summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-29Merge 6.19-rc3 into usb-nextGreg Kroah-Hartman
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-29dt-bindings: arm: fsl: add TQ-Systems boards MBLS1028A and MBLS1028A-INDMatthias Schiffer
Add two mainboards for the TQ-Systems TQMLS1028A SoM, based on the NXP Layerscape LS1028A. Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: ls1028a: Add mbls1028a and mbls1028a-ind devicetreesGregor Herburger
Add device trees for the MBLS1028A and the MBLS1028A-IND and the SoM TQMLS1028A. Signed-off-by: Gregor Herburger <gregor.herburger@tq-group.com> Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29drm/i915/vdsc: Account for DSC slice overhead in intel_vdsc_min_cdclk()Ankit Nautiyal
When DSC is enabled on a pipe, the pipe pixel rate input to the CDCLK frequency and pipe joining calculation needs an adjustment to account for compression overhead "bubbles" added at each horizontal slice boundary. Account for this overhead while computing min cdclk required for DSC. v2: - Get rid of the scaling factor and return unchanged pixel-rate instead of 0. v3: - Use mul_u32_u32() for the bubble-adjusted pixel rate to avoid 64x64 multiplication and drop redundant casts in DIV_ROUND_UP_ULL(). (Imre) Bspec:68912 Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20251223150826.2591182-1-ankit.k.nautiyal@intel.com
2025-12-29arm64: dts: imx8mp libra: add peb-av-10 expansion board overlayYashwanth Varakala
Add an overlay of expansion board (PEB-AV-10) that supports multimedia interfaces, 3.5mm headphone jack, a USB-A port and LVDS, backlight connectors can be connected to the imx8mp libra. Audio works when no display is connected to expansion board. A separate overlay for Powertip display, based on peb-av-10.dtsi and intended for use with PEB-AV-10 expansion board, will be added later as display support is not yet available. Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx8mp libra: add and update display overlaysYashwanth Varakala
Add imx8mp-libra-rdk-fpsc-lvds-ph128800t006-zhc01.dtso devicetree display overlay for the i.MX8MP Libra RDK platform. The overlay enable LVDS display configuration. To keep the consistent style of panel and backlight nodes and labels. They are updated in imx8mp-libra base board devicetree and etml1010g3dra display overlay. Signed-off-by: Yashwanth Varakala <y.varakala@phytec.de> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx943-evk: add ENETC, EMDIO and PTP Timer supportWei Fang
Add ENETC instance 1~3, EMDIO and PTP Timer 0~1 support. The EMDIO provides MDIO bus for ENETCs to access their external PHYs. The PTP Timer provides current time with nanosecond resolution, precise periodic pulse, pulse on timeout, and time capture on external pulse support. It also provides PTP clock for ENETCs to implement time synchronization as required for IEEE 1588 and IEEE 802.1AS-2020. Signed-off-by: Wei Fang <wei.fang@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx94: add basic NETC related nodesWei Fang
The NETC related nodes for i.MX94, this NETC has two PCIe buses, the bus 0 has 1 ENETC instance, one PTP timer, one RCEC and a switch, currently, the switch is not added due to the DT binding and the driver is not ready at the moment. The bus 1 has three ENETC instances, 2 PTP timers, 1 RCEC and one EMDIO. Signed-off-by: Wei Fang <wei.fang@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx8dxl-ss-ddr: Add DB (system interconnects) pmu support for ↵Jacky Bai
i.MX8DXL Add DB pmu related nodes. This pmu is in DB (system interconnects). Signed-off-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29arm64: dts: imx8qm: add ddr perf device nodeFrank Li
Add ddr perf monitor device node for i.MX8QM. Change imx8-ss-ddr.dtsi's compatible string to fsl,imx8qxp-ddr-pmu. i.MX8QM overwrite to fsl,imx8qm-ddr-pmu. All fallback to fsl,imx8-ddr-pmu. Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-28Merge tag 'sched_ext-for-6.19-rc3-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix uninitialized @ret on alloc_percpu() failure leading to ERR_PTR(0) - Fix PREEMPT_RT warning when bypass load balancer sends IPI to offline CPU by using resched_cpu() instead of resched_curr() - Fix comment referring to renamed function - Update scx_show_state.py for scx_root and scx_aborting changes * tag 'sched_ext-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: tools/sched_ext: update scx_show_state.py for scx_aborting change tools/sched_ext: fix scx_show_state.py for scx_root change sched_ext: Use the resched_cpu() to replace resched_curr() in the bypass_lb_node() sched_ext: Fix some comments in ext.c sched_ext: fix uninitialized ret on alloc_percpu() failure
2025-12-28Merge tag 'cgroup-for-6.19-rc3-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: - Fix a spurious cpuset warning when disabling remote partition after CPU hotplug leaves subpartitions_cpus empty. Guard the warning and invalidate affected partitions. * tag 'cgroup-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cpuset: fix warning when disabling remote partition
2025-12-28Merge tag 'v6.19-p2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix UAF in seqiv - Fix regression in hisilicon * tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num() crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
2025-12-29crypto: drbg - make drbg_get_random_bytes() return *void*Sergey Shtylyov
Now that drbg_get_random_bytes() always returns 0, checking its result at the call sites stopped to make sense -- make this function return *void* instead of *int*... Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: drbg - make drbg_fips_continuous_test() return boolSergey Shtylyov
Currently, drbg_fips_continuous_test() only returns 0 and -EAGAIN, so an early return from the *do*/*while* loop in drbg_get_random_bytes() just isn't possible. Make drbg_fips_continuous_test() return bool instead of *int* (using true instead of 0 and false instead of -EAGAIN). This way, we can further simplify drbg_get_random_bytes()... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Suggested-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: drbg - kill useless variable in drbg_fips_continuous_test()Sergey Shtylyov
In drbg_fips_continuous_test(), not only the initializer of the ret local variable is useless, the variable itself does not seem needed as it only stores the result of memcmp() until it's checked on the next line -- get rid of the variable... Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: khazad - simplify return statement in khazad_mod_initThorsten Blum
Return the result of calling crypto_register_alg() directly and remove the local return variable. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: octeontx2 - Use sysfs_emit in sysfs show functionsThorsten Blum
Replace sprintf() with sysfs_emit() in sso_pf_func_ovrd_show() and kvf_limits_show(). sysfs_emit() is preferred for formatting sysfs output as it performs proper bounds checking. No functional changes. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functionsThorsten Blum
Replace sprintf() with sysfs_emit() in verify_compress_show() and sync_mode_show(). sysfs_emit() is preferred to format sysfs output as it provides better bounds checking. No functional changes. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Acked-by: Kanchana P Sridhar <kanchana.p.sridhar@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-29crypto: qat - fix duplicate restarting msg during AER errorHarshita Bhilwaria
The restarting message from PF to VF is sent twice during AER error handling: once from adf_error_detected() and again from adf_disable_sriov(). This causes userspace subservices to shutdown unexpectedly when they receive a duplicate restarting message after already being restarted. Avoid calling adf_pf2vf_notify_restarting() and adf_pf2vf_wait_for_restarting_complete() from adf_error_detected() so that the restarting msg is sent only once from PF to VF. Fixes: 9567d3dc760931 ("crypto: qat - improve aer error reset handling") Signed-off-by: Harshita Bhilwaria <harshita.bhilwaria@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Ravikumar PM <ravikumar.pm@intel.com> Reviewed-by: Srikanth Thokala <srikanth.thokala@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-12-28io_uring: IOPOLL polling improvementsJens Axboe
io_uring manages issued and pending IOPOLL read/write requests in a singly linked list. One downside of that is that individual items cannot easily be removed from that list, and as a result, io_uring will only complete a completed request N in that list if 0..N-1 are also complete. For homogenous IO this isn't necessarily an issue, but if different devices are involved in polling in the same ring, or if disparate IO from the same device is being polled for, this can defer completion of some requests unnecessarily. Move to a doubly linked list for iopoll completions instead, making it possible to easily complete whatever requests that were polled done successfully. Co-developed-by: Fengnan Chang <fengnanchang@gmail.com> Link: https://lore.kernel.org/io-uring/20251210085501.84261-1-changfengnan@bytedance.com/ Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28brd: replace simple_strtol with kstrtoul in ramdisk_sizeThorsten Blum
Replace simple_strtol() with the recommended kstrtoul() for parsing the 'ramdisk_size=' boot parameter. Unlike simple_strtol(), which returns a long, kstrtoul() converts the string directly to an unsigned long and avoids implicit casting. Check the return value of kstrtoul() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtol() helper. The current code silently sets 'rd_size = 0' if parsing fails, instead of leaving the default value (CONFIG_BLK_DEV_RAM_SIZE) unchanged. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28rnull: replace `kernel::c_str!` with C-StringsTamir Duberstein
C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein <tamird@gmail.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28Linux 6.19-rc3v6.19-rc3Linus Torvalds
2025-12-28drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbufferKrzysztof Niemiec
Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb->vma[i].vma pointers to NULL, simplifying cleanup and getting rid of the bug described below. During the execution of eb_lookup_vmas(), the eb->vma array is successively filled up with struct eb_vma objects. This process includes calling eb_add_vma(), which might fail; however, even in the event of failure, eb->vma[i].vma is set for the currently processed buffer. If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which prompts a call to eb_release_vmas() to clean up the mess. Since eb_lookup_vmas() might fail during processing any (possibly not first) buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know at what point did the lookup function fail. In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is set to NULL in case i915_gem_object_userptr_submit_init() fails; the current one needs to be cleaned up by eb_release_vmas() at this point, so the next one is set. If eb_add_vma() fails, neither the current nor the next vma is set to NULL, which is a source of a NULL deref bug described in the issue linked in the Closes tag. When entering eb_lookup_vmas(), the vma pointers are set to the slab poison value, instead of NULL. This doesn't matter for the actual lookup, since it gets overwritten anyway, however the eb_release_vmas() function only recognizes NULL as the stopping value, hence the pointers are being set to NULL as they go in case of intermediate failure. This patch changes the approach to filling them all with NULL at the start instead, rather than handling that manually during failure. Reported-by: Gangmin Kim <km.kim1503@gmail.com> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062 Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Cc: stable@vger.kernel.org # 5.16.x Signed-off-by: Krzysztof Niemiec <krzysztof.niemiec@intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com
2025-12-28vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file()Alper Ak
migf->filp is accessed after migf has been freed. Save the error value before calling kfree() to prevent use-after-free. Fixes: 1f5556ec8b9e ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Link: https://lore.kernel.org/r/20251225151349.360870-1-alperyasinak1@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28vfio/pds: Fix memory leak in pds_vfio_dirty_enable()Zilin Guan
pds_vfio_dirty_enable() allocates memory for region_info. If interval_tree_iter_first() returns NULL, the function returns -EINVAL immediately without freeing the allocated memory, causing a memory leak. Fix this by jumping to the out_free_region_info label to ensure region_info is freed. Fixes: 2e7c6feb4ef52 ("vfio/pds: Add multi-region support") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://lore.kernel.org/r/20251225143150.1117366-1-zilin@seu.edu.cn Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28Merge tag 'usb-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes, and bunch of reverts for 6.19-rc3. Included in here are: - reverts of some typec ucsi driver changes that had a lot of regression reports after -rc1. Let's just revert it all for now and it will come back in a way that is better tested. - other typec bugfixes - usb-storage quirk fixups - dwc3 driver fix - other minor USB fixes for reported problems. All of these have passed 0-day testing and individual testing" * tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits) Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" Revert "usb: typec: ucsi: Add support for message out data structure" Revert "usb: typec: ucsi: Enable debugfs for message_out data structure" Revert "usb: typec: ucsi: Add support for SET_PDOS command" Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common" Revert "usb: typec: ucsi: Get connector status after enable notifications" usb: ohci-nxp: clean up probe error labels usb: gadget: lpc32xx_udc: clean up probe error labels usb: ohci-nxp: fix device leak on probe failure usb: phy: isp1301: fix non-OF device reference imbalance usb: gadget: lpc32xx_udc: fix clock imbalance in error path usb: typec: ucsi: Get connector status after enable notifications usb: usb-storage: Maintain minimal modifications to the bcdDevice range. usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common USB: lpc32xx_udc: Fix error handling in probe usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() usb: typec: ucsi: huawei-gaokin: add DRM dependency ...
2025-12-28Merge tag 'tty-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are some small serial driver fixes for some reported issues. Included in here are: - serial sysfs fwnode fix that was much reported - sh-sci driver fix - serial device init bugfix - 8250 bugfix - xilinx_uartps bugfix All of these have passed 0-day testing and individual testing" * tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: xilinx_uartps: fix rs485 delay_rts_after_send serial: sh-sci: Check that the DMA cookie is valid serial: core: Fix serial device initialization serial: 8250: longson: Fix NULL vs IS_ERR() bug in probe serial: core: Restore sysfs fwnode information
2025-12-28Merge tag 'firewire-fixes-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "A fix for PCI driver for Texas Instruments PCILyx series. The driver had a bug where it allocated a DMA-coherent buffer of 16 KB but released it using PAGE_SIZE. This disproportion was reported in 2020, but the fix was never merged. It is finally resolved" * tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: nosy: Fix dma_free_coherent() size
2025-12-28Merge tag 'riscv-for-linus-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "Nothing exotic here; these are the cleanup and new ISA extension probing patches (not including CFI): - Add probing and userspace reporting support for the standard RISC-V ISA extensions Zilsd and Zclsd, which implement load/store dual instructions on RV32 - Abstract the register saving code in setup_sigcontext() so it can be used for stateful RISC-V ISA extensions beyond the vector extension - Add the SBI extension ID and some initial data structure definitions for the RISC-V standard SBI debug trigger extension - Clean up some code slightly: change some page table functions to avoid atomic operations oinn !SMP and to avoid unnecessary casts to atomic_long_t; and use the existing RISCV_FULL_BARRIER macro in place of some open-coded 'fence rw,rw' instructions" * tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Add SBI debug trigger extension and function ids riscv/atomic.h: use RISCV_FULL_BARRIER in _arch_atomic* function. riscv: hwprobe: export Zilsd and Zclsd ISA extensions riscv: add ISA extension parsing for Zilsd and Zclsd dt-bindings: riscv: add Zilsd and Zclsd extension descriptions riscv: mm: use xchg() on non-atomic_long_t variables, not atomic_long_xchg() riscv: mm: ptep_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: mm: pmdp_huge_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: signal: abstract header saving for setup_sigcontext
2025-12-28Merge tag 'powerpc-6.19-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix for kexec warning due to SMT disable or partial SMT enabled - Handle font bitmap pointer with reloc_offset to fix boot crash - Fix to enable cpuidle state for Power11 - Couple of misc fixes Thanks to Aboorva Devarajan, Aditya Bodkhe, Cedar Maxwell, Christian Zigotzky, Christophe Leroy, Christophe Leroy (CS GROUP), Finn Thain, Gopi Krishna Menon, Guenter Roeck, Jan Stancek, Joe Lawrence, Josh Poimboeuf, Justin M. Forbes, Madadi Vineeth Reddy, Naveen N Rao (AMD), Nysal Jan K.A., Sachin P Bappalige, Samir M, Sourabh Jain, Srikar Dronamraju, and Stan Johnson * tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/32: Restore disabling of interrupts at interrupt/syscall exit powerpc/powernv: Enable cpuidle state detection for POWER11 powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() powerpc/tools: drop `-o pipefail` in gcc check scripts selftests/powerpc/pmu/: Add check_extended_reg_test to .gitignore powerpc/kexec: Enable SMT before waking offline CPUs
2025-12-28selftests/ublk: fix Makefile to rebuild on header changesMing Lei
Add header dependencies to kublk build rule so that changes to kublk.h, ublk_dep.h, or utils.h trigger a rebuild. Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28selftests/ublk: add test for async partition scanMing Lei
Add test_generic_15.sh to verify that async partition scan prevents IO hang when reading partition tables. The test creates ublk devices with fault_inject target and very large delay (60s) to simulate blocked partition table reads, then kills the daemon to verify proper state transitions without hanging: 1. Without recovery support: - Create device with fault_inject and 60s delay - Kill daemon while partition scan may be blocked - Verify device transitions to DEAD state 2. With recovery support (-r 1): - Create device with fault_inject, 60s delay, and recovery - Kill daemon while partition scan may be blocked - Verify device transitions to QUIESCED state Before the async partition scan fix, killing the daemon during partition scan would cause deadlock as partition scan held ub->mutex while waiting for IO. With the async fix, partition scan happens in a work function and flush_work() ensures proper synchronization. Add _add_ublk_dev_no_settle() helper function to skip udevadm settle, which would otherwise hang waiting for partition scan events to complete when partition table read is delayed. Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28ublk: scan partition in async wayMing Lei
Implement async partition scan to avoid IO hang when reading partition tables. Similar to nvme_partition_scan_work(), partition scanning is deferred to a work queue to prevent deadlocks. When partition scan happens synchronously during add_disk(), IO errors can cause the partition scan to wait while holding ub->mutex, which can deadlock with other operations that need the mutex. Changes: - Add partition_scan_work to ublk_device structure - Implement ublk_partition_scan_work() to perform async scan - Always suppress sync partition scan during add_disk() - Schedule async work after add_disk() for trusted daemons - Add flush_work() in ublk_stop_dev() before grabbing ub->mutex Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Reported-by: Yoav Cohen <yoav@nvidia.com> Closes: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/ Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28tools/sched_ext: update scx_show_state.py for scx_aborting changeKohei Enju
Commit a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") removed scx_in_softlockup and scx_breather_depth, replacing them with scx_aborting. Update the script accordingly. Fixes: a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") Signed-off-by: Kohei Enju <enjuk@amazon.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28tools/sched_ext: fix scx_show_state.py for scx_root changeKohei Enju
Commit 48e126777386 ("sched_ext: Introduce scx_sched") introduced scx_root and removed scx_ops, causing scx_show_state.py to fail when searching for the 'scx_ops' object. [1] Fix by using 'scx_root' instead, with NULL pointer handling. [1] # drgn -s vmlinux ./tools/sched_ext/scx_show_state.py Traceback (most recent call last): File "/root/.venv/bin/drgn", line 8, in <module> sys.exit(_main()) ~~~~~^^ File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main runpy.run_path( ~~~~~~~~~~~~~~^ script_path, init_globals={"prog": prog}, run_name="__main__" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "<frozen runpy>", line 287, in run_path File "<frozen runpy>", line 98, in _run_module_code File "<frozen runpy>", line 88, in _run_code File "./tools/sched_ext/scx_show_state.py", line 30, in <module> ops = prog['scx_ops'] ~~~~^^^^^^^^^^^ _drgn.ObjectNotFoundError: could not find 'scx_ops' Fixes: 48e126777386 ("sched_ext: Introduce scx_sched") Signed-off-by: Kohei Enju <enjuk@amazon.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28block,bfq: fix aux stat accumulation destinationshechenglong
Route bfqg_stats_add_aux() time accumulation into the destination stats object instead of the source, aligning with other stat fields. Reviewed-by: Yu Kuai <yukuai@fnnas.com> Signed-off-by: shechenglong <shechenglong@xfusion.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28af_unix: don't post cmsg for SO_INQ unless explicitly asked forJens Axboe
A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is incorrect, as ->msg_get_inq is just the caller asking for the remainder to be passed back in msg->msg_inq, it has nothing to do with cmsg. The original commit states that this is done to make sockets io_uring-friendly", but it's actually incorrect as io_uring doesn't use cmsg headers internally at all, and it's actively wrong as this means that cmsg's are always posted if someone does recvmsg via io_uring. Fix that up by only posting a cmsg if u->recvmsg_inq is set. Additionally, mirror how TCP handles inquiry handling in that it should only be done for a successful return. This makes the logic for the two identical. Cc: stable@vger.kernel.org Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.") Reported-by: Julian Orth <ju.orth@gmail.com> Link: https://github.com/axboe/liburing/issues/1509 Signed-off-by: Jens Axboe <axboe@kernel.dk> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/07adc0c2-2c3b-4d08-8af1-1c466a40b6a8@kernel.dk Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28Merge tag 'counter-fixes-for-6.19' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 6.19 A fix for interrupt-cnt dropping the IRQF_NO_THREAD configuration to allow the IRQ handler to correctly acquire a spinlock_t lock. A fix for 104-quad-8 correcting quad8_irq_handler() to return irqreturn_t enum values rather than negative errno codes on error. * tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: 104-quad-8: Fix incorrect return value in IRQ handler counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
2025-12-28PM: sleep: Fix suspend_test() at the TEST_CORE levelRafael J. Wysocki
Commit a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") replaced mdelay() in suspend_test() with msleep() which does not work at the TEST_CORE test level that calls suspend_test() while running on one CPU with interrupts off. Address this by making suspend_test() check if the test level is suitable for using msleep() and use mdelay() otherwise. Fixes: a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com> Closes: https://lore.kernel.org/linux-pm/aUsAk0k1N9hw8IkY@venus/ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/6251576.lOV4Wx5bFT@rafael.j.wysocki
2025-12-28rust: Add SoC Driver SampleMatthew Maurer
Shows registration of a SoC device upon receipt of a probe. Signed-off-by: Matthew Maurer <mmaurer@google.com> Link: https://patch.msgid.link/20251226-soc-bindings-v4-3-2c2fac08f820@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-28rust: Add soc_device supportMatthew Maurer
Allow SoC drivers in Rust to present metadata about their devices to userspace through /sys/devices/socX and other drivers to identify their properties through `soc_device_match`. Signed-off-by: Matthew Maurer <mmaurer@google.com> Link: https://patch.msgid.link/20251226-soc-bindings-v4-1-2c2fac08f820@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-28arm64: dts: exynos: gs101: add OTP nodeTudor Ambarus
Add the OTP controller node. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-5-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: add google,gs101-otp supportTudor Ambarus
GS101 is different (but also e850 and autov9 I assume) from the SoCs that are currently handled by the exynos-chipid driver because the chip ID info is part of the OTP registers. GS101 OTP has a clock, an interrupt line, a register space (that contains product and chip ID, TMU data, ASV, etc) and a 32Kbit memory space that can be read/program/locked with specific commands. On GS101 the "ChipID block" is just an abstraction, it's not a physical device. When the power-on sequence progresses, the OTP chipid values are loaded to the OTP registers. Add the GS101 chip ID support. The support is intentionally added in the exynos-chipid driver, and not in a dedicated Exynos OTP driver, because we estimate that there will not be any OTP consumers in the kernel other than the chip ID/SoC interface. The downstream GS101 drivers confirm this supposition. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-4-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: downgrade dev_info to dev_dbg for soc infoTudor Ambarus
The SoC information is exposed to userspace using the standard soc interface. Downgrade to dev_dbg to stop polluting the console log. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-3-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: rename methodTudor Ambarus
s/product_id_to_soc_id/exynos_product_id_to_name. Prepend exynos_ to avoid name space pollution. The method translates the product id to a name, rename the method to make that clear. While touching the code where it is called, add a blank line for readability purposes. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-2-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28dt-bindings: nvmem: add google,gs101-otpTudor Ambarus
Add binding for the OTP controller found on Google GS101. Reviewed-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-1-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28w1: fix redundant counter decrement in w1_attach_slave_device()Haoxiang Li
In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device(). Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28net: mana: Fix use-after-free in reset service rescan pathDipayaan Roy
When mana_serv_reset() encounters -ETIMEDOUT or -EPROTO from mana_gd_resume(), it performs a PCI rescan via mana_serv_rescan(). mana_serv_rescan() calls pci_stop_and_remove_bus_device(), which can invoke the driver's remove path and free the gdma_context associated with the device. After returning, mana_serv_reset() currently jumps to the out label and attempts to clear gc->in_service, dereferencing a freed gdma_context. The issue was observed with the following call logs: [ 698.942636] BUG: unable to handle page fault for address: ff6c2b638088508d [ 698.943121] #PF: supervisor write access in kernel mode [ 698.943423] #PF: error_code(0x0002) - not-present page [S[ 698.943793] Pat Dec 6 07:GD5 100000067 P4D 1002f7067 PUD 1002f8067 PMD 101bef067 PTE 0 0:56 2025] hv_[n e 698.944283] Oops: Oops: 0002 [#1] SMP NOPTI tvsc f8615163-00[ 698.944611] CPU: 28 UID: 0 PID: 249 Comm: kworker/28:1 ... [Sat Dec 6 07:50:56 2025] R10: [ 699.121594] mana 7870:00:00.0 enP30832s1: Configured vPort 0 PD 18 DB 16 000000000000001b R11: 0000000000000000 R12: ff44cf3f40270000 [Sat Dec 6 07:50:56 2025] R13: 0000000000000001 R14: ff44cf3f402700c8 R15: ff44cf3f4021b405 [Sat Dec 6 07:50:56 2025] FS: 0000000000000000(0000) GS:ff44cf7e9fcf9000(0000) knlGS:0000000000000000 [Sat Dec 6 07:50:56 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Sat Dec 6 07:50:56 2025] CR2: ff6c2b638088508d CR3: 000000011fe43001 CR4: 0000000000b73ef0 [Sat Dec 6 07:50:56 2025] Call Trace: [Sat Dec 6 07:50:56 2025] <TASK> [Sat Dec 6 07:50:56 2025] mana_serv_func+0x24/0x50 [mana] [Sat Dec 6 07:50:56 2025] process_one_work+0x190/0x350 [Sat Dec 6 07:50:56 2025] worker_thread+0x2b7/0x3d0 [Sat Dec 6 07:50:56 2025] kthread+0xf3/0x200 [Sat Dec 6 07:50:56 2025] ? __pfx_worker_thread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork+0x21a/0x250 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork_asm+0x1a/0x30 [Sat Dec 6 07:50:56 2025] </TASK> Fix this by returning immediately after mana_serv_rescan() to avoid accessing GC state that may no longer be valid. Fixes: 9bf66036d686 ("net: mana: Handle hardware recovery events when probing the device") Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Long Li <longli@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20251218131054.GA3173@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>