summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-20Merge tag 'platform-drivers-x86-v7.1-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "asus-wmi: - Retain battery charge threshold during boot which avoids unsolicited change to 100%. Return -ENODATA when the limit is not yet known - Improve screenpad power/brightness handling consistency - Fix screenpad brightness range barco-p50-gpio: - Normalize gpio_get return values bitland-mifs-wmi: - Add driver for Bitland laptops (supports platform profile, hwmon, kbd backlight, gpu mode, hotkeys, and fan boost) dell_rbu: - Fix using uninitialized value in sysfs write function dell-wmi-sysman: - Respect destination length when constructing enum strings hp-wmi: - Propagate fan setting apply failures and log an error - Fix sysfs write vs work handler cancel_delayed_work_sync() deadlock - Correct keepalive schedule_delayed_work() to mod_delayed_work() - Fix u8 underflows in GPU delta calculation - Use mutex to protect fan pwm/mode - Ignore kbd backlight and FnLock key events that are handled by FW - Fix fan table parsing (use correct field) - Add support for Omen 14-fb0xxx, 16-n0xxx, 16-wf1xxx, and Omen MAX 16-ak0xxxx input: trackpoint & thinkpad_acpi: - Enable doubletap by default and add sysfs enable/disable int3472: - Add support for GPIO type 0x02 (IR flood LED) intel-speed-select: (updated to v1.26) - Avoid using current base frequency as maximum - Fix CPU extended family ID decoding - Fix exit code - Improve error reporting intel/vsec: - Refactor to support ACPI-enumerated PMT endpoints. pcengines-apuv2: - Attach software node to the gpiochip uniwill: - Refactor hwmon to smaller parts to accomodate HW diversity - Support USB-C power/performance priority switch through sysfs - Add another XMG Fusion 15 (L19) DMI vendor - Enable fine-grained features to device lineup mapping wmi: - Perform output size check within WMI core to allow simpler WMI drivers misc: - acpi_driver -> platform driver conversions (a large number of changes from Rafael J. Wysocki) - cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (106 commits) platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77) platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44) platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87) platform/x86: hp-wmi: fix fan table parsing platform/x86: hp-wmi: add Omen 14-fb0xxx (board 8C58) support platform/wmi: Replace .no_notify_data with .min_event_size platform/wmi: Extend wmidev_query_block() to reject undersized data platform/wmi: Extend wmidev_invoke_method() to reject undersized data platform/wmi: Prepare to reject undersized unmarshalling results platform/wmi: Convert drivers to use wmidev_invoke_procedure() platform/wmi: Add wmidev_invoke_procedure() platform/x86: int3472: Add support for GPIO type 0x02 (IR flood LED) platform/x86: int3472: Parameterize LED con_id in registration platform/x86: int3472: Rename pled to led in LED registration code platform/x86: int3472: Use local variable for LED struct access platform/x86: thinkpad_acpi: remove obsolete TODO comment platform/x86: dell-wmi-sysman: bound enumeration string aggregation platform/x86: hp-wmi: Ignore backlight and FnLock events platform/x86: uniwill-laptop: Fix signedness bug platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() ...
2026-04-20Merge tag 'backlight-next-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Apple Backlight: - Convert the Apple Backlight ACPI driver to a proper platform driver, aligning with current ACPI binding practices Skyworks SKY81452: - Check the return value of `devm_gpiod_get_optional()` to properly handle GPIO acquisition errors" * tag 'backlight-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: apple_bl: Convert to a platform driver backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt()
2026-04-20net: mctp: fix don't require received header reserved bits to be zeroYuan Zhaoming
From the MCTP Base specification (DSP0236 v1.2.1), the first byte of the MCTP header contains a 4 bit reserved field, and 4 bit version. On our current receive path, we require those 4 reserved bits to be zero, but the 9500-8i card is non-conformant, and may set these reserved bits. DSP0236 states that the reserved bits must be written as zero, and ignored when read. While the device might not conform to the former, we should accept these message to conform to the latter. Relax our check on the MCTP version byte to allow non-zero bits in the reserved field. Fixes: 889b7da23abf ("mctp: Add initial routing framework") Signed-off-by: Yuan Zhaoming <yuanzm2@lenovo.com> Cc: stable@vger.kernel.org Acked-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260417141340.5306-1-yuanzhaoming901030@126.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20gtp: disable BH before calling udp_tunnel_xmit_skb()David Carlier
gtp_genl_send_echo_req() runs as a generic netlink doit handler in process context with BH not disabled. It calls udp_tunnel_xmit_skb(), which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec on softnet_data.xmit.recursion to track the tunnel xmit recursion level. Without local_bh_disable(), the task may migrate between dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the per-CPU counter pairing. The result is stale or negative recursion levels that can later produce false-positive SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU. The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected: the data path runs under ndo_start_xmit and the echo response handlers run from the UDP encap rx softirq, both with BH already disabled. Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring commit 2cd7e6971fc2 ("sctp: disable BH before calling udp_tunnel_xmit_skb()"). Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260417055408.4667-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20hv_sock: Report EOF instead of -EIO for FINDexuan Cui
Commit f0c5827d07cb unluckily causes a regression for the FIN packet, and the final read syscall gets an error rather than 0. Ideally, we would want to fix hvs_channel_readable_payload() so that it could return 0 in the FIN scenario, but it's not good for the hv_sock driver to use the VMBus ringbuffer's cached priv_read_index, which is internal data in the VMBus driver. Fix the regression in hv_sock by returning 0 rather than -EIO. Fixes: f0c5827d07cb ("hv_sock: Return the readable bytes in hvs_stream_has_data()") Cc: stable@vger.kernel.org Reported-by: Ben Hillis <Ben.Hillis@microsoft.com> Reported-by: Mitchell Levy <levymitchell0@gmail.com> Signed-off-by: Dexuan Cui <decui@microsoft.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20260416191433.840637-1-decui@microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20Merge tag 'leds-next-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: Core: - Implement fallback to software node name for LED names - Fix formatting issues in `led-core.c` reported by checkpatch.pl - Make `led_remove_lookup()` NULL-aware - Switch from `class_find_device_by_of_node()` to `class_find_device_by_fwnode()` - Drop the unneeded dependency on `OF_GPIO` from `LEDS_NETXBIG` in Kconfig Kinetic KTD2692: - Make the `ktd2692_timing` variable static to resolve a sparse warning LGM SSO: - Fix a typo in the `GET_SRC_OFFSET` macro - Remove a duplicate assignment of `priv->mmap` in `intel_sso_led_probe()` Multicolor: - Fix a signedness error by changing the `intensity_value` type to `unsigned int` Qualcomm LPG: - Prevent array overflow when selecting high-resolution values Spreadtrum SC2731: - Add a compatible string for the SC2730 PMIC LED controller TI LM3642: - Use `guard(mutex)` to simplify locking and avoid manual `mutex_unlock()` calls TI LP5569: - Use `sysfs_emit()` instead of `sprintf()` for sysfs outputs TI LP5860: - Add the `enable-gpios` property for the `VIO_EN` pin" TI LP8860: - Do not unconditionally program the EEPROM on probe - Hold the mutex lock for the entirety of the EEPROM programming process - Return directly from `lp8860_init()` instead of using empty `goto` statements - Use a single regmap table and an access table instead of separate maps for normal and EEPROM registers - Remove an unused read of the `STATUS` register during EEPROM programming TTY Trigger: - Prefer `IS_ERR_OR_NULL()` over manual NULL checks" * tag 'leds-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: leds: class: Make led_remove_lookup() NULL-aware leds: led-class: Switch to using class_find_device_by_fwnode() leds: Kconfig: Drop unneeded dependency on OF_GPIO leds: lm3642: Use guard to simplify locking leds: core: Fix formatting issues leds: core: Implement fallback to software node name for LED names leds: lgm-sso: Fix typo in macro for src offset dt-bindings: leds: lp5860: add enable-gpio leds: Prefer IS_ERR_OR_NULL over manual NULL check dt-bindings: leds: sc2731: Add compatible for SC2730 leds: lp8860: Do not always program EEPROM on probe leds: lp8860: Remove unused read of STATUS register leds: lp8860: Hold lock for all of EEPROM programming leds: lp8860: Return directly from lp8860_init leds: lp8860: Use a single regmap table leds: lgm-sso: Remove duplicate assignments for priv->mmap leds: qcom-lpg: Check for array overflow when selecting the high resolution leds: ktd2692: Make ktd2692_timing variable static leds: lp5569: Use sysfs_emit instead of sprintf() leds: multicolor: Change intensity_value to unsigned int
2026-04-20net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()Lorenzo Bianconi
Since multiple net_device TX queues can share the same hw QDMA TX queue, there is no guarantee we have inflight packets queued in hw belonging to a net_device TX queue stopped in the xmit path because hw QDMA TX queue can be full. In this corner case the net_device TX queue will never be re-activated. In order to avoid any potential net_device TX queue stall, we need to wake all the net_device TX queues feeding the same hw QDMA TX queue in airoha_qdma_tx_napi_poll routine. Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260416-airoha-txq-potential-stall-v2-1-42c732074540@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20openvswitch: cap upcall PID array size and pre-size vport repliesWeiming Shi
The vport netlink reply helpers allocate a fixed-size skb with nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID array via ovs_vport_get_upcall_portids(). Since ovs_vport_set_upcall_portids() accepts any non-zero multiple of sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID array large enough to overflow the reply buffer, causing nla_put() to fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with unprivileged user namespaces enabled (e.g., Ubuntu default), this is reachable via unshare -Urn since OVS vport mutation operations use GENL_UNS_ADMIN_PERM. kernel BUG at net/openvswitch/datapath.c:2414! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1 RIP: 0010:ovs_vport_cmd_set+0x34c/0x400 Call Trace: <TASK> genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116) genl_rcv_msg (net/netlink/genetlink.c:1194) netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exception Reject attempts to set more PIDs than nr_cpu_ids in ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply size in ovs_vport_cmd_msg_size() based on that bound, similar to the existing ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already used by the per-CPU dispatch configuration on the datapath side (ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the two sides stay consistent. Fixes: 5cd667b0a456 ("openvswitch: Allow each vport to have an array of 'port_id's.") Reported-by: Xiang Mei <xmei5@asu.edu> Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260416024653.153456-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20net/mlx5: Fix HCA caps leak on notifier init failurePrathamesh Deshpande
mlx5_mdev_init() allocates HCA caps via mlx5_hca_caps_alloc() before calling mlx5_notifiers_init(). If notifier initialization fails, the error path jumps to err_hca_caps and skips mlx5_hca_caps_free(), leaking allocated caps. Add a dedicated unwind label for notifier-init failure that frees HCA caps before continuing the existing cleanup sequence. Fixes: b6b03097f982 ("net/mlx5: Initialize events outside devlink lock") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260415005022.34764-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20pppoe: drop PFC framesQingfang Deng
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding. Fixes: 7fb1b8ca8fa1 ("ppp: Move PFC decompression to PPP generic layer") Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260415022456.141758-2-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20flow_dissector: do not dissect PPPoE PFC framesQingfang Deng
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process of that commit [1], support for PFC is suggested. However, having a compressed (1-byte) protocol field means the subsequent PPP payload is shifted by one byte, causing 4-byte misalignment for the network header and an unaligned access exception on some architectures. The exception can be reproduced by sending a PPPoE PFC frame to an ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE session is active on that interface: $ 0 : 00000000 80c40000 00000000 85144817 $ 4 : 00000008 00000100 80a75758 81dc9bb8 $ 8 : 00000010 8087ae2c 0000003d 00000000 $12 : 000000e0 00000039 00000000 00000000 $16 : 85043240 80a75758 81dc9bb8 00006488 $20 : 0000002f 00000007 85144810 80a70000 $24 : 81d1bda0 00000000 $28 : 81dc8000 81dc9aa8 00000000 805ead08 Hi : 00009d51 Lo : 2163358a epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50 ra : 805ead08 __skb_get_hash_net+0x74/0x12c Status: 11000403 KERNEL EXL IE Cause : 40800010 (ExcCode 04) BadVA : 85144817 PrId : 0001992f (MIPS 1004Kc) Call Trace: [<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50 [<805ead08>] __skb_get_hash_net+0x74/0x12c [<805ef330>] get_rps_cpu+0x1b8/0x3fc [<805fca70>] netif_receive_skb_list_internal+0x324/0x364 [<805fd120>] napi_complete_done+0x68/0x2a4 [<8058de5c>] mtk_napi_rx+0x228/0xfec [<805fd398>] __napi_poll+0x3c/0x1c4 [<805fd754>] napi_threaded_poll_loop+0x234/0x29c [<805fd848>] napi_threaded_poll+0x8c/0xb0 [<80053544>] kthread+0x104/0x12c [<80002bd8>] ret_from_kernel_thread+0x14/0x1c Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000 To reduce the attack surface and maintain performance, do not process PPPoE PFC frames. [1] https://lore.kernel.org/r/20220630231016.GA392@debian.home Fixes: 46126db9c861 ("flow_dissector: Add PPPoE dissectors") Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev> Link: https://patch.msgid.link/20260415022456.141758-1-qingfang.deng@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-20Merge tag 'mfd-next-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core: - Add a resource-managed version of alloc_workqueue() (`devm_alloc_workqueue()`) - Preserve the Open Firmware (OF) node when an ACPI handle is present Apple SMC: - Wire up the Apple SMC power driver by adding a new MFD cell Atmel HLCDC: - Fetch the LVDS PLL clock as a fallback if the generic sys_clk is unavailable Broadcom BCM2835 PM: - Add support for the BCM2712 power management device - Introduce a hardware type identifier to distinguish SoC variants Congatec CGBC, KEMPLD, RSMU, Si476x: - Fix various kernel-doc warnings and correct struct member names DLN2: - Drop redundant USB device references and switch to managed resource allocations - Update bare 'unsigned' types to 'unsigned int' ENE KB3930: - Use the of_device_is_system_power_controller() wrapper EZX PCAP: - Avoid rescheduling after destroying the workqueue by switching to a device-managed workqueue - Drop redundant memory allocation error messages - Return directly instead of using empty goto statements Freescale i.MX25 TSADC: - Convert devicetree bindings from TXT to YAML format Freescale MC13xxx: - Fix a memory leak in subdevice platform data allocation by using devm_kmemdup() Intel LPC ICH: - Expose a software node for the GPIO controller cell to fix GPIO lookups Intel LPSS: - Add PCI IDs for the Intel Nova Lake-H platform Maxim MAX77620: - Convert devicetree bindings from TXT to YAML format - Document an optional I2C address for the MAX77663 RTC device Maxim MAX77705: - Make the max77705_pm_ops variable static to resolve a sparse warning MediaTek MT6397: - Correct the hardware CIDs for the MT6328, MT6331, and MT6332 PMICs to allow proper driver binding ROHM BD71828: - Enable system wakeup via the power button ROHM BD72720: - Add a new compatible string for the ROHM BD73900 PMIC SpacemiT P1: - Drop the deprecated "vin-supply" property from the devicetree bindings - Add individual regulator supply properties to match actual hardware topology STMicroelectronics STPMIC1: - Attempt system shutdown a second time to handle transient I2C communication failures Viperboard: - Drop redundant USB device references" * tag 'mfd-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (28 commits) mfd: core: Preserve OF node when ACPI handle is present mfd: ene-kb3930: Use of_device_is_system_power_controller() wrapper mfd: intel-lpss: Add Intel Nova Lake-H PCI IDs dt-bindings: mfd: max77620: Document optional RTC address for MAX77663 dt-bindings: mfd: max77620: Convert to DT schema mfd: ezx-pcap: Avoid rescheduling after destroying workqueue mfd: ezx-pcap: Return directly instead of empty gotos mfd: ezx-pcap: Drop memory allocation error message mfd: bcm2835-pm: Add BCM2712 PM device support mfd: bcm2835-pm: Introduce SoC-specific type identifier dt-bindings: mfd: bd72720: Add ROHM BD73900 mfd: si476x: Fix kernel-doc warnings mfd: rsmu: Remove a empty kernel-doc line mfd: kempld: Fix kernel-doc struct member names mfd: congatec: Fix kernel-doc struct member names dt-bindings: mfd: Convert fsl-imx25-tsadc.txt to yaml format mfd: viperboard: Drop redundant device reference mfd: dln2: Switch to managed resources and fix bare unsigned types mfd: macsmc: Wire up Apple SMC power driver mfd: mt6397: Properly fix CID of MT6328, MT6331 and MT6332 ...
2026-04-20Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "The usual collection of driver changes, more core infrastructure updates that typical this cycle: - Minor cleanups and kernel-doc fixes in bnxt_re, hns, rdmavt, efa, ocrdma, erdma, rtrs, hfi1, ionic, and pvrdma - New udata validation framework and driver updates - Modernize CQ creation interface in mlx4 and mlx5, manage CQ umem in core - Promote UMEM to a core component, split out DMA block iterator logic - Introduce FRMR pools with aging, statistics, pinned handles, and netlink control and use it in mlx5 - Add PCIe TLP emulation support in mlx5 - Extend umem to work with revocable pinned dmabuf's and use it in irdma - More net namespace improvements for rxe - GEN4 hardware support in irdma - First steps to MW and UC support in mana_ib - Support for CQ umem and doorbells in bnxt_re - Drop opa_vnic driver from hfi1 Fixes: - IB/core zero dmac neighbor resolution race - GID table memory free - rxe pad/ICRC validation and r_key async errors - mlx4 external umem for CQ - umem DMA attributes on unmap - mana_ib RX steering on RSS QP destroy" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (116 commits) RDMA/core: Fix user CQ creation for drivers without create_cq RDMA/ionic: bound node_desc sysfs read with %.64s IB/core: Fix zero dmac race in neighbor resolution RDMA/mana_ib: Support memory windows RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv RDMA/core: Prefer NLA_NUL_STRING RDMA/core: Fix memory free for GID table RDMA/hns: Remove the duplicate calls to ib_copy_validate_udata_in() RDMA: Remove redundant = {} for udata req structs RDMA/irdma: Add missing comp_mask check in alloc_ucontext RDMA/hns: Add missing comp_mask check in create_qp RDMA/mlx5: Pull comp_mask validation into ib_copy_validate_udata_in_cm() RDMA: Use ib_copy_validate_udata_in_cm() for zero comp_mask RDMA/hns: Use ib_copy_validate_udata_in() RDMA/mlx4: Use ib_copy_validate_udata_in() for QP RDMA/mlx4: Use ib_copy_validate_udata_in() RDMA/mlx5: Use ib_copy_validate_udata_in() for MW RDMA/mlx5: Use ib_copy_validate_udata_in() for SRQ RDMA/pvrdma: Use ib_copy_validate_udata_in() for srq RDMA: Use ib_copy_validate_udata_in() for implicit full structs ...
2026-04-20Merge tag 'ntfs3_for_7.1' of ↵Linus Torvalds
https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New: - reject inodes with zero non-DOS link count - return folios from ntfs_lock_new_page() - subset of W=1 warnings for stricter checks - work around -Wmaybe-uninitialized warnings - buffer boundary checks to run_unpack() - terminate the cached volume label after UTF-8 conversion Fixes: - check return value of indx_find to avoid infinite loop - prevent uninitialized lcn caused by zero len - increase CLIENT_REC name field size to prevent buffer overflow - missing run load for vcn0 in attr_data_get_block_locked() - memory leak in indx_create_allocate() - OOB write in attr_wof_frame_info() - mount failure on volumes with fragmented MFT bitmap - integer overflow in run_unpack() volume boundary check - validate rec->used in journal-replay file record check Updates: - resolve compare function in public index APIs - $LXDEV xattr lookup - potential double iput on d_make_root() failure - initialize err in ni_allocate_da_blocks_locked() - correct the pre_alloc condition in attr_allocate_clusters()" * tag 'ntfs3_for_7.1' of https://github.com/Paragon-Software-Group/linux-ntfs3: fs/ntfs3: fix Smatch warnings fs/ntfs3: validate rec->used in journal-replay file record check fs/ntfs3: terminate the cached volume label after UTF-8 conversion fs/ntfs3: fix potential double iput on d_make_root() failure ntfs3: fix integer overflow in run_unpack() volume boundary check ntfs3: add buffer boundary checks to run_unpack() ntfs3: fix mount failure on volumes with fragmented MFT bitmap fs/ntfs3: fix $LXDEV xattr lookup ntfs3: fix OOB write in attr_wof_frame_info() ntfs3: fix memory leak in indx_create_allocate() ntfs3: work around false-postive -Wmaybe-uninitialized warnings fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() fs/ntfs3: increase CLIENT_REC name field size fs/ntfs3: prevent uninitialized lcn caused by zero len fs/ntfs3: add a subset of W=1 warnings for stricter checks fs/ntfs3: return folios from ntfs_lock_new_page() fs/ntfs3: resolve compare function in public index APIs ntfs3: reject inodes with zero non-DOS link count
2026-04-20selftests/sched_ext: Add non_scx_kfunc_deny testCheng-Yang Chou
Verify that the BPF verifier rejects a non-SCX struct_ops program (tcp_congestion_ops) that attempts to call an SCX kfunc (scx_bpf_kick_cpu). The test expects the load to fail with -EACCES from scx_kfunc_context_filter. Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20sched_ext: Deny SCX kfuncs to non-SCX struct_ops programsCheng-Yang Chou
scx_kfunc_context_filter() currently allows non-SCX struct_ops programs (e.g. tcp_congestion_ops) to call SCX unlocked kfuncs. This is wrong for two reasons: - It is semantically incorrect: a TCP congestion control program has no business calling SCX kfuncs such as scx_bpf_kick_cpu(). - With CONFIG_EXT_SUB_SCHED=y, kfuncs like scx_bpf_kick_cpu() call scx_prog_sched(aux), which invokes bpf_prog_get_assoc_struct_ops(aux) and casts the result to struct sched_ext_ops * before reading ops->priv. For a non-SCX struct_ops program the returned pointer is the kdata of that struct_ops type, which is far smaller than sched_ext_ops, making the read an out-of-bounds access (confirmed with KASAN). Extend the filter to cover scx_kfunc_set_any and scx_kfunc_set_idle as well, and deny all SCX kfuncs for any struct_ops program that is not the SCX struct_ops. This addresses both issues: the semantic contract is enforced at the verifier level, and the runtime out-of-bounds access becomes unreachable. Fixes: d1d3c1c6ae36 ("sched_ext: Add verifier-time kfunc context filter") Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20sched_ext: Documentation: clarify arena-backed doubly-linked lists in scx_qmapCheng-Yang Chou
Update scx_qmap description to reflect arena-backed doubly-linked lists with per-queue bpf_res_spin_lock. Also update scx_qmap.bpf.c to reflect switch from PIDs to TIDs. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20sched_ext: Documentation: add note about multiple ops.enqueue() calls in a rowKuba Piecuch
Commit 84b1a0ea0b7c ("sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs") introduced the possibility of ops.enqueue() being called multiple times in a row for the same task without intervening calls to ops.dequeue(). Document this behavior as it may be surprising to some. Acked-by: Andrea Righi <arighi@nvidia.com> Acked-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20dm-thin: fix metadata refcount underflowMikulas Patocka
There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: 3241b1d3e0aa ("dm: add persistent data library") Cc: stable@vger.kernel.org
2026-04-20Merge tag 'ecryptfs-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs Pull eCryptfs updates from Tyler Hicks: - avoid unnecessary eCryptfs inode timestamp truncation by re-using the lower filesystem's time granularity - various small code cleanups - reorganize the setattr hook inode resizing to improve style and readability, remove an unnecessary memory allocation when shrinking, and to support an upcoming rework of the VFS interfaces involved in truncation * tag 'ecryptfs-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs: ecryptfs: keep the lower iattr contained in truncate_upper ecryptfs: factor out a ecryptfs_iattr_to_lower helper ecryptfs: merge ecryptfs_inode_newsize_ok into truncate_upper ecryptfs: combine the two ATTR_SIZE blocks in ecryptfs_setattr ecryptfs: use ZERO_PAGE instead of allocating zeroed memory in truncate_upper ecryptfs: streamline truncate_upper ecryptfs: cleanup ecryptfs_setattr ecryptfs: Drop TODO comment in ecryptfs_derive_iv ecryptfs: Fix typo in ecryptfs_derive_iv function comment ecryptfs: Log function name only once in decode_and_decrypt_filename ecryptfs: Remove redundant if checks in encrypt_and_encode_filename ecryptfs: Fix tag number in encrypt_filename() error message ecryptfs: Use struct_size to improve process_response + send_miscdev ecryptfs: Replace memcpy + manual NUL termination with strscpy ecryptfs: Set s_time_gran to get correct time granularity
2026-04-20dt-bindings: timer: Remove sifive,fine-ctr-bits propertyNick Hu
The counter width can be inferred from the compatible string, making the explicit "sifive,fine-ctr-bits" property redundant. Remove the property to simplify the bindings. Fixes: 0f920690a82c ("dt-bindings: timer: Add SiFive CLINT2") Suggested-by: Conor Dooley <conor+dt@kernel.org> Signed-off-by: Nick Hu <nick.hu@sifive.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/linux-riscv/20260330-relative-hardened-5ce35fe1ef57@spud/ Link: https://patch.msgid.link/20260419-clintv2-remove-fine-ctr-v1-1-7527f4d45850@sifive.com
2026-04-20Merge tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linuxLinus Torvalds
Pull nfsd updates from Chuck Lever: - filehandle signing to defend against filehandle-guessing attacks (Benjamin Coddington) The server now appends a SipHash-2-4 MAC to each filehandle when the new "sign_fh" export option is enabled. NFSD then verifies filehandles received from clients against the expected MAC; mismatches return NFS error STALE - convert the entire NLMv4 server-side XDR layer from hand-written C to xdrgen-generated code, spanning roughly thirty patches (Chuck Lever) XDR functions are generally boilerplate code and are easy to get wrong. The goals of this conversion are improved memory safety, lower maintenance burden, and groundwork for eventual Rust code generation for these functions. - improve pNFS block/SCSI layout robustness with two related changes (Dai Ngo) SCSI persistent reservation fencing is now tracked per client and per device via an xarray, to avoid both redundant preempt operations on devices already fenced and a potential NFSD deadlock when all nfsd threads are waiting for a layout return. - scalability and infrastructure improvements Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.1 NFSD development cycle. * tag 'nfsd-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (83 commits) NFSD: Docs: clean up pnfs server timeout docs nfsd: fix comment typo in nfsxdr nfsd: fix comment typo in nfs3xdr NFSD: convert callback RPC program to per-net namespace NFSD: use per-operation statidx for callback procedures svcrdma: Use contiguous pages for RDMA Read sink buffers SUNRPC: Add svc_rqst_page_release() helper SUNRPC: xdr.h: fix all kernel-doc warnings svcrdma: Factor out WR chain linking into helper svcrdma: Add Write chunk WRs to the RPC's Send WR chain svcrdma: Clean up use of rdma->sc_pd->device svcrdma: Clean up use of rdma->sc_pd->device in Receive paths svcrdma: Add fair queuing for Send Queue access SUNRPC: Optimize rq_respages allocation in svc_alloc_arg SUNRPC: Track consumed rq_pages entries svcrdma: preserve rq_next_page in svc_rdma_save_io_pages SUNRPC: Handle NULL entries in svc_rqst_release_pages SUNRPC: Allocate a separate Reply page array SUNRPC: Tighten bounds checking in svc_rqst_replace_page NFSD: Sign filehandles ...
2026-04-20ASoC: Correct bug parsing DisCo booleansMark Brown
Charles Keepax <ckeepax@opensource.cirrus.com> says: MIPI DisCo uses the unfortunate convention of allowing boolean properties to be present but having a zero value. Opposed to the normal convention of simply not specifying the property. Fix an issue in the SDCA code where mipi-sdca-control-deferrable is not parsed correctly. However, we also have some shipping ACPIs where these properties are not specified correctly. Update the MBQ regmap to attempt defers albeit with a warning in the case where a control attempts to defer but is not marked at such. There is little down side to this as if defer is genuinely not supported then the control will just return the same error again.
2026-04-20ASoC: SDCA: Fix reading of mipi-sdca-control-deferrableCharles Keepax
The discussion in [1] highlighted that the SDCA code shouldn't be using fwnode_property_read_bool() for DisCo controls, as the spec allows setting the value to zero meaning the property should not be used. Correct a small bug in the SDCA code that will mark such controls as deferrable. Link: https://lore.kernel.org/linux-sound/20260311142153.2201761-1-rf@opensource.cirrus.com/ [1] Fixes: 42b144cb6a2d ("ASoC: SDCA: Add SDCA Control parsing") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260413124621.1345315-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20regmap: sdw-mbq: Allow defers on undeferrable controlsCharles Keepax
It is a fairly common DisCo issue to have the deferrability of controls marked incorrectly and Windows seems very permissive in this regard. As there isn't really any down side to trying a defer even if the control isn't deferrable, allow this but add a warning message. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260413124621.1345315-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20Input: lm8323 - remove space before newlineColin Ian King
There is an extraneous space before a newline in a dev_err message. Remove it Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20250729113147.1924862-1-colin.i.king@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-20fsnotify: fix inode reference leak in fsnotify_recalc_mask()Amir Goldstein
fsnotify_recalc_mask() fails to handle the return value of __fsnotify_recalc_mask(), which may return an inode pointer that needs to be released via fsnotify_drop_object() when the connector's HAS_IREF flag transitions from set to cleared. This manifests as a hung task with the following call trace: INFO: task umount:1234 blocked for more than 120 seconds. Call Trace: __schedule schedule fsnotify_sb_delete generic_shutdown_super kill_anon_super cleanup_mnt task_work_run do_exit do_group_exit The race window that triggers the iref leak: Thread A (adding mark) Thread B (removing mark) ────────────────────── ──────────────────────── fsnotify_add_mark_locked(): fsnotify_add_mark_list(): spin_lock(conn->lock) add mark_B(evictable) to list spin_unlock(conn->lock) return /* ---- gap: no lock held ---- */ fsnotify_detach_mark(mark_A): spin_lock(mark_A->lock) clear ATTACHED flag on mark_A spin_unlock(mark_A->lock) fsnotify_put_mark(mark_A) fsnotify_recalc_mask(): spin_lock(conn->lock) __fsnotify_recalc_mask(): /* mark_A skipped: ATTACHED cleared */ /* only mark_B(evictable) remains */ want_iref = false has_iref = true /* not yet cleared */ -> HAS_IREF transitions true -> false -> returns inode pointer spin_unlock(conn->lock) /* BUG: return value discarded! * iput() and fsnotify_put_sb_watched_objects() * are never called */ Fix this by deferring the transition true -> false of HAS_IREF flag from fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B). Fixes: c3638b5b1374 ("fsnotify: allow adding an inode mark without pinning inode") Signed-off-by: Xin Yin <yinxin.x@bytedance.com> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Link: https://patch.msgid.link/CAOQ4uxiPsbHb0o5voUKyPFMvBsDkG914FYDcs4C5UpBMNm0Vcg@mail.gmail.com Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-20sched_ext: add p->scx.tid and SCX_OPS_TID_TO_TASK lookupTejun Heo
BPF schedulers that can't hold task_struct pointers (arena-backed ones in particular) key tasks by pid. During exit, pid is released before the task finishes passing through scheduler callbacks, so a dying task becomes invisible to the BPF side mid-schedule. scx_qmap hits this: an exiting task's dispatch callback can't recover its queue entry, stalling dispatch until SCX_EXIT_ERROR_STALL. Add a unique non-zero u64 p->scx.tid assigned at fork that survives the full task lifetime including exit. scx_bpf_tid_to_task() looks up the task; unlike bpf_task_from_pid(), it handles exiting tasks. The lookup costs an rhashtable insert/remove under scx_tasks_lock, so root schedulers opt in via SCX_OPS_TID_TO_TASK. Sub-schedulers that set the flag to declare a dependency are rejected at attach if root didn't opt in. scx_qmap converted: keys tasks by tid and enables SCX_OPS_ENQ_EXITING. Pre-patch it stalls within seconds under a non-leader-exec workload; with the patch it runs cleanly. v3: Warn on rhashtable_lookup_insert_fast() failure via new scx_tid_hash_insert() helper (Cheng-Yang Chou). v2: Guard scx_root deref in scx_bpf_tid_to_task() error path. The kfunc is registered via scx_kfunc_set_any and reachable from tracing and syscall programs when no scheduler is attached (Cheng-Yang Chou). Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-20Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive 73bd1227787b ("rhashtable: Restore insecure_elasticity toggle") as a dependency for upcoming patches that use .insecure_elasticity = true on their rhashtables. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20tools/sched_ext: Remove dead -d option in scx_flatcgCheng-Yang Chou
The -d option was non-functional, only toggling a variable that was echoed in the status line but never used to dump the cgroup hierarchy. Remove the option to avoid documenting dead code as a feature. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-20Revert "ALSA: usb-audio: Add quirk for SmartlinkTechnology M01"Takashi Iwai
This reverts commit d1aa2b9aad696c0434a5e0ac1d07810ce264e686. Juan reported that the patch didn't work as expected at the later check, failing to create PCM capture devices that has worked beforehand. Drop the change again for addressing the regression, and we'll continue developing a proper fix later. Reported-by: Juan Pablo Fuentealba Bizama <jpfuentealbabizama@gmail.com> Closes: https://lore.kernel.org/20260417150748.6684-1-jpfuentealbabizama@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-20ALSA: als4000: Fix capture trigger chip->mode raceCássio Gabriel
snd_als4000_capture_trigger() updates chip->mode under mixer_lock, while snd_als4000_set_rate() and snd_als4000_playback_trigger() serialize the same rate-lock state with reg_lock. The PCM core serializes callbacks only per acted-on substream, or for an explicitly linked group, so unlinked playback and capture streams can run concurrently. That leaves two races on ALS4000 rate-lock state: - playback and capture trigger callbacks can concurrently update chip->mode and lose one of the SB_RATE_LOCK bits - snd_als4000_set_rate() can observe chip->mode without the capture lock bit set and reprogram the shared sample rate while capture is being started Fix this by taking reg_lock as the outer lock in snd_als4000_capture_trigger() and nesting mixer_lock only for the CR1E write. This keeps chip->mode serialized with the rest of the ALS4000 rate-lock users while preserving the existing CR1E programming sequence. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260417-als4000-capture-trigger-race-v1-1-daeffc2feb67@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-20ALSA: core: Fix potential data race at fasync handlingTakashi Iwai
In snd_fasync_work_fn(), which is the offload work for traversing and processing the pending fasync list, the call of kill_fasync() is done outside the snd_fasync_lock for avoiding deadlocks. The problem is that its the references of fasync->on, fasync->signal and fasync->poll are done there also outside the lock. Since these may be modified by snd_kill_fasync() call concurrently from other process, inconsistent values might be passed to kill_fasync(). Although there shouldn't be critical UAF, it's still better to be addressed. This patch moves the kill_fasync() argument evaluations inside the snd_fasync_lock for avoiding the data races above. The handling in fasync->on flag is optimized in the loop to skip directly. Also, for more clarity, snd_fasync_free() takes the lock and unlink the pending entry more directly instead of clearing fasync->on flag. Reported-by: Jake Lamberson <lamberson.jake@gmail.com> Fixes: ef34a0ae7a26 ("ALSA: core: Add async signal helpers") Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260420061721.3253644-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-20ALSA: hda/tas2781: Fix sound abnormal issue on some SPI deviceBaojun Xu
In the SPI driver probe, the chip ID must be set to TAS2781. Without this initialization, calibration data fails to load correctly, causing audio abnormalities on some devices. And update the register bulk read API to handle the distinct requirements of SPI and I2C devices. Fixes: 05ac3846ffe5 ("ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781") Signed-off-by: Baojun Xu <baojun.xu@ti.com> Link: https://patch.msgid.link/20260418055030.765-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-20ALSA: hda/realtek: add quirk for Acer Nitro 16 AN16-41Bob Song
The combo jack microphone is not detected/working on the laptop featuring the Realtek ALC245 codec, and mic pincfg is the default value. So here, add quirk for it and test good. Reported-by: Yenilmez99 <mehmetcanosma77@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221344 Signed-off-by: Bob Song <songxiebing@kylinos.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260420053351.547352-1-songxiebing@kylinos.cn
2026-04-20isofs: use QSTR_LEN() in isofs_cmpThorsten Blum
Use QSTR_LEN() and inline the code in isofs_cmp(). Remove the stale function comment while at it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260420102544.8924-3-thorsten.blum@linux.dev Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-20Merge tag 'apple-soc-fixes-7.0' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/late2 Apple SoC fixes for 7.0 Two commits without any functional changes that arrived just before the merge window opened: - Update Sasha's email address in all dt-bindings, MAINTAINERS and add him to mailmap - Fix a typo in spi1-nvram.dtsi * tag 'apple-soc-fixes-7.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: Fix spelling error dt-bindings: Update Sasha Finkelstein's email address mailmap: Update Sasha Finkelstein's email address Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-20wifi: ath12k: Fix ath12k_dp_htt_tlv_iter()'s iter() signatureJeff Johnson
Per ath12k convention, a pointer to struct ath12k_base should be named 'ab'. However, the current signature of the 'iter' parameter of ath12k_dp_htt_tlv_iter() uses 'ar'. Change it to use 'ab'. No functional changes, compile tested only. Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260409-ath12k-htc-proto-v1-2-cda86d6355f1@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-04-20wifi: ath12k: Fix HTC prototype ath12k_base parametersJeff Johnson
Per ath12k convention, a pointer to struct ath12k_base should be named 'ab'. However, in htc.h, several function prototypes do not follow the convention, and instead use 'ar'. Conversely, in htc.c, the function implementations all correctly use 'ab'. So update the prototypes to match the implementations. No functional changes, compile tested only. Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260409-ath12k-htc-proto-v1-1-cda86d6355f1@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-04-20Documentation/process: maintainer-soc: Document purpose of defconfigsKrzysztof Kozlowski
Common mistake in commit messages of patches on mailing list adding CONFIG options to arm/multi_v7 or arm64/defconfig is saying what that patch is doing, e.g. "Enable driver foo". That is obvious from the diff part, thus explaining it does not bring any value. What brings value is to understand why "driver foo" should be in a shared, upstream defconfig, especially considering that distros have their own defconfigs and we do not care about non-upstream trees. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260413074401.27282-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-20Documentation/process: maintainer-soc: Trim from trivial ask-DTKrzysztof Kozlowski
It is obvious that one can ask DT maintainers of something, just like one can ask anyone, so just drop the sentence. Concise documents with rules have bigger chances of actually being read by people. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260413074401.27282-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-20ARM: dts: bcm4709: fix bus range assignmentArnd Bergmann
The netgear r8000 dts file limits the bus range for the first host bridge to exclude bus 0, but the two devices on the first bus are explicitly assigned to bus 0, causing a build time warning: /home/arnd/arm-soc/arch/arm/boot/dts/broadcom/bcm4709-netgear-r8000.dts:142.3-27: Warning (pci_device_bus_num): /axi@18000000/pcie@13000/pcie@0/pcie@0,0/pcie@1,0:bus-range: PCI bus number 0 out of range, expected (1 - 255) /home/arnd/arm-soc/arch/arm/boot/dts/broadcom/bcm4709-netgear-r8000.dts:142.3-27: Warning (pci_device_bus_num): /axi@18000000/pcie@13000/pcie@0/pcie@0,0/pcie@2,0:bus-range: PCI bus number 0 out of range, expected (1 - 255) As Rosen mentioned, the bus-range property was a mistake, so just remove it and keep the reg values pointing to bus 0, which is allowed by the default bus range of the SoC. Fixes: 893faf67438c ("ARM: dts: BCM5301X: add root pcie bridges") Suggested-by: Rosen Penev <rosenp@gmail.com> Link: https://lore.kernel.org/r/20260414064754.3129667-1-arnd@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-20Merge tag 'mvebu-dt64-7.1-1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/late2 mvebu dt64 for 7.1 (part 1) - Armada 37xx/3720 device tree fixes: - Reorder USB PHYs, standardize names, drop undocumented properties, fix schema alignment - Add Marvell 7k COMe board bindings and uDPU ethernet aliases - Cleanup: drop unused .dtsi files * tag 'mvebu-dt64-7.1-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: armada-37xx: swap PHYs' order in USB3 controller node arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names arm64: dts: marvell: armada-37xx: drop 'marvell,usb-misc-reg' from USB host nodes arm64: dts: marvell: armada-37xx: drop redundant status property arm64: dts: marvell: armada-37xx: align 'phy-names' of EHCI node with DT schema dt-bindings: arm64: add Marvell 7k COMe boards arm64: dts: marvell: armada-3720: drop 'marvell,xenon-emmc' properties arm64: dts: marvell: uDPU: add ethernet aliases arm/arm64: dts: marvell: Drop unused .dtsi arm64: dts: a7k: use phy handle Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-04-20Merge branch 'arm/fixes' into soc/late2Arnd Bergmann
* arm/fixes: arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT reset: amlogic: t7: Fix null reset ops arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT dt-bindings: arm64: add Marvell 7k COMe boards
2026-04-20isofs: validate block number from NFS file handle in isofs_export_igetMichael Bommarito
isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker- controlled block number (ifid->block or ifid->parent_block) from the NFS file handle to isofs_export_iget(), which only rejects block == 0 before calling isofs_iget() and ultimately sb_bread(). A crafted file handle with fh_len sufficient to pass the check added by commit 0405d4b63d08 ("isofs: Prevent the use of too small fid") can still drive the server to read any in-range block on the backing device as if it were an iso_directory_record. That earlier fix was assigned CVE-2025-37780. sb_bread() on an out-of-range block returns NULL cleanly via the EIO path, so there is no memory-safety violation. For in-range reads of adjacent-partition data on the same block device, the unrelated bytes end up in iso_inode_info fields that reach the NFS client as dentry metadata. The deployment surface (isofs exported over NFS from loop-mounted images) is narrow and requires an authenticated NFS peer, but the malformed-file-handle class is reportable as hardening next to the existing CVE-2025-37780 fix. Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent() call sites with a single line. Fixes: 0405d4b63d08 ("isofs: Prevent the use of too small fid") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260419212155.2169382-3-michael.bommarito@gmail.com Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-20isofs: validate Rock Ridge CE continuation extent against volume sizeMichael Bommarito
rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice. Fixes: f54e18f1b831 ("isofs: Fix infinite looping over CE entries") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260419212155.2169382-2-michael.bommarito@gmail.com Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-20selftests/bpf: Fix off-by-one in bpf_cpumask_populate related selftestMatt Bobrowski
The test_populate test uses >= instead of > when checking if the runtime nr_cpus exceeds the bit capacity of a cpumask_t. On a system where the physical CPU core count perfectly matches the CONFIG_NR_CPUS upper bound (e.g. nr_cpus = 512 and CONFIG_NR_CPUS = 512), the condition nr_cpus >= CPUMASK_TEST_MASKLEN * 8 evaluates to true (512 >= 512). This incorrectly causes the test to fail with an error value of 3. A 512-bit cpumask_t provides enough bits (indices 0 through 511) to represent 512 CPUs. The subsequent bpf_for(i, 0, nr_cpus) loop iterates up to nr_cpus - 1 (511), which perfectly aligns with the maximum valid index of the bitmask. Change the condition to nr_cpus > CPUMASK_TEST_MASKLEN * 8 to fix the false positive failure on these systems. Fixes: 918ba2636d4e ("selftests: bpf: add bpf_cpumask_populate selftests") Signed-off-by: Matt Bobrowski <mattbobrowski@google.com> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/bpf/20260420093734.2400330-1-mattbobrowski@google.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-20MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm ↵Yongbang Shi
matainers To improve maintainability, split the maintainer information for the hibmc and kirin drivers under the drivers/gpu/drm/hisilicon directory. drivers/gpu/drm/hisilicon/hibmc driver has almost completed feature development based on the new generation HiSilicon BMC chip. It was co-developed by Yongbang Shi, Baihan Li and Lin He. Going forward, this module will be maintained by Yongbang Shi. Signed-off-by: Yongbang Shi <shiyongbang@huawei.com> Acked-by: Tao Tian <tiantao6@hisilicon.com> Acked-by: Xinliang Liu <xinliang.liu@linaro.org> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260319131132.722033-1-shiyongbang@huawei.com
2026-04-20Merge branch 'for-next/c1-pro-erratum-4193714' into for-next/coreCatalin Marinas
* for-next/c1-pro-erratum-4193714: : Work around C1-Pro erratum 4193714 (CVE-2026-0995) arm64: errata: Work around early CME DVMSync acknowledgement arm64: cputype: Add C1-Pro definitions arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish() arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance
2026-04-20Merge branches 'for-next/misc' and 'for-next/mpam' into for-next/coreCatalin Marinas
* for-next/misc: : Miscellaneous cleanups/fixes virt: arm-cca-guest: fix error check for RSI_INCOMPLETE arm64/hwcap: Include kernel-hwcap.h in list of generated files * for-next/mpam: : Fix an unmount->remount problem with the CDP emulation, uninitialised : variable and checker warnings arm_mpam: resctrl: Make resctrl_mon_ctx_waiters static arm_mpam: resctrl: Fix the check for no monitor components found arm_mpam: resctrl: Fix MBA CDP alloc_capable handling on unmount
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-13 15:50:05 +0000