summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-29gpu: nova-core: fw: move appropriate code into pin initializerDanilo Krummrich
Relocate the code that technically fits in the pin initializer into the initializer itself. While, thanks to pin_init_scope(), it is also possible to keep it as is, moving appropriate code into the initializer has the advantage that it structures the dependencies of fields naturally. For instance, intermediate data that is only needed for a single field goes into the initializer block of this field, making it obvious that it is not needed by anything else. On the other hand, intermediate data that is needed for multiple fields to initialize remains above the initializer, naturally indicating that it is needed my multiple fields. Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Link: https://patch.msgid.link/20251218155239.25243-3-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29gpu: nova-core: fw: get rid of redundant Result in GspFirmware::new()Danilo Krummrich
In GspFirmware::new(), utilize pin_init_scope() to get rid of the Result in the returned Result<impl PinInit<T, Error>> which is unnecessarily redundant. Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com> Link: https://patch.msgid.link/20251218155239.25243-2-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29PCI: endpoint: Add missing NULL check for alloc_workqueue()Haotian Zhang
alloc_workqueue() can return NULL on memory allocation failure. Without proper error checking, this may lead to a NULL pointer dereference when queue_work() is later called with the NULL workqueue pointer in epf_ntb_epc_init(). Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on failure to prevent the driver from loading with an invalid workqueue pointer. Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Fixes: 8b821cf76150 ("PCI: endpoint: Add EP function driver to provide NTB functionality") Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251110040446.2065-1-vulab@iscas.ac.cn
2025-12-29net: stmmac: fix the crash issue for zero copy XDP_TX actionWei Fang
There is a crash issue when running zero copy XDP_TX action, the crash log is shown below. [ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcache_clean_poc+0x20/0x38 (P) [ 216.308308] __dma_sync_single_for_device+0x1bc/0x1e0 [ 216.313351] stmmac_xdp_xmit_xdpf+0x354/0x400 [ 216.317701] __stmmac_xdp_run_prog+0x164/0x368 [ 216.322139] stmmac_napi_poll_rxtx+0xba8/0xf00 [ 216.326576] __napi_poll+0x40/0x218 [ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt For XDP_TX action, the xdp_buff is converted to xdp_frame by xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame depends on the memory type of the xdp_buff. For page pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy XSK pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the memory type and always uses the page pool type, this leads to invalid mappings and causes the crash. Therefore, check the xdp_buff memory type in stmmac_xdp_xmit_back() to fix this issue. Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Hariprasad Kelam <hkelam@marvell.com> Link: https://patch.msgid.link/20251204071332.1907111-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29PCI: endpoint: Replace use of system_wq with system_percpu_wqMarco Crivellari
Currently work items enqueued by schedule_delayed_work() use "system_wq" (a per-CPU wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a CPU is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Replace system_wq with system_percpu_wq, keeping the same behavior. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251105151649.256274-1-marco.crivellari@suse.com
2025-12-29PCI: Add WQ_PERCPU to alloc_workqueue() usersMarco Crivellari
Currently work items enqueued by schedule_delayed_work() use "system_wq" (a per-CPU wq), while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a CPU is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they're needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue() flag in: 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Add WQ_PERCPU to explicitly request alloc_workqueue() to be per-CPU when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn't explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> [bhelgaas: squash similar commits] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251107142526.234685-1-marco.crivellari@suse.com Link: https://patch.msgid.link/20251107142835.237636-1-marco.crivellari@suse.com Link: https://patch.msgid.link/20251107143108.240025-1-marco.crivellari@suse.com Link: https://patch.msgid.link/20251107143335.242342-1-marco.crivellari@suse.com Link: https://patch.msgid.link/20251107143624.244978-1-marco.crivellari@suse.com
2025-12-29Merge tag 'wireless-2025-12-17' of ↵Paolo Abeni
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Various fixes all over, most are recent regressions but also some long-standing issues: - cfg80211: - fix an issue with overly long SSIDs - mac80211: - long-standing beacon protection issue on some devices - for for a multi-BSSID AP-side issue - fix a syzbot warning on OCB (not really used in practice) - remove WARN on connections using disabled channels, as that can happen due to changes in the disable flag - fix monitor mode list iteration - iwlwifi: - fix firmware loading on certain (really old) devices - add settime64 to PTP clock to avoid a warning and clock registration failure, but it's not actually supported - rtw88: - remove WQ_UNBOUND since it broke USB adapters (because it can't be used with WQ_BH) - fix SDIO issues with certain devices - rtl8192cu: fix TID array out-of-bounds (since 6.9) - wlcore (TI): add missing skb push headroom increase * tag 'wireless-2025-12-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP wifi: iwlwifi: Fix firmware version handling wifi: mac80211: ocb: skip rx_no_sta when interface is not joined wifi: mac80211: do not use old MBSSID elements wifi: mac80211: don't WARN for connections on invalid channels wifi: wlcore: ensure skb headroom before skb_push wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor() wifi: mac80211: Discard Beacon frames to non-broadcast address Revert "wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users" wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() wifi: rtw88: limit indirect IO under powered off for RTL8822CS ==================== Link: https://patch.msgid.link/20251217201441.59876-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"Anshumali Gaur
This patch ensures that the RX ring size (rx_pending) is not set below the permitted length. This avoids UBSAN shift-out-of-bounds errors when users passes small or zero ring sizes via ethtool -G. Fixes: d45d8979840d ("octeontx2-pf: Add basic ethtool support") Signed-off-by: Anshumali Gaur <agaur@marvell.com> Link: https://patch.msgid.link/20251219062226.524844-1-agaur@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29platform/x86: asus-armoury: fix ppt data for FA507RDenis Benato
PPT data for FA507R was reported to be wrong by a user: change limits to make them equal to Armoury Crate limits. Fixes: 39ae6c50e599 ("platform/x86: asus-armoury: add ppt_* and nv_* tuning knobs") Signed-off-by: Denis Benato <denis.benato@linux.dev> Link: https://patch.msgid.link/20251229150755.1351495-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29Documentation/x86: Fix PR_SET_SPECULATION_CTRL error codesBrendan Jackman
If you force-disable mitigations on the kernel cmdline, for SPEC_STORE_BYPASS this ends up with the prctl returning -ENXIO, but contrary to the current docs for the other controls it returns -EPERM. Fix that. Note that this return value should probably be considered a bug. But, making the behaviour consistent with the current docs seems more likely to break existing users than help anyone out in practice, so just "fix" it by specifying it as correct. Since this is getting more wordy and confusing, also be more explicit about "control is not possible" be mentioning the boot configuration, to better distinguish this case conceptually from the FORCE_DISABLE failure mode. Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20251111-b4-prctl-docs-2-v2-1-bc9d14ec9662@google.com
2025-12-29platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probeAlok Tiwari
The PMT feature probe creates a child device with device_create(). If device creation fail, the code pass priv->dev (which is an ERR_PTR) to dev_err_probe(), which is not a valid device pointer. This patch change the dev_err_probe() call to use the parent auxiliary device (&auxdev->dev) and update the error message to reference the parent device name. It ensure correct error reporting and avoid passing an invalid device pointer. Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Link: https://patch.msgid.link/20251224095133.115678-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29landlock: Improve the comment for domain_is_scopedTingmao Wang
Currently it is not obvious what "scoped" mean, and the fact that the function returns true when access should be denied is slightly surprising and in need of documentation. Cc: Tahera Fahimi <fahimitahera@gmail.com> Signed-off-by: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/06393bc18aee5bc278df5ef31c64a05b742ebc10.1766885035.git.m@maowtm.org [mic: Fix formatting and improve consistency] Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29selftests/landlock: Use scoped_base_variants.h for ptrace_testTingmao Wang
ptrace_test.c currently contains a duplicated version of the scoped_domains fixture variants. This patch removes that and make it use the shared scoped_base_variants.h instead, like in scoped_abstract_unix_test and scoped_signal_test. This required renaming the hierarchy fixture to scoped_domains, but the test is otherwise the same. Cc: Tahera Fahimi <fahimitahera@gmail.com> Signed-off-by: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/48148f0134f95f819a25277486a875a6fd88ecf9.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29selftests/landlock: Fix missing semicolonTingmao Wang
Add missing semicolon after EXPECT_EQ(0, close(stream_server_child)) in the scoped_vs_unscoped test. I suspect currently it's just not executing the close statement after the line, but this causes no observable difference. Fixes: fefcf0f7cf47 ("selftests/landlock: Test abstract UNIX socket scoping") Cc: Tahera Fahimi <fahimitahera@gmail.com> Signed-off-by: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/d9e968e4cd4ecc9bf487593d7b7220bffbb3b5f5.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29selftests/landlock: Fix typo in fs_testTingmao Wang
Signed-off-by: Tingmao Wang <m@maowtm.org> Link: https://lore.kernel.org/r/62d18e06eeb26f62bc49d24c4467b3793c5ba32b.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29landlock: Optimize stack usage when !CONFIG_AUDITMickaël Salaün
Until now, each landlock_request struct were allocated on the stack, even if not really used, because is_access_to_paths_allowed() unconditionally modified the passed references. Even if the changed landlock_request variables are not used, the compiler is not smart enough to detect this case. To avoid this issue, explicitly disable the related code when CONFIG_AUDIT is not set, which enables elision of log_request_parent* and associated caller's stack variables thanks to dead code elimination. This makes it possible to reduce the stack frame by 32 bytes for the path_link and path_rename hooks, and by 20 bytes for most other filesystem hooks. Here is a summary of scripts/stackdelta before and after this change when CONFIG_AUDIT is disabled: current_check_refer_path 560 320 -240 current_check_access_path 328 184 -144 hook_file_open 328 184 -144 is_access_to_paths_allowed 376 360 -16 Also, add extra pointer checks to be more future-proof. Cc: Günther Noack <gnoack@google.com> Reported-by: Tingmao Wang <m@maowtm.org> Closes: https://lore.kernel.org/r/eb86863b-53b0-460b-b223-84dd31d765b9@maowtm.org Fixes: 2fc80c69df82 ("landlock: Log file-related denials") Link: https://lore.kernel.org/r/20251219142302.744917-2-mic@digikod.net Reviewed-by: Günther Noack <gnoack3000@gmail.com> [mic: Improve stack usage measurement accuracy with scripts/stackdelta] Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29null_blk: Constify struct configfs_item_operations and configfs_group_operationsChristophe JAILLET
'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 100263 37808 2752 140823 22617 drivers/block/null_blk/main.o After: ===== text data bss dec hex filename 100423 37648 2752 140823 22617 drivers/block/null_blk/main.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-29drm/nova: Align GEM memory allocation to system page sizeBrendan Shephard
Use page::page_align for GEM object memory allocation to ensure the allocation is page aligned. This is important on systems where the default page size is not 4k. Such as 16k or 64k aarch64 systems. This change uses the updated page_align() function which returns Option<usize> for overflow safety. (See "rust: Return Option from page_align and ensure no usize overflow"). Signed-off-by: Brendan Shephard <bshephar@bne-home.net> Link: https://patch.msgid.link/20251215083416.266469-1-bshephar@bne-home.net [ Import page module only. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29rust: Return Option from page_align and ensure no usize overflowBrendan Shephard
Change `page_align()` to return `Option<usize>` to allow validation of the provided `addr` value. This ensures that any value that is within one `PAGE_SIZE` of `usize::MAX` will not panic, and instead returns `None` to indicate overflow. Signed-off-by: Brendan Shephard <bshephar@bne-home.net> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Link: https://patch.msgid.link/20251223055647.9761-1-bshephar@bne-home.net [ Use kernel vertical style for imports; use markdown in comments. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29RAS/AMD/ATL: Remove an unneeded semicolonChen Ni
Remove an unneeded semicolon. No functional changes. Detected by Coccinelle. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20240701072118.846277-1-nichen@iscas.ac.cn
2025-12-29PCI: dwc: Use cfg0_base as iMSI-RX target address to support 32-bit MSI devicesShawn Lin
commit f3a296405b6e ("PCI: dwc: Strengthen the MSI address allocation logic") strengthened the iMSI-RX target address allocation logic to handle 64-bit addresses for platforms without 32-bit DMA addresses. However, it still left 32-bit MSI capable endpoints (EPs) non-functional on such platforms. Per DWC databook r6.21a, sec 3.10.2.3, it states: "The iMSI-RX is programmed with an address (MSI_CTRL_ADDR_OFF and MSI_CTRL_UPPER_ADDR_OFF) that is used as the system MSI address. When an inbound MWr request is passed to the AXI bridge and matches this address as well as the conditions specified for an MSI memory write request, an MSI interrupt is detected. When this MWr is about to be driven onto the AXI bridge master interface1, it is dropped and never appears on the AXI bus." Since iMSI-RX MSI_CTRL_ADDR doesn't require actual system memory mapping, any 32-bit address that won't be used for BAR memory allocations can be assigned. So assign cfg0_base to the iMSI-RX target address as the first option if it's a 32-bit address, which satisfies this requirement. Otherwise, fallback to the existing coherent allocation. cc: Ajay Agarwal <ajayagarwal@google.com> cc: Will McVicker <willmcvicker@google.com> Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> [mani: trimmed the description to exclude testbed info and used imperative tone] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/1766540332-24235-1-git-send-email-shawn.lin@rock-chips.com
2025-12-29auxdisplay: arm-charlcd: Remove redundant ternary operatorsAndy Shevchenko
For ternary operators in the form of a ? true : false, if a itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29auxdisplay: arm-charlcd: Join string literals backAndy Shevchenko
For easy grepping on debug purposes join string literals back in the messages. No functional change. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29auxdisplay: arm-charlcd: Use readl_poll_timeoutAndy Shevchenko
Use readl_poll_timeout_atomic() from <iopoll.h> instead of using custom poll loops. The timeout settings are different, but that shouldn't be much of a problem. Instead of polling 10 times in a close loop, it polls for one millisecond. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29auxdisplay: arm-charlcd: Don't use "proxy" headersAndy Shevchenko
Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29auxdisplay: arm-charlcd: drop of_match_ptr()Andy Shevchenko
The general recommendation is to not use of_match_ptr(). Drop it. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsingJunrui Luo
The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities. These functions parse ACPI packages into internal data structures using a for loop with index variable 'elem' that iterates through enum_obj/integer_obj/order_obj/password_obj/string_obj arrays. When processing multi-element fields like PREREQUISITES and ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array elements using expressions like 'enum_obj[elem + reqs]' and 'enum_obj[elem + pos_values]' within nested loops. The bug is that the bounds check only validated elem, but did not consider the additional offset when accessing elem + reqs or elem + pos_values. The fix changes the bounds check to validate the actual accessed index. Reported-by: Yuhao Jiang <danisjiang@gmail.com> Reported-by: Junrui Luo <moonafterrain@outlook.com> Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes") Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29fs/ntfs3: implement iomap-based file operationsKonstantin Komarov
This patch modifies the ntfs3 driver by replacing the buffer_head-based operations with the iomap ones. Implementation details: - Implements core iomap operations (ntfs_iomap_begin/end) for block mapping: Proper handling of resident attributes via IOMAP_INLINE. Support for sparse files through IOMAP_HOLE semantics. Correct unwritten extent handling for zeroing operations. - Replaces custom implementations with standardized iomap helpers: Converts buffered reads to use iomap_read_folio and iomap_readahead. Implements iomap_file_buffered_write for write operations. Uses iomap_dio_rw for direct I/O paths. Migrates zero range operations to iomap_zero_range. - Preserves special handling paths for compressed files - Implements proper EOF/valid data size management during writes Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: fix deadlock in ni_read_folio_cmprSzymon Wilczek
Syzbot reported a task hung in ni_readpage_cmpr (now ni_read_folio_cmpr). This is caused by a lock inversion deadlock involving the inode mutex (ni_lock) and page locks. Scenario: 1. Task A enters ntfs_read_folio() for page X. It acquires ni_lock. 2. Task A calls ni_read_folio_cmpr(), which attempts to lock all pages in the compressed frame (including page Y). 3. Concurrently, Task B (e.g., via readahead) has locked page Y and calls ntfs_read_folio(). 4. Task B waits for ni_lock (held by A). 5. Task A waits for page Y lock (held by B). -> DEADLOCK. The fix is to restructure locking: do not take ni_lock in ntfs_read_folio(). Instead, acquire ni_lock inside ni_read_folio_cmpr() ONLY AFTER all required page locks for the frame have been successfully acquired. This restores the correct lock ordering (Page Lock -> ni_lock) consistent with VFS. Reported-by: syzbot+5af33dd272b913b65880@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5af33dd272b913b65880 Fixes: f35590ee26f5 ("fs/ntfs3: remove ntfs_bio_pages and use page cache for compressed I/O") Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com> [almaz.alexandrovich@paragon-software.com: ni_readpage_cmpr was renamed to ni_read_folio_cmpr] Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runsKonstantin Komarov
The generic llseek implementation does not understand ntfs data runs, sparse regions, or compression semantics, and therefore cannot correctly locate data or holes in files. Add a filesystem-specific llseek handler that scans attribute data runs to find the next data or hole starting at the given offset. Handle resident attributes, sparse runs, compressed holes, and the implicit hole at end-of-file. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()Konstantin Komarov
Handle ntfs_read_folio() early when the folio offset is beyond i_valid by zero-filling the folio and marking it uptodate. This avoids needless I/O and locking, improves read performance. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: handle attr_set_size() errors when truncating filesKonstantin Komarov
If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: drop preallocated clusters for sparse and compressed filesKonstantin Komarov
Do not keep preallocated clusters for sparsed and compressed files. Preserving preallocation in these cases causes fsx failures when running with sparse files and preallocation enabled. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29fs/ntfs3: fsync files by syncing parent inodesKonstantin Komarov
Some xfstests expect fsync() on a file or directory to also persist directory metadata up the parent chain. Using generic_file_fsync() is not sufficient for ntfs, because parent directories are not explicitly written out. Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()Chris J Arges
KASAN reported a stack-out-of-bounds access in ima_appraise_measurement from is_bprm_creds_for_exec: BUG: KASAN: stack-out-of-bounds in ima_appraise_measurement+0x12dc/0x16a0 Read of size 1 at addr ffffc9000160f940 by task sudo/550 The buggy address belongs to stack of task sudo/550 and is located at offset 24 in frame: ima_appraise_measurement+0x0/0x16a0 This frame has 2 objects: [48, 56) 'file' [80, 148) 'hash' This is caused by using container_of on the *file pointer. This offset calculation is what triggers the stack-out-of-bounds error. In order to fix this, pass in a bprm_is_check boolean which can be set depending on how process_measurement is called. If the caller has a linux_binprm pointer and the function is BPRM_CHECK we can determine is_check and set it then. Otherwise set it to false. Fixes: 95b3cdafd7cb7 ("ima: instantiate the bprm_creds_for_exec() hook") Signed-off-by: Chris J Arges <carges@cloudflare.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2025-12-29auxdisplay: arm-charlcd: Remove unneeded info messageAndy Shevchenko
When probe succeeds we have other means to check if it was successful, no need to pollute kernel log with the practically duplicated info. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29auxdisplay: arm-charlcd: convert to use device managed APIsAndy Shevchenko
The current probe function of the driver is implemented by using plain old APIs. As Geert noted, one of the error paths has a mistake that may lead to a wrong call. Instead of targeting that particular issue, convert the driver to use device managed APIs altogether. It's not needed per se (driver can never be removed once loaded), but it simplifies coding and error handling. Reported-by: Geert Uytterhoeven <geert@linux-m68k.org> Closes: https://lore.kernel.org/r/CAMuHMdVquNEoxRQkcBEH0nC+CDuib6o0H6m3CBk3ZN2267LpQw@mail.gmail.com Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29arm64: dts: imx93-14x14-evk: Add audio XCVR sound cardChancel Liu
Add audio XCVR sound card, which supports SPDIF TX & RX only, eARC RX, ARC RX are not supported. Signed-off-by: Chancel Liu <chancel.liu@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx93-14x14-evk: Add bt-sco sound card supportChancel Liu
Add bt-sco sound card, which is used by BT HFP case. It supports wb profile as default. Signed-off-by: Chancel Liu <chancel.liu@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label positionVitor Soares
Fix the SMARC_SDIO_WP gpio-line-name position. It should be on line 15 of som_gpio_expander_1, not line 17. Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 ↵Vitor Soares
interrupt Change the PHY interrupt trigger type from IRQ_TYPE_LEVEL_LOW to IRQ_TYPE_EDGE_FALLING to match the PCA9745 GPIO expander hardware capabilities and avoid emulated level detection. Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") Signed-off-by: Vitor Soares <vitor.soares@toradex.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29ARM: multi_v7_defconfig: enable DA9052 and MC13XXXDmitry Baryshkov
Enable PMICs used on i.MX53 Quick-Start Boards: DA9052 for i.MX53 QSB and MC13XXX for i.MX53 QSRB (it has Freescale MC34708 PMIC). Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29rust: device_id: replace incorrect word in safety documentationYilin Chen
The safety documentation incorrectly refers to `RawDeviceId` when transmuting to `RawType`. This fixes the documentation to correctly indicate that implementers must ensure layout compatibility with `RawType`, not `RawDeviceId`. Fixes: 9b90864bb42b ("rust: implement `IdArray`, `IdTable` and `RawDeviceId`") Signed-off-by: Yilin Chen <1479826151@qq.com> Link: https://patch.msgid.link/tencent_C18DD5047749311142ED455779C7CCCF3A08@qq.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29arm64: dts: imx8ulp: add sim lpav nodeLaurentiu Mihalcea
Add DT node for the SIM LPAV module. Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx943-evk: add flexcan supportHaibo Chen
Add flexcan2 and flexcan4, and related phys support. Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx8mm: Add label to thermal-zonesDaniel Schultz
Add 'thermal_zones' as a label to the thermal-zones node. Without this label, it is not possible to add additional trip points in board files. For example, to add an active trip point for controlling a fan. Signed-off-by: Daniel Schultz <d.schultz@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: add support for NXP i.MX8MP FRDM boardRogerio Pimentel
The FRDM-i.MX8MP is an NXP development platform based on the i.MX8M Plus SoC, featuring a quad Cortex-A53, Cortex-M7 co-processor, 4GB LPDDR4, 32GB eMMC, Wi-Fi 6/Bluetooth 5.4/802.15.4 tri-radio, Ethernet, HDMI/MIPI display interfaces, camera connectors, and standard expansion headers. Based on the device tree found in the NXP repository at github https://github.com/nxp-imx-support/meta-imx-frdm and on imx8mp-evk board kernel mainline device tree. This is a basic device tree supporting: - Quad Cortex-A53 - 4GB LPDDR4 DRAM - PCA9450C PMIC with regulators - Two NXP PCAL6416 GPIO expanders - RGB LEDs via GPIO expander - I2C1, I2C2, I2C3 controllers - UART2 (console) and UART3 (with RTS/CTS) - USDHC3 (8-bit eMMC) - SNVS power key (onboard power button) Co-developed-by: Xiaofeng Wei <xiaofeng.wei@nxp.com> Signed-off-by: Xiaofeng Wei <xiaofeng.wei@nxp.com> Signed-off-by: Rogerio Pimentel <rpimentel.silva@gmail.com> Acked-by: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: tqma8xxs-mb-smarc-2: replace 0 with IMX_LPCG_CLK_0 for lpcg indicesAlexander Stein
Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the numerical value is identical, the LPCG input is defined as IMX_LPCG_CLK_<n>, so using the symbolic constant improves clarity and consistency with the LPCG clock naming convention. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: tqma8xxs: replace 0 with IMX_LPCG_CLK_0 for lpcg indicesAlexander Stein
Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the numerical value is identical, the LPCG input is defined as IMX_LPCG_CLK_<n>, so using the symbolic constant improves clarity and consistency with the LPCG clock naming convention. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx8qxp-mek: Add sensors under i2c1 busFrank Li
Add sensors under i2c1 bus. Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>