summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
10 hoursMerge tag 'for-linus-7.4a-rc3-tag' of ↵HEADmasterLinus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "A bunch of isolated fixes of Xen related drivers" * tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: Xen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages() xen: don't allow gnttab_dma_[alloc|free]_pages() in PV guest xen/pvcalls: destroy the per-socket workqueue on release xen/pvcalls: unwind pvcalls_new_active_socket() step by step xen/privcmd: fix double free when an irqfd is shut down twice xen/gntdev: fix deadlock between map ioctl and mmap xen/platform-pci: Disable device before releasing PCI regions xen/grant-table: annotate on-stack work in gnttab_unmap_refs_sync()
10 hoursMerge tag 'hwmon-for-v7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Read tracking-mode voltage fault limits dynamically in the mp2975 PMBus driver instead of caching probe-time snapshots, avoiding false over-voltage alarms when CPU voltage changes at runtime. - Fix SCMI sensor probe by enabling supported sensors via firmware IDs before exposing channels and checking channel config allocations. - Fix runtime PM enable and reference count imbalances during probe and teardown in the gpio-fan driver. - Fix max31760 fan controller initialization and reporting, including leaving standby at probe, initial 0 RPM reporting, and swapped temperature limit registers. - Assorted minor sensor reading, interval clamping, and register handling fixes in other drivers. * tag 'hwmon-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (aht10) Fix update_interval overflow on 64-bit hwmon: (scmi) Configure sensors before exposing channels hwmon: (scmi) Check channel config allocation hwmon: (nct6775) Handle dual use registers hwmon: (scmi) Enable temperature sensors using their sensor IDs hwmon: (pmbus/mp2975) Get vout fault limits dynamically hwmon: (sy7636a) fix negative temperatures hwmon: (max31760) Report 0 RPM before the first fan speed measurement hwmon: (max31760) Leave standby mode at probe hwmon: (max31760) Fix the local temperature limit registers hwmon: (gpio-fan) Fix runtime PM imbalance in probe and teardown
12 hoursMerge tag 'ovl-fixes-7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs fixes from Amir Goldstein: - Fixes for data-only layers (composefs), some for regressions from v6.16, which relaxed the requirements for redirects to data-only layers - Fix a use-after-free in lookup of a hardlink with a FUSE upper, reported by Sashiko - Fix a mount failure right after unmount of an overlay with the same upperdir - Reject lower layers on the same fs with different idmaps, which could decode file handles through the wrong layer - Minor fixes for a memory leak, an error message and readdir d_ino * tag 'ovl-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: selftests: overlayfs: reject different lower idmaps on same fs ovl: reject different lower idmaps on the same fs ovl: bump the impure dir version when linking a file with origin ovl: return EIO if the lowerdata is missing ovl: follow lower to lowerdata redirects from any lower layer ovl: report the requested redirect_dir mode in conflicting options ovl: do not allow nfs_export with data-only layers ovl: do not check the deferred lowerdata redirect on index lookup ovl: fix leak of lowerdata redirect on ovl_get_inode() failure ovl: do not always clear absolute_redirect ovl: release the upperdir/workdir in-use locks before the umount sync ovl: do not read the flags of a put upper dentry in lookup
12 hoursMerge tag 'ntfs-for-7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Validate that $INDEX_ALLOCATION is open and non-resident before reading or writing index blocks, preventing NULL pointer dereferences when an earlier index operation has not opened it - Check that index allocation inodes are non-resident and child VCNs are non-negative and within bounds before directory lookup reads, preventing a deadlock when $INDEX_ALLOCATION is missing or damaged - Validate file names against the index entry's key length, preventing out-of-bounds reads when directory enumeration resumes using a copied key - Return -ENOENT for NTFS_IOC_LIST_STREAMS on deleted base files and fix unsigned underflow in its buffer bounds check, preventing out-of-bounds writes when the sizing and filling passes disagree - Use kfree() for the temporary runlist allocated with kmalloc() on merge failure, resolving the Coccinelle allocation/free mismatch warning * tag 'ntfs-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: open the index allocation before reading or writing an index block ntfs: do not read an index block outside $INDEX_ALLOCATION ntfs: silence kmalloc/kvfree mismatch warning ntfs: check the file name against the key length of an index entry ntfs: fix out-of-bounds write race in NTFS_IOC_LIST_STREAMS
13 hoursMerge tag 'ksmbd-for-7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb Pull smb server fixes from Namjae Jeon: - Evaluate explicit-access requests in DACL order with exact SID matching, and prevent guest and anonymous sessions from matching Authenticated Users - Apply Unix group and OWNER RIGHTS ACEs, and keep their denials when POSIX ACL fallback determines access - Allow the parent directory’s DACL to grant explicitly requested DELETE and FILE_READ_ATTRIBUTES through FILE_DELETE_CHILD and FILE_LIST_DIRECTORY - Exclude metadata-only file and stream opens from sharing conflicts and stream delete-sharing checks, while accounting for writes implied by overwrites and named-stream creation - Return STATUS_ACCESS_DENIED for reads on files lacking FMODE_READ, preventing warnings in __kernel_read() and potential panics - Pin parent dentries during SMB2 CREATE permission, status, and ACL inheritance operations to prevent use-after-free races with concurrent rename and removal - Keep expired sessions bound to their original user during NTLM reauthentication, preventing identity changes and a user-object leak * tag 'ksmbd-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: ksmbd: keep group denials when a POSIX ACL entry decides access ksmbd: refuse reauthentication of an expired session as another user ksmbd: pin parent dentries in SMB2 CREATE ACL path ksmbd: let the parent's DACL grant DELETE and FILE_READ_ATTRIBUTES ksmbd: evaluate the DACL in order for explicit access requests ksmbd: skip metadata-only stream opens in the delete check ksmbd: skip metadata-only opens in sharing checks ksmbd: refuse to read a handle that is not open for reading ksmbd: grant a caller what its groups and OWNER RIGHTS ACEs allow
27 hoursMerge tag 'keys-v7.4-rc3-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull key fixes from Jarkko Sakkinen: - Invoke the match callback before the state checks in keyring_search_iterator(), so that a non-matching revoked, expired or invalidated key cannot decide the search result - Take key->sem for reading around the ->asym_*() method calls in the keyctl pkey operations, as a key reference does not pin the module providing the key type * tag 'keys-v7.4-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: Protect pkey method checks against type removal KEYS: do not let an unmatched key decide the search result
27 hoursMerge tag 'drm-fixes-2026-11-14' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Weekly drm fixes, this is a bit bigger as we missed xe last week due to a tree screw up, so it's mostly xe and amdgpu, then the usual scattering of fixes across drivers. sched: - Ensure stopped entity cannot be re-added to the run-queue bridge: - ssd2825: Fix panel enable sequence - sii902x: validate I2S data lane values display: - hdmi: Fixes to SCDC i915: - Fix for PTL GitLab #9196: eDP-2 on DDI B ends up in a state where any enable fails - PSR fixes amdgpu: - DCN 6 DML2 fix - VCE fixes - GC 11.0.2 fix - SMU 15 fix - Error handling fixes - Partition fix - IMU firmware clean up fix - TLB fence handling fix amdkfd: - SVM fixes - CRIU fixes xe: - select configfs - Sync Wa_16023105232 in xe_was to match OOB rule - Program LMTT directory pointer from each GT init path - Demote uncorrectable local error log on CRI - Apply tile workarounds after PCODE init - VRAM offlining fixes - ras: Fix sysctrl and drm-ras discrepancy - pat: Return error from xe_pat_init_early() on unknown - Prevent VF memory IRQ from accessing a torn-down engine - guc: Protect timeout handling from device unplug - gt: Disable GT reset worker before engine teardown - Various hwmon fixes - tuning: Restrict Anyhit NULL-query tuning to render engines - gsc: Fix NVL-S GSC compatibility number - Don't abort the shrinker walk on -EBUSY - Mark xe_vma_ops_alloc() noinline for error injection - lrc: Restore CTX_CS_INDIRECT_CTX_OFFSET programming for pre-Xe2 - Fix build with DRM_XE=y and CONFIGFS_FS=m - madvise: use already clamped pat_index - Various wedging fixes - Rebind BOs evicted before the first LR queue - Toggle the D3Cold enable flag at runtime resume - Access GT MMIO after pcode init - xe_late_bind_fw: Fix firmware leak on missing manifest entry - svm: Preserve default PAT index when resetting VMA attributes - Unwrap sync fences before adding them as job dependencies - Schedule disable G2H fixes gud: - Avoid divide error in gud_stats_debugfs meson: - load ENCL gamma table while ENCL is disabled nouveau: - disp: Set atomic functions in struct drm_mode_config_funcs - gsp: Handle only IRQs routed to host panfrost: - Fixes to perfcnt vc4: - Fix firmware reference leak - Hold runtime PM reference while allocating the binner BO - Rebuild V3D interrupt mask on every power transition - Re-enable the V3D interrupt after a GPU reset" * tag 'drm-fixes-2026-11-14' of https://gitlab.freedesktop.org/drm/kernel: (81 commits) drm/vc4: Re-enable the V3D interrupt after a GPU reset drm/vc4: Rebuild the V3D interrupt mask on every power transition drm/vc4: Hold a runtime PM reference while allocating the binner BO drm: xe: select configfs drm/xe: Sync Wa_16023105232 in xe_was to match OOB rule drm/xe/pf: Program LMTT directory pointer from each GT's init path drm/xe/guc: Demote uncorrectable local error log on CRI drm/xe/pm: Apply tile workarounds after PCODE initialization drm/gud: avoid divide error in gud_stats_debugfs drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (attempt 2) drm/amdgpu: fix TLB invalidation fence handling v4 drm/amdkfd: check CRIU SVM priv data bounds before allocating drm/amdgpu: release the IMU firmware with the other GFX microcode drm/amdgpu: Allow cancelling a requested NPS mode drm/amdgpu: fix the error handling of amdgpu_vm_init_entities() drm/amdgpu: use supported SMU clock messages on SMU 15.0.0 drm/amdkfd: skip GPUs without a VM when checkpointing the BO mappings drm/amdkfd: Acquire cwsr buffer during CRIU resume drm/amdkfd: Acquire buffers in CRIU queue restore (again) drm/amdgpu: Fix VCE buffer size check for DPB and input surface ...
27 hoursMerge tag 'watchdog-fixes-for-v7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull watchdog fixes from Guenter Roeck: - gunyah_wdt: Re-enable the watchdog on resume - mediatek: Register reset controller before watchdog device - meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog - mtk_wdt: Stop a running watchdog over system sleep even if not opened - npcm: fix clock prepare leak when setting timeout on a running watchdog - omap: Fix early_enable handling in omap_wdt_probe() - orion_wdt: load the pretimeout counter on Armada 370/XP start - rzv2h: Drop runtime PM handling from WDTDCR init, and use pm_runtime_put_sync() - sbsa_gwdt: Limit the MediaTek WS0 race workaround to revision 0 - sc1200wdt: add missing MODULE_DEVICE_TABLE() - sp5100_tco: Use release_mem_region() for EFCH MMIO resource * tag 'watchdog-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: watchdog: rzv2h: Drop runtime PM handling from WDTDCR init watchdog: rzv2h: Use pm_runtime_put_sync() watchdog: omap: Fix early_enable handling in omap_wdt_probe() watchdog: npcm: fix clock prepare leak when setting timeout on a running watchdog watchdog: gunyah_wdt: Re-enable the watchdog on resume watchdog: mediatek: Register reset controller before watchdog device watchdog: sp5100_tco: Use release_mem_region() for EFCH MMIO resource watchdog: sbsa_gwdt: Limit the MediaTek WS0 race workaround to revision 0 watchdog: meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog watchdog: mtk_wdt: Stop a running watchdog over system sleep even if not opened watchdog: orion_wdt: load the pretimeout counter on Armada 370/XP start watchdog: sc1200wdt: add missing MODULE_DEVICE_TABLE()
29 hoursMerge tag 'drm-misc-fixes-2026-11-13' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bridge: - ssd2825: Fix panel enable sequence - sii902x: validate I2S data lane values display: - hdmi: Fixes to SCDC gud: - Avoid divide error in gud_stats_debugfs meson: - load ENCL gamma table while ENCL is disabled nouveau: - disp: Set atomic functions in struct drm_mode_config_funcs - gsp: Handle only IRQs routed to host panfrost: - Fixes to perfcnt sched: - Ensure stopped entity cannot be re-added to the run-queue vc4: - Fix firmware reference leak - Hold runtime PM reference while allocating the binner BO - Rebuild V3D interrupt mask on every power transition - Re-enable the V3D interrupt after a GPU reset Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20261113074438.GA14592@linux.fritz.box
31 hoursMerge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "Fix hugetlb write fault livelock, permission overlay and GCS state preservation across CPU suspend, cpuidle context tracking during system suspend, GCS mode handling on signal return, AMU counter errata workarounds, kexec loading of images with a non-zero text_offset and a spurious ptrace warning: - Fix hugetlb write fault livelocks caused by stale read-only TLB entries after another CPU makes the page writable and only performs a local invalidate. Unlike the generic fault path, hugetlb has no fix_spurious_fault() fallback - Save and restore POR_EL0, GCSPR_EL0 and GCSCRE0_EL1 across CPU suspend - Restrict cpuidle context tracking in cpu_suspend() to idle tasks, avoiding context tracking warnings during system suspend - Ignore attempts to change GCS mode through signal return, which updated the software state without updating the hardware. Changes made through prctl() in the signal handler are preserved. This changes the documented ABI but no known userspace relies on it. Allowing mode changes through both prctl() and signal return also creates confusing interactions, with signal return potentially undoing changes deliberately made by the handler - Extend the AMU constant counter workaround to additional CPUs and add a core cycle counter workaround for Cortex-A715/A720, treating the affected counters as unavailable - Avoid CMA allocations when loading a kexec Image with a non-zero text_offset, fixing an incorrect entry point and a memory leak when freeing the image - Remove a spurious ptrace warning when setting the syscall number of a task in a non-seized group-stop without siginfo" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: suspend: Only track cpuidle context for idle tasks arm64: ptrace: don't warn on missing siginfo in a group-stop arm64: kexec_file: Do not use CMA for images with a non-zero text_offset arm64: errata: Add Cortex-A715/A720 AMU core counter workaround arm64: errata: Extend the workaround for broken AMEVCNTR01 counter arm64/gcs: Ignore attempts to change GCS mode during signal return arm64: hugetlb: Prevent write fault livelocks on stale TLB entries arm64: suspend: Save GCS state over suspend arm64: suspend: Save POR_EL0 over suspend
33 hourshwmon: (aht10) Fix update_interval overflow on 64-bitRupesh Majhi
On 64-bit, update_interval writes are clamped to LONG_MAX ms, but ms_to_ktime() overflows above 9223372036854 ms and the interval wraps. LONG_MAX becomes -1 ms, so every read starts a new measurement and update_interval reads back -1. Clamp to INT_MAX like sht4x, so the limit is the same on all platforms. Fixes: 8c78f0dee437 ("hwmon: Add AHT10 Temperature and Humidity Sensor Driver") Cc: stable@vger.kernel.org Signed-off-by: Rupesh Majhi <zoone.rupert@gmail.com> Link: https://patch.msgid.link/20261108172651.220121-1-zoone.rupert@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (scmi) Configure sensors before exposing channelsSudeep Holla
SCMI hwmon enables sensors with SENSOR_CONFIG_SET, but only after registering the hwmon device and only for temperature sensors. This leaves other sensor classes disabled on firmware that defaults sensors to off, and exposes temperature channels before they are ready. Configure each supported sensor while building the channel list, before registering the hwmon device. Leave failed sensors out of the list so their channels remain hidden, while continuing with other sensors. Cc: Marek Vasut <marek.vasut@mailbox.org> Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/bug/linux-4bdf9a68-22d5-4305-b684-f11fe6d1dbcc Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read") Cc: stable@vger.kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/20261109151927.1672956-2-sudeep.holla@kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (scmi) Check channel config allocationSudeep Holla
scmi_hwmon_add_chan_info() can fail to allocate a channel's config array. Ignoring that error leaves a channel with a NULL config pointer in the hwmon chip info, which hwmon dereferences while registering the device. Check the helper's return value and abort probe on failure. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/bug/linux-d10ced6b-a6f0-403b-9619-f5a6573f9e7f Fixes: b23688aefb8b ("hwmon: add support for sensors exported via ARM SCMI") Cc: stable@vger.kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/20261109151927.1672956-1-sudeep.holla@kernel.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (nct6775) Handle dual use registersAnton Lundin
The REG_TARGET register has different meaning, depending on if pwm is in thermal_cruise or speed_cruise. This means we can't assume it's always word sized, so we need to handle it differently depending on which mode we're in. The code already does this, but the register was configured as word sized for the speed_cruise mode, which would do the wrong thing in thermal_cruise mode. Fixes: 6c009501ff20 ("hwmon: (nct6775) Add support for NCT6102D/6106D") Fixes: 29c7cb485b32 ("hwmon: (nct6775) Integrate new model nct6116") Fixes: 437b3c2a4bdc ("hwmon: (nct6775) Add support for NCT6126D") Cc: stable@vger.kernel.org Signed-off-by: Anton Lundin <glance@ac2.se> Link: https://patch.msgid.link/20261109082511.851377-2-glance@ac2.se Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (scmi) Enable temperature sensors using their sensor IDsXu Rao
scmi_hwmon_probe() groups sensors by hwmon type, so the index in scmi_sensors->info[hwmon_temp] is not necessarily the SCMI sensor ID. Passing that index to config_set() targets a different sensor if the platform exposes non-temperature sensors ahead of temperature sensors. The intended temperature sensor can remain disabled, causing subsequent readings to fail. If configuring the wrong sensor fails, thermal registration of the intended sensor is also skipped. Use the firmware sensor ID, as the read and thermal registration paths already do, so temperature sensors are enabled correctly. The patch was reviewed and the commit message expanded with OpenCode AI assistance. Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/AED18609B941BCFD+20261109082854.3739085-1-raoxu@uniontech.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (pmbus/mp2975) Get vout fault limits dynamicallyFelix Radensky
The over- and under-voltage fault limits of the tracking mode are relative to the voltage reference, which follows the VID/AVS requests issued to the device and therefore changes at runtime. The driver reads the voltage reference once during probe and derives the limits from that snapshot, which the PMBus core caches in addition. As a result in2_crit and in2_lcrit reflect the operating point at probe, rather than the thresholds the device enforces. On systems where the device supplies the CPU core voltage, in2_crit was reported anywhere between 1.15V and 1.70V across identical systems, causing false over-voltage reports once the CPU voltage exceeded the value latched at probe. Read the voltage reference and the over-voltage offset selector whenever a limit is requested, and mark both limits with pmbus_set_update(), so that the core does not cache them. The voltage reference is available on page 3 only. Let the core change the page, so that the page it caches matches the device, except for a single rail configuration, for which the core does not issue PAGE commands, and the page is changed directly. With the selector read at runtime, a device configured with an unsupported selector no longer fails to probe. The OVP1 threshold, which does not depend on the selector, is reported for it instead, with a warning. Clamp the under-voltage limit to zero, since the offset can exceed a low voltage reference, while a negative value would be reported as a read error. Fixes: 2c6fcbb21149 ("hwmon: (pmbus) Add support for MPS Multi-phase mp2975 controller") Cc: stable@vger.kernel.org Signed-off-by: Felix Radensky <fradensky@nvidia.com> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> Link: https://patch.msgid.link/20261105193200.1570996-1-fradensky@nvidia.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
33 hourshwmon: (sy7636a) fix negative temperaturesPablo Mazzini
The thermistor readout is a signed 8-bit value in degrees Celsius. Fixes: de34a4053250 ("hwmon: sy7636a: Add temperature driver for sy7636a") Cc: stable@vger.kernel.org Signed-off-by: Pablo Mazzini <pmazzini@gmail.com> Link: https://patch.msgid.link/20261108093602.329554-3-pmazzini@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
34 hoursMerge tag 'sound-7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes as usual. A couple of regression fixes are included in addition to the various quirks and device-specific fixes. ALSA Core: - PCM: Fix potential inconsistent PCM state reporting after XRUN HD-audio: - Fix sysfs hint parser - Revert CS4208 fixup for MacBookAir 7,2 due to regressions - ACPI _DSD fixes for CS35L41 side-codec on various HP laptops - Device quirks for Acer (Predator, TravelLite) and Dell (Pro QC1255, XPS 8940) USB-audio: - Fix for USB controller bugs reporting oversized packets - Fix UAF on disconnect in caiaq - Quirks for NiceHCK Octave DAC and RYDZ Technology Piva AC20 ASoC: - Fix a regression due to the conversion to devm_kzalloc_flex() that initialized the counter unexpectedly - Copy DAI link names into card device to survive component rebind - SOF: Fix pin format memory leak in IPC4 process widget setup, - SOF: Support alternatively signed firmware loading on AMD platforms - AMD: Guard SoundWire context with NULL checks in IRQ handlers - AMD: SoundWire support on LG gram 16Z95U, fix speaker pop noise on ACP3x with ES83xx codecs, quirks for Acer, ASUS, Huawei, and Lenovo - Qualcomm: Fix headset jack at card rebind, PCM position fix on q6asm - Apple: Fix clock selection for clock consumer FEs in MCA driver - Intel: SoundWire jack-detection quirk for Dell Latitude 9420 - Codecs: Fixes for CS43130 (power down on close), ES9356 (gain dB scale), and MAX98090 (preserve mic boost)" * tag 'sound-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (34 commits) ALSA: aw2-alsa: select SND_PCM ALSA: usb-audio: Add native DSD support for NiceHCK Octave Revert "ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2" ALSA: hda/realtek: Update quirk for Acer Predator PHN16-72 ALSA: hda/realtek - remove headphone MIC support for Dell Pro QC1255 ALSA: caiaq: Kill EP1 URB before unregistering the input device ALSA: pcm: update state after xrun ASoC: max98090: keep the MIC boost across mic input power-up ALSA: hda/realtek: Fix the Dell XPS 8940 headset microphone ASoC: amd: acp70: Add rt713 + rt1320 SoundWire machine for LG gram 16Z95U ASoC: amd: acp: Add ACP70 ACPI flag override for LG gram 16Z95U ASoC: apple: mca: Fix clock selection for clock consumer FEs ASoC: soc-core: reset rtd->num_components after allocation ASoC: SOF: ipc4-topology: Fix pin format leak in process widget setup ALSA: usb-audio: Drop capture packets with bogus actual_length ALSA: usb-audio: Add iface reset and delay quirk for RYDZ Technology Piva AC20 ASoC: amd: acp: Add Lenovo Legion 5 15AGP11 to ACP70 override table ASoC: SOF: amd: Load alternatively signed firmware with an "_l" suffix ASoC: es9356: fix the capture gain dB scale ASoC: amd: acp: es83xx: Enable speaker amplifier after the codec output ...
34 hoursMerge tag 'block-7.4-20261112' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - ublk fixes: don't publish a new device in the idr until it's fully set up, and don't hold ublk_ctl_mutex across device removal, as a stuck filesystem on one device otherwise blocked ADD_DEV and DEL_DEV for every other ublk device. - s390/dasd fixes: re-initialize the RCD buffer magic before every request start, fix a wrong free and refcount leak in the check_tcw error path, don't trust the userspace-supplied result field in the format check, and a typo fix. * tag 'block-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: s390/dasd: Don't trust userspace-supplied result field in format check s390/dasd: Fix wrong free and refcount leak in build_check_tcw error path s390/dasd: Re-initialize RCD buffer with "V1.0" before every start s390/dasd: Fix typo 'immediatly' -> 'immediately' ublk: don't take ublk_ctl_mutex in DEL_DEV ublk: publish a new device by its id only once it is set up
35 hoursMerge tag 'io_uring-7.4-20261112' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: - Don't end the NAPI busy poll early on need_resched() when a single NAPI is registered, as that left the rest of the wait timeout sleeping in schedule_hrtimeout() rather than busy polling. * tag 'io_uring-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/napi: don't end the single NAPI busy poll early on need_resched()
35 hoursMerge tag 'cifs-fixes-7.4-rc3' of https://git.manguebit.org/linuxLinus Torvalds
Pull smb client fixes from Paulo Alcantara: - Fix silent data loss in writeback Since the move to netfslib a transient failure (a reconnect, a lost handle, an interrupted wait, -ENOMEM, or a task killed while close() flushes its dirty pages) ended writeback with the folios clean and no error, dropping the write. Retry it instead, bounded by the hard and retrans mount options, and have umount -f abort the retries and the reconnect and credit waits so the unmount's own sync can't hang - Prefer a non-O_DIRECT handle for writeback, as Windows rejects unaligned I/O on O_DIRECT handles and silently dropped about 1% of the writes in generic/051 - netfs: keep the prepare_read() and prepare_write() errno across a reissue, and don't hang a read whose retry is abandoned (the writeback fixes depend on these) - Fix an out-of-bounds write when compounding an encrypted SMB2_IOCTL with a large input, which an unprivileged user can trigger with a long symlink target - Fix an out-of-bounds read parsing a DFS target referral, and a double conversion of the DFS path in setup_dfs_ref() - Validate security descriptor headers before allocating the query result, and compare owner and group SIDs by their encoded lengths - Hold a server reference while queueing reconnect work so the server can't be freed under the worker - Hold the inode across cifs_oplock_break() so dropping the handle reference can't free it before the break is acknowledged - Flush an inode's deferred handles before opening another of its hard links, so the open doesn't reuse the lease key under a mismatched name and get rejected with STATUS_INVALID_PARAMETER - Skip a NULL channel in __cifs_put_smb_ses() - Bound the invalid NTLMSSP signature diagnostic * tag 'cifs-fixes-7.4-rc3' of https://git.manguebit.org/linux: (29 commits) smb: client: flush deferred handles of other names before a hard link open smb: client: hold the inode across cifs_oplock_break() smb: client: stop reconnecting and replaying during a forced unmount smb: client: fail writeback sends and reopens fast when the server is gone smb: client: don't replay handle reopens inside SMB2_open() smb: client: let umount -f stop waiting for reconnects on hard mounts smb: client: retry writeback after losing the connection, share or handle smb: client: retry writes that couldn't be issued due to a reconnect smb: client: don't block dying tasks waiting for writeback on fsync smb: client: retry writeback on interrupts and allocation failures smb: client: don't fail writeback preparation if the task is dying smb: client: issue writes from a worker if the task is dying smb: client: don't block dying tasks waiting for writeback on close smb: client: don't spend read retries on reads cut short by a reconnect smb: client: don't retry failed writes forever regardless of mount options smb: client: don't give up writeback on the first replayable error smb: client: let umount -f abort retried reads and writes netfs: don't hang a read whose retry is abandoned netfs: keep the prepare_read errno when abandoning read retries netfs: preserve prepare_write errno on reissue ...
35 hoursMerge tag 'erofs-for-7.4-rc3-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix stacked fs check for file-backed mounts with extra devices - Disallow file-backed mounts on shared backing inodes - Reset metadata offsets when fsoffset= is used to fix xattr reads inside and outside the metabox in ont shot - Refine on-disk format summary * tag 'erofs-for-7.4-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: docs: erofs: refine the on-disk overview erofs: reset buf->off in erofs_init_metabuf() erofs: treat files shared by inode_share as stacked erofs: apply the stacked fs check to extra file-backed devices
36 hoursarm64: suspend: Only track cpuidle context for idle tasksUladzislau Zhauniarovich
Commit 19235e472798 ("cpuidle, arm64: Fix the ARM64 cpuidle logic") moved the calls to ct_cpuidle_enter() and ct_cpuidle_exit() into cpu_suspend() so that arm64 cpuidle could keep RCU watching longer and manage context tracking internally. However, cpu_suspend() is called not only by cpuidle via psci_cpu_suspend_enter() (which runs in the context of the idle task), but also during system suspend via psci_system_suspend_enter() (which runs in the context of the task initiating suspend, such as a process writing to /sys/power/state). When entering system suspend, current is a non-idle task. Calling ct_cpuidle_enter() invokes ct_kernel_exit() from kernel space (!user) on a non-idle task. With CONFIG_RCU_EQS_DEBUG enabled, this violates context tracking invariants and triggers a warning: WARNING: kernel/context_tracking.c:120 at ct_kernel_exit+0x1b4/0x1f4 kernel/context_tracking.c:118 Call trace: ct_kernel_exit+0x1b4/0x1f4 kernel/context_tracking.c:118 ct_idle_enter+0x20/0x34 kernel/context_tracking.c:299 ct_cpuidle_enter include/linux/cpuidle.h:134 [inline] cpu_suspend+0x264/0x474 arch/arm64/kernel/suspend.c:136 psci_system_suspend_enter+0x4c/0x80 drivers/firmware/psci/psci.c:544 suspend_enter kernel/power/suspend.c:468 [inline] suspend_devices_and_enter+0x88c/0xd0c kernel/power/suspend.c:533 enter_state kernel/power/suspend.c:618 [inline] pm_suspend+0x498/0x698 kernel/power/suspend.c:644 state_store+0x14c/0x1fc kernel/power/main.c:819 kobj_attr_store+0x6c/0x90 lib/kobject.c:842 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 A corresponding warning is subsequently triggered in ct_kernel_enter() via ct_cpuidle_exit() upon resume. Fix this by checking is_idle_task(current) in cpu_suspend() and only invoking ct_cpuidle_enter() and ct_cpuidle_exit() when executing in the context of an idle task. Fixes: 19235e472798 ("cpuidle, arm64: Fix the ARM64 cpuidle logic") Cc: <stable@vger.kernel.org> Assisted-by: Gemini:gemini-3.8-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+79883955da3a62652a80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=79883955da3a62652a80 Link: https://syzkaller.appspot.com/ai_job?id=5359e16f-013b-4850-9cbc-ddfb3bac95e5 Signed-off-by: Uladzislau Zhauniarovich <uladzislau.zhauniarovich@gmail.com> Tested-by: Uladzislau Zhauniarovich <uladzislau.zhauniarovich@gmail.com> Link: https://lore.kernel.org/r/3e92ccb0-2952-4317-af4c-45457c15efae@gmail.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
39 hoursarm64: ptrace: don't warn on missing siginfo in a group-stopZhao Gongyi
PTRACE_ATTACH to a group-stopped child can enter do_jobctl_trap(), which calls ptrace_stop() without siginfo. If the tracer writes NT_ARM_SYSTEM_CALL, system_call_set() can change syscallno from NO_SYSCALL before update_syscall_orig_x0_after_ptrace() checks last_siginfo. WARN_ON_ONCE(!info) then fires for a valid ptrace stop. Keep the early return when siginfo is absent, but remove the warning. This leaves orig_x0 untouched at a non-seized group-stop and preserves the existing syscall-exit-stop handling. Fixes: 88b839ce497c ("arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry") Cc: stable@vger.kernel.org Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Will Deacon <will@kernel.org> [catalin.marinas@arm.com: modified comment as per Will's suggestion] Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
42 hoursXen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages()Jan Beulich
Both decrease-reservation and populate-physmap can succeed partially. For the former this may be pretty unlikely, but clearly the latter can hit both out-of-memory conditions in the hypervisor or denial because of the allocation exceeding the domain's allowance (there's no interaction with the balloon driver here either). In gnttab_dma_free_pages() we simply can't give back to the system what hasn't been re-filled with backing memory. For gnttab_dma_alloc_pages() both parts of the overall region need dealing with differently. While no present caller of gnttab_dma_free_pages() checks its return value, also don't use -EFAULT there: It really is an out-of-memory condition. (In gnttab_dma_alloc_pages() -EFAULT doesn't look quite right either, but I couldn't think of a clearly better error code there.) Fixes: 9bdc7304f536 ("xen/grant-table: Allow allocating buffers suitable for DMA") Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20261110095605.369848-3-jgross@suse.com>
42 hoursxen: don't allow gnttab_dma_[alloc|free]_pages() in PV guestJuergen Gross
Today gnttab_dma_alloc_pages() or gnttab_dma_free_pages are never called when running as a PV guest, but this holds for in-tree callers only. Bail out early when being called in PV mode in order to ensure no out of tree module or future use cases are violating this assumption. This enables to safely remove PV-only code from both functions. Reviewed-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20261110095605.369848-2-jgross@suse.com>
45 hoursALSA: aw2-alsa: select SND_PCMJude Gyimah
Several stanzas in sound/pci/Kconfig select SND_PCM. SND_AW2 selects nothing at all. aw2-alsa calls snd_pcm_new, which sound/core/pcm.c provides under SND_PCM. aw2-alsa.c:(.text+0x554): undefined reference to `snd_pcm_new' 4 symbols are undefined in all. The driver can be built into vmlinux while SND_PCM is a module, in which case the symbols are not there at link time. Select rather than depend on: SND_PCM has no prompt of its own and is only ever enabled by a select, so a depends on would leave SND_AW2 unselectable. Reproduced on v7.3, arm64, with CONFIG_SND_AW2=y and CONFIG_SND_PCM=m. Found with kreach, a static check that compares what Kconfig allows against the symbols the compiled objects actually reference. Fixes: 98f2a97f207a ("[ALSA] Emagic Audiowerk 2 ALSA driver.") Signed-off-by: Jude Gyimah <jude.gyimah87@gmail.com> Link: https://patch.msgid.link/20261113064614.15045-1-jude.gyimah87@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
45 hoursMerge tag 'asoc-fix-v7.4-rc2' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.4 Another week, another pile of driver specific fixes and quirks. We do have one major fix which addresses a bug introduced by confusion with the counted_by interfaces that was causing major disruption for a number of platforms.
47 hoursMerge tag 'drm-xe-fixes-2026-11-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - select configfs (Arnd) - Sync Wa_16023105232 in xe_was to match OOB rule (Gustavo) - Program LMTT directory pointer from each GT init path (Satya) - Demote uncorrectable local error log on CRI (Varun) - Apply tile workarounds after PCODE init (Daniel) - VRAM offlining fixes (Tejas) - ras: Fix sysctrl and drm-ras discrepancy (Roper) - pat: Return error from xe_pat_init_early() on unknown (Roper) - Prevent VF memory IRQ from accessing a torn-down engine (Piotr) - guc: Protect timeout handling from device unplug (Satya) - gt: Disable GT reset worker before engine teardown (Satya) - Various hwmon fixes (Karthik) - tuning: Restrict Anyhit NULL-query tuning to render engines (Nitin) - gsc: Fix NVL-S GSC compatibility number (Daniele) - Don't abort the shrinker walk on -EBUSY (Thomas) - Mark xe_vma_ops_alloc() noinline for error injection (Shuicheng) - lrc: Restore CTX_CS_INDIRECT_CTX_OFFSET programming for pre-Xe2 (Helen) - Fix build with DRM_XE=y and CONFIGFS_FS=m (Rodrigo) - madvise: use already clamped pat_index (Auld) - Various wedging fixes (Raag) - Rebind BOs evicted before the first LR queue (Arvind) - Toggle the D3Cold enable flag at runtime resume (Vinay) - Access GT MMIO after pcode init (Vinay) - xe_late_bind_fw: Fix firmware leak on missing manifest entry (Badal) - svm: Preserve default PAT index when resetting VMA attributes (Arvind) - Unwrap sync fences before adding them as job dependencies (Junjia) - Schedule disable G2H fixes (Jagmeet) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/avZ4bHmL2NTc4W8a@gsse-cloud1.jf.intel.com
2 daysKEYS: Protect pkey method checks against type removalYuansheng Yang
keyctl_pkey_query(), keyctl_pkey_e_d_s() and keyctl_pkey_verify() check that key->type has the ->asym_*() method they need and call it later, without holding key->sem. A reference keeps the key alive, but does not pin the module that provides its type. When that module is unloaded, unregister_key_type() waits for the key GC to process every remaining key of the type. For each such key, the GC takes key->sem for writing, switches key->type to key_type_dead, whose ->asym_*() methods are NULL, and destroys the payload. If that happens between the check and the call, the keyctl calls a NULL method; if it happens while the method runs, the method returns into freed module text. In-tree, turris-signing-key provides ->asym_query() and ->asym_eds_op() and can be built as a module. Take key->sem for reading around each method call, and check the method again under it, right before the call. While the lock is held the GC cannot switch the key to key_type_dead, so unregister_key_type() and the module unload cannot complete until the method returns. If the type is already gone, the check finds key_type_dead and the keyctl fails with -EOPNOTSUPP, as it does for any key type without the method. memdup_user() and copy_to_user() stay outside key->sem, as in keyctl_read_key(), so no page fault is taken with key->sem held. The in-tree ->asym_*() methods do not take key->sem themselves. Nothing else in the kernel calls these methods, so these four call sites are the full coverage: - keyctl_pkey_query(): ->asym_query() for KEYCTL_PKEY_QUERY - keyctl_pkey_params_get_2(): ->asym_query(), and the op-specific check for KEYCTL_PKEY_ENCRYPT, _DECRYPT, _SIGN and _VERIFY - keyctl_pkey_e_d_s(): ->asym_eds_op() for _ENCRYPT, _DECRYPT and _SIGN - keyctl_pkey_verify(): ->asym_verify_signature() for _VERIFY This problem was recently fixed for keyctl_read_key() by 925c84e3cc21 ("keys: Protect the read method check against type removal") and for key_update() by aef3a8a4f988 ("KEYS: Protect the update method check against type removal"). Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") Cc: stable@vger.kernel.org Signed-off-by: Yuansheng Yang <0xbeac@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20261110030252.9979-1-0xbeac@gmail.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2 daysKEYS: do not let an unmatched key decide the search resultGuixiong Wei
With the dns_resolver key type available, put a key named "foo" in a fresh session keyring, revoke it, and search for "bar": keyctl new_session >/dev/null A=$(printf '127.0.0.1\0' | keyctl padd dns_resolver foo @s) keyctl revoke "$A" keyctl search @s dns_resolver bar Results: keyctl_search: Key has been revoked The search returns -EKEYREVOKED even though there is no key named "bar". It should return -ENOKEY. A dns_resolver search walks the keys in the keyring and uses dns_resolver_cmp() to compare their descriptions with the requested name. When keyring_search_iterator() sees the revoked "foo" key, it records -EKEYREVOKED in ctx->result and skips the key before comparing its description. The search continues, but without a match it returns the error recorded for "foo". Call the match callback before checking for invalidated, revoked or expired keys. A nonmatching key then leaves ctx->result alone. Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") Reported-by: Jarkko Sakkinen <jarkko@kernel.org> Closes: https://lore.kernel.org/lkml/avDG8G-Jl1YsmfCs@kernel.org/ Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20261109032931.80406-2-weiguixiong@bytedance.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2 daysMerge tag 'amd-drm-fixes-7.4-2026-11-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.4-2026-11-12: amdgpu: - DCN 6 DML2 fix - VCE fixes - GC 11.0.2 fix - SMU 15 fix - Error handling fixes - Partition fix - IMU firmware clean up fix - TLB fence handling fix amdkfd: - SVM fixes - CRIU fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261112163539.1265175-1-alexander.deucher@amd.com
2 daysMerge tag 'drm-intel-fixes-2026-11-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for PTL GitLab #9196: eDP-2 on DDI B ends up in a state where any enable fails - PSR fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/avWCYSLHWGPjYq7z@jlahtine-mobl
2 daysMerge tag 'net-7.4-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, wireless and bluetooth. Previous releases - regressions: - tcp: rate limit receive queue collapsing - raw: fix ICMP unreachable sent when receive queue is full - eth: bnxt_en: take RTNL before netif_close() when aborting FW reset Previous releases - always broken: - tcp: - bound snd_cwnd_clamp to TCP_MAX_SND_CWND - number of fixes for TCP Fast Open - gro: - invalidate frag0 after a pull - avoid parsing headers from shared fragments - cipso: stop modifying live ip_options_rcu - udp: do not use a cross-family sk_rx_dst in early demux - fou: gue: check IP version of held packets for direct IP encapsulation - skbuff: preserve fclone lifetime when freeing stolen heads - eth: - mlx5e: - fix crashes on queue stats access to queues without stats - SHAMPO, disable end padding when relaxed ordering is - ena: keep the RX buffer mapped if skb allocation fails" * tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (227 commits) selftests: net: add a test for NSH GSO nsh: limit recursion in nsh_gso_segment() selftests: tls: Cover the cap on consecutive empty records selftests: tls: Extend coverage for zero-length records selftests: tls: Skip the zero_len tests when TLS is unavailable tls: Consume empty data records in tls_sw_splice_read() tls: Break the connection after a burst of empty data records net: phy: c45: select BASE-T1 type for the forced speed net/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failure net/mlx5e: IPsec, don't match upper proto selectors in crypto offload TX tcp: fix request_sock use-after-free during Fast Open accept() net: usb: cdc_ncm: don't underflow the NDP room check net: netns: fix INT_MAX nsid cleanup amt: use ipv6_hdr() in amt_mldv1_leave_handler() af_unix: Inherit SO_INQ in unix_stream_connect() tcp: Pass req->rsk_listener to inet_csk_reqsk_queue_drop() in tcp_check_req(). mailmap: add entries for Hangbin Liu net: virtio: validate outer protocol of UDP tunnel GSO packets tun: clear stale skb->protocol of NAPI frags skbs net: virtio: fix UDP tunnel GSO header of VLAN tagged packets ...
2 daysarm64: kexec_file: Do not use CMA for images with a non-zero text_offsetJinjie Ruan
image_load() adds text_offset to kernel_segment->mem and subtracts it from kernel_segment->memsz. For CMA backed segments this breaks the load path: the payload is copied to page_address(cma), which is the CMA base, while image->start is set to the adjusted address, so kexec jumps into the middle of the kernel. kimage_map_segment() has the same mismatch when a segment has been moved. The adjusted memsz also breaks the release path: the CMA pages are freed using segment->memsz >> PAGE_SHIFT, which is fewer than were allocated, leaking the tail of the allocation. Both problems are specific to CMA segments, which are accessed through page_address(cma) and ignore segment->mem. The normal load path uses segment->mem, so the text_offset adjustment stays consistent there. Keep honoring text_offset, but load such images from regular memory by setting image->no_cma: they lose the CMA contiguous allocation, but keep working. Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Cc: Will Deacon <will@kernel.org> Cc: Mike Rapoport <rppt@kernel.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260921090450.807575-2-ruanjinjie@huawei.com/ Link: https://lore.kernel.org/all/20260921090450.807575-3-ruanjinjie@huawei.com/ Link: https://lore.kernel.org/all/au4JOjnQlx2aSpiE@arm.com/ Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2 daysarm64: errata: Add Cortex-A715/A720 AMU core counter workaroundBeata Michalska
On Cortex-A715 (erratum 2738462) and Cortex-A720 (erratum 2738461), the AMEVCNTR00 counter may continue incrementing while the core remains in WFE with the clocks being enabled. The resulting core cycle count may become unreliable. Add a workaround that effectively treats the AMU counter as unavailable. Cc: <stable@vger.kernel.org> Signed-off-by: Beata Michalska <beata.michalska@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2 daysarm64: errata: Extend the workaround for broken AMEVCNTR01 counterBeata Michalska
The erratum causing significant inaccuracies in the AMU CNT_CYCLES counter due to WFI/WFE has been identified in additional microarchitectures. Extend the existing workaround to cover these implementations, which are affected by the following errata: - ARM Cortex-A725 erratum 3821522 (SDEN-2832921) - ARM Cortex-A720 erratum 4689339 (SDEN-2439421) - ARM Cortex-A720AE erratum 4689340 (SDEN-3090091) - ARM Neoverse N3 erratum 4689341 (SDEN-3050973) - ARM C1-Pro erratum 4689344 (SDEN-3273080) Cc: <stable@vger.kernel.org> Signed-off-by: Beata Michalska <beata.michalska@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2 daysMerge branch 'nsh-limit-recursion-in-nsh_gso_segment'Jakub Kicinski
Eric Dumazet says: ==================== nsh: limit recursion in nsh_gso_segment() Sashiko found that nsh_gso_segment() can call itself, through skb_mac_gso_segment(), once per stacked NSH header. Nothing limits the depth, and a 64KB GSO packet made of 8-byte NSH headers overflows the kernel stack. It was reported while reviewing an unrelated virtio series [1]. Such a packet can be sent with a packet socket using PACKET_VNET_HDR, when the nsh module is loaded. Patch 1 uses the recursion counter added in commit 006c8b834aed ("net: gso: limit recursive IP-in-IP segmentation"), with the same limit as IPv4 and IPv6. Patch 2 adds a selftest: it panics an unfixed kernel, and passes with patch 1. ==================== Link: https://patch.msgid.link/20261112102001.3744643-1-edumazet@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysselftests: net: add a test for NSH GSOEric Dumazet
Send TCPv4 GSO packets encapsulated in a stack of NSH headers to a dummy device which has TSO disabled, using a packet socket with PACKET_VNET_HDR, and count the packets the device transmits. Packets with one or four NSH headers must be segmented. Packets with 5, 64 or 8000 NSH headers must be dropped: they exceed the recursion limit of the GSO handlers. Without the limit in nsh_gso_segment(), the last one overflows the kernel stack. # ./nsh_gso.sh PASS: 1 NSH headers: 4 packets sent PASS: 4 NSH headers: 4 packets sent PASS: 5 NSH headers: 0 packets sent PASS: 64 NSH headers: 0 packets sent PASS: 8000 NSH headers: 0 packets sent Signed-off-by: Eric Dumazet <edumazet@kernel.org> Link: https://patch.msgid.link/20261112102001.3744643-3-edumazet@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysnsh: limit recursion in nsh_gso_segment()Eric Dumazet
nsh_gso_segment() calls skb_mac_gso_segment() for the inner packet, which calls nsh_gso_segment() again when the next protocol is NSH, either directly or behind an inner Ethernet header (ETH_P_TEB). Nothing limits the depth: a GSO packet made of stacked 8-byte NSH headers recurses once per header, and a 64KB packet can hold about 8000 of them, overflowing the kernel stack. Such a packet can be injected with a packet socket using PACKET_VNET_HDR, or with tun/tap or virtio_net, as nothing checks that a GSO packet with VIRTIO_NET_HDR_F_NEEDS_CSUM carries the protocol it claims. It is then segmented in software if the output device does not support the GSO type: BUG: TASK stack guard page was hit at ffffcad5c0ab3ff8 (stack is ffffcad5c0ab4000..ffffcad5c0ab8000) Oops: stack guard page: 0000 [#1] SMP NOPTI CPU: 3 UID: 0 PID: 337 Comm: nsh_gso Tainted: G E 7.4.0-rc1+ #118 PREEMPT(lazy) RIP: 0010:lock_acquire (kernel/locking/lockdep.c:5902) Call Trace: <TASK> skb_mac_gso_segment (include/linux/rcupdate.h:309 include/linux/rcupdate.h:849 net/core/gso.c:50) nsh_gso_segment (net/nsh/nsh.c:110) nsh skb_mac_gso_segment (net/core/gso.c:53) nsh_gso_segment (net/nsh/nsh.c:110) nsh [...] skb_mac_gso_segment (net/core/gso.c:53) __skb_gso_segment (net/core/gso.c:129) validate_xmit_skb (net/core/dev.c:4238) __dev_queue_xmit (net/core/dev.c:5087) packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189) __sys_sendto (net/socket.c:800 net/socket.c:818 net/socket.c:2283) __x64_sys_sendto (net/socket.c:2290 net/socket.c:2286 net/socket.c:2286) do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Use gso_recursion_inc_test(), added in commit 006c8b834aed ("net: gso: limit recursive IP-in-IP segmentation"), with the same limit as IPv4 and IPv6. The counter is shared with them: a packet with four NSH headers in front of an IPv4 header is still segmented, one more NSH header and it is dropped. The NSH -> ETH_P_TEB -> NSH route is covered as well, as each round goes through nsh_gso_segment(). Fixes: c411ed854584 ("nsh: add GSO support") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/netdev/179443691180.2199510.148246238688217560@kernel.org/ Cc: Jiri Benc <jbenc@redhat.com> Signed-off-by: Eric Dumazet <edumazet@kernel.org> Reviewed-by: Jiri Benc <jbenc@redhat.com> Link: https://patch.msgid.link/20261112102001.3744643-2-edumazet@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysMerge branch 'net-tls-break-the-connection-after-a-burst-of-empty-data-records'Jakub Kicinski
Jakub Kicinski says: ==================== net: tls: break the connection after a burst of empty data records Deal with overload of zero-length TLS records. This is the next iteration of Chuck's series. I tried to make it as simple as possible - break the connection if sender floods us with zero-length records. Consume / discard those records even on PEEK to avoid infinite rx_list growth. https://lore.kernel.org/20261019-tls-follow-on-v6-0-ab01c4ecca0c@kernel.org ==================== Link: https://patch.msgid.link/20261111185522.2859004-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysselftests: tls: Cover the cap on consecutive empty recordsJakub Kicinski
Check through both recv() and splice() that a run of 128 empty data records is consumed and the data record behind it is delivered, and that a run of 129 breaks the connection with EBADMSG before the data record can be read. Two runs of 128 with a read returning EAGAIN in between must not break the connection, the cap applies to a burst the reader cannot keep up with, not to the connection as a whole. kTLS cannot send an empty record. A TLS 1.3 record of type 0 whose only byte is the data content type decrypts to one, since the receiver strips the 0 as padding. Reviewed-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261111185522.2859004-6-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysselftests: tls: Extend coverage for zero-length recordsChuck Lever
The zero_len fixture injects raw pre-encrypted records over a socket carrying a TLS_RX key only, and some of those records are zero-length application_data records. Every variant reads the records back with recvmsg() without MSG_PEEK, so neither splice nor MSG_PEEK is tested against an empty record. Add zero_len_splice and zero_len_peek. A zero return from splice() means EOF, so zero_len_splice checks that a run of empty data records does not end a live connection. zero_len_peek checks that a peek reaches the payload behind a run of empty records and leaves the payload in place for the read that follows. When a payload does not follow the run, the peek must leave the socket unreadable. An unfixed kernel returns 0 from splice(), and after the peek poll() reports the socket readable. Signed-off-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261111185522.2859004-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysselftests: tls: Skip the zero_len tests when TLS is unavailableChuck Lever
FIXTURE_SETUP(zero_len) returns early when ulp_sock_pair() reports that the TCP_ULP setsockopt failed, so on a kernel built without CONFIG_TLS the TLS_RX setsockopt never runs. TEST_F(zero_len, test) then sends its raw records over a plain TCP socket, which returns the ciphertext verbatim. All eight variants FAIL on a machine that lacks TLS, and those failures mask any real regression in the same run. Skip the test when the fixture recorded notls, as the other fixtures in this file do. Fixes: a61a3e961baf ("selftests: tls: add tests for zero-length records") Signed-off-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261111185522.2859004-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daystls: Consume empty data records in tls_sw_splice_read()Chuck Lever
A zero-length application_data record decrypts to full_len == 0, so tls_sw_splice_read() splices zero bytes and returns zero. A zero return from a splice read means EOF, and the caller tears down a connection that is still live. Consume the record and fetch the next one, as tls_sw_read_sock() does. The cap on consecutive empty records bounds the loop. When an empty record precedes a close_notify, splice(2) now returns -EINVAL from the control-record test instead of a false EOF. A splice that reaches an alert record already reports -EINVAL. Fixes: c46234ebb4d1 ("tls: RX path for ktls") Reported-by: Sabrina Dubroca <sd@queasysnail.net> Closes: https://lore.kernel.org/netdev/akaoXcfamBp8_mYe@krikkit/ Signed-off-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261111185522.2859004-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daystls: Break the connection after a burst of empty data recordsJakub Kicinski
TLS permits zero-length application_data records, and RFC 8446 suggests them for generating cover traffic. Nothing bounds how many of them a reader processes back to back, though. They advance neither loop bound in tls_sw_recvmsg() and tls_sw_read_sock(), so a peer streaming them faster than the reader decrypts them keeps it in the kernel for as long as they arrive. recvmsg() does not check for signals while records are ready, and its peek and async paths queue every empty record on rx_list. read_sock consumers like nvme-tcp hold the socket lock throughout and never get control back. Break the connection once a reader decrypts more than 128 consecutive empty data records without sleeping or returning to its caller in between, treating the burst as a protocol violation like a malformed record header. A stream of empty records which the reader keeps up with costs no more than any other traffic, so the count starts over on every read and whenever the reader waits for the next record. The strparser is stopped before it parses the next record, so the reader gets the error from tls_rx_rec_wait() and no later record is delivered. Returning to the caller and keeping the connection alive would need a way to wake read_sock consumers which installed their own sk_data_ready after the handshake, a lot of code for a peer that is either broken or malicious. Consume empty records in recvmsg() rather than queuing them on rx_list, so that repeated MSG_PEEK cannot pile them up past the per-read count. Decrypt them synchronously, too. Once a recvmsg() call has decrypted a record asynchronously, recv_end replaces the error with the result of process_rx_list(), so a call that saw only empty records returns 0, a false EOF, instead of the error or -EAGAIN. Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260720-tcp-read-sock-v2-0-29545d034f3c@kernel.org?part=1 Closes: https://sashiko.dev/#/patchset/20260630191551.875664-1-cel@kernel.org?part=1 Link: https://lore.kernel.org/all/20261019-tls-follow-on-v6-0-ab01c4ecca0c@kernel.org/ Fixes: c46234ebb4d1 ("tls: RX path for ktls") Fixes: 3be28e2c9cd0 ("net/tls: Consume empty data records in tls_sw_read_sock()") Reviewed-by: Chuck Lever <cel@kernel.org> Link: https://patch.msgid.link/20261111185522.2859004-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysMerge tag 'for-7.4-rc2-tag' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - zoned mode fixes - fix counting active zones after activation - redo zone reset after error - update device lock range during mount and zone loading to avoid lockdep warnings with device drivers (virtio) - space accounting and extent buffer handling fixes - fix keeping zstd workspace for the last level - handle a real case of a subvolume with 0 refs in the SUBVOL_SYNC ioctl - properly handle case of zero num_stripes when reading chunk items - exclude reloc tree from xarray as it is special and its key does does not fit unsigned long on 32bit platforms - in tree-checker, handle extent item tree owner depending on the features (enabled in simple quota mode) - fix bio control structure leak when checksumming fails * tag 'for-7.4-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix bio counter and bioc leak when async checksumming fails btrfs: tree-checker: reject extent owner ref without simple quota btrfs: do not insert the data reloc tree into fs_roots_radix btrfs: handle zero num_stripes in btrfs_chunk_item_size() btrfs: reject refs=0 subvolume without DEAD in SUBVOL_SYNC_WAIT btrfs: zstd: prevent leak of workspace below maximum level btrfs: zoned: fix lockdep splat on mount btrfs: zoned: don't wait for ordered extents in do_zone_finish() btrfs: zoned: avoid underflow of space info bytes_zone_unusable btrfs: zoned: requeue block group if zone reset bails out btrfs: zoned: fix possible UAF in wait_eb_writebacks() btrfs: zoned: only change active zone counter on successful (de)activation
2 daysnet: phy: c45: select BASE-T1 type for the forced speedIustin Stolniceanu
Commit 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced setup") made genphy_c45_pma_setup_forced() write the type selection field (bits 3:0) of the BASE-T1 PMA/PMD control register (1.2100) on every forced setup: 1000BASE-T1 for SPEED_1000, and 0 for everything else. 0 selects 100BASE-T1, so forcing a 10BASE-T1L PHY to 10 Mbit/s now also switches its PMA to 100BASE-T1, a mode it does not implement. Seen on an ADIN1110 (internal ADIN1100 PHY): after ethtool -s ethX autoneg off speed 10 master-slave forced-master 1.2100 reads 0xc000 instead of the 0xc002. Since the field is not restored by re-enabling autoneg, the PHY keeps the wrong type until the next forced setup or reset. Add a helper that returns the type selection value for the forced speed and the supported link modes: 100BASE-T1, 1000BASE-T1, and 10BASE-T1L or 10BASE-T1S for SPEED_10 depending on the supported 10 Mbit/s modes. Fail with -EINVAL when no type matches instead of writing 100BASE-T1. This also applies to forced 2.5G, 5G and 10G on BASE-T1 capable PHYs, for which there are no link modes yet. The field is called "type selection" in IEEE 802.3-2022 (45.2.1.214, Table 45-178). Keep the old STRAP names as aliases. Tested on EVAL-ADIN1110EBZ: with this change, forcing 10 Mbit/s writes 1.2100 = 0xc002 (10BASE-T1L) instead of the invalid 0xc000. Fixes: 25108a834e14 ("net: phy: c45: add support for 1000BASE-T1 forced setup") Signed-off-by: Iustin Stolniceanu <iustin.stolniceanu@analog.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20261111100053.345196-1-iustin.stolniceanu@analog.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysnet/mlx5e: Fix false WARN_ON_ONCE in flow steering cleanup on RX init failureAlexei Lazar
mlx5e_attach_netdev() sets rx_mode_active before calling init_rx(), so any init_rx() failure after mlx5e_create_flow_steering() has succeeded makes mlx5e_destroy_flow_steering() trip WARN_ON_ONCE(fs->rx_mode_active) in mlx5e_del_vlan_rules(). Hit in internal regression testing, so kthread creation failed with -EINTR: WARNING: CPU: 3 PID: 170 at drivers/net/ethernet/mellanox/mlx5/core/en_fs.c:564 mlx5e_del_vlan_rules+0x295/0x2b0 [mlx5_core] mlx5e_destroy_flow_steering+0x34/0xc0 [mlx5_core] mlx5e_init_nic_rx+0x137/0x200 [mlx5_core] mlx5e_attach_netdev+0x105/0x360 [mlx5_core] Fix it by creating NIC flow steering with rx_mode_active cleared and setting it only after profile->init_rx() succeeds. This also lets the internal error paths of mlx5e_create_flow_steering() destroy partially created steering without warning. The flag is set in mlx5e_attach_netdev() rather than mlx5e_init_nic_rx() so that non-NIC profiles, such as representors, also get it set after a detach/attach cycle. Fixes: 8c7353b6f716 ("net/mlx5e: Fix VLAN cleanup flow") Signed-off-by: Alexei Lazar <alazar@nvidia.com> Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20261111082142.3131746-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 daysnet/mlx5e: IPsec, don't match upper proto selectors in crypto offload TXCosmin Ratiu
The mentioned commit introduced support for upper protocol selectors (protocol & ports) to mlx5 IPsec offload. In crypto offload mode this causes offloaded TX SAs to stop matching traffic. In tx_add_rule(), setup_fte_upper_proto_match() is called for all offload types and programs a match on the upper protocol (TCP/UDP) and ports. For crypto offload, setup_fte_esp() is then called and sets ip_protocol to ESP. The resulting rule requires both ESP as the IP protocol and TCP/UDP ports, which no packet can satisfy, so TX crypto offload silently stops working for such SAs. In crypto offload mode the stack builds the ESP packet and the HW only encrypts it, so the SA rule should only match on the SPI. Move the setup_fte_upper_proto_match() call under the XFRM_DEV_OFFLOAD_PACKET case, where the rule matches the plaintext packet and upper protocol selectors apply. The other three callers are unaffected: rx_add_rule_sa_selector() is already only invoked for packet offload, and tx_add_policy() / rx_add_policy() are only reachable in packet offload mode, since xfrm policy offload is exclusively of type XFRM_DEV_OFFLOAD_PACKET. Fixes: a7385187a386 ("net/mlx5e: IPsec, support upper protocol selector field offload") Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20261111081337.3129580-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>