summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-20Merge branch 'rework/prb-fixes' into for-linusPetr Mladek
2026-04-20Merge branch 'for-7.1-printf-kunit-build' into for-linusPetr Mladek
2026-04-20spi: fix explicit controller deregistrationMark Brown
Johan Hovold <johan@kernel.org> says: Turns out we have a few drivers that get the tear down ordering wrong also when not using device managed registration (cf. [1] and [2]). Fix this to avoid issues like system errors due to unclocked accesses, NULL-pointer dereferences, hangs or failed I/O during during deregistration (e.g. when powering down devices). Johan [1] https://lore.kernel.org/lkml/20260409120419.388546-2-johan@kernel.org/ [2] https://lore.kernel.org/lkml/20260410081757.503099-1-johan@kernel.org/
2026-04-20spi: topcliff-pch: fix use-after-free on unbindJohan Hovold
Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support") Cc: stable@vger.kernel.org # 3.1 Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: topcliff-pch: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and DMA during driver unbind. Fixes: e8b17b5b3f30 ("spi/topcliff: Add topcliff platform controller hub (PCH) spi bus driver") Cc: stable@vger.kernel.org # 2.6.37 Cc: Masayuki Ohtake <masa-korg@dsn.okisemi.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-8-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: orion: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: 60cadec9da7b ("spi: new orion_spi driver") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-7-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: mxic: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling underlying resources like clocks (via runtime pm) during driver unbind. Fixes: b942d80b0a39 ("spi: Add MXIC controller driver") Cc: stable@vger.kernel.org # 5.0: cc53711b2191 Cc: stable@vger.kernel.org # 5.0 Cc: Mason Yang <masonccyang@mxic.com.tw> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-6-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: mpc52xx: fix use-after-free on unbindJohan Hovold
The state machine work is scheduled by the interrupt handler and therefore needs to be cancelled after disabling interrupts to avoid a potential use-after-free. Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remove") Cc: stable@vger.kernel.org Cc: Pei Xiao <xiaopei01@kylinos.cn> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: mpc52xx: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling and releasing underlying resources like interrupts and gpios during driver unbind. Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver") Fixes: b8d4e2ce60b6 ("mpc52xx_spi: add gpio chipselect") Cc: stable@vger.kernel.org # 2.6.33 Cc: Grant Likely <grant.likely@secretlab.ca> Cc: Luotao Fu <l.fu@pengutronix.de> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-4-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: cadence-quadspi: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before dropping the reference count that allows new operations to start to allow SPI drivers to do I/O during deregistration. Fixes: 7446284023e8 ("spi: cadence-quadspi: Implement refcount to handle unbind during busy") Cc: stable@vger.kernel.org # 6.17 Cc: Khairul Anuar Romli <khairul.anuar.romli@altera.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20spi: cadence: fix controller deregistrationJohan Hovold
Make sure to deregister the controller before disabling underlying resources like clocks during driver unbind. Fixes: c474b3866546 ("spi: Add driver for Cadence SPI controller") Cc: stable@vger.kernel.org # 3.16 Cc: Harini Katakam <harinik@xilinx.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260414134319.978196-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-20drm/i915/psr: Init variable to avoid early exit from et alignment loopJouni Högander
Uninitialized boolean variable may cause unwanted exit from et alignment loop. Fix this by initializing it as false. Fixes: 1be2fca84f52 ("drm/i915/psr: Repeat Selective Update area alignment") Cc: <stable@vger.kernel.org> # v6.9+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Nemesa Garg <nemesa.garg@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://patch.msgid.link/20260413112345.88853-1-jouni.hogander@intel.com (cherry picked from commit 289678a90b8cf81e3514c9d6c667235cd39c7acf) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-04-20gpio: aspeed: fix AST2700 debounce selector bit definitionsBilly Tsai
The AST2700 datasheet defines reg_debounce_sel1 as the low bit and reg_debounce_sel2 as the high bit. The current driver uses the AST2600 mapping instead, where sel1 is the high bit and sel2 is the low bit. As a result, the debounce selector bits are programmed in reverse on AST2700. Swap the G7 sel1/sel2 bit definitions so the driver matches the hardware definition. Fixes: b2e861bd1eaf ("gpio: aspeed: Support G7 Aspeed gpio controller") Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com> Link: https://patch.msgid.link/20260415-gpio-fix-v1-1-b08a89b31e6f@aspeedtech.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-04-20gpio: rockchip: Fix GPIO regression after conversion to dynamic base allocationJonas Karlman
The commit c8079f83e0bf ("gpio: rockchip: convert to dynamic GPIO base allocation") broke GPIO on devices using device trees which don't set the gpio-ranges property, something only Rockchip RK35xx SoC DTs do. On a Rockchip RK3399 device something like following is now observed: [ 0.082771] rockchip-gpio ff720000.gpio: probed /pinctrl/gpio@ff720000 [ 0.083531] rockchip-gpio ff730000.gpio: probed /pinctrl/gpio@ff730000 [ 0.084110] rockchip-gpio ff780000.gpio: probed /pinctrl/gpio@ff780000 [ 0.084746] rockchip-gpio ff788000.gpio: probed /pinctrl/gpio@ff788000 [ 0.085389] rockchip-gpio ff790000.gpio: probed /pinctrl/gpio@ff790000 -- [ 0.212208] rockchip-pinctrl pinctrl: pin 637 is not registered so it cannot be requested [ 0.212271] rockchip-pinctrl pinctrl: error -EINVAL: pin-637 (gpio3:637) [ 0.212344] leds-gpio leds: error -EINVAL: Failed to get GPIO '/leds/led-0' [ 0.212389] leds-gpio leds: probe with driver leds-gpio failed with error -22 -- [ 0.607545] rockchip-pinctrl pinctrl: pin 519 is not registered so it cannot be requested [ 0.608775] rockchip-pinctrl pinctrl: error -EINVAL: pin-519 (gpio0:519) [ 0.610003] dwmmc_rockchip fe320000.mmc: probe with driver dwmmc_rockchip failed with error -22 -- [ 0.805882] rockchip-pinctrl pinctrl: pin 547 is not registered so it cannot be requested [ 0.806672] rockchip-pinctrl pinctrl: error -EINVAL: pin-547 (gpio1:547) [ 0.807301] reg-fixed-voltage regulator-vbus-typec: error -EINVAL: can't get GPIO [ 0.807307] rockchip-pinctrl pinctrl: pin 602 is not registered so it cannot be requested [ 0.807970] reg-fixed-voltage regulator-vbus-typec: probe with driver reg-fixed-voltage failed with error -22 [ 0.808692] rockchip-pinctrl pinctrl: error -EINVAL: pin-602 (gpio2:602) [ 0.810279] reg-fixed-voltage regulator-vcc3v3-pcie: error -EINVAL: can't get GPIO [ 0.810284] rockchip-pinctrl pinctrl: pin 665 is not registered so it cannot be requested [ 0.810299] rockchip-pinctrl pinctrl: error -EINVAL: pin-665 (gpio4:665) [ 0.810960] reg-fixed-voltage regulator-vcc3v3-pcie: probe with driver reg-fixed-voltage failed with error -22 [ 0.811679] reg-fixed-voltage regulator-vcc5v0-host: error -EINVAL: can't get GPIO [ 0.813943] reg-fixed-voltage regulator-vcc5v0-host: probe with driver reg-fixed-voltage failed with error -22 -- [ 0.867788] rockchip-pinctrl pinctrl: pin 522 is not registered so it cannot be requested [ 0.868537] rockchip-pinctrl pinctrl: error -EINVAL: pin-522 (gpio0:522) [ 0.869166] pwrseq_simple sdio-pwrseq: error -EINVAL: reset GPIOs not ready [ 0.869798] pwrseq_simple sdio-pwrseq: probe with driver pwrseq_simple failed with error -22 -- [ 0.940365] rockchip-pinctrl pinctrl: pin 623 is not registered so it cannot be requested [ 0.941084] rockchip-pinctrl pinctrl: error -EINVAL: pin-623 (gpio3:623) [ 0.941823] rk_gmac-dwmac fe300000.ethernet: error -EINVAL: Cannot register the MDIO bus [ 0.942542] rk_gmac-dwmac fe300000.ethernet: error -EINVAL: MDIO bus (id: 0) registration failed [ 0.943772] rk_gmac-dwmac fe300000.ethernet: probe with driver rk_gmac-dwmac failed with error -22 Restore GPIO to a working state on devices using older Rockchip SoCs and/or DTs not having the gpio-ranges property set by restoring prior use of bank->pin_base as the pin_offset value. Also change to use bank->nr_pins as the npins value to align and prevent a possible future breakage if gc->ngpio is ever changed to match the 32 GPIOs each controller theoretically can handle. Fixes: c8079f83e0bf ("gpio: rockchip: convert to dynamic GPIO base allocation") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Linus Walleij <linusw@kernel.org> Acked-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260416154928.2103388-1-jonas@kwiboo.se Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-04-20crypto: krb5enc - fix async decrypt skipping hash verificationDudu Lu
krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this signals "done" to the caller without executing krb5enc_dispatch_decrypt_hash(), completely bypassing the integrity verification (hash check). Compare with the encrypt path which correctly uses krb5enc_encrypt_done as an intermediate callback to chain into the hash computation on async completion. Fix by adding krb5enc_decrypt_done as an intermediate callback that chains into krb5enc_dispatch_decrypt_hash() upon async skcipher completion, matching the encrypt path's callback pattern. Also fix EBUSY/EINPROGRESS handling throughout: remove krb5enc_request_complete() which incorrectly swallowed EINPROGRESS notifications that must be passed up to callers waiting on backlogged requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done for the dispatch_encrypt return value. Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") Signed-off-by: Dudu Lu <phx0fer@gmail.com> Unset MAY_BACKLOG on the async completion path so the user won't see back-to-back EINPROGRESS notifications. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-04-20crypto: algif_aead - snapshot IV for async AEAD requestsDouya Le
AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity can update that shared state before the original request has fully completed, which can lead to inconsistent IV handling. Snapshot the IV into per-request storage when preparing the AEAD request, so in-flight operations no longer depend on mutable socket state. Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") Cc: stable@kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn> Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn> Tested-by: Yucheng Lu <kanolyc@gmail.com> Signed-off-by: Douya Le <ldy3087146292@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-04-20fanotify: Fix spelling mistake "enforecement" -> "enforcement"Ethan Carter Edwards
There is a spelling mistake in a comment. Fix it. Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com> Link: https://patch.msgid.link/20260418-fanotify-typo-v1-1-03ea48cb44ba@ethancedwards.com Signed-off-by: Jan Kara <jack@suse.cz>
2026-04-20xfrm: ah: account for ESN high bits in async callbacksMichael Bommarito
AH allocates its temporary auth/ICV layout differently when ESN is enabled: the async ahash setup appends a 4-byte seqhi slot before the ICV or auth_data area, but the async completion callbacks still reconstruct the temporary layout as if seqhi were absent. With an async AH implementation selected, that makes AH copy or compare the wrong bytes on both the IPv4 and IPv6 paths. In UML repro on IPv4 AH with ESN and forced async hmac(sha1), ping fails with 100% packet loss, and the callback logs show the pre-fix drift: ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24 ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36 Reconstruct the callback-side layout the same way the setup path built it by skipping the ESN seqhi slot before locating the saved auth_data or ICV. Per RFC 4302, the ESN high-order 32 bits participate in the AH ICV computation, so the async callbacks must account for the seqhi slot. Post-fix, the same IPv4 AH+ESN+forced-async-hmac(sha1) UML repro shows the corrected offset (ah4 output_done: esn=1 err=0 icv_off=24 expected_off=24) and ping succeeds; net/ipv4/ah4.o and net/ipv6/ah6.o build clean at W=1. IPv6 AH+ESN was not exercised at runtime, and the change has not been tested against a real async hardware AH engine. Fixes: d4d573d0334d ("{IPv4,xfrm} Add ESN support for AH egress part") Fixes: d8b2a8600b0e ("{IPv4,xfrm} Add ESN support for AH ingress part") Fixes: 26dd70c3fad3 ("{IPv6,xfrm} Add ESN support for AH egress part") Fixes: 8d6da6f32557 ("{IPv6,xfrm} Add ESN support for AH ingress part") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5-4 Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2026-04-20Merge branch into tip/master: 'timers/clocksource'Ingo Molnar
# New commits in timers/clocksource: 68ed094971b0 ("clocksource/drivers/timer-of: Make the code compatible with modules") 2423405880c2 ("clocksource/drivers/mmio: Make the code compatible with modules") fed9f727cc3f ("clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()") 045a9dac7eb7 ("clocksource/drivers/timer-rtl-otto: Make rttm_cs variable static") b385caf91868 ("dt-bindings: timer: fsl,imxgpt: add compatible string fsl,imx25-epit") Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-04-20Merge branch into tip/master: 'timers/urgent'Ingo Molnar
# New commits in timers/urgent: 4096fd0e8eae ("clockevents: Add missing resets of the next_event_forced flag") Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-04-20Merge branch into tip/master: 'core/urgent'Ingo Molnar
# New commits in core/urgent: 7b41ff29c8d3 ("entry: Kill ARCH_SYSCALL_WORK_{ENTER,EXIT}") Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-04-20drm/mgag200: Enable DRM_FORMAT_XRGB1555 on the primary planeThomas Zimmermann
The driver already sets the format for the depth value in the XMULCTRL register. Add the format to the other switch statements, set the helpers for gamma correction and export the XRGB1555 in the primary plane's format array. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-7-tzimmermann@suse.de
2026-04-20drm/mgag200: Enable DRM_FORMAT_C8 on the primary planeThomas Zimmermann
The driver already contains all format setting for DRM_FORMAT_C8. Set the gamma-correction helpers and add the format to the array of plane formats. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-6-tzimmermann@suse.de
2026-04-20drm/mgag200: g200se: Set hiprilvl from DRM formatThomas Zimmermann
Replace the deprecated cpp field from struct drm_format_info with the format's 4CC code when setting the hiprilvl field in CRTCEXT6. Using a bpp of 32 for RGB888 is a bit dubious, but we keep it for now to avoid changing behavior. Otherwise, bpp could also be retrieved by calling drm_format_info_bpp(). Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-5-tzimmermann@suse.de
2026-04-20drm/mgag200: Simplify offset calculationThomas Zimmermann
The offset value sets the distance in bytes between two consecutive scanlines. Reduce the calculation to the minimum. According to the Matrox programming manual, Sec 4.6.5, the offset is the scanline pitch in bits divided by 128. The field pitches[0] in struct drm_framebuffer stores the scanline pitch in bytes, so we have to divide by 16 only. Reducing the existing bpp-shift look-up and offset calculations also returns exactly this for all formats. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Co-developed-by: Jocelyn Falempe <jfalempe@redhat.com> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-4-tzimmermann@suse.de
2026-04-20drm/mgag200: Set scale from DRM formatThomas Zimmermann
Replace the deprecated cpp value from struct drm_format_info with the format's 4CC code when setting the scale value in CRTCEXT3. While at it, remove the scale variable and add a mask constant. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-3-tzimmermann@suse.de
2026-04-20drm/mgag200: Set xmulctrl from DRM formatThomas Zimmermann
Replace the deprecated cpp value from struct drm_format_info with the format's 4CC code when setting the depth value in the XMULCTRL register. Split the 16-bit case into XRGB1555 and RGB565. The default branch cannot be taken, so remove it. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260415152625.101710-2-tzimmermann@suse.de
2026-04-20drm/ast: Support DRM_FORMAT_XRGB1555 on the primary planeThomas Zimmermann
Export DRM_FORMAT_XRGB1555 in the primary plane's format array and handle the format in the color-format updates. With this, ast is now feature complete wrt. color-format support. Also update the comments in the gamma-LUT code to reflect the ast manual's terminology. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260414070522.33943-5-tzimmermann@suse.de
2026-04-20drm/ast: Replace references to struct drm_format_info.cppThomas Zimmermann
Replace all uses of struct drm_format_info.cpp with the corresponding 4CC constant. Color-mode selection uses switch statements that branch by cpp in several places. While at it, also name the involved variables according to register names and replace magic values with constants. Replace the use of *ModeIndex constants in ast_set_vbios_color_reg() with correct register constants. The former are array indices and do not belong into registers. In ast_set_color_reg(), vgacra0 is independent from the color format, so move it out from the switch statements. There is also a flag for gamma correction in vgacra8, which currently ast_set_color_reg() handles as part of the primary plane. The gamma LUT and its programming is located in the CRTC. A future update should consolidate gamma correction in the primary plane and implement the functionality with DRM's colorop helpers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260414070522.33943-4-tzimmermann@suse.de
2026-04-20drm/ast: Remove traces of DRM_FORMAT_RGB888 handlingThomas Zimmermann
There's some incomplete handling for DRM_FORMAT_RGB888 in the mode- setting code. It was added by ast's original commit, which imported the code from the user-space Xorg driver. But the hardware doesn't support 24-bit pixel sizes. Hence remove the traces of RGB888 from ast. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260414070522.33943-3-tzimmermann@suse.de
2026-04-20drm/ast: Add constant for VGACR91Thomas Zimmermann
Register VGACR91 receives a password that enables the new mode-info header in other registers. Replace the password's magic value with a constant. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260414070522.33943-2-tzimmermann@suse.de
2026-04-19Merge branch 'next' into for-linusDmitry Torokhov
Prepare input updates for 7.1 merge window.
2026-04-19Input: charlieplex_keypad - add GPIO charlieplex keypadHugo Villeneuve
Add support for GPIO-based charlieplex keypad, allowing to control N^2-N keys using N GPIO lines. Reuse matrix keypad keymap to simplify, even if there is no concept of rows and columns in this type of keyboard. Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Link: https://patch.msgid.link/20260312180304.3865850-5-hugo@hugovil.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19dt-bindings: input: add GPIO charlieplex keypadHugo Villeneuve
Add DT bindings for GPIO charlieplex keypad. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260312180304.3865850-4-hugo@hugovil.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19dt-bindings: input: add settling-time-us common propertyHugo Villeneuve
Add common property that can be reused by other bindings. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260312180304.3865850-3-hugo@hugovil.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19dt-bindings: input: add debounce-delay-ms common propertyHugo Villeneuve
A few bindings are already defining a debounce-delay-ms property, so add it to the input binding to reduce redundant redefines. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260312180304.3865850-2-hugo@hugovil.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19Input: imx_keypad - fix spelling mistake "Colums" -> "Columns"Ethan Carter Edwards
There is a spelling mistake in two comments. Fix them. Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com> Link: https://patch.msgid.link/20260418-imx-typo-v1-1-2a15e54ad4e7@ethancedwards.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19Input: edt-ft5x06 - fix use-after-free in debugfs teardownDmitry Torokhov
The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessible after edt_ft5x06_ts_teardown_debugfs() frees tsdata->raw_buffer. To prevent a use-after-free, protect the freeing of raw_buffer with the device mutex and set raw_buffer to NULL. The debugfs read function already checks if raw_buffer is NULL under the same mutex, so this safely avoids the use-after-free. Fixes: 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/adnJicDh-bTUaWXP@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-19drm/v3d: Reject empty multisync extension to prevent infinite loopAshutosh Desai
v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector. Fixes: e4165ae8304e ("drm/v3d: add multiple syncobjs support") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com> Link: https://patch.msgid.link/20260415050000.3816128-1-ashutoshdesai993@gmail.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-20MAINTAINERS: add Rust I2C tree and update Igor Korotin's emailIgor Korotin
Add a git tree entry for Rust I2C development and update the e-mail address. The tree will be used to collect patches and provide a basis for integration and testing, including linux-next. Signed-off-by: Igor Korotin <igor.korotin@linux.dev> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
2026-04-20Merge tag 'i2c-host-7.1-part2' of ↵Wolfram Sang
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v7.1, part 2 - cx92755: convert I2C bindings to DT schema - mediatek: add optional bus power management during transfers - pxa: handle early bus busy condition
2026-04-19Merge tag 'mm-hotfixes-stable-2026-04-19-00-14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "7 hotfixes. 6 are cc:stable and all are for MM. Please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-04-19-00-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/core: disallow non-power of two min_region_sz on damon_start() mm/vmalloc: take vmap_purge_lock in shrinker mm: call ->free_folio() directly in folio_unmap_invalidate() mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() mm/zone_device: do not touch device folio after calling ->folio_free() mm/damon/core: disallow time-quota setting zero esz mm/mempolicy: fix weighted interleave auto sysfs name
2026-04-19Merge tag 'driver-core-7.1-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Prevent a device from being probed before device_add() has finished initializing it; gate probe with a "ready_to_probe" device flag to avoid races with concurrent driver_register() calls - Fix a kernel-doc warning for DEV_FLAG_COUNT introduced by the above - Return -ENOTCONN from software_node_get_reference_args() when a referenced software node is known but not yet registered, allowing callers to defer probe - In sysfs_group_attrs_change_owner(), also check is_visible_const(); missed when the const variant was introduced * tag 'driver-core-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: driver core: Add kernel-doc for DEV_FLAG_COUNT enum value sysfs: attribute_group: Respect is_visible_const() when changing owner software node: return -ENOTCONN when referenced swnode is not registered yet driver core: Don't let a device probe until it's ready
2026-04-19sched_ext: Document the ops compat strategy in compat.h/compat.bpf.hTejun Heo
The comments around SCX_OPS_DEFINE() and SCX_OPS_OPEN() were vague about how backward compatibility actually works. Expand them to describe the two mechanisms: load-time BTF fix-up for additive changes, and multi-variant struct_ops for incompatible ones. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Andrea Righi <arighi@nvidia.com> Acked-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
2026-04-19Merge tag 'staging-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the "big" set of staging driver changes for 7.1-rc1. Nothing major in here at all, just lots of little cleanups for the staging drivers, driven by new developers getting their feet wet in kernel development. "Largest" thing in here is the change of some of the octeon variable types into proper kernel ones. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (154 commits) staging: rtl8723bs: remove redundant & parentheses staging: most: dim2: replace BUG_ON() in poison_channel() staging: most: dim2: replace BUG_ON() in enqueue() staging: most: dim2: replace BUG_ON() in configure_channel() staging: most: dim2: replace BUG_ON() in service_done_flag() staging: most: dim2: replace BUG_ON() in try_start_dim_transfer() staging: rtl8723bs: remove unused RTL8188E antenna selection macros staging: rtl8723bs: remove redundant blank lines in basic_types.h staging: rtl8723bs: wrap complex macros with parentheses staging: rtl8723bs: remove unused WRITEEF/READEF byte macros staging: rtl8723bs: rename camelCase variable staging: greybus: audio: fix error message for BTN_3 button staging: rtl8723bs: rename variables to snake_case staging: rtl8723bs: fix spelling in comment staging: rtl8723bs: cleanup return in sdio_init() staging: rtl8723bs: use direct returns in sdio_dvobj_init() staging: rtl8723bs: remove unused arg at odm_interface.h greybus: raw: fix use-after-free if write is called after disconnect greybus: raw: fix use-after-free on cdev close staging: rtl8723bs: fix logical continuations in xmit_linux.c ...
2026-04-19Merge tag 'usb-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt changes for 7.1-rc1. Lots of little things in here, nothing major, just constant improvements, updates, and new features. Highlights are: - new USB power supply driver support. These changes did touch outside of drivers/usb/ but got acks from the relevant mantainers for them. - dts file updates and conversions - string function conversions into "safer" ones - new device quirks - xhci driver updates - usb gadget driver minor fixes - typec driver additions and updates - small number of thunderbolt driver changes - dwc3 driver updates and additions of new hardware support - other minor driver updates All of these have been in the linux-next tree for a while with no reported issues" * tag 'usb-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (176 commits) usb: dwc3: starfive: Add JHB100 USB 2.0 DRD controller dt-bindings: usb: dwc3: add support for StarFive JHB100 dt-bindings: usb: atmel,at91sam9rl-udc: convert to DT schema dt-bindings: usb: atmel,at91rm9200-udc: convert to DT schema dt-bindings: usb: generic-ehci: fix schema structure and add at91sam9g45 constraints dt-bindings: usb: generic-ohci: add AT91RM9200 OHCI binding support arm: dts: at91: remove unused #address-cells/#size-cells from sam9x60 udc node drivers/usb/host: Fix spelling error 'seperate' -> 'separate' usbip: tools: add hint when no exported devices are found USB: serial: iuu_phoenix: fix iuutool author name usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() usb: gadget: f_hid: Add missing error code usb: typec: cros_ec_ucsi: Load driver from OF and ACPI definitions dt-bindings: chrome: Add cros-ec-ucsi compatibility to typec binding USB: of: Simplify with scoped for each OF child loop usbip: validate number_of_packets in usbip_pack_ret_submit() usb: gadget: renesas_usb3: validate endpoint index in standard request handlers usb: core: config: reverse the size check of the SSP isoc endpoint descriptor usb: typec: ucsi: Set usb mode on partner change ...
2026-04-19sched_ext: Mark scx_sched_hash insecure_elasticityTejun Heo
scx_sched_hash is inserted into under scx_sched_lock (raw_spinlock_irq) in scx_link_sched(). rhashtable's sync grow path calls get_random_u32() and does a GFP_ATOMIC allocation; both acquire regular spinlocks, which is unsafe under raw_spinlock_t. Set insecure_elasticity to skip the sync grow. v2: - Dropped dsq_hash changes. Insertion is not under raw_spin_lock. - Switched from no_sync_grow flag to insecure_elasticity. Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers") Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-19rhashtable: Restore insecure_elasticity toggleHerbert Xu
Some users of rhashtable cannot handle insertion failures, and are happy to accept the consequences of a hash table that having very long chains. Restore the insecure_elasticity toggle for these users. In addition to disabling the chain length checks, this also removes the emergency resize that would otherwise occur when the hash table occupancy hits 100% (an async resize is still scheduled at 75%). Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-19Merge tag 'tty-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the set of tty and serial driver changes for 7.1-rc1. Not much here this cycle, biggest thing is the removal of an old driver that never got any actual hardware support (esp32), and the second try to moving the tty ports to their own workqueues (first try was in 7.0-rc1 but was reverted due to problems) Otherwise it's just a small set of driver updates and some vt modifier key enhancements. All have been in linux-next for a while with no reported issues" * tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (35 commits) tty: serial: ip22zilog: Fix section mispatch warning hvc/xen: Check console connection flag serial: sh-sci: Add support for RZ/G3L RSCI dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC tty: atmel_serial: update outdated reference to atmel_tasklet_func() serial: xilinx_uartps: Drop unused include serial: qcom-geni: drop stray newline format specifier serial: 8250: loongson: Enable building on MIPS Loongson64 dt-bindings: serial: 8250: Add Loongson 3A4000 uart compatible serial: 8250_fintek: Add support for F81214E tty: tty_port: add workqueue to flip TTY buffer vt: support ITU-T T.416 color subparameters serial: qcom-geni: Fix RTS behavior with flow control tty: serial: imx: keep dma request disabled before dma transfer setup tty: serial: 8250: Add SystemBase Multi I/O cards serial: pic32_uart: allow driver to be compiled on all architectures with COMPILE_TEST serial: tegra: remove Kconfig dependency on APB DMA controller dt-bindings: serial: amlogic,meson-uart: Add compatible string for A9 dt-bindings: serial: atmel,at91-usart: add microchip,lan9691-usart serial: auart: check clk_enable() return in console write ...
2026-04-19Merge tag 'mm-stable-2026-04-18-02-14' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "Eliminate Dying Memory Cgroup" (Qi Zheng and Muchun Song) Address the longstanding "dying memcg problem". A situation wherein a no-longer-used memory control group will hang around for an extended period pointlessly consuming memory - "fix unexpected type conversions and potential overflows" (Qi Zheng) Fix a couple of potential 32-bit/64-bit issues which were identified during review of the "Eliminate Dying Memory Cgroup" series - "kho: history: track previous kernel version and kexec boot count" (Breno Leitao) Use Kexec Handover (KHO) to pass the previous kernel's version string and the number of kexec reboots since the last cold boot to the next kernel, and print it at boot time - "liveupdate: prevent double preservation" (Pasha Tatashin) Teach LUO to avoid managing the same file across different active sessions - "liveupdate: Fix module unloading and unregister API" (Pasha Tatashin) Address an issue with how LUO handles module reference counting and unregistration during module unloading - "zswap pool per-CPU acomp_ctx simplifications" (Kanchana Sridhar) Simplify and clean up the zswap crypto compression handling and improve the lifecycle management of zswap pool's per-CPU acomp_ctx resources - "mm/damon/core: fix damon_call()/damos_walk() vs kdmond exit race" (SeongJae Park) Address unlikely but possible leaks and deadlocks in damon_call() and damon_walk() - "mm/damon/core: validate damos_quota_goal->nid" (SeongJae Park) Fix a couple of root-only wild pointer dereferences - "Docs/admin-guide/mm/damon: warn commit_inputs vs other params race" (SeongJae Park) Update the DAMON documentation to warn operators about potential races which can occur if the commit_inputs parameter is altered at the wrong time - "Minor hmm_test fixes and cleanups" (Alistair Popple) Bugfixes and a cleanup for the HMM kernel selftests - "Modify memfd_luo code" (Chenghao Duan) Cleanups, simplifications and speedups to the memfd_lou code - "mm, kvm: allow uffd support in guest_memfd" (Mike Rapoport) Support for userfaultfd in guest_memfd - "selftests/mm: skip several tests when thp is not available" (Chunyu Hu) Fix several issues in the selftests code which were causing breakage when the tests were run on CONFIG_THP=n kernels - "mm/mprotect: micro-optimization work" (Pedro Falcato) A couple of nice speedups for mprotect() - "MAINTAINERS: update KHO and LIVE UPDATE entries" (Pratyush Yadav) Document upcoming changes in the maintenance of KHO, LUO, memfd_luo, kexec, crash, kdump and probably other kexec-based things - they are being moved out of mm.git and into a new git tree * tag 'mm-stable-2026-04-18-02-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (121 commits) MAINTAINERS: add page cache reviewer mm/vmscan: avoid false-positive -Wuninitialized warning MAINTAINERS: update Dave's kdump reviewer email address MAINTAINERS: drop include/linux/liveupdate from LIVE UPDATE MAINTAINERS: drop include/linux/kho/abi/ from KHO MAINTAINERS: update KHO and LIVE UPDATE maintainers MAINTAINERS: update kexec/kdump maintainers entries mm/migrate_device: remove dead migration entry check in migrate_vma_collect_huge_pmd() selftests: mm: skip charge_reserved_hugetlb without killall userfaultfd: allow registration of ranges below mmap_min_addr mm/vmstat: fix vmstat_shepherd double-scheduling vmstat_update mm/hugetlb: fix early boot crash on parameters without '=' separator zram: reject unrecognized type= values in recompress_store() docs: proc: document ProtectionKey in smaps mm/mprotect: special-case small folios when applying permissions mm/mprotect: move softleaf code out of the main function mm: remove '!root_reclaim' checking in should_abort_scan() mm/sparse: fix comment for section map alignment mm/page_io: use sio->len for PSWPIN accounting in sio_read_complete() selftests/mm: transhuge_stress: skip the test when thp not available ...
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-13 15:13:11 +0000