of alloc_buffer_head(), and set b_data. The previous patch taught fs/buffer.c to submit such a buffer. folio_set_bh() is now needed on only one path - the one that journals the page cache copy directly - so it moves there, and new_folio, new_offset and the flag that used to pick between them all go away. The two commit-path checksum helpers reach the shadow buffer's contents through a new kmap_local_bh()/kunmap_local_bh() pair, which handle a buffer with or without a folio. Memory outside the page cache is always mapped, so for those there is nothing to map or unmap. Mapping it anyway would be worse than pointless: with CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP, kmap_local_page() hands back a one page mapping even for such memory, which is not enough for a buffer bigger than a page. Tested with ext4 mounted data=journal,journal_checksum on a metadata_csum filesystem, writing files whose every block begins with the JBD2 magic so that escaping forces the copy-out, then crashing with sysrq-b without unmounting and replaying the journal on the next mount. Recovery completed, the file contents matched, e2fsck -fn was clean, and an instrumented build confirmed the b_folio == NULL path was taken. Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org> Acked-by: Weidong Zhu <weizhu@fiu.edu> Signed-off-by: Chao Shi <coshi036@gmail.com> Link: https://patch.msgid.link/6140cd23beb88e99f40eaeff4044a16213f6caab.1785951556.git.coshi036@gmail.com Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10buffer_head: Remove b_pageMatthew Wilcox (Oracle)
All users except bh_offset() have been converted to use b_folio instead. Convert bh_offset() and remove b_page. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Chao Shi <coshi036@gmail.com> Acked-by: Weidong Zhu <weizhu@fiu.edu> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://patch.msgid.link/e9d168901578902bffe78ac8b5dfaf1210ee7fb3.1785951556.git.coshi036@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10thunderbolt: Use shadow copy for ring interrupt maskMika Westerberg
Each time we mask or unmask ring interrupt we do a read-modify-write and that is not without a cost when on a hot path. We can get rid of that read by making a shadow copy of the interrupt mask register and using that in place of a register read. Assisted-by: LLM Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-09-09net: dsa: microchip: enable the SGMII port of the KSZ9897STapio Reijonen
The KSZ9897 has an SGMII/1000BASE-X capable port 7, but its chip_info entry never set .sgmii_port. ksz_has_sgmii_port() is therefore false, ksz9477_pcs_create() is never called and ksz9477_phylink_mac_select_pcs() returns NULL for port 7, so a phy-mode = "sgmii" or "1000base-x" link on that port cannot come up. Only the KSZ9897S has that port; the KSZ9897R has a second RGMII port instead. Both report chip ID 0x00989700, so the port cannot be enabled from the chip ID alone, and enabling it unconditionally breaks the KSZ9897R badly: ksz9477_setup() propagates the failure of xpcs_create_pcs_mdiodev() on a part without an XPCS, so the switch as a whole stops probing. The variants do differ in the read-only bit 7 of the port 7 XMII control 0 register, which reads one on the KSZ9897S and zero on the KSZ9897R. Compare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with the KSZ9897R data sheet DS00002330D section 5.2.3.1. Read that bit in ksz_switch_register() and use it to select a KSZ9897S chip_data entry, which is the KSZ9897 one plus .sgmii_port = 7, with port 7 no longer marked as supporting MII, RMII and RGMII. On the KSZ9897S that port is permanently an SGMII port and only its differential pairs are brought out, so advertising the xMII modes on it would let phylink accept a mode the driver never programs: ksz_phylink_need_config() skips the XMII control registers for the SGMII port. The KSZ9477, which also has SGMII on port 7, is described the same way. See DS00002394C section 4.11. KSZ9897S_CHIP_ID selects that chip_data entry and nothing else. dev->chip_id keeps the KSZ9897 chip ID that both parts report, so no other chip ID comparison has to know about the variant, ksz_check_device_id() is unchanged, and a device tree naming the KSZ9897 keeps matching whichever part is fitted. No binding change is needed and existing device trees keep working. Tested on a KSZ9897S with a 1000BASE-LX fibre SFP on port 7: bit 7 of the port 7 XMII control 0 register reads one, the switch is identified as a KSZ9897S and the PCS is created. The port advertises 1000baseX/Full, clause 37 in-band autonegotiation completes against the link partner, and the link comes up at 1Gbps/full duplex and passes traffic. Suggested-by: Nicolai Buchwitz <nb@tipi-net.de> Suggested-by: Jerry Ray <Jerry.Ray@microchip.com> Suggested-by: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260904-ksz9897-sgmii-port-v5-1-9bd4a0381aa8@vaisala.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09netconsole: move struct inet_addr into netconsole.cGustavo Luiz Duarte
The struct inet_addr lives in netpoll.h, but since commit a1116396476f ("netconsole: move local_ip/remote_ip/ipv6 to netconsole_target") the only user is netconsole. Move the definition into netconsole.c Suggested-by: Breno Leitao <leitao@debian.org> Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-6-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09netconsole: add an address family to struct inet_addrGustavo Luiz Duarte
netconsole_target stores a single 'bool ipv6' to denote the target's address family. This makes it hard to detect conditions like "no address set" or ipv4/ipv6 mixup between local_ip and remote_ip. Add a 'family' field to inet_addr so each address stores its own address family: AF_UNSPEC while unset, else AF_INET or AF_INET6. Nothing reads the new field yet. The next patch switches the users over and removes the bool. No functional change. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com> Link: https://patch.msgid.link/20260903-netcons_ipv6-v4-1-bdd183c844d3@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10power: supply: bq27xxx: add support for bq27z746Henrik Grimler
bq27z746 is similar to bq27z561, but has additional battery protection logic. The standard register map is a subset of the one found in bq27z561. There are some more differences among the ManufacturerAccess registers, but the ManufacturerAccess registers are currently not handled by the driver in any way. Therefore use the same regs and props for bq27z746 and bq27z561. Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Acked-by: Andrew Davis <afd@ti.com> Link: https://patch.msgid.link/20260818-bq27z746-v2-3-0371e206665f@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-09-10power: supply: Add sysfs entry for system load controlWaqar Hameed
There are devices that can control the connection from power to system load. For example, with a field-effect transistor between a battery and the system load (BATFET). Drivers for these devices are currently enrolling their own custom `sysfs` property to control this. In order to unify this, add a new `sysfs` entry for controlling such switch and corresponding `power_supply_property` with `enum` values. The obvious states are "on" and "off", i.e. there is a connection or not, respectively. However, many devices can also enter special modes such as "low-power", "shipping" or "deep sleep". Since the members in `struct power_supply_desc` already are ordered, adding `load_switches` only increases the size with 4 bytes, as can be seen from `pahole`: struct power_supply_desc { const char * name; /* 0 4 */ enum power_supply_type type; /* 4 4 */ u32 charge_types; /* 8 4 */ u32 usb_types; /* 12 4 */ u32 load_switches; /* 16 4 */ const enum power_supply_property * properties; /* 20 4 */ size_t num_properties; /* 24 4 */ int (*get_property)(...); /* 28 4 */ int (*set_property)(...); /* 32 4 */ int (*property_is_writeable)(...); /* 36 4 */ void (*external_power_changed)(...); /* 40 4 */ int (*init)(struct power_supply *); /* 44 4 */ int use_for_apm; /* 48 4 */ bool no_thermal; /* 52 1 */ u8 charge_behaviours; /* 53 1 */ /* size: 56, cachelines: 1, members: 15 */ /* padding: 2 */ /* last cacheline: 56 bytes */ }; Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/d86f528de9a058091f806d9676639239cfeaf805.1788290289.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-09-10power: supply: Pack power_supply_desc to eliminate holesWaqar Hameed
`pahole` reports that there are two holes in `struct power_supply_desc`: struct power_supply_desc { const char * name; /* 0 4 */ enum power_supply_type type; /* 4 4 */ u8 charge_behaviours; /* 8 1 */ /* XXX 3 bytes hole, try to pack */ u32 charge_types; /* 12 4 */ u32 usb_types; /* 16 4 */ const enum power_supply_property * properties; /* 20 4 */ size_t num_properties; /* 24 4 */ int (*get_property)(...); /* 28 4 */ int (*set_property)(...); /* 32 4 */ int (*property_is_writeable)(...); /* 36 4 */ void (*external_power_changed)(...); /* 40 4 */ int (*init)(struct power_supply *); /* 44 4 */ bool no_thermal; /* 48 1 */ /* XXX 3 bytes hole, try to pack */ int use_for_apm; /* 52 4 */ /* size: 56, cachelines: 1, members: 14 */ /* sum members: 50, holes: 2, sum holes: 6 */ /* last cacheline: 56 bytes */ }; This can be optimized by moving `u8 charge_behaviours` to the end and swapping `int use_for_apm` with `bool no_thermal`: struct power_supply_desc { const char * name; /* 0 4 */ enum power_supply_type type; /* 4 4 */ u32 charge_types; /* 8 4 */ u32 usb_types; /* 12 4 */ const enum power_supply_property * properties; /* 16 4 */ size_t num_properties; /* 20 4 */ int (*get_property)(...); /* 24 4 */ int (*set_property)(...); /* 28 4 */ int (*property_is_writeable)(...); /* 32 4 */ void (*external_power_changed)(...); /* 36 4 */ int (*init)(struct power_supply *); /* 40 4 */ int use_for_apm; /* 44 4 */ bool no_thermal; /* 48 1 */ u8 charge_behaviours; /* 49 1 */ /* size: 52, cachelines: 1, members: 14 */ /* padding: 2 */ /* last cacheline: 52 bytes */ }; Do this in order to save 4 bytes. This will also help when adding new members in the future to this `struct`. Signed-off-by: Waqar Hameed <waqar.hameed@axis.com> Link: https://patch.msgid.link/5b6d1d588c8aaf237c45638c29a2ff23f0a07f34.1788290289.git.waqar.hameed@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-09-10power: supply: Fix maintenance charge table kernel-docKarl Mehltretter
struct power_supply_maintenance_charge_table contains charge_safety_timer_minutes, but its kernel-doc describes safety_timer_minutes. This leaves the real member undescribed and adds a nonexistent member to the generated documentation. Use the member's actual name. Fixes: d72ce7d32478 ("power: supply: ab8500: Standardize maintenance charging") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260909064623.90737-1-kmehltretter@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-09-09netlink: specs: handshake: do not accept the handler-class sentinelJakub Kicinski
"max" is the exclusive upper bound of enum handshake_handler_class, not a class a handler can ask for, but the spec lists it as a plain entry. _init_checks() derives the policy limit from the highest entry, so the generated policy came out as NLA_POLICY_MAX(NLA_U32, 2) and handshake_nl_accept_doit() takes class 2 all the way into handshake_req_next(), which walks hn_requests under hn_lock before returning -EAGAIN instead of the -EINVAL a bad class deserves. render-max is how YNL spells this, and unlike a hand written limit it stays correct when a second handler class is added. It does change what HANDSHAKE_HANDLER_CLASS_MAX means - the highest valid class rather than one past it, as in every other Netlink/YNL family - with the count left as __HANDSHAKE_HANDLER_CLASS_MAX. The constant is uAPI, but I could not find any user space user, this constant seems to have been added for kernel's benefit. I think the risk of changing this is worth taking, having MAX with different semantics than the rest of Netlink is very confusing. Acked-by: Chuck Lever <cel@kernel.org> Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> Link: https://patch.msgid.link/20260904190410.3864660-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09Merge tag 'landlock-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fixes from Mickaël Salaün: "This fixes a use-after-free and a lockdep assert NULL dereferencing, and properly truncates too-long strings printed by a Landlock tracepoint. Most of the changes are brought by new tests" * tag 'landlock-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Test trace path output boundaries landlock: Bound escaped trace path output landlock: Clean up ruleset validation checks selftests/landlock: Test abstract socket trace name limits landlock: Fix use-after-free of the source's parent directory
2026-09-09Merge tag 'vfs-7.3-rc3.fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - netfs: - Fix an uninitialized return value in netfs_unbuffered_write() when preparing the first subrequest fails - For partial unbuffered/DIO writes return the amount transferred rather than an error - Update i_size with the amount actually written when a partial transfer ends in an error - Fix a subrequest reference leak when the io_iter ends up empty - Handle netfs_alloc_subrequest() failure during unbuffered writes - Load all readahead folios into the rolling buffer upfront and drop the readahead references once the first subrequest is dispatched - Mark folios for copy-to-cache while issuing subrequests - Fix read progress reporting - afs: - Add the missing kunmap in the error path of afs_dir_search_bucket() - Fix a double kunmap in afs_edit_dir_remove() - Don't free an existing server's endpoint state when cleaning up a candidate server in afs_lookup_server() - Unbind peers removed from a server's address list - ufs: - Load the cylinder group metadata before creating the root dentry - Validate the cylinder group index and rotor positions before caching them - Treat an unreadable directory block as not empty - exec: - Close the close-on-exec files before taking exec_update_lock Closing a file can block on the filesystem, so a hung filesystem blocked everything that takes exec_update_lock and a FUSE server inspecting the calling process could deadlock - Drop the bprm loader before closing bprm->file in free_bprm() - exit: Hold a reference to thread_pid across proc_flush_pid() - reboot: Fix a use-after-free on cad_pid - nsfs: Keep the namespace tree fields out of the rcu_head used by kfree_rcu() - nstree: Check listing permission before taking a namespace reference in listns() - super: Return 0 when a nested thaw drops its hold while other freezers remain - ext4: Don't set I_METADATA_WRITEBACK during fastcommit replay - adfs: Free s_fs_info in ->kill_sb() - autofs: Free the inode info allocated in autofs_fill_super() when the root inode allocation fails - ovl: Return EINVAL instead of EIO on a user namespace mismatch now that it's a plain refusal and not an internal error - cachefiles: Don't cast the variable-length coherency data to a __be64 in the coherency tracepoint * tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits) nstree: check listing permission before taking a namespace reference exec: do_close_on_exec() before taking exec_update_lock exit: hold a reference to thread_pid across proc_flush_pid fs: autofs: fix memory leak in autofs_fill_super() exec: Drop bprm loader before closing bprm->file afs: Clear stale peer app data after address list changes afs: Fix incorrect free in candidate cleanup in afs_lookup_server() afs: Fix double-unmap of directory block afs: Fix missing kunmap in afs_dir_search_bucket() ovl: return EINVAL instead of EIO in case of mismatched user_ns reboot: fix cad_pid use-after-free race cachefiles: Fix potential UAF/KASAN warning netfs: Fix read progress reporting netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs netfs: Fix readahead synchronisation issues by loading all folios upfront netfs: break unbuffered write when netfs_alloc_subrequest() fails netfs: Fix subreq ref leak netfs: Fix i_size update for partial transfer netfs: Fix error vs transferred passed to ->ki_complete() netfs: Fix unbuffered/DIO write partial transfer error return ...
2026-09-09i2c: Change return type to bool for i2c_check_functionality()Thorsten Blum
i2c_check_functionality() returns a bool - change the return type from int to bool and update the comment accordingly. Signed-off-by: Thorsten Blum <blum@kernel.org> Acked-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260909082053.410739-5-blum@kernel.org
2026-09-09ACPI: utils: Adjust message printing macros for ACPI objectsRafael J. Wysocki
The majority of acpi_handle_<level>() macros use neither pr_fmt() nor dev_fmt() and acpi_handle_debug() uses pr_fmt() like dev_fmt(), but only if dynamic debug is compiled in. For more consistency, redefine all of the macros in question to use dev_fmt() because they are more similar to the analogous dev_*() family of macros than to the pr_*() ones and make all of them use it in the same way. While at it, rephrase the comment documenting those macros for more clarity. Fixes: 45fef5b88d1f ("ACPI: add dynamic_debug support") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2300525.irdbgypaU6@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-09-09ACPI: PM: Move acpi_bus_init_power() declaration to internal header fileRafael J. Wysocki
Since acpi_bus_init_power() is only used internally in the core ACPI device enumeration and power management code, it need not be visible outside, so move its declaration to an internal header file. No functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Peixin Xie <peixin.xie@linux.spacemit.com> Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/3079955.e9J7NaK4W3@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-09-09ASoC: soc-dai: move snd_soc_xx() to soc-dai.cMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: This patch-set moves soc-dai related functions from soc-core.c to soc-dai.c. We should have snd_soc_dai_xxx() functions on soc-dai.c. No functional changes. We have 2 type of function defines in include/sound/xx.h A is for ASoC drivers B is for ASoC framwork I think include/sound/xx.h is only for drivers (A). In other words, ASoC framework function (B) is not needed for drivers, or *shouldn't* indicate to drivers. This patch adds new sound/soc/soc-internal.h, and the functions for ASoC framework will be moved to here. Link: https://patch.msgid.link/8733vuu75t.wl-kuninori.morimoto.gx@renesas.com
2026-09-09ASoC: soc-dai: move snd_soc_dai_{set/get}_stream() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ik4qssjl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_stream_active() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87jyp6ssjo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_tdm_mask_{get/set}() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_tdm_mask_get() -> snd_soc_dai_stream_tdm_mask_get() snd_soc_dai_tdm_mask_set() -> snd_soc_dai_stream_tdm_mask_set() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ld9mssjt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_dma_data_{get/set}() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c These macros are very similar. Will be handled by same macro snd_soc_dai_dma_data_get() -> snd_soc_dai_stream_dma_data_get() snd_soc_dai_dma_data_set() -> snd_soc_dai_stream_dma_data_set() snd_soc_dai_get_dma_data() -> snd_soc_dai_stream_dma_data_get() snd_soc_dai_set_dma_data() -> snd_soc_dai_stream_dma_data_set() This macro is not much helps code, will be removed snd_soc_dai_init_dma_data() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87mru2ssjx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_{get/set}_widget() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_get_widget() -> snd_soc_dai_stream_widget_get() snd_soc_dai_set_widget() -> snd_soc_dai_stream_widget_set() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87o6eissk1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_get_pcm_stream() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_get_pcm_stream() snd_soc_dai_pcm_stream_get() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87pkyyssk4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move soc_pcm_set_dai_params()Kuninori Morimoto
soc_pcm_set_dai_params() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-pcm.c. Move it to soc-dai.c It renames function name - soc_pcm_set_dai_params() + snd_soc_dai_symmetric_set_params() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87se3usska.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_{un}register_dai()Kuninori Morimoto
snd_soc_{un}register_dai() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c Note1 snd_soc_{un}register_dai() needs to use client_mutex which is soc-core.c local. This patch removes static from it, and allow to use it from ASoC internal. It renames function name - snd_soc_register_dai() + snd_soc_dai_register() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87tsoasske.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_is_matching_dai()Kuninori Morimoto
snd_soc_is_matching_dai() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_is_matching_dai() + snd_soc_dai_matches_dlc() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87v78qsskh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_is_match_dai_args()Kuninori Morimoto
snd_soc_is_match_dai_args() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_is_match_dai_args() + snd_soc_dai_matches_args() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87wlt6sskk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_dai_name_get()Kuninori Morimoto
snd_soc_dai_name_get() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_dai_name_get() + snd_soc_dai_name() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87y0dmssko.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09ASoC: soc-dai: move snd_soc_add_dai_controls()Kuninori Morimoto
snd_soc_add_dai_controls() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_add_dai_controls() + snd_soc_dai_add_controls() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87zey2ssku.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-09Merge tag 'printk-for-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixes from Petr Mladek: - Use lazy irq_work for waking printk kthreads - Flush pending irq_work before destroying printk kthreads - Remove redundant WARN() when a printk kthread can't be created - Typo fix * tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY printk/nbcon: Flush nbcon_irq_work in nbcon_free() console: fix /dev/kmsg reference in flags kernel doc printk: Don't WARN on kthread_run failure.
2026-09-09dmaengine: dw-edma: Add dw_edma_core_ll_cur_idx() to get current LL entry indexFrank Li
Add dw_edma_core_ll_cur_idx() to get the current LL entry index and prepare for dynamic addition of DMA requests while the DMA engine is running. Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Co-developed-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Koichiro Den <den@valinux.co.jp> Link: https://patch.msgid.link/20260820173439.2004068-2-den@valinux.co.jp Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-09-09drm/dp: Add helper to validate DP lane countsDamon Ding
Add a generic helper function drm_dp_lane_count_is_valid() to check if a DisplayPort lane count is valid. According to the DP specification, only 1, 2, or 4 lanes are supported. This helper avoids duplicating DP lane count validation logic across individual DisplayPort drivers. Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260828065153.590802-3-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-09-09wifi: mac80211: don't allow injecting frames wider than the chanctxJohannes Berg
Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent. Assisted-by: LLM Fixes: 646e76bb5daf ("mac80211: parse VHT info in injected frames") Reported-by: syzbot+435fdb053cf98bfa5778@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=435fdb053cf98bfa5778 Link: https://patch.msgid.link/20260908122838.201719-13-johannes@sipsolutions.net Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-09Merge tag 'thunderbolt-for-v7.3-rc3' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v7.3-rc3 This includes following USB4/Thunderbolt fixes: - Fix various issues around asynchronous DisplayPort tunnel activation when there is no graphics driver doing doing the capability exchange. - Fix potential NULL pointer dereference when XDomain connection is removed. - Fix use-after-free when control channel request is canceled. - Fix lockdep false positive. - Revert a commit that causes XDomain properties ping-pong. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.3-rc3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: Revert "thunderbolt: xdomain: Notify peers after enumeration" thunderbolt: Use separate lock class for each ring thunderbolt: Fix KASAN reported use-after-free when request is canceled thunderbolt: Fix NULL dereference in tb_remove_work() thunderbolt: Tear down inactive DP tunnels when the domain is stopped thunderbolt: Mark discovered tunnels as active thunderbolt: Don't access a DP tunnel after its DPRX read was canceled thunderbolt: Fix domain reference leak when DPRX read is canceled thunderbolt: Make the DP tunnel activation callback mandatory thunderbolt: Hold a router reference for each allocated HopID
2026-09-09media: i2c: add driver for ITE IT6625/IT6626Hermes Wu
Add a V4L2 subdevice driver for the ITE IT6625/IT6626 HDMI-to-MIPI CSI-2 bridge chips. IT6625 accepts an HDMI 2.0 input and IT6626 an HDMI 2.1 input, converting it to a D-PHY (or C/D-PHY on IT6626) MIPI CSI-2 output. The bridge is configured over I2C, exposes an HDMI CEC adapter, and supports EDID read/write, DV timings detection/configuration, and HPD control via the standard V4L2 subdevice pad and video ops. Signed-off-by: Hermes Wu <Hermes.wu@ite.com.tw> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> [hverkuil: change it6625_v4l2_sd_ctrl_update to a void function]