summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-23rust: jump_label: skip arch-specific asm in `testlib` buildsFUJITA Tomonori
Running `make rusttest` with `ARCH=` set to an architecture other than the host's may fail in the future, e.g. `ARCH=arm64` on an x86_64 host: error: alignment must be a power of 2 --> rust/kernel/jump_label.rs:51:13 | 51 | include!(concat!(env!("OBJTREE"), "/rust/kernel/generated_arch_static_branch_asm.rs")); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | note: instantiated into assembly here --> <inline asm>:3:10 | 3 | .align 3 | ^ The reason is that `rusttest` builds the kernel crate as a host library: it passes the `CONFIG_*` cfgs of the configured architecture, but not `--target`, so code generation happens for the host. `arch_static_branch!` then selects the arch-specific inline asm arm based on CONFIG_*, and the host assembler rejects it. This does not happen with the current master because `arch_static_branch!` has no user inside the kernel crate itself yet, but fix it now to avoid surprises later. Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Link: https://patch.msgid.link/20260809134858.1219036-1-tomo@flapping.org [ Reworded slightly to clarify it "may fail in the future". - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-23objtool/rust: add one more `noreturn` Rust functionMiguel Ojeda
When the pointer formatting series [1] is applied and KUnit tests are enabled, `objtool` would report an error with any of our supported Rust versions. For instance, with Rust 1.97.1: rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_() falls through to next function _R..._4core7convert5AsRefNtB5_4BStrE6as_ref() Or, with Rust 1.85.0: rust/kernel.o: error: objtool: _R..._4core3fmt7Pointer3fmtB7_() falls through to next function _R..._4core3ffi5c_str4CStrENtNtBS_3fmt7Display3fmtB7_() This happens due to calls to the `noreturn` symbol: core::str::slice_error_fail Thus add the mangled one to the list so that `objtool` knows it is actually `noreturn`. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. [ While the series [1] mentioned above was not applied in a way that triggered this, Gary found another case [2]: I am seeing this function causing issue on my 1.85.1 -Os build, although the error message is different this time: rust/kernel.o: warning: objtool: _R..._5range9RangeFromjEE5indexCsldbe0TGTmNx_6kernel+0x1d: stack state mismatch: cfa1=4+8 cfa2=4+16 Disassembly shows that the function call before the warning location is a call to _4core3str16slice_error_fail, and objtool thought it can return (which will end up with a unbalanced stack if it does return). Thus apply it. - Miguel ] Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Reported-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/rust-for-linux/anLxXvCKBcAVf91_@google.com/ Link: https://lore.kernel.org/rust-for-linux/20260706-hashedptr-v13-0-377a07f2f78d@kylinos.cn/ [1] Link: https://lore.kernel.org/rust-for-linux/DKS7U9UHY6XR.2JC0EBIPCI06Z@garyguo.net/ [2] Link: https://patch.msgid.link/20260805144524.233362-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-23rust: kernel: list: fix incorrect pop_back example commentNikolai Grlica
The example uses pop_back(), but the accompanying comment says pop_front(). Update the comment to match the example. Signed-off-by: Nikolai Grlica <nikolai@nikolaigrlica.dev> Cc: stable@vger.kernel.org Fixes: bf87a41b85d6 ("rust: list: Add an example for `ListLinksSelfPtr` usage") Link: https://patch.msgid.link/20260810150322.61809-1-nikolai@nikolaigrlica.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-23rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCsLad Prabhakar
Add support for the RTC block found on the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. These SoCs integrate a closely related variant of the RZ/N1 RTC IP, but do not implement the RTCA0SUBU register. Use variant-specific match data to disable SUBU support for these SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-18-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Drop trailing comma from OF match table sentinelLad Prabhakar
Drop the trailing comma from the final empty entry in the RZN1 RTC OF match table and mark it explicitly as the sentinel. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-17-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Add OF match data to gate SUBU register accessLad Prabhakar
The RZ/N1 RTC driver selects SCMP mode only when an optional xtal clock is provided at a valid rate other than 32768 Hz. Without an xtal clock, or when it runs at 32768 Hz, the driver uses SUBU mode. However, the RTCA0SUBU register used by SUBU mode is not present on all SoCs that integrate a similar variant of the RTC block. Allowing SUBU mode on those variants would expose RTC offset operations that access a non-existent register. Add OF match data to describe whether the RTC supports the SUBU register. Reject probe with -EOPNOTSUPP when SUBU mode would be selected on a variant without SUBU support. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-16-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register accessLad Prabhakar
Replace open-coded shift and mask operations with the bitfield API. Note that the weekday field is changed from an explicit 0x0f mask to an 8-bit field definition, matching the hardware manual. This does not change behaviour, as valid weekday values cannot exceed 7. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-15-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Consistently use dev_err_probe()Lad Prabhakar
Use dev_err_probe() in the IRQ request error path to make error handling consistent with the rest of rzn1_rtc_probe(). Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-14-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Use temporary variable for struct deviceLad Prabhakar
Use a temporary variable for the struct device pointers to avoid dereferencing. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-13-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Dynamically calculate synchronization delay based on clock rateLad Prabhakar
Replace the hardcoded hardware synchronization delays with a calculated time window derived from the operating sub-clock frequency. The driver currently hardcodes microsecond ranges assuming a fixed sub-clock frequency of 32.768 kHz. Newer SoC variants, such as the RZ/T2H, drive this hardware block using a much faster clock rate (~195.3 kHz). Hardcoding these wait windows forces faster blocks to over-sleep, introducing unnecessary delays during clock initialization and register configuration. Calculate the duration of the required clock cycles in microseconds based on the runtime clock rate, and store this value in the driver private structure to adjust the usleep_range() and readl_poll_timeout() boundaries dynamically. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-12-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Replace remove callback with devm_add_action_or_reset()Lad Prabhakar
Simplify the driver teardown by registering a managed cleanup action with devm_add_action_or_reset(). This eliminates the explicit probe error path and allows the .remove() callback to be dropped. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-11-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Use pm_runtime_put_sync()Lad Prabhakar
pm_runtime_put() may trigger the idle check after pm_runtime_disable() is run as part of devm_pm_runtime_enable()'s cleanup action, leaving runtime PM active. Use pm_runtime_put_sync() to ensure the idle check runs synchronously. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-10-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESASLad Prabhakar
Replace the ARCH_RZN1 dependency with ARCH_RENESAS for the RTC_DRV_RZN1 config option to make the driver available across both ARM32 and ARM64 Renesas architectures. The newer RZ/T2H and RZ/N2H ARM64 SoCs integrate a closely related variant of the RTC IP block found on the RZ/N1 SoCs. Update the build dependency and expand the Kconfig help text to allow this driver to be selected for these additional platforms. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-9-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Fix malformed MODULE_AUTHOR stringLad Prabhakar
Fix a malformed MODULE_AUTHOR macro in the rtc-rzn1 driver where a missing closing angle bracket on the second author entry creates an invalid format. Correct it to the standard "Name <email>" format. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-8-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Disable alarm interrupt before reprogramming alarm registersLad Prabhakar
rzn1_rtc_set_alarm() updates RZN1_RTC_ALM, RZN1_RTC_ALH and RZN1_RTC_ALW using separate MMIO writes without first disabling the alarm interrupt. If a previous alarm is still enabled, the interrupt can fire while the alarm registers contain a mixture of old and newly written values. Fix this by disabling the alarm interrupt before reprogramming ALM, ALH and ALW with a call to rzn1_rtc_alarm_irq_enable(). Fixes: b5ad1bf00d2c4 ("rtc: rzn1: Add alarm support") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Fix alarm range check truncation on 32-bit systemsLad Prabhakar
alarm and farest were declared as unsigned long, but rtc_tm_to_time64() returns time64_t (s64). On 32-bit systems where unsigned long is 32 bits, the assignment silently truncates the upper 32 bits of the timestamp. Fix by declaring alarm and farest as time64_t and replacing time_after() with a direct signed comparison, which is correct for time64_t values that will never realistically overflow. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarmLad Prabhakar
RZN1_RTC_ALW is a weekday bitmask where bit N represents weekday N. When no alarm has been configured, the register has its power-on-reset value of zero. rzn1_rtc_read_alarm() uses fls() to convert the weekday bitmask into a weekday number. When RZN1_RTC_ALW is zero, fls(0) returns zero and fls(wday) - 1 evaluates to -1. This invalid weekday is then used to calculate the alarm date and can either leave tm_wday set to -1 or produce a fabricated alarm date. Treat a zero RZN1_RTC_ALW value as an unset alarm weekday and return without calculating the alarm date. Move reading RZN1_RTC_CTL1 before this check so that alrm->enabled is updated for both configured and unconfigured alarms. Fixes: b5ad1bf00d2c4 ("rtc: rzn1: Add alarm support") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Fix weekday underflow when alarm crosses month boundaryLad Prabhakar
rzn1_rtc_set_alarm() calculates the alarm weekday from the difference between the alarm day and the current day of the month. When the alarm crosses a month boundary, this difference can become negative. Since days_ahead is unsigned, it underflows and results in an incorrect weekday being programmed into RZN1_RTC_ALW. The RTC core already provides a fully populated struct rtc_time for the alarm, including the correct tm_wday. Use tm->tm_wday directly instead of recalculating the weekday from the day-of-month. This avoids the underflow and ensures alarms scheduled across a month boundary use the correct weekday. Fixes: b5ad1bf00d2c4 ("rtc: rzn1: Add alarm support") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23rtc: rzn1: Handle EPROBE_DEFER for optional pps interruptLad Prabhakar
Check for -EPROBE_DEFER from platform_get_irq_byname_optional() and handle the deferred probe request properly. Although the "pps" interrupt is optional, an error code of -EPROBE_DEFER indicates that the interrupt subsystem is not yet ready. Intercept this specific error condition, assign it to the return value, and jump to the dis_runtime_pm label to avoid ignoring a valid probe deferral. Fixes: eea7791e00f33 ("rtc: rzn1: implement one-second accuracy for alarms") Cc: stable@vger.kernel.org Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23dt-bindings: rtc: renesas,rzn1-rtc: Add RZ/T2H and RZ/N2H supportLad Prabhakar
Add compatible strings for the RTC block found on the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. These SoCs integrate a closely related variant of the RZ/N1 RTC IP. Unlike RZ/N1, they do not implement the RTCA0SUBU register. This is not a limitation for Linux support, as these registers are not used when the RTC operates in "scmp" clock mode, which is required on RZ/T2H and RZ/N2H due to their 195.3 kHz input clock. The RZ/T2H RTC variant also supports a 1Hz output signal on the RTCAT1HZ pin, controlled by the RTCA0CTL1[RTCA01HZE] bit. This bit is marked as reserved in the RZ/N1 hardware manual. Update the binding schema to require the additional clock inputs used by these SoCs. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20260821211032.13554-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-23Merge tag 'parisc-for-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture updates from Helge Deller: - Drop PER_HPUX personality from UAPI headers - Infinite loop fix when parsing IRQ value in eisa code - Switch to use asm-generic/serial.h - Prevent possible unaligned asm code in head.S * tag 'parisc-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: eisa: Fix infinite loop when parsing invalid IRQ value parisc: Fix alignment of asm statements in head.S parisc: eisa_eeprom: Add missing MODULE_DESCRIPTION() parisc: Use asm-generic/serial.h parisc: sba_iommu: Remove dead DEBUG_DMB_TRAP code UAPI: Drop PER_HPUX personality parisc: superio: Spelling s/Peterson/Petersen/
2026-08-23Merge tag 's390-7.3-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Vasily Gorbik: - Add a cpuidle driver with polling and enabled wait states using the existing CPU idle infrastructure and idle governor to improve latency for frequent sleep/wakeup cycles. Remove the obsolete tick delay heuristic and generic arch_needs_cpu() hook. Add the corresponding driver entry to MAINTAINERS - Add kCFI support using the generic support provided by Clang - Enable Clang CONTEXT_ANALYSIS for various architecture code and for char, PCI, CIO and virtio drivers. Add required lock annotations, exclude unsupported mm helpers and remove conditional PCI locking - Fix secure storage access exception handling and reintroduce DCACHE_WORD_ACCESS previously removed as a workaround - Fix cpum_cf perf crashes when CPUs are brought online while per-task events are active. Allocate and remove per-CPU counter data from CPU hotplug callbacks - Fix a deadlock when an s390dbf debug area is unregistered while one of its debugfs files is being written to - Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler macro silently omitted an instruction needed to repair interrupted operations after CPU migration - Remove/replace cond_resched() calls which are no-ops with the supported s390 preemption models - Fix AP queue depth and maximum message length decoding according to the architecture. Current hardware is not affected, but future hardware could report values which were handled incorrectly - Reflect the configured CPU state in cpu_enabled_mask so deconfigured CPUs are not presented as available for onlining - Restore the vDSO GNU_EH_FRAME program header which was lost when the build switched to direct linker invocation, and mark it read-only - Add SCLP action qualifiers used by Spyre for card initialization, recoverable error and telemetry reporting - Move KMSAN interrupt flag helpers out of line to fix -Wstatic-in-inline build warnings - Use level-specific page table entry accessors for hugetlb entries and ptep_get() when accessing crashed kernel memory in kdump - Make forced AP bus rescans killable so that a user process blocked behind an ongoing scan can still be terminated with SIGKILL - Rework pkey ioctl error paths to remove duplicated cleanup code and avoid freeing error pointers - Allow the protected guest SWIOTLB buffer to be allocated outside the first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic pool fallback to improve I/O behavior when the initial pool is exhausted - Add program check statistics and spinlock contention tracepoints. Increase the lockdep chain capacity to keep lockdep enabled for complex code paths such as btrfs - Simplify IPL, trap and syscall code and remove the obsolete unistd_32.h generation entry * tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits) s390/percpu: Fix MVIY_PERCPU() with older binutils s390/debug: Fix deadlock during unregister s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390: Enable CONTEXT_ANALYSIS for various directories s390/mm: Add __context_unsafe() attribute to gmap helper functions s390/mm: Add __context_unsafe() attribute to do_secure_storage_access() s390/sysinfo: Add context analysis attributes s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN s390/virtio: Enable CONTEXT_ANALYSIS s390/cio: Enable CONTEXT_ANALYSIS s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce() s390/pci: Enable CONTEXT_ANALYSIS s390/pci: Rework __zpci_event_availability() to remove conditional locking s390/pci: Rework __zpci_event_error() to remove conditional locking s390/char: Enable CONTEXT_ANALYSIS s390/con3215: Add __must_hold() attribute to raw3215_make_room() s390/ap: Fix MAPML computation s390/cio: Remove cond_resched() calls s390: Remove cond_resched() calls KVM: s390: Remove cond_resched() calls ...
2026-08-23drm/gud: validate GUD_ROTATION_0 is present in supported rotationsSajal Gupta
The rotation argument to drm_plane_create_rotation_property() is set to DRM_MODE_ROTATE_0, and the device reported rotation bitmask is used as the supported_rotations argument. The driver never validates that GUD_ROTATION_0 is present, so a device that omits it from its GUD_PROPERTY_ROTATION triggers the WARN_ON(rotation & ~supported_rotations) in drm_plane_create_rotation_property() Fix this by skipping the creation of rotation property if the device doesn't have the GUD_ROTATION_0 bit Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") Reported-by: syzbot+efe2810681f1b065d3a8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=efe2810681f1b065d3a8 Tested-by: syzbot+efe2810681f1b065d3a8@syzkaller.appspotmail.com Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com> Acked-by: Ruben Wauters <rubenru09@aol.com> Signed-off-by: Ruben Wauters <rubenru09@aol.com> Link: https://patch.msgid.link/20260821071812.16500-1-sajal2005gupta@gmail.com
2026-08-23Merge tag 'efi-next-for-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Set a timeout for EFI runtime service completions, and declare the firmware wedged if it is exceeded. Note that this requires special handling in case the firmware does return after all - Rate limit the efivarfs statfs() handler as the QueryVariableInfo() runtime service can be costly - Sanity check the size of struct properties_header on Mac/x86 - Tweak the prototype of efi_guid_to_str() * tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Rate limit statfs() handler efi: apple-properties: validate setup data header length efi: make efi_guid_to_str() take a const GUID pointer efi/runtime-wrappers: retire the worker if a wedged call ever returns efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths efi/runtime-wrappers: bound the wait for EFI runtime service calls efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work efi/runtime-wrappers: handle queue_work() failure with goto exit efi/runtime-wrappers: factor out efi_rts_park_worker() efi: fix stale reference to efi_recover_from_page_fault()
2026-08-23drm/gud: validate TV mode names before creating enum propertyTao Yu
The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data. Reported-by: syzbot+9ae8e7884e451eaed5b4@syzkaller.appspotmail.com Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") Signed-off-by: Tao Yu <tao1.yu@intel.com> Reviewed-by: Ruben Wauters <rubenru09@aol.com> Cc: <stable@vger.kernel.org> Signed-off-by: Ruben Wauters <rubenru09@aol.com> Link: https://patch.msgid.link/20260819072835.4074130-1-tao1.yu@intel.com
2026-08-23Merge tag 'liveupdate-v7.3-rc1-20260823' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull more liveupdate updates from Mike Rapoport: "Make boot time huge page allocation work nicely with kexec handover. Today allocation of gigantic pages in HugeTLB cannot work reliably with kexec handover (KHO): - HugeTLB allocates gigantic pages using memblock and autoscaling of KHO scratch accounts for these allocations. When gigantic pages occupy half of the memory of more, KHO fails to allocate its scratch memory. - After kexec handover, memblock allocations exclusively use KHO scratch that is not supposed to contain preserved memory. This essentially blocks preservation of HugeTLB with gigantic pages. Extend early memory pools available for KHO kernel with areas that are guaranteed not to contain preserved memory" * tag 'liveupdate-v7.3-rc1-20260823' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: (21 commits) kho: exclude hugetlb memory from scratch size calculation memblock: add memblock_reserved_hugetlb_size() memblock: make HugeTLB bootmem allocation work with KHO memblock: always include KHO headers kho: extend scratch mm/mm_init: don't rely on memblock to get KHO scratch migratetype kho: initialize preserved memory map radix tree earlier kho: initialize kho_scratch pointer earlier in boot kho: expose kho_scratch_overlap() to kexec_handover.h kho: add kho_radix_init_tree() kho: allow destroying KHO radix tree kho: allow early-boot usage of the KHO radix tree kho: add data argument to radix walk callback kho: add callback for table pages kho: add a struct for radix callbacks kho: move all memory retrieval logic to kho_mem_retrieve() kho: store incoming radix tree in kho_in kho: disallow wide keys in radix tree kho: make radix max key width more obvious kho: generalize radix tree APIs ...
2026-08-23Merge tag 'mtd/for-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "Raw NAND changes: - Sunxi: Support added for the H616 compatible - Qcom: Support added for the MDM9607 compatible - Support for the Toshiba TC58NVG1S3H part - GPMI: New debugfs entry to expose the chip geometry - PL353: Timing updates and software ECC support have been fixed SPI NAND changes: - fmsh: Support added for FM25G{01,02}B chips - HeYangTek: Support added for HYF1GQ4UDACAE Aside from these main changes, there is a high load of misc fixes and hardening changes, and exceptionally no SPI NOR change" * tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits) mtd: rawnand: sunxi: fix H6/H616 controller timings mtd: rawnand: sunxi: describe tADL and tWHR delays mtd: rawnand: sunxi: group controller delay tables mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP mtd: rawnand: gpmi: add debugfs entry for BCH geometry mtd: rawnand: validate ONFI extended parameter page sections mtd: rawnand: sunxi: add H616 MBUS DMA support mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd: mpc5121_nfc: use platform for irq and ioremap mtd: mtdoops: free page bitmap when the backing MTD is removed mtd: mtdswap: Avoid freeing registered blktrans device twice mtd: afs: validate v2 image info bounds mtd: intel-dg: Fix runtime PM error path in probe mtd: nand-omap2: Move omap_nand_ids[] to raw nand driver mtd: rawnand: add Toshiba TC58NVG1S3H mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() mtd: rawnand: qcom: Add MDM9607 compatible mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2 mtd: rawnand: qcom: Make "aon" clock optional ...
2026-08-23Merge tag 'ksmbd-for-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb Pull smb server updates from Namjae Jeon: "This contains server updates focused on SMB2 command sequencing, SMB3 request replay and encryption, Apple Time Machine interoperability, protocol-compatibility fixes validated with smbtorture, security hardening, SMB Direct transport support, connection reliability, and other correctness improvements. New features: - Implement the SMB2 command sequence window Enforce the credit-based MessageId range for each connection, rejecting out-of-window, duplicate, and wrapped sequence numbers. This prevents invalid requests and same-channel replays from being processed - Add SMB3 request replay support SMB3 clients may resend requests with SMB2_FLAGS_REPLAY_OPERATION after a channel disconnect when the original response was lost. Track the required channel and open state to safely handle durable CREATE replays and make oplock, lease, and lock replays idempotent, avoiding duplicate state changes and improving multichannel reconnect reliability - Add opt-in Apple Time Machine support Implement the AAPL negotiation and related Finder, stream, COPYCHUNK, sparse-file, CHANGE_NOTIFY, and RPC compatibility required for Time Machine shares, allowing macOS backupd to use ksmbd for backups - Add per-share SMB3 encryption support Allow individual shares to require SMB3 encryption by advertising SMB2_SHAREFLAG_ENCRYPT_DATA in TREE_CONNECT responses and rejecting unencrypted tree connects and plaintext requests for protected shares - Add SMB Direct RDMA encryption support Extend SMB Direct to support SMB3 encrypted payloads over RDMA, with transform negotiation and encryption/decryption for RDMA READ/WRITE Other changes: - Parse and retain AppInstanceVersion contexts, enforce version ordering, close older active handles for newer takeovers, and reject invalid or unversioned opens according to the SMB2 semantics - Accept durable reconnect requests that omit VolatileFileId when the persistent ID and reconnect context identify the handle, while continuing to reject explicit volatile-ID mismatches - Fix SMB2/SMB3 protocol validation and security issues, including request offsets, file and object IDs, IPC responses, output buffer sizes, SMB3.1.1 binding validation, signing-required handling, durable handles, ACLs, maximal access, and security information - Fix heap out-of-bounds accesses, use-after-free bugs, memory leaks, invalid pointer dereferences, and sensitive-data lifetime issues in authentication, Kerberos, preauthentication, sessions, connections, and module teardown - Correct alternate-data-stream and named-stream handling, COPYCHUNK behavior, sparse-file and compression attributes, allocated-range queries, file trimming, duplicate extents, DOS attributes, snapshots, normalized names, and partial information responses - Fix locking, lease, oplock, durable reconnect, async request, and CHANGE_NOTIFY races, including deferred-lock rollback, parent directory lease notifications, and connection teardown lifetime bugs - Fix SMB3 encryption handling for compressed requests, expired encrypted sessions, interim responses, bound multichannel connections, and decryption failures - Fix SMB3 multichannel session lookup and session state transitions so changes are scoped to the correct bound connections and cannot revive connections that are already shutting down - Fix DACL access checks so ACE walks are bounded by the declared DACL size, preventing data beyond the DACL boundary from being interpreted during access validation - Fix session accounting and lifetime issues, including session counter updates during publication and removal, session leaks on registration failure, and procfs creation diagnostics - Improve TCP connection reliability by enabling TCP keepalive for accepted connections and preserving TCP timers for kernel sockets, preventing silent peers from holding connections indefinitely - Fix smbdirect RDMA cleanup ordering for completion queues, QPs, child sockets, and listener locking - Improve async response framing, multi-iovec signing, RPC pipe status handling, and ksmbd procfs monitoring for server, share, connection, session, and open-file state - Remove the obsolete DES crypto header and Kconfig dependency now that NTLMv1 support has been removed - Update the ksmbd repository URL in MAINTAINERS and add an additional KSMBD reviewer" * tag 'ksmbd-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: (142 commits) MAINTAINERS: update ksmbd repository URL MAINTAINERS: add myself as KSMBD reviewer smb: server: remove unused DES crypto header smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file ksmbd: keep TCP timers alive for kernel sockets ksmbd: enable TCP keepalive for accepted connections smb/server: fix session counter on session removal smb/server: update session counter under sessions table lock smb/server: fix session leak in ksmbd_session_register() smb/server: warn if ksmbd_proc_create() fails ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size ksmbd: make RDMA encryption diagnostics conditional ksmbd: add SMB Direct RDMA encryption transform ksmbd: handle encrypted compressed requests ksmbd: decrypt requests from expired encrypted sessions ksmbd: disconnect on SMB3 decryption failure ksmbd: encrypt interim responses to encrypted requests ksmbd: scope session state changes to bound connections ksmbd: fix encrypted request lookup on bound channels ksmbd: add per-share SMB3 encryption enforcement ...
2026-08-23drm/gud: NUL-terminate TV mode names read from the deviceDeepanshu Kartikey
gud_connector_add_tv_mode() reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drm_mode_create_tv_properties_legacy(), which calls strlen() on each one. Nothing guarantees the device NUL-terminates a name, so strlen() can run past the end of a slot and, for the last mode, past the end of the allocation. Terminate each name at the end of its slot before use. Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") Reported-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=916c888ba5f1a54c9526 Tested-by: syzbot+916c888ba5f1a54c9526@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Acked-by: Ruben Wauters <rubenru09@aol.com> Cc: <stable@vger.kernel.org> Signed-off-by: Ruben Wauters <rubenru09@aol.com> Link: https://patch.msgid.link/20260816085234.22053-1-kartikey406@gmail.com
2026-08-23MAINTAINERS: update btrfs git tree entriesDavid Sterba
Add new entry pointing to the development branch so e.g. sashiko can pick it as the baseline. The other entry is for linux-next and slightly behind. Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-08-23Merge tag 'for-next-keys-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull TPM update from Jarkko Sakkinen: "Just a single bug fix" * tag 'for-next-keys-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: Fix TPM teardown ordering
2026-08-23Merge tag 'mm-nonmm-stable-2026-08-22-16-57' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam Vargas) Validate and bound all input lengths and count fields in the o2dlm migration and recovery receive handlers to prevent memory corruption and kernel panics from malformed cluster messages - "ocfs2: validate xattr entry bounds" (Cen Zhang) Validate OCFS2 extended attribute entry name and value bounds during metadata reads to prevent out-of-range memory accesses during retrieval or listing operations. - "taskstats: fix cgroupstats invalid fd handling and add selftests" (Yiyang Chen) Return -EBADF when cgroupstats receives an invalid file descriptor to prevent caller hangs and misleading success ACKs. Add a kselftest to validate valid cgroup v1 queries and verify proper error handling across different Netlink flag combinations. - "misc lib/raid/ improvements v2" (Christoph Hellwig) Improve benchmark-based algorithm selection for the XOR and RAID6 libraries, add KUnit benchmark tests, and cleanup minor implementation details. - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi) Fix sleeping-in-atomic, lock order inversion and error-path cleanup bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping configfs_depend_item() calls and using unlocked variants from callback context. Ensure failed pin attempts properly decrement user counts and unpin partially initialized heartbeat regions to prevent memory leaks and unprotected states. - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()" (Vincent Mailhol) Fix an off-by-one which could cause an out-of-bounds read. - "ocfs2: harden heartbeat teardown races" (Cen Zhang) Fix two OCFS2 heartbeat/o2net teardown races found by KASAN. - "taskstats: tidy up the cpumask command path" *Bradley Morgan) make two small cleanups in kernel/taskstats.c. - "ocfs2: validate active orphan slots during inode read" (ZhengYuan Huang) Validate active ordinary and append-DIO orphan slots read from OCFS2 dinodes at the metadata boundary to prevent corrupted slot indices from causing out-of-bounds array accesses. - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng) Enforce strict boundary checks on directory entry record lengths and offset calculations during OCFS2 directory re-scans to prevent out-of-bounds memory reads and directory position corruption. * tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (95 commits) mailmap: fix bouncing address for Taniya Das ocfs2: bound-check dir entries in the inline-data re-validation scan ocfs2: bound-check dir entries in the readdir re-validation scan squashfs: avoid thundering-herd cache wakeups prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator mailmap: update email address for Linfeng Sun lib/interval_tree: fix allocation warning messages checkpatch: add NOKPROBE_SYMBOL to the whitelist of lines that can occur immediately after functions Squashfs: check block offset is not negative signal: factor out the kernel reserved si_code check ocfs2: fix readdir position truncation on 32-bit kernels ocfs2: fix cached cluster count after suballocator reclaim ocfs2: fix circular locking dependency in ocfs2_init_acl() ocfs2: validate DIO orphan slot during inode read ocfs2: validate orphan slot during inode read selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test MAINTAINERS: add IRC and patchwork for LTP include/linux/list.h: mark list_add and __list_add as __always_inline tools/mm: prevent page_owner_sort from truncating input hung_task: update DETECT_HUNG_TASK_BLOCKER Kconfig help ...
2026-08-23Merge tag 'nand/for-7.3' into mtd/nextMiquel Raynal
* Raw NAND changes - Sunxi: Support added for the H616 compatible - Qcom: Support added for the MDM9607 compatible - Support for the Toshiba TC58NVG1S3H part - GPMI: New debugfs entry to expose the chip geometry - PL353: Timing updates and software ECC support have been fixed * SPI NAND changes - fmsh: Support added for FM25G{01,02}B chips - HeYangTek: Support added for HYF1GQ4UDACAE Aside from these main changes, there is the usual load of misc fixes and hardening changes.
2026-08-23ALSA: usb-audio: Add iD14 MkI to monitor-mix volume quirkWill Porter
Add the iD14 MkI USB ID to the existing audient_id14_map. This names feature unit 12 Monitor Mix Playback Volume. Live meter A/B testing on MkI USB ID 2708:0002 reproduced the same asymmetric attenuation seen on MkII. At ALSA value 104, the right channel was 23.07 dB below the left. At 127, both channels were equal. The misleading Speaker Playback Volume name causes PipeWire to adopt FU12 as the stream master. Reuse the existing map to keep the control available while preventing that selection. Hardware-tested on Bazzite 7.2.0-ogc4.1.fc44.x86_64 with this change backported. ALSA exposed Monitor Mix Playback Volume after module load and USB reconnect. PipeWire volume changes from 100% to 35% and back left all four FU12 values at 127. Channel-isolated left/right playback remained balanced after reconnect. Build-tested with CONFIG_SND_USB_AUDIO=m using the focused sound/usb target. Assisted-by: Codex:gpt-5 Signed-off-by: Will Porter <mrwillporter@gmail.com> Link: https://patch.msgid.link/20260823015353.686080-1-mrwillporter@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-23ALSA: usb-audio: Add quirk flags for Logitech PRO X WirelessRong Zhang
The Logitech PRO X Wireless is a wireless headset with a hotpluggable microphone. Its Playback mixer's GET_CUR somehow becomes broken when the microphone is detached, so set QUIRK_FLAG_MIXER_GET_CUR_OK to prevent the mixer behavior from depending on whether the microphone is attached. Meanwhile, the Playback mixer's minimum value doesn't work properly, thus set QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE to prevent userspace audio stack from using the minimum mixer value to tune volume (setting it when muted is OK). Reported-by: Alexander Niemeyer <adventureFAN@gmx.de> Closes: https://msgid.link/6262cbbd-d1f2-4c9d-a1c7-9c5d12636f4b@gmx.de Closes: https://msgid.link/7984832b-86f6-4934-bfc0-1ed70218973a@gmx.de Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-4-a8cbe572edff@rong.moe
2026-08-23ALSA: usb-audio: Reverse MIXER_GET_CUR_BROKEN as MIXER_GET_CUR_OKRong Zhang
The default behavior of sticky check now becomes what QUIRK_FLAG_MIXER_GET_CUR_BROKEN originally does, so the quirk flag is no longer needed. On some devices, whether their GET_CUR being sticky depends on whether hotpluggable components are present. When the hotpluggable components are missing on probe, their GET_CUR behavior is classified as broken. Therefore, reverse QUIRK_FLAG_MIXER_GET_CUR_BROKEN as QUIRK_FLAG_MIXER_GET_CUR_OK, so that it can be set to prevent the heuristics from gating GET_CUR. Note that even if the quirk flag is set, init_cur_mix_raw() should still initialize the mixer value to cval->min, otherwise restoring the bogus saved value on the first channel could lead to unbalanced channels. Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-3-a8cbe572edff@rong.moe
2026-08-23ALSA: usb-audio: Demote the severity of sticky GET_CURRong Zhang
Currently, a mixer is disabled when its GET_CUR is sticky, causing userspace to fall back to soft mixers, unless QUIRK_FLAG_MIXER_GET_CUR_BROKEN is set. This leads to issues on some wireless headphones with broken GET_CUR but effective SET_CUR, which use poorly-performed lossy codecs and are prone to audible distortion at low volume. They have to set the quirk flag to reeanble the mixer. Considering that users can always opt into soft mixers if they need it, i.e., when SET_CUR is stubbed, demote the severity of sticky GET_CUR by marking GET_CUR as broken and only provide mixer values from the cache. The mixer itself is still registered. Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-2-a8cbe572edff@rong.moe
2026-08-23ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_ALWAYS_SET_RATERong Zhang
QUIRK_FLAG_ALWAYS_SET_RATE was introduced into usb-audio before without appropriate documentation, so add it. There is an odd colon in its comments, so remove it too. As this is often forgotten, also add a reminder to the end of the enumeration. Fixes: 786f91da8535 ("ALSA: usb-audio: add QUIRK_FLAG_ALWAYS_SET_RATE for Mackie DLZ Creator XS") Signed-off-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260823-uac-demote-sticky-check-v1-1-a8cbe572edff@rong.moe
2026-08-23ALSA: usb-audio: Add quirk flags for SMSL USB DACEdward Blair
The SMSL USB DAC with USB ID 152a:85dd produces an audible pop when snd-usb-audio performs its redundant probe-time interface setup. It also pops when returning from runtime suspend. Skip the probe-time interface setup and disable runtime autosuspend for this device. Both flags have been verified through the quirk_flags module parameter. Keep QUIRK_FLAG_DSD_RAW in the device entry because the exact match takes precedence over the generic 0x152a vendor entry from which the device currently inherits that flag. Signed-off-by: Edward Blair <edward.blair@gmail.com> Link: https://patch.msgid.link/20260822114110.1069541-1-edward.blair@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-23ALSA: hda/realtek: Fix ALC700 audio on Intel Hades CanyonCsaba Budai
On Intel Hades Canyon systems with an ALC700 codec, analog audio can become unusable after rebooting from Windows into Linux. The affected system uses codec subsystem ID 8086:2073. In the broken state, Realtek coefficient 0x1b has value 0x4a4b. Setting bit 0x0400 changes it to 0x4e4b and immediately restores normal analog playback. The BIOS also sets this bit after disabling and re-enabling onboard audio, while Windows may leave it cleared. Linux currently does not restore it during codec initialization. Add a machine-specific fixup for Intel Hades Canyon which sets only bit 0x0400 of coefficient 0x1b during HDA_FIXUP_ACT_INIT. The fix has been verified across Windows -> Linux reboots on an Intel NUC8i7HNB with an ALC700 codec. Signed-off-by: Csaba Budai <ilyr73@gmail.com> Link: https://patch.msgid.link/20260821102514.11194-1-ilyr73@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-22Merge tag 'sched-urgent-2026-08-22' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Add missing cpus_read_lock locking to rebuild_sched_domains() (Sebastian Andrzej Siewior) - Fix division by zero bug in tg_cpus() that can be triggered with empty cpusets (Jake Steinman) * tag 'sched-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Floor tg_cpus() at 1 sched/topology: Add a cpus_read_lock to rebuild_sched_domains()
2026-08-22Merge tag 'locking-urgent-2026-08-22' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex fixes from Ingo Molnar: - Enforce that the private futex owner shares the mm when attaching (Kyle Zeng, Thomas Gleixner) - Fix race on the initial mm->futex.phash.ref allocation (Hyunwoo Kim) - Fix might_sleep() warning in futex_pivot_pending() (Peter Zijlstra) * tag 'locking-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Fix might_sleep() warning in futex_pivot_pending() futex: Fix race on the initial mm->futex.phash.ref allocation futex: Clean up the redundant exit/exec functions futex/pi: Plug private futex exec() race futex: Sanitize and document task_struct::futex::state transitions futex/pi: Reject cross-mm private futex owners
2026-08-22Merge tag 'irq-urgent-2026-08-22' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irqchip driver fixes from Ingo Molnar: - Fix potential loss of interrupt in the renesas-rzg2l irqchip driver (Biju Das) - Fix a series of mostly corner case & error handling bugs in the gic-v5 irqchip driver (Lorenzo Pieralisi) - Fix hardware probing on the ast2700-intc irqchip driver (Michael Pesa) - Fix endianness bug on the Realtek Interrupt Controller (Rustam Adilov) - Fix incorrect sleeping allocation in critical section in the ast2700-intc irqchip driver (Ryan Chen) - Fix two bugs in the GICv5 irqchip driver: clear IRQ affinity properly on teardown, and fix IRQ serialization bug on disabling the IRQ (Sascha Bischoff) * tag 'irq-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel() irqchip/gic-v5: Defer default SPI and LPI IAFFID programming irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation irqchip/gic-v5: Release IRS iomem region on driver init failure irqchip/gic-v5: Fix gicv5_init_common() error paths irqchip/gic-v5: Disable IRSes on probe failures irqchip/gic-v5: Check for NULL LPI domain on domain teardown irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing irqchip/gic-v5: Synchronize CPU interface disable irqchip/gic-v5: Clear per-CPU IRS data on teardown irqchip/ast2700-intc: Disable all interrupt merge banks on probe irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback irqchip/renesas-rzg2l: Fix loss of interrupt
2026-08-22Merge tags 'core-urgent-2026-08-22' and 'timers-urgent-2026-08-22' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix timer debugobjects state corruption on CPU offlining (Thomas Gleixner) - Fix ARM get_cycles() regression causing boot hangs on certain ARM configs (Nathan Chancellor) * tag 'core-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timer: Keep debugobjects state consistent in migrate_timer_list() * tag 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: ARM: Fix get_cycles() after delay_read_timer() conversion
2026-08-22Merge tag 'unicode-for-next-7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode Pull unicode updates from Gabriel Krisman Bertazi: "Two minor fixes: - Remove the normalization function that we no longer use (David Alan Gilbert)) - Fix a parsing issue in the encoding version argument passed by filesystems (me)" * tag 'unicode-for-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode: unicode: Properly reject invalid encoding version strings utf8: Remove unused utf8_normalize
2026-08-22tracing: Fix use-after-free in trace_pipe read on sub-buffer order changeDeepanshu Kartikey
Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() looks up an event under cpu_buffer->reader_lock but returns the event pointer after dropping the lock, and peek_next_entry() then calls ring_buffer_event_length() and ring_buffer_event_data() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: free_buffer_page kernel/trace/ring_buffer.c:398 [inline] ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. This is the lock trace_pipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260817140655.5694-1-kartikey406@gmail.com Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page") Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2 Tested-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com Reviewed-by: Bradley Morgan <include@grrlz.net> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-22tracing: Fix crash passing ERR_PTR to kthread_stop()Hui Su
event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()"). Cc: stable@vger.kernel.org Fixes: e6187007d6c3 ("tracing/events: add startup tests for events") Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com Signed-off-by: Hui Su <sh_def@163.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-22tracing: Fix use-after-free with same-name named triggersHui Su
When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data. Cc: stable@vger.kernel.org Fixes: 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") Link: https://patch.msgid.link/20260816100427.33642-3-sh_def@163.com Signed-off-by: Hui Su <sh_def@163.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-22net/sched: sch_cake: fix autorate reconfiguration throttlingGiuseppe Piscitelli
CAKE's autorate-ingress path intends to limit shaper reconfiguration to once per 250 ms, but last_reconfig_time is only checked and never updated. Since the field stays zero, every qualifying capacity-estimate window can call cake_reconfigure(), causing avoidable rate churn and scheduler work under bursty traffic. Store the current timestamp when autorate actually reconfigures the qdisc so the guard enforces the intended interval. Fixes: 7298de9cd725 ("sch_cake: Add ingress mode") Signed-off-by: Giuseppe Piscitelli <ooonea@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260820154503.892214-1-ooonea@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-22net: hibmcge: fix page_pool DMA direction mismatchJian Shen
The driver memsets the RX buffer page head to zero before submitting it to hardware, then calls dma_sync_single_for_device() with DMA_TO_DEVICE. This sync direction does not match the pool dma_dir which is DMA_FROM_DEVICE, violating the DMA API contract that the sync direction must match the mapping direction. On swiotlb platforms the mismatch can cause incorrect bounce-buffer behaviour, and CONFIG_DMA_API_DEBUG emits a warning. Switch the page_pool dma_dir to DMA_BIDIRECTIONAL so that the CPU-to-device memset sync becomes legal. Fixes: c30595917585 ("net: hibmcge: add support for pagepool on rx") Signed-off-by: Jian Shen <shenjian15@huawei.com> Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260820124346.4097115-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-08 17:59:57 +0000