summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-09-22sched/cache: Decouple sched_cache_group from mm to fix UAFTim Chen
Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In account_mm_sched(), the scheduling stats are accessed by task->mm->sc_stat. However, a task may be switching mm on one CPU when another CPU is running account_mm_sched(), and possibly accessing the old mm that was freed. This problem was found when running tests with KASAN by Hyunwoo: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Instead of serializing the mm access by introducing extra acquisition of rq lock in the mm free path, extract sched_cache_stat from mm_struct, rename it as sched_cache_group and manage its life cycle apart from mm_struct with its own ref counting. This allows us in the next patch access sched_cache_group directly from task, and add a refcount on sched_cache_group when a task links to it. This prevents the use after free issue when accessing stale and released old mm and its sched cache stat a task switches to a new mm while account_mm_sched() is done elsewhere. The other benefit of this restructure is in the future, the grouping of tasks to a LLC would have the flexibility to be associated with a user defined grouping, or cgroup, cookie group, numa_group or others instead of just with a single mm address space. Rename sched_cache_stat to sched_cache_group and turn it into a refcounted object allocated from mm_struct. The mm_struct now holds a pointer (sched_cache_grp) to this object instead of embedding it. Fixes: df0d98475954 ("sched/cache: Introduce infrastructure for cache-aware load balancing") Closes: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Closes: https://lore.kernel.org/all/343a7e07-7fad-4979-9c9b-82ec038c293c@linux.dev/ Reported-by: Hyunwoo Kim <imv4bel@gmail.com> Reported-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev> Co-developed-by: Chen Yu <yu.c.chen@intel.com> Signed-off-by: Chen Yu <yu.c.chen@intel.com> Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: <stable@kernel.org> #7.2.x Link: https://patch.msgid.link/91fd1e3266707c865bc9abecfb3e17bc676712df.1790035273.git.tim.c.chen@linux.intel.com
2026-09-22Backmerge tag 'v7.3-rc4' into drm-nextDave Airlie
Linux 7.3-rc4 Requested by Philipp Stanner for 2ab510e63197360945f915dd5631a77c63ac6b27 would be needed as a groundlayer for further patches that extend the locking in drm_sched Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-09-229p: skip intermediate directory entry name copy in p9dirent_read()Haobin Wu
v9fs_dir_readdir_dotl() decodes each entry of a Rreaddir reply with p9dirent_read(), which parses it through p9pdu_readf("Qqbs"). The 's' conversion in p9pdu_vreadf() already allocates a NUL-terminated copy of the name from the wire buffer; p9dirent_read() then strscpy()s that copy into the fixed 256-byte p9_dirent::d_name and frees the original. The wire format carries the name length in 16 bits, so a name longer than 255 bytes is valid on the wire and may well be valid on the server's filesystem, but it makes strscpy() return -E2BIG. v9fs_dir_readdir_dotl() turns that into -EIO and aborts getdents64(), so every entry after the long one disappears from the listing. Drop the second copy: keep the string allocated by p9pdu_vreadf() in p9_dirent and let v9fs_dir_readdir_dotl(), its only user, free it once dir_emit() has consumed it. p9_dirent is a short-lived stack object, so the string's lifetime does not change. Note that the VFS only rejects names of PATH_MAX bytes or more in verify_dirent_name(), so after this change a name between NAME_MAX and PATH_MAX is returned by getdents64() even though any later lookup on it fails with -ENAMETOOLONG. The next patch skips such entries. Fixes: 7751bdb3a095 ("9p: readdir implementation for 9p2000.L") Closes: https://github.com/microsoft/WSL/issues/41192 Signed-off-by: Haobin Wu <853555@gmail.com> Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com> Message-ID: <20260918024851.51229-2-853555@gmail.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2026-09-22sched/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in the ↵Thomas Huth
<uapi/linux/sched.h> header While the GCC and Clang compilers already define __ASSEMBLER__ auto- matically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. Let's standardize now on the __ASSEMBLER__ macro to avoid this confusion. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://patch.msgid.link/20260922064641.61120-1-thuth@redhat.com
2026-09-22net/9p: add vsock transportMatus Skvarla
Add vsock as a transport option for 9P client connections. This allows mounting 9P filesystems over VM sockets without requiring TCP/IP networking or additional userspace tools, which can be useful with hypervisors other than Qemu/KVM, for example Hyper-V/WSL which is used by podman machine on Windows[1][2]. The implementation extends trans_fd.c with vsock support, reusing the existing socket infrastructure. A new p9_fd_create_vsock() function handles vsock connection setup by parsing the CID from the mount source, creating an AF_VSOCK socket, and connecting to the specified endpoint. All other transport operations (close, request, cancel) use the shared fd transport implementation. The privport mount option is not currently implemented for vsock and returns -EOPNOTSUPP if specified. Add CONFIG_NET_9P_VSOCK option that conditionally compiles vsock support into 9pnet_fd.ko. This follows the pattern where socket-based transports (TCP, Unix, vsock) share trans_fd.c, while specialized hardware transports (virtio, xen, rdma) have dedicated files. Usage: mount -t 9p -o trans=vsock[,port=<port>] <CID> /mnt/point Link: https://github.com/podman-container-tools/podman/blob/main/cmd/podman/machine/server9p.go [1] Link: https://github.com/podman-container-tools/podman/blob/main/cmd/podman/machine/client9p.go [2] Signed-off-by: Matus Skvarla <skvarlamatus@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Message-ID: <20260709161741.15138-1-skvarlamatus@gmail.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2026-09-22Merge tag 'drm-xe-next-2026-09-18' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Add SRCID to pagefault reporting (Jonathan) Cross-subsystem Changes: - gpusvm: share one HMM fault and keep single mappings inline (Honglei) - pagemap: Prevent CPU stalls during unbounded pagemap teardown (Varun) Driver Changes: - VRAM health check + CCS fix (Auld) - Add memory page offlining support (Tejas) - Report GT TDR and VM rebind faults using SIGID (Arvind) - Flush LSC untyped L1 dataport cache after rcs/ccs batches (Thomas) - Add multi_queue_active_lrca debugfs (Varun) - mmio_gem: fix fault handler and destroy path (Auld, Ilia, Shuicheng) - sysctrl: Add helper to query application status (Anoop) - shrinker: Runtime PM reference for non-system memory (Shuicheng) - pcode: Increase default mailbox timeout (Karthik) - Skip clearing purged page-table BOs (Tejas) - tests: Fix subplatform selection (Wajdeczko) - log: Relax location ID recognition (Wajdeczko) - i2c: Disable IRQ on unbind (Raag) - Refactor VF LMEM BAR resize helper function (Wajdeczko) - pf: Add _locked variant of config functions (Wajdeczko) - nvm: add system controller region (Alexander) - guc: Add simple KLV decoder helpers (Wajdeczko) - debugfs: Expose per-engine idle status (Anirban) - gt_throttle: Report power brake as a throttle reason on CRI (Anirban) - tlb_inval: Treat wedged-device invalidations as complete (Shuicheng) - Add mnemonic error reason to page fault diagnostics (Brost) - Keep walking on SVM eviction failure (Brost) - Make p2pdma distance check verbose via dynamic debug (Thomas) - Consolidate semaphore instruction definitions (Roper) - Poll GT for C6 before D3 (Vinay) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/aq2UzTdN95ZpzKGz@gsse-cloud1.jf.intel.com
2026-09-21KMSAN: fix memset() when using fortify-source, againArnd Bergmann
Both kmsan and fortify-source replace the memset function. When both are enabled at the same time, the kmsan version gets used, which triggers a warning about fortify-source being nonfunctional: warning: unsafe memset() usage lacked '__write_overflow' symbol in /home/arnd/arm-soc/lib/test_fortify/write_overflow-memset.c warning: unsafe memset() usage lacked '__write_overflow_field' symbol in /home/arnd/arm-soc/lib/test_fortify/write_overflow_field-memset.c Commit 78a498c3a227 already tried to address this, but this seems to only have worked for memcpy() and memmove() but not memset(), which is still lacking the macro definition when KMSAN is enabled. Remove the incorrect #ifndef check around the memset() macro. Fixes: ff901d80fff6 ("x86: kmsan: use __msan_ string functions where possible.") Fixes: 78a498c3a227 ("x86: fortify: kmsan: fix KMSAN fortify builds") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260618142951.1739694-1-arnd@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2026-09-21Merge tag 'wireless-next-2026-09-21' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== More changes, including drivers: - brcmfmac: FT/OKC roaming offload - ath12k: IPQ5332 platform infrastructure - cfg80211/mac80211: non-STA TX/RX infrastructure for MLO to fix address translation bugs - the rest is mostly minor cleanups etc. * tag 'wireless-next-2026-09-21' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (101 commits) dt-bindings: net: wireless: Convert WL1251 to DT schema libertas: mesh: remove unused and undocumented sysfs attribute groups wifi: mac80211: fix multi-link UHR association wifi: nl80211: rename no-ACK bitmap to TID bitmap wifi: radiotap: correct EHT TB U-SIG 1 B20:25 wifi: ieee80211: fix FTM bufferable check wifi: mac80211: allow advertising 20 MHz-only non-AP STA wifi: mac80211: WARN on 40 MHz HT/HE mismatch wifi: mac80211: tests: fix memory leak wifi: mac80211: use assign_bit() where applicable wifi: mac80211: pass error station if non-STA transmit was requested wifi: mac80211: pass station to ieee80211_tx_skb_tid wifi: mac80211: report to cfg80211 when no STA is known for a frame wifi: cfg80211: add attribute for TX/RX denoting there is no station wifi: mac80211: rework RX packet handling wifi: mac80211: refactor RX link_id and station handling wifi: mac80211: change public RX API to use link stations wifi: iwlwifi: use link_sta internally to the driver MAINTAINERS: Replace wireless.wiki.kernel.org links wifi: brcmfmac: log the firmware status when a connect fails ... ==================== Link: https://patch.msgid.link/20260921121635.195723-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21ipv6: Fix dst leak for uncached routes.Kuniyuki Iwashima
ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect an uncached route by list_empty(&rt->dst.rt_uncached), which replaced the static DST_NOCACHE flag check in commit a4c2fd7f7891 ("net: remove DST_NOCACHE flag"). When a device is unregistered, rt6_uncached_list_flush_dev() unlinks uncached routes tied to the device from rt6_uncached_list. Previously, they were moved to another list with list_move() (__list_del_entry() + list_add()), and since commit 98aa546af5e4 ("inet: remove (struct uncached_list)->quarantine"), the routes are just unlinked with list_del_init(). If list_del_init() runs concurrently, list_empty() evaluates to true; ip6_route_output_flags() calls dst_hold_safe() incorrectly and ip6_rt_put_flags() skips ip6_rt_put(), leaking dst, and thus dev tied via rt->from as well. The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()"). Let's check rt6->dst.rt_uncached_list instead. Note that IPv4 does not have the same issue. Fixes: 98aa546af5e4 ("inet: remove (struct uncached_list)->quarantine") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260920191558.2990636-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21bnge: update HSIVikas Gupta
Update HSI to support future patches implementing multi-RSS and NTUPLE-related features. Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Link: https://patch.msgid.link/20260917064548.773334-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21i3c: mipi-i3c-hci: Add HDR-DDR supportAdrian Hunter
Add support for HDR-DDR private transfers. Encode HDR-DDR Command Descriptors and advertise HDR-DDR capability when supported by the controller. Carry the HDR Command Code in the descriptor CP, CMD and RNW fields. Use the Immediate Data Transfer Command for writes of up to four bytes, as is already done for SDR, and the Regular Data Transfer Command otherwise. The Immediate Data Transfer Command is write-only, which suits HDR because the eighth bit of the HDR Command Code is field RNW, so a write Command Code leaves that field zero as required. Reject transfers shorter than one Data Word or with an odd byte count, as HDR-DDR transfers are defined in whole Data Words and the I3C specification requires at least one Data Word to follow the Command Word. Only advertise HDR-DDR capability when the driver can generate the required descriptor format. Assisted-by: GitHub-Copilot:claude-opus-5 Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260920151248.46936-18-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-21i3c: master: Match ACPI targets to the correct bus controller instanceAdrian Hunter
For ACPI-enumerated I3C targets, _ADR encodes both the zero-based bus controller instance number in bits 51:48 and the Provisioned ID (PID) in bits 47:0, as defined by ACPI 6.6 Table 6.2 and MIPI DisCo for I3C v1.1 section 5.2. However, i3c_master_add_acpi_dev() treats the entire _ADR value as the PID. On multi-instance controllers this folds the instance number into the PID, causing i3c_master_add_i3c_boardinfo() to reject devices on instance 1 and above with -EINVAL. The problem is exposed by the MIPI I3C HCI PCI driver, which creates one MFD child device per bus controller instance. Since the child devices do not have their own ACPI companions, they all inherit the parent's ACPI node and therefore enumerate the same set of child devices. As a result, a target belonging to any instance other than 0 prevents registration of all controller instances. Add an instance number to struct i3c_master_controller, propagate it from the HCI PCI driver, extract the PID from bits 47:0 of _ADR, and ignore ACPI child nodes that belong to a different controller instance. ACPI-enumerated I2C devices are unaffected. Their controller instance is encoded in the Resource Source Index of the I2cSerialBusV2 descriptor rather than in _ADR and will require separate handling. Fixes: b46a4b3c5d1e ("i3c: master: Support ACPI enumeration of child devices") Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260920151248.46936-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-09-21bpf: Preserve stack initialization for generic output buffersKumar Kartikeya Dwivedi
Partial-output helpers such as bpf_snprintf() do not read incoming buffer contents, but may leave some bytes untouched. Let them accept uninitialized storage without promising full initialization to callers that cannot read uninitialized stack memory. Make this the default for generic MEM_UNINIT buffers, including __uninit kfunc arguments. Allow invalid stack bytes through the output check but leave them invalid when uninitialized stack reads are not allowed. Scrub initialized bytes and scalar spills as possible writes, retaining the existing restrictions on spilled pointers and special stack objects. Retain the output annotation for variable-sized arguments and track their raw-mode eligibility separately. Callers allowed uninitialized stack reads can continue treating the potentially written range as initialized. For constant ranges, defer that initialization until all inputs are checked. Keep prior stack contents live for generic outputs when the caller cannot read uninitialized stack memory. Such calls do not define the entire range, so liveness must preserve initialization facts that remain relevant after the call. Dynptr and iterator constructors still define their storage. Annotate the snprintf, sysctl name, d_path, snprintf_btf and branch-record destinations with MEM_UNINIT, and document that generic __uninit kfuncs may leave bytes untouched. This also changes readback from existing full-writing helpers: without permission to read uninitialized stack memory, programs must initialize those bytes themselves before reading them after a call. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260921023843.411943-9-memxor@gmail.com
2026-09-21bpf: Support multiple __uninit kfunc output argumentsKumar Kartikeya Dwivedi
A single output descriptor cannot retain the initialization ranges of two __uninit memory arguments. Track raw-mode eligibility and the definite output size separately for each ABI slot, so a variable-size output leaves independent constant-size outputs intact. Use the shared argument-checking path to record outputs for both helpers and kfuncs. With per-slot tracking, neither needs the single-output prototype restriction. Initialize every recorded output after checking all arguments, skipping empty slots before looking up their register state. Use the resolved BTF parameter when looking up __uninit for stack liveness. A preceding by-value parameter can consume multiple ABI slots, so its slot number cannot index the BTF parameter array. Suggested-by: Amery Hung <ameryhung@gmail.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260921023843.411943-7-memxor@gmail.com
2026-09-21bpf: Fix generic __uninit kfunc output buffersKumar Kartikeya Dwivedi
Stack liveness treats __uninit kfunc arguments as writes. Even with write-only access checks, ordinary clobber handling leaves poisoned stack bytes poisoned after the call, so the output cannot be read. Reuse the helper output descriptor for generic kfunc buffers. Record the output after resolving its memory type, and initialize its stack bytes only after all arguments have been checked. This prevents an output from making an aliased, uninitialized input appear valid. Track the output by its ABI argument slot, since a kfunc pointer may be passed on the stack or follow a multi-slot by-value argument. Keep the single-output restriction in prototype validation; multiple-output tracking is a separate extension. Document that output buffers must be fully initialized on every return path, including error returns and padding. Fixes: 2cb27158adb3 ("bpf: poison dead stack slots") Reported-by: Tejun Heo <tj@kernel.org> Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/86d966ec88bbf27d21b2bb4e18c8aa00@kernel.org Link: https://patch.msgid.link/20260921023843.411943-5-memxor@gmail.com
2026-09-21bitfield: get rid of __MAKE_OP machineryYury Norov
The __MAKE_OP machinery hides the fixed-width bitfield helper definitions from source searches and makes the end result highly obscured and largely uncontrolled. This follows earlier discussions about making these helpers easier to find: [1], [2]. Move the explicit helpers and their shared checks into linux/bitfield-fix-width.h in both the kernel and tools headers, and include it from bitfield.h to preserve existing users. The repeated overflow check is factored into __assert_field(), preserving the original condition and compile-time diagnostics. With GCC 15.2.0 and x86-64 defconfig plus the bitfield KUnit tests, the before/after kernel builds are binary identical. The __MAKE_OP generates the following 40 functions (including the direct ____MAKE_OP(u8,u8,,) invocation): u8_encode_bits() u8_replace_bits() u8p_replace_bits() u8_get_bits() le16_encode_bits() le16_replace_bits() [dead code] le16p_replace_bits() le16_get_bits() be16_encode_bits() be16_replace_bits() [dead code] be16p_replace_bits() [dead code] be16_get_bits() u16_encode_bits() u16_replace_bits() u16p_replace_bits() u16_get_bits() le32_encode_bits() le32_replace_bits() [dead code] le32p_replace_bits() le32_get_bits() be32_encode_bits() be32_replace_bits() [dead code] be32p_replace_bits() be32_get_bits() u32_encode_bits() u32_replace_bits() u32p_replace_bits() u32_get_bits() le64_encode_bits() le64_replace_bits() [dead code] le64p_replace_bits() [dead code] le64_get_bits() be64_encode_bits() be64_replace_bits() [dead code] be64p_replace_bits() [dead code] be64_get_bits() u64_encode_bits() u64_replace_bits() u64p_replace_bits() u64_get_bits() Functions marked with [dead code] have no in-tree callers and are removed by this change. Link: https://lore.kernel.org/all/20250214073402.0129e259@kernel.org/ [1] Link: https://lore.kernel.org/all/aeub59FBHbCy-KKP@yury/ [2] Assisted-by: OpenAI Codex Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-09-21dt-bindings: clock: airoha: Add PHY binding for Serdes portChristian Marangi
Add PHY cell property for Serdes port selection. Currently supported only for Airoha AN7581 SoC, that support up to 4 Serdes port. The Serdes port can support both PCIe, USB3 or Ethernet mode. - PCIe1 Serdes can support PCIe or Ethernet mode. - PCIe2 Serdes can support PCIe or Ethernet mode. - USB1 Serdes can support USB3 or HSGMII mode. - USB2 Serdes can support USB3 or PCIe mode. Add bindings to permit correct reference of the Serdes ports in DT. Values are just symbolic and enumerates the Serdes port with a specific number for precise reference. The available Serdes port can be selected following the dt-binding header in [2]. [2] <include/dt-bindings/soc/airoha,scu-ssr.h> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-09-21dt-bindings: watchdog: Add compatible for MediaTek mt8167Luca Leonardo Scorcia
Currently mt8167 inherits its watchdog from the included mt8516 dtsi, which in turn falls back on mt6589-wdt. However according to the data sheet mt8167 toprgu is not actually compatible with mt6589 (it has 14 sw resets instead of 12, and its reset bit map table is different from mt6589). Update the mtk-wdt binding to add a dedicated compatible for mt8167 and add the IDs that can be used in device trees to identify subsystem resets. Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260908174259.9009-4-l.scorcia@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-09-21regulator: add support for the Nexperia NEX10000UB dual output LCD bias ↵Mark Brown
power supply Neil Armstrong <neil.armstrong@linaro.org> says: Document and add regulator support for the Nexperia NEX10000UB dual output LCD bias power supply which provides programmable positive and negative output voltages mainly for display panels applications. The driver supports setting the output voltage from 4V to 6V in 100mV steps for each output via the I2C programming interface and supports the enable GPIOs for both outputs. Product datashet can be found online at [1]. [1] https://assets.nexperia.com/documents/data-sheet/NEX10000UB.pdf Link: https://patch.msgid.link/20260921-topic-sm8x50-nex10000ub-v2-0-eeeaf9b0c913@linaro.org
2026-09-21spi: Parse the rx-sample-delay-ns peripheral property in the coreFrieder Schrempf
"rx-sample-delay-ns" is documented in spi-peripheral-props.yaml as a generic SPI peripheral property, but the core never looks at it. Only spi-dw reads it from the peripheral node as the binding describes, and any other driver wanting to act on it would have to duplicate that. Add spi_device.rx_sample_delay_ns and parse the property once, in __spi_add_device(), which covers every way a device can be instantiated and runs before ->setup(). Use device_property_read_u32() rather than adding this to of_spi_parse_dt(). spi-dw already uses the fwnode accessor, so the property works today on ACPI and software node platforms such as the ones served by spi-dw-pci, and parsing it only in the device tree path would quietly drop it there. No functional change, since nothing reads the new field yet. Assisted-by: Claude:claude-opus-5 Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Link: https://patch.msgid.link/20260921-spi-sample-delay-cleanup-v2-2-b460d572fd32@kontron.de Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-21ASoC et alia: Convert to use dma_request_chan()Mark Brown
Andy Shevchenko <andriy.shevchenko@linux.intel.com> says: Convert the last users (mostly in ASoC) to use dma_request_chan() and drop deprecated dma_request_slave_channel() completely. Link: https://patch.msgid.link/20260918113727.1898998-1-andriy.shevchenko@linux.intel.com
2026-09-21dmaengine: Remove deprecated dma_request_slave_channel()Andy Shevchenko
No more users. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Vinod Koul <vkoul@kernel.org> Link: https://patch.msgid.link/20260918113727.1898998-8-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-21pmdomain: riscv: Add RPMI device power serviceJoshua Yeong
Add a generic power domain provider on top of the RISC-V Platform Management Interface (RPMI) device power service group, reached through an SBI MPXY channel. The driver enumerates the device power domains advertised by the platform microcontroller, queries their attributes and initial state, and registers them as an onecell genpd provider so that devices can reference them through the "power-domains" property. Signed-off-by: Joshua Yeong <joshua.yeong@starfivetech.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-09-21ata: libata-core: Extend Samsung LPM quirk to AMD controllersNiklas Cassel
A Samsung SSD 870 QVO 8TB connected to an AMD 600 Series chipset SATA controller is reported to time out on STANDBY IMMEDIATE during system suspend with med_power_with_dipm enabled. The command completes when using max_performance instead. The existing Samsung LPM quirk only matches ATI controllers, leaving AMD controllers unaffected. Rename it to ATA_QUIRK_NO_LPM_ON_ATI_AND_AMD and extend the vendor check to AMD for the same Samsung SSD model patterns. Keep LPM behavior unchanged for other controller vendors, including Intel. Leave ATA_QUIRK_NO_NCQ_ON_ATI restricted to ATI, since the reported AMD issue concerns LPM rather than NCQ. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221986 Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> --- Link: https://lore.kernel.org/r/20260918124030.1962773-5-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel@kernel.org>
2026-09-21Merge tag 'pwrseq-is-controllable-for-v7.4' of ↵Bartosz Golaszewski
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into pwrseq/for-next Add a new core power sequencing consumer functions: pwrseq_is_controllable(). This allows users to check whether the sequencer's target is actually host-controllable.
2026-09-21power: sequencing: Add pwrseq_is_controllable() APILoic Poulain
On some boards a power sequencing target has no host-controllable enable for its function, for instance when the enable line is not wired up to a GPIO and is hardwired to an always-on level. The pcie-m2 "uart" target is one such example: when the M.2 connector does not route the W_DISABLE2# signal to a host GPIO, its enable/disable are no-ops and the consumer cannot gate the Bluetooth function at all or exclusively. Add a generic pwrseq_is_controllable() helper. It reports whether the target's final unit provides a host-controllable dedicated power actuator. The target can implement a new optional is_controllable() callback, reporting whether that actuator is effective on this target (for example depending on GPIO presence). If the target does not provide the callback, it is assumed to be controllable. Note this only describes the target's own enable actuator. It does not imply that a power-off reaches an electrical OFF state, since a target may have multiple consumers. It also does not mean that power is uncontrolled for the target's dependencies: those may still be gated on their own. And it does not restrict consumers from calling pwrseq_power_off() either, which remains valid to drop this consumer's vote on the (possibly shared) resources and dependencies of the target. Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260904-monza-wireless-v6-3-d8c5042b3efd@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-09-21gpiolib: add get_config() and gpiochip_generic_get_config()Mehmet Fide
A chip with a pin control backend sets a line's configuration through set_config() and gpiochip_generic_config(), but has no way to read one back. gpio-mmio needs that to learn the direction of a line whose direction lives in the pin controller. Add the optional get_config() callback, taking the packed parameter to query and returning its bare argument the way pinctrl_gpio_get_config() does, and gpiochip_generic_get_config() as the pin control backed implementation, the mirror of gpiochip_generic_config(): a chip without pin ranges, or a kernel without pinctrl, gets -ENOTSUPP. Nothing in gpiolib calls get_config() and there is no consumer API; it is for the chip's own use. Suggested-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260915080501.329424-4-mehmet.fide@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-09-21Merge branch 'ib-gpio-dir-imx' of ↵Bartosz Golaszewski
https://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into gpio/for-next Pull pinctrl updates required to allow tracking of direction of GPIOs on chips without dedicated direction registers that GPIO drivers can access. This allows GPIO drivers to get that information from the associated pin controller.
2026-09-21wifi: nl80211: rename no-ACK bitmap to TID bitmapJohannes Berg
Rename the NL80211_ATTR_NOACK_MAP attribute to be called NL80211_ATTR_TID_BITMAP, allowing it to be reused in more contexts. The interpretation stays for the only command using it now (NL80211_CMD_SET_NOACK_MAP.) Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> Link: https://patch.msgid.link/20260916120620.823bfa05f5f5.Ibb334016129512921b0aa5236ee4c670d83d0f95@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-21wifi: radiotap: correct EHT TB U-SIG 1 B20:25Johannes Berg
The mask here needs to cover six bits, not just five, fix that. Link: https://patch.msgid.link/20260916120406.e4c89f440edb.I8d80bba29ff7e7d642ec603098fb7d30f2db5968@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-21wifi: ieee80211: fix FTM bufferable checkJohannes Berg
The FTM action frames don't have a protected dual, in fact their numbers are assigned otherwise. Remove the wrong check. Link: https://patch.msgid.link/20260916120232.d3c05305173e.I3855653e49311b0752b9fcdf9d5c6373408a14da@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-21firewire: core: update kerneldoc for fw_send_request() and its variantsTakashi Sakamoto
Some error paths invoke the transaction callback in process context using a workqueue. All transaction callbacks are now invoked in process context. Update kerneldoc to reflect this behavior. Link: https://lore.kernel.org/r/20260921031931.287429-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-09-21firewire: core: use workqueue to invoke transaction callback in some error casesTakashi Sakamoto
Some error paths of __fw_send_request() invoke the transaction callback in the caller's context. Additionally, when a split transaction times out, the callback is invoked in softIRQ context by the timer wheel. These are the only cases where the callback is not guaranteed to be invoked in process context. Use a workqueue to invoke the callback in these cases. This may introduce additional delay when a split transaction times out, but the default timeout is 2 seconds, so the additional delay should be negligible. Link: https://lore.kernel.org/r/20260921031931.287429-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-09-21Merge tag 'v7.3-rc4' into togregJonathan Cameron
Linux 7.3-rc4 Merged to pick up an x86 build fix needed for the ad9910 driver and the IIO fixes recently picked up.
2026-09-21pinctrl: make the CONFIG_PINCTRL=n gpio config stubs return -ENOTSUPPMehmet Fide
With CONFIG_PINCTRL=n, pinctrl_gpio_get_config() and pinctrl_gpio_set_config() are stubs that return 0. The getter reports success without touching the config it was asked to fill, so a caller reads the packed parameter it passed in back as if it were the pin's state; the setter reports success for a configuration nobody applied. With CONFIG_PINCTRL=y the same callers already get -ENOTSUPP from gpiochip_generic_config() and gpiochip_generic_get_config() for a chip without pin ranges, and gpiolib treats that value as "the backend cannot do this" and carries on. Return it from the stubs too, so a kernel without pinctrl behaves like a chip without pin ranges instead of claiming success. Suggested-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-09-20Merge tag 'input-for-v7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - Fixes for evdev and input compat handling to zero-initialize on-stack absinfo and force-feedback effect structures before partial or compat copies from userspace, preventing kernel stack memory disclosure - Fixes for the Synaptics RMI4 driver to prevent an out-of-bounds read when writing multi-chunk blocks over SMBus and to avoid a NULL pointer dereference during suspend/resume when the RMI device is unbound - Fixes for the soc_button_array driver to propagate -EPROBE_DEFER on non-Bay Trail/Cherry Trail platforms (fixing broken power and volume buttons on the Microsoft Surface Pro 11) and to validate the ACPI package element count before dereferencing - A fix for the adp5588-keys driver to cache the initial GPIO hardware state before registering the gpiochip so pre-configured pin states are not clobbered by GPIO hogs during registration - A fix for the cyttsp5 touchscreen driver to clamp the device-supplied HID report size before copying into the response buffer, preventing a buffer overflow - A fix for the HP SDC serio driver to use timer_shutdown_sync() on module exit so the periodic kicker timer cannot rearm itself during teardown - A fix for the eeti_ts touchscreen driver to export its OF module alias so the module autoloads on Device Tree platforms - Updates to the xpad joystick driver adding support for the Victrix Pro BFG controller and Azeron devices, and fixing the device type classification for the PDP Marvel Xbox 360 controller - Quirks for the i8042 and atkbd drivers to keep the built-in keyboards functional on the Acer Aspire Go 15 AG15-42P and Xiaomi Redmi Book Pro 16 2026 - A quirk for the Synaptics PS/2 touchpad driver disabling SMBus InterTouch on the Lenovo ThinkPad T440p (board ID 2722) so the touchpad and TrackPoint respond immediately at boot - Other minor updates and documentation fixes, including reading the "ti,poll-period" property as u32 in tsc2007, adding the mt6572 compatible to the MediaTek keypad Device Tree binding, fixing an attribute name typo in the trackpoint sysfs ABI documentation, and documenting that no new LED codes should be added to the input subsystem * tag 'input-for-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: hp_sdc - shut down kicker timer on module exit Input: xpad - add support for Victrix Pro BFG Controller Input: tsc2007 - read "ti,poll-period" as u32 Input: trackpoint - fix the inertia attribute name in the ABI document Input: eeti_ts - publish the OF module alias Input: xpad - add support for Azeron devices Input: xpad - fix PDP Marvel Xbox 360 controller Input: document that no new LED codes should be added Input: soc_button_array - check btns_desc->package.count Input: soc_button_array - fix MS Surface Pro 11 probe failure Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) Input: cyttsp5 - clamp the HID report size before memcpy Input: zero ff_effect before compat copy in input_ff_effect_from_user Input: evdev - zero absinfo before partial copy in EVIOCSABS Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 dt-bindings: input: mediatek,mt6779-keypad: add mt6572 Input: adp5588-keys - cache GPIO state before registering the gpiochip
2026-09-20landlock: Fix tracepoint contract documentationMickaël Salaün
The tracepoint documentation claims that denial and lifecycle events expose every input needed to reproduce a verdict. Instead document how denial, ruleset, and domain events identify the denying policy, checked operation and object, and reason for denial. Direct consumers to generic tracepoints for additional operational context. State the reconstruction limits: IDs are boot-local, rule checks have no request ID, and exported records may be lost or cross-CPU reordered. Also replace the incorrect BPF_RAW_TRACEPOINT guidance with libbpf SEC("tp_btf/...") attachment and refer consumers to the event prototypes for callback argument layouts. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Link: https://patch.msgid.link/20260918185036.608651-10-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Report the effective signal numberMickaël Salaün
The signal-scope denial callback identifies its target but not the effective signal. This loses permission-probe signal zero and makes the file-owner hook's zero sentinel ambiguous. Append an int signal argument to the typed-BPF callback. Preserve sig, including zero, in hook_task_kill(). In hook_file_send_sigiotask(), translate signum zero to SIGIO at the producer, where its meaning is known. Carry the effective signal and target domain ID in a private, stack-backed context consumed synchronously. This requires no allocation or task reference in the interrupt-capable file-owner path. Gate this context and the remaining scope-only domain IDs with CONFIG_TRACEPOINTS. Keep the tracefs record and audit output unchanged. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Fixes: bb91730f16c0 ("landlock: Add tracepoints for ptrace and scope denials") Link: https://patch.msgid.link/20260918185036.608651-7-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Report the actual ptrace tracerMickaël Salaün
The ptrace denial callback identifies only the tracee. Current is the tracer during hook_ptrace_access_check(), but it is the tracee during PTRACE_TRACEME, where the parent is the actual tracer. A consumer therefore cannot infer both parties from the existing arguments. Append the actual tracer task to the typed-BPF callback: current for hook_ptrace_access_check() and parent for hook_ptrace_traceme(). Carry it with the tracee domain ID in a private ptrace context. Both hooks keep the selected tasks alive through synchronous dispatch, so no extra task reference is needed. Keep the tracefs record unchanged. The new context is available only to typed BPF, while same_exec continues to describe the tracer that owns the denying policy. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Fixes: bb91730f16c0 ("landlock: Add tracepoints for ptrace and scope denials") Link: https://patch.msgid.link/20260918185036.608651-6-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Fix network denial trace contextMickaël Salaün
Network denial events report source and destination ports reconstructed from audit data. Their zero values are ambiguous, and neither identifies the complete endpoint that Landlock checked. Carry the checked sockaddr and its signed length in a private trace-only context. For an enabled event, validate the length and copy only the initialized prefix into zeroed local storage. This prevents a typed BPF program from reading uninitialized bytes while exposing the socket family, socket, address, and length. Replace the source and destination trace-record fields with one signed port derived from the checked address. A value of -1 means that no port was checked, zero is a valid port, and positive values use host endianness. Bind blockers select the bind address; connect and send blockers select the destination. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Fixes: 01ce260f5ccf ("landlock: Add landlock_deny_access_fs and landlock_deny_access_net") Link: https://patch.msgid.link/20260918185036.608651-5-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Fix rule tracepoint contextMickaël Salaün
Name each event after the identity it reports. Add-rule events describe UAPI rule insertion, so rename them after LANDLOCK_RULE_PATH_BENEATH and LANDLOCK_RULE_NET_PORT. Check-rule events describe matches in internal rule trees, so rename them after LANDLOCK_KEY_INODE and LANDLOCK_KEY_NET_PORT. This remains accurate if multiple UAPI rule types share one lookup and stored rule. Keep denial event names based on filesystem and network families because they describe final access decisions. Use u64 for growable access masks passed by value to add-rule and check-rule typed BTF callbacks. CO-RE can relocate pointer-reached fields, but it cannot widen a scalar callback slot declared by a BPF program. Keep native access_mask_t for internal state and trace records. For add-rule callbacks, report the normalized per-call contribution passed to landlock_insert_rule() and expose the complete validated flags value. Put the ruleset and flags first as a common invocation prefix. This distinguishes duplicate and effective-zero additions without recovering arguments from saved syscall registers. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Fixes: 63747c94774d ("landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints") Fixes: 3f1f106e4c14 ("landlock: Add tracepoints for rule checking") Link: https://patch.msgid.link/20260918185036.608651-4-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Fix filesystem denial blocker reportingMickaël Salaün
Filesystem topology denials are rendered with an empty blockers value because their blocker is identified by the request type instead of an access mask. Introduce the private struct landlock_blockers to carry the request type and final missing access mask to filesystem and network denial tracepoints. Copy both members into named trace-record fields, then use the type to print change_topology for topology denials while preserving symbolic access masks for ordinary denials. The request type lets typed BPF consumers distinguish topology denials from access denials. Keeping the native access mask in a pointer-reached field also lets CO-RE adjust existing programs' load width if access_mask_t grows. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Fixes: 01ce260f5ccf ("landlock: Add landlock_deny_access_fs and landlock_deny_access_net") Link: https://patch.msgid.link/20260918185036.608651-3-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20landlock: Fix tracepoint fixed-width type namesMickaël Salaün
The new Landlock tracepoints use UAPI-prefixed __u32 and __u64 names for callback arguments and record fields, including internal IDs that are not Landlock UAPI values. Typed BPF consumers see callback typedef names through BTF. Use the kernel u32 and u64 aliases before release so the tracepoint contract does not present internal values as Landlock UAPI types. This changes BTF-visible typedef spelling but not integer widths, calling conventions, tracefs formats, or record layouts. Cc: Günther Noack <gnoack@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Link: https://patch.msgid.link/20260918185036.608651-2-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-20firewire: core: fulfill kerneldoc for address handlerTakashi Sakamoto
The callback for the address handler is now invoked in process context. Update the kerneldoc for the address handler accordingly. Link: https://lore.kernel.org/r/20260920083659.191855-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-09-19net: remove ndo_do_ioctl handlerArnd Bergmann
All of the references to the callback pointer are gone, so remove the pointer itself before we grow new references to it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260915211538.1519815-2-arnd@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-19ieee802154: avoid deprecated .ndo_do_ioctl callbackArnd Bergmann
The ieee802154 socket implementation is the last remaining caller of the netdevice ioctl callback. In order to completely remove this, add a custom pointer to the existing wpan_dev specific operations structure. Since that structure is currently only used to wrap the 'create' header operation, adjust the naming slightly to make this more generic. It would be a good idea to adjust the calling conventions and split the get/set operations into separate functions, but that can be a follow-up cleanup. For the moment, I kept the actual changes to a minimum to avoid regressions. Link: https://lore.kernel.org/all/20231011140225.253106-2-arnd@kernel.org/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260915211538.1519815-1-arnd@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-19vlan: require the MAC header to be present in __vlan_insert_inner_tag()Xiang Mei
__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(), never that mac_len bytes of MAC header are present. Its ETH_HLEN wrappers - __vlan_insert_tag() under skb_vlan_push(), and vlan_insert_tag() under validate_xmit_vlan() on the generic transmit path - therefore rewrite the first 16 bytes at skb->data: a 12-byte memmove plus two 2-byte stores at +12 and +14. No caller supplies the bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull(). An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a hwaccel tag; the next - clsact "action vlan push" or bpf_skb_vlan_push() - enters the helper with skb->len still 1. The head comes from skbuff_small_head without __GFP_ZERO, so each push drags bytes from beyond skb->tail into the frame. After three the one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised slab: 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81 `------------------------------' only 0x5a was sent; the rest is slab, here the top 56 bits of a linear-map address Require the MAC header the helper rewrites to be present, so such a frame is dropped rather than transmitted. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: co+0ea1ac045375cf05@bugs.sh Signed-off-by: Xiang Mei <xmei5@asu.edu> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260915083152.705309-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-19tick/nohz: Add BLOCK_SOFTIRQ to the hotplug safe maskWang Shuaiwei
During CPU-hotplug stress testing combined with an I/O workload, the following message is observed: "NOHZ tick-stop error: local softirq work is pending, handler #10!!!" On CPU offline, ksoftirqd is parked at CPUHP_AP_SMPBOOT_THREADS while the CPU still takes interrupts. A block completion raised after that point stays pending, and if the dying CPU goes idle before teardown, report_idle_softirq() sees it, keeps the tick alive and prints the error above. Such pending block completions on the outgoing CPU are drained later by blk_softirq_cpu_dead() (CPUHP_BLOCK_SOFTIRQ_DEAD), so a pending BLOCK_SOFTIRQ is harmless here. Add it to SOFTIRQ_HOTPLUG_SAFE_MASK like the other teardown-covered vectors. Signed-off-by: Wang Shuaiwei <wangshuaiwei1@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Link: https://patch.msgid.link/20260904064506.671203-1-wangshuaiwei1@xiaomi.com
2026-09-19drm/display: hdmi-state-helper: Add drm_atomic_helper_connector_hdmi_force_ctx()Cristian Ciocaltea
Introduce drm_atomic_helper_connector_hdmi_force_ctx() as the HDMI connector implementation of the .force_ctx() callback. It receives the modeset acquire context, allowing it to take additional locks, e.g. to support SCDC status synchronization. Since migrating from the .force() callback is somewhat more involved, its users will be migrated incrementally, after which drm_atomic_helper_connector_hdmi_force() will be removed. Reviewed-by: Maxime Ripard <mripard@kernel.org> Link: https://patch.msgid.link/20260901-dw-hdmi-qp-scramb-v11-22-bc12954a0688@collabora.com Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
2026-09-19drm/display: hdmi-state-helper: Pass acquire ctx to hotplug helpersCristian Ciocaltea
In preparation for supporting SCDC status synchronization on hotplug events, extend drm_atomic_helper_connector_hdmi_hotplug() and drm_atomic_helper_connector_hdmi_update() to take a struct drm_modeset_acquire_ctx argument. This will be used when a CRTC reset is required. Additionally, change their return type from void to int to allow propagation of errors such as -EDEADLK caused by lock contention. Update existing callers accordingly. Note that in the VC4 case, the return code is ignored, as it cannot fail: being in the .detect_ctx() call path, the connection mutex is already held through ctx, and it bails out early because the driver relies on a local SCDC state-management implementation, and therefore does not yet expose the scrambler capability through the common helpers. Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Reviewed-by: Maxime Ripard <mripard@kernel.org> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Link: https://patch.msgid.link/20260901-dw-hdmi-qp-scramb-v11-21-bc12954a0688@collabora.com Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>