summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-14Merge tag 'kbuild-7.1-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild/Kconfig updates from Nicolas Schier: "Kbuild: - reject unexpected values for LLVM= - uapi: remove usage of toolchain headers - switch from '-fms-extensions' to '-fms-anonymous-structs' when available (currently: clang >= 23.0.0) - reduce the number of compiler-generated suffixes for clang thin-lto build - reduce output spam ("GEN Makefile") when building out of tree - improve portability for testing headers - also test UAPI headers against C++ compilers - drop build ID architecture allow-list in vdso_install - only run checksyscalls when necessary - update the debug information notes in reproducible-builds.rst - expand inlining hints with -fdiagnostics-show-inlining-chain Kconfig: - forbid multiple entries with the same symbol in a choice - error out on duplicated kconfig inclusion" * tag 'kbuild-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (35 commits) kbuild: expand inlining hints with -fdiagnostics-show-inlining-chain kconfig: forbid multiple entries with the same symbol in a choice Documentation: kbuild: Update the debug information notes in reproducible-builds.rst checksyscalls: move instance functionality into generic code checksyscalls: only run when necessary checksyscalls: fail on all intermediate errors checksyscalls: move path to reference table to a variable kbuild: vdso_install: drop build ID architecture allow-list kbuild: vdso_install: gracefully handle images without build ID kbuild: vdso_install: hide readelf warnings kbuild: vdso_install: split out the readelf invocation kbuild: uapi: also test UAPI headers against C++ compilers kbuild: uapi: provide a C++ compatible dummy definition of NULL kbuild: uapi: handle UML in architecture-specific exclusion lists kbuild: uapi: move all include path flags together kbuild: uapi: move some compiler arguments out of the command definition check-uapi: use dummy libc includes check-uapi: honor ${CROSS_COMPILE} setting check-uapi: link into shared objects kbuild: reduce output spam when building out of tree ...
2026-04-14accel/amdxdna: Fix order of canceled mailbox messagesLizhi Hou
Mailbox message IDs are allocated cyclically. When destroying a mailbox channel, pending messages are canceled starting from message ID 0. This results in an incorrect cancellation order when the ID of the last posted message wraps around and is smaller than the ID of the first posted message. Fix this by canceling pending messages starting from the next available message ID, ensuring the correct ordering across wraparound. Fixes: a37d78470bcc ("accel/amdxdna: Replace idr api with xarray") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260413181843.670796-1-lizhi.hou@amd.com
2026-04-14accel/amdxdna: Fix iommu_map_sgtable() return value handlingLizhi Hou
iommu_map_sgtable() returns negative error codes on failure, but the result is stored in an unsigned variable. This prevents proper error detection. Change the variable type to ssize_t so negative error values can be handled correctly. Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter") Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/all/adk7kOUBwIyYnX1M@stanley.mountain/ Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Wendy Liang <wendy.liang@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260413180238.668441-1-lizhi.hou@amd.com
2026-04-14platform/x86: hp-wmi: Add support for Omen 16-wf1xxx (8C77)Krishna Chomal
The HP Omen 16-wf1xxx (board ID: 8C77) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_thermal_params. Testing on board 8C77 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Thomas Arici <absolute3d86@gmail.com> Reported-by: Thomas Arici <absolute3d86@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221300 Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260410191039.125659-5-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-14platform/x86: hp-wmi: Add support for Omen 16-n0xxx (8A44)Krishna Chomal
The HP Omen 16-n0xxx (board ID: 8A44) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_legacy_thermal_params. Testing on board 8A44 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Prasoon Dev <prasoon5050@outlook.com> Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260410191039.125659-4-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-14platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8D87)Krishna Chomal
The HP OMEN MAX 16-ak0xxx (8D87) requires the same WMI queries as other Victus S devices, hence it has been added to the corresponding list. For this reason, platform_profile_victus_s_get_ec() will be called during thermal_profile_setup() and victus_s_powersource_event() to obtain hardware state (platform profile) by reading from the Embedded Controller, however, this particular board's EC does not seem to expose the platform profile value, unlike other boards. Hence EC readback is disabled. Testing on board 8D87 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Jinyang Zhu <Jakie101@proton.me> Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260410191039.125659-3-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-14platform/x86: hp-wmi: fix fan table parsingKrishna Chomal
For Victus S devices, the BIOS fan table header was being incorrectly parsed as: struct { u8 unknown; u8 num_entries; } The first field should be num_fans and the second should be unknown. It is pure coincidence that interpreting an "unknown" field as "num_entries" worked on multiple device, however for board 8D87 (in an upcoming patch), this assumption fails, and the hp-wmi driver fails to load. We fix this by correcting the header definition and compensating for num_entries by parsing each entry of the fan table until an all-NULL row is obtained, mirroring the behavior of OMEN Gaming Hub on Windows. Fixes: 46be1453e6e6 ("platform/x86: hp-wmi: add manual fan control for Victus S models") Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260410191039.125659-2-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-14Merge tag 'bitmap-for-v7.1' of https://github.com/norov/linuxLinus Torvalds
Pull bitmap updates from Yury Norov: - new API: bitmap_weight_from() and bitmap_weighted_xor() (Yury) - drop unused __find_nth_andnot_bit() (Yury) - new tests and test improvements (Andy, Akinobu, Yury) - fixes for count_zeroes API (Yury) - cleanup bitmap_print_to_pagebuf() mess (Yury) - documentation updates (Andy, Kai, Kit). * tag 'bitmap-for-v7.1' of https://github.com/norov/linux: (24 commits) bitops: Update kernel-doc for sign_extendXX() powerpc/xive: simplify xive_spapr_debug_show() thermal: intel: switch cpumask_get() to using cpumask_print_to_pagebuf() coresight: don't use bitmap_print_to_pagebuf() lib/prime_numbers: drop temporary buffer in dump_primes() drm/xe: switch xe_pagefault_queue_init() to using bitmap_weighted_or() ice: use bitmap_empty() in ice_vf_has_no_qs_ena ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() bitmap: introduce bitmap_weighted_xor() bitmap: add test_zero_nbits() bitmap: exclude nbits == 0 cases from bitmap test bitmap: test bitmap_weight() for more asm-generic/bitops: Fix a comment typo in instrumented-atomic.h bitops: fix kernel-doc parameter name for parity8() lib: count_zeros: unify count_{leading,trailing}_zeros() lib: count_zeros: fix 32/64-bit inconsistency in count_trailing_zeros() lib: crypto: fix comments for count_leading_zeros() x86/topology: use bitmap_weight_from() bitmap: add bitmap_weight_from() lib/find_bit_benchmark: avoid clearing randomly filled bitmap in test_find_first_bit() ...
2026-04-14Merge tag 'docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linuxLinus Torvalds
Pull documentation updates from Jonathan Corbet: "A busier cycle than I had expected for docs, including: - Translations: some overdue updates to the Japanese translations, Chinese translations for some of the Rust documentation, and the beginnings of a Portuguese translation. - New documents covering CPU isolation, managed interrupts, debugging Python gbb scripts, and more. - More tooling work from Mauro, reducing docs-build warnings, adding self tests, improving man-page output, bringing in a proper C tokenizer to replace (some of) the mess of kernel-doc regexes, and more. - Update and synchronize changes.rst and scripts/ver_linux, and put both into alphabetical order. ... and a long list of documentation updates, typo fixes, and general improvements" * tag 'docs-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (162 commits) Documentation: core-api: real-time: correct spelling doc: Add CPU Isolation documentation Documentation: Add managed interrupts Documentation: seq_file: drop 2.6 reference docs/zh_CN: update rust/index.rst translation docs/zh_CN: update rust/quick-start.rst translation docs/zh_CN: update rust/coding-guidelines.rst translation docs/zh_CN: update rust/arch-support.rst translation docs/zh_CN: sync process/2.Process.rst with English version docs/zh_CN: fix an inconsistent statement in dev-tools/testing-overview tracing: Documentation: Update histogram-design.rst for fn() handling docs: sysctl: Add documentation for /proc/sys/xen/ Docs: hid: intel-ish-hid: make long URL usable Documentation/kernel-parameters: fix architecture alignment for pt, nopt, and nobypass sched/doc: Update yield_task description in sched-design-CFS Documentation/rtla: Convert links to RST format docs: fix typos and duplicated words across documentation docs: fix typo in zoran driver documentation docs: add an Assisted-by mention to submitting-patches.rst Revert "scripts/checkpatch: add Assisted-by: tag validation" ...
2026-04-14drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()Shuicheng Lin
Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. Fixes: 7970cb36966c ("'drm/xe/hw_engine_group: Register hw engine group's exec queues") Cc: Francois Dugast <francois.dugast@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408020647.3397933-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()Shuicheng Lin
When xe_dma_buf_init_obj() fails, the attachment from dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before returning the error. Note: we cannot use goto out_err here because xe_dma_buf_init_obj() already frees bo on failure, and out_err would double-free it. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Mattheq Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failureShuicheng Lin
When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo is not freed. Add xe_bo_free(storage) before returning the error. xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own error paths. Otherwise, since xe_gem_prime_import() cannot distinguish whether the failure originated from xe_dma_buf_init_obj() or from xe_bo_init_locked(), it cannot safely decide whether the bo should be freed. Add comments documenting the ownership semantics: on success, ownership of storage is transferred to the returned drm_gem_object; on failure, storage is freed before returning. v2: Add comments to explain the free logic. Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()Shuicheng Lin
When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 5a3b0df25d6a ("drm/xe: Allow bo mapping on multiple ggtts") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()Shuicheng Lin
When type is ttm_bo_type_device and aligned_size != size, the function returns an error without freeing a caller-provided bo, violating the documented contract that bo is freed on failure. Add xe_bo_free(bo) before returning the error. Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14drm/xe: Fix potential NULL deref in ↵Shuicheng Lin
xe_exec_queue_tlb_inval_last_fence_put_unlocked xe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q->vm->xe as the first argument to xe_assert(). This function is called unconditionally from xe_exec_queue_destroy() for all queues, including kernel queues that have q->vm == NULL (e.g., queues created during GT init in xe_gt_record_default_lrcs() with vm=NULL). While current compilers optimize away the q->vm->xe dereference (even in CONFIG_DRM_XE_DEBUG=y builds, the compiler pushes the dereference into the WARN branch that is only taken when the assert condition is false), the code is semantically incorrect and constitutes undefined behavior in the C abstract machine for the NULL pointer case. Use gt_to_xe(q->gt) instead, which is always valid for any exec queue. This is consistent with how xe_exec_queue_destroy() itself obtains the xe_device pointer in its own xe_assert at the top of the function. Fixes: b2d7ec41f2a3 ("drm/xe: Attach last fence to TLB invalidation job queues") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260409003449.3405767-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-04-14virt: arm-cca-guest: fix error check for RSI_INCOMPLETESami Mujawar
The RSI interface can return RSI_INCOMPLETE when a report spans multiple granules. This is an expected condition and should not be treated as a fatal error. Currently, arm_cca_report_new() checks for `info.result != RSI_SUCCESS` and bails out, which incorrectly flags RSI_INCOMPLETE as a failure. Fix the check to only break out on results other than RSI_SUCCESS or RSI_INCOMPLETE. This ensures partial reports are handled correctly and avoids spurious -ENXIO errors when generating attestation reports. Fixes: 7999edc484ca ("virt: arm-cca-guest: TSM_REPORT support for realms") Signed-off-by: Sami Mujawar <sami.mujawar@arm.com> Reported-by: Jagdish Gediya <Jagdish.Gediya@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-04-14arm64/hwcap: Include kernel-hwcap.h in list of generated filesMark Brown
When adding generation for the kernel internal constants for hwcaps the generated file was not explicitly flagged as such in the build system, causing it to be regenerated on each build. This wasn't obvious when the series the change was included in was developed since it was all about changes that trigger rebuilds anyway. Fixes: abed23c3c44f ("arm64/hwcap: Generate the KERNEL_HWCAP_ definitions for the hwcaps") Reported-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Mark Brown <broonie@kernel.org> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-04-14MAINTAINERS: Add netkit selftest filesDaniel Borkmann
The following selftest files are related to netkit and should have netkit folks in Cc for review: - tools/testing/selftests/bpf/prog_tests/tc_netkit.c - tools/testing/selftests/drivers/net/hw/nk_qlease.py - tools/testing/selftests/net/nk_qlease.py Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260414075249.611608-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14Merge branch 'follow-ups-to-nk_qlease-net-selftests'Jakub Kicinski
Daniel Borkmann says: ==================== Follow-ups to nk_qlease net selftests This is a set of follow-ups addressing [0]: - Split netdevsim tests from HW tests in nk_qlease and move the SW tests under selftests/net/ - Remove multiple ksft_run()s to fix the recently enforced hard-fail - Move all the setup inside the test cases for the ones under selftests/net/ (I'll defer the HW ones to David) - Add more test coverage related to queue leasing behavior and corner cases, so now we have 45 tests in nk_qlease.py with netdevsim which does not need special HW ==================== Link: https://patch.msgid.link/20260413220809.604592-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14selftests/net: Add additional test coverage in nk_qleaseDaniel Borkmann
Add further netkit queue-lease coverage for netns lifecycle of the guest and physical halves, channel resize across active leases, single-device and multi-lessee scenarios, L3 mode operation, lease capacity exhaustion, and corner-cases of e.g. queue-create rejection paths. Also make the tests more robust by removing the time.sleep(0.1) after netns deletion and turn them into a wait loop. Full test run: # ./nk_qlease.py TAP version 13 1..45 ok 1 nk_qlease.test_remove_phys ok 2 nk_qlease.test_double_lease ok 3 nk_qlease.test_virtual_lessor ok 4 nk_qlease.test_phys_lessee ok 5 nk_qlease.test_different_lessors ok 6 nk_qlease.test_queue_out_of_range ok 7 nk_qlease.test_resize_leased ok 8 nk_qlease.test_self_lease ok 9 nk_qlease.test_create_tx_type ok 10 nk_qlease.test_create_primary ok 11 nk_qlease.test_create_limit ok 12 nk_qlease.test_link_flap_phys ok 13 nk_qlease.test_queue_get_virtual ok 14 nk_qlease.test_remove_virt_first ok 15 nk_qlease.test_multiple_leases ok 16 nk_qlease.test_lease_queue_tx_type ok 17 nk_qlease.test_invalid_netns ok 18 nk_qlease.test_invalid_phys_ifindex ok 19 nk_qlease.test_multi_netkit_remove_phys ok 20 nk_qlease.test_single_remove_phys ok 21 nk_qlease.test_link_flap_virt ok 22 nk_qlease.test_phys_queue_no_lease ok 23 nk_qlease.test_same_ns_lease ok 24 nk_qlease.test_resize_after_unlease ok 25 nk_qlease.test_lease_queue_zero ok 26 nk_qlease.test_release_and_reuse ok 27 nk_qlease.test_veth_queue_create ok 28 nk_qlease.test_two_netkits_same_queue ok 29 nk_qlease.test_l3_mode_lease ok 30 nk_qlease.test_single_double_lease ok 31 nk_qlease.test_single_different_lessors ok 32 nk_qlease.test_cross_ns_netns_id ok 33 nk_qlease.test_delete_guest_netns ok 34 nk_qlease.test_move_guest_netns ok 35 nk_qlease.test_resize_phys_no_reduction ok 36 nk_qlease.test_delete_one_netkit_of_two ok 37 nk_qlease.test_bind_rx_leased_phys_queue ok 38 nk_qlease.test_resize_phys_shrink_past_leased ok 39 nk_qlease.test_resize_virt_not_supported ok 40 nk_qlease.test_lease_devices_down ok 41 nk_qlease.test_lease_capacity_exhaustion ok 42 nk_qlease.test_resize_phys_up ok 43 nk_qlease.test_multi_ns_lease ok 44 nk_qlease.test_multi_ns_delete_one ok 45 nk_qlease.test_move_phys_netns # Totals: pass:45 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260413220809.604592-4-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14selftests/net: Split netdevsim tests from HW tests in nk_qleaseDaniel Borkmann
As pointed out in 3d2c3d2eea9a ("selftests: net: py: explicitly forbid multiple ksft_run() calls"), ksft_run() cannot be called multiple times. Move the netdevsim-based queue lease tests to selftests/net/ so that each file has exactly one ksft_run() call. The HW tests (io_uring ZC RX, queue attrs, XDP with MP, destroy) remain in selftests/drivers/net/hw/. Fixes: 65d657d80684 ("selftests/net: Add queue leasing tests with netkit") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/netdev/20260409181950.7e099b6c@kernel.org Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260413220809.604592-3-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14tools/ynl: Make YnlFamily closeable as a context managerDaniel Borkmann
YnlFamily opens an AF_NETLINK socket in __init__ but has no way to release it other than leaving it to the GC. YnlFamily holds a self reference cycle through SpecFamily's self.family = self in its super().__init__() call, so refcount GC cannot reclaim it and the socket stays open until the cyclic GC runs. If a test creates a guest netns, instantiates a YnlFamily inside it via NetNSEnter(), performs some test case work via Ynl, and then deletes the netns, then the 'ip netns del' only drops the mount binding and cleanup_net in the kernel never runs, so any subsequent test case assertions that objects got cleaned up would fail given this only gets triggered later via cyclic GC run. Add an explicit close() that closes the netlink socket and wire up the __enter__/__exit__ so callers can scope the instance deterministically via 'with YnlFamily(...) as ynl: ...'. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260413220809.604592-2-daniel@iogearbox.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-14tracefs: Removed unused 'ret' variable in eventfs_iterate()Steven Rostedt
Moving to guard() usage removed the need of using the 'ret' variable but it wasn't removed. As it was set to zero, the compiler in use didn't warn (although some compilers do). Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://patch.msgid.link/20260414110344.75c0663f@robin Fixes: 4d9b262031f ("eventfs: Simplify code using guard()s") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604100111.AAlbQKmK-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-04-15tomoyo: use u64 for holding inode->i_ino valueTetsuo Handa
TOMOYO is treating numeric fields (including inode->i_ino) as "unsigned long". Now that commit 0b2600f81cef ("treewide: change inode->i_ino from unsigned long to u64") went upstream, update affected portions in TOMOYO. While an administrator might write a rule that compares inode->i_ino with an immediate value, this patch changes type of variable for inode->i_ino to "u64" but does not change type of variable for the corresponding immediate value to "u64" due to the following reasons. It is likely that rules that compare inode->i_ino are for testing whether the directories involved in e.g. rename() operation are the same (i.e. comparison between two inode->i_ino values rather than one inode->i_ino value and one immediate value). It unlikely makes sense to compare inode->i_ino with an immediate value larger than UINT_MAX. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
2026-04-14lib/vsprintf: use bool for local decode variableThorsten Blum
The local variable 'decode' is only used as a boolean value - change its data type from int to bool accordingly. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Petr Mladek <pmladek@suse.com> Link: https://patch.msgid.link/20260407181835.1053072-2-thorsten.blum@linux.dev Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-04-14ALSA: control: Validate buf_len before strnlen() in ↵Ziqing Chen
snd_ctl_elem_init_enum_names() snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone. Fixes: 8d448162bda5 ("ALSA: control: add support for ENUMERATED user space controls") Cc: stable@vger.kernel.org Signed-off-by: Ziqing Chen <chenziqing@xiaomi.com> Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-14net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()Lorenzo Bianconi
Add the following PPE configuration in airoha_ppe_hw_init routine: - 6RD hw offloading is currently not supported by Netfilter flowtable. Disable explicitly PPE 6RD offloading in order to prevent PPE to learn 6RD flows and eventually interrupt the traffic. - Add missing PPE bind rate configuration for L3 and L2 traffic. PPE bind rate configuration specifies the pps threshold to move a PPE entry state from UNBIND to BIND. Without this configuration this value is random. - Set ageing thresholds to the values used in the vendor SDK in order to improve connection stability under load and avoid packet loss caused by fast aging. Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260412-airoha_ppe_hw_init-missing-bits-v1-1-06ac670819e3@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14MAINTAINERS: update second Socionext SPI maintainer addressJohan Hovold
The Linaro address is bouncing so switch to Jassi's gmail address also found in MAINTAINERS. Cc: Jassi Brar <jassisinghbrar@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260410083423.504695-3-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14MAINTAINERS: update Socionext SPI maintainer addressJohan Hovold
The Linaro address is bouncing so switch to Masahisa's Socionext address also found in MAINTAINERS. Acked-by: Masahisa Kojima <kojima.masahisa@socionext.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260410083423.504695-2-johan@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14spi: dt-bindings: fsl: Correct GPIO flags in the exampleKrzysztof Kozlowski
IRQ_TYPE_xxx flags are not correct in the context of GPIO flags. These are simple defines so they could be used in DTS but they will not have the same meaning: IRQ_TYPE_EDGE_RISING = 1 = GPIO_ACTIVE_LOW. Correct the example DTS to use proper flags for chip select GPIOs, assuming the author of the code wanted similar logical behavior: IRQ_TYPE_EDGE_RISING => GPIO_ACTIVE_HIGH Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260413085947.51047-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14drm/mxsfb/lcdif: use DRM_BRIDGE_ATTACH_NO_CONNECTOR and the bridge-connectorLuca Ceresoli
Convert this driver to DRM_BRIDGE_ATTACH_NO_CONNECTOR and to the drm_bridge_connector framework which is the current DRM bridge best practice. Based on the in-tree dts[i] files this introduces no regression. Based on the kernel doc of drm_bridge_connector.c: * To make use of this helper, all bridges in the chain shall report bridge * operation flags (&drm_bridge->ops) and bridge output type * (&drm_bridge->type), as well as the DRM_BRIDGE_ATTACH_NO_CONNECTOR attach * flag (none of the bridges shall create a DRM connector directly). and each of the 3 LCDIF blocks in the i.MX8MP, all of them comply with the above requirement: * For the LCDIF3, the pipeline is: LCDIF3 -> fsl,imx8mp-hdmi-pvi -> fsl,imx8mp-hdmi-tx -> HDMI connector And the involved bridges are: * fsl,imx8mp-hdmi-pvi has ops = 0 (it doesn't set it) because it implements none the optional features mentioned by those flags, and it honors the DRM_BRIDGE_ATTACH_NO_CONNECTOR by propagating it * fsl,imx8mp-hdmi-tx is implemented based on dw-hdmi, which sets ops as appropriate and also propagates the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag * display-connector (enabled via the DT overlay if needed) sets ops and makes DRM_BRIDGE_ATTACH_NO_CONNECTOR mandatory * The LCDIF2 involves the panel-bridge, display-connector and lvds-decoder (even though only the pane-bridge is currently supported), and all these three also set ops as needed and propagate DRM_BRIDGE_ATTACH_NO_CONNECTOR or make it mandatory. * The LCDIF1 is used with the adv7511, tc358767 and the panel bridge drivers which also comply with the requirements. Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-11-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx: switch to DRM_BRIDGE_ATTACH_NO_CONNECTORLuca Ceresoli
The imx8mp-hdmi-tx one of many drivers based on dw-hdmi. dw-hdmi in turn can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used [0] B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge The imx8mp-hdmi-tx driver falls in case A. Switching to case B, which is the current best practice, requires that the HDMI connector is always described in the live device tree, and a previous commit ensured this is always the case by adding an overlay in case the device tree does not comply. So now we can simply switch to the new mode and support DRM_BRIDGE_ATTACH_NO_CONNECTOR. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-10-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx-connector-fixup: show a warning when adding the ↵Luca Ceresoli
overlay Describing the HDMI connector in device tree is recommended. While the overlay insertion is a workaround to avoid breaking existing devices, every dts should be improved by adding a connector description. Add a warning to make users aware as far as possible. As a warning line cannot hold all the relevant info, add a detailed comment in the code so it easy to find when the warning is seen. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-9-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: imx8mp-hdmi-tx-connector-fixup: add an hdmi-connector when ↵Luca Ceresoli
missing using a DT overlay at boot time The imx8mp-hdmi-tx is one of many drivers based on dw-hdmi. dw-hdmi in turn can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used [0] B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge The imx8mp-hdmi-tx driver falls in case A. This implies next_bridge will always be NULL, and so dw_hdmi_bridge_attach() [1] will always fail if called with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag. In fact case A assumes that DRM_BRIDGE_ATTACH_NO_CONNECTOR is not set and in that case it adds an HDMI Type A connector programmatically at bridge attach time. Support for DRM_BRIDGE_ATTACH_NO_CONNECTOR is implemented by dw-hdmi.c in case B. However switching to base B requires that port@1 is connected to a "next bridge" DT node, typically the HDMI connector, because dw-hdmi won't add the connector when using DRM_BRIDGE_ATTACH_NO_CONNECTOR. Many dts files for imx8mp-based boards in the kernel have such a connector described and linked to port@1, so the pipeline will be fully attached up to a display-connector and a drm_connector added by the bridge-connector. Sadly some of those dts files don't have the connector described. Adding it would solve the problem easily, but this would break existing devices which do not update the dtb when upgrading to a newer kernel. In preparation for switching to case B while preserving backward compatibility for such devices, introduce a module adding the hdmi-connector node to the live device tree at init time. This will allow the dw-hdmi code to find the next bridge (the one wrapping the hdmi-connector) and let the pipeline work as before. The module is inserted only if there is no endpoint in port@1. So boards whose device tree describe the connector will not have the device tre modified, and will start isntantiating the correct HDMI connector type as described in the device tree. For boards lacking a connector description in DT the overlay will be added, abd the HDMI connector will be Type A, which is a reasonable fallback and is what the driver is currently doing. [0] https://elixir.bootlin.com/linux/v7.0-rc1/source/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c#L3310 [1] https://elixir.bootlin.com/linux/v7.0-rc1/source/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c#L2907 Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-8-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: dw-hdmi: move next_bridge lookup to attach timeLuca Ceresoli
This driver looks up the next_bridge at probe time and stores it in hdmi->bridge.next_bridge, but only uses the stored value when attaching, and only in the DRM_BRIDGE_ATTACH_NO_CONNECTOR case. This will be problematic with an upcoming change, adding an hdmi-connector using a device tree overlay when not present. That change is in turn necessary to migrate the i.MX LCDIF driver to the bridge-connector. The problem is that, adding the hdmi-connector via an overlay, devlink considers hdmi-connector a consumer of the dw-hdmi device, generating a chicken-egg problem: * hdmi-connector probe won't be tried until dw-hdmi is probed (devlink) * dw-hdmi probe will defer until it finds the next_bridge (the hdmi-connector wrapper bridge) In preparation for those changes, move the next_bridge lookup from probe to attach, when it is actually used. This allows dw-hdmi to probe, so that the hdmi-connector can probe as well. Also avoid storing the pointer in hdmi->bridge.next_bridge: the value is computed when needed, thus a local variable is enough. Finally, this also allows to slightly improve the code by not doing any DT lookup in the !DRM_BRIDGE_ATTACH_NO_CONNECTOR case. Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Acked-by: Liu Ying <victor.liu@nxp.com> Tested-by: Damon Ding <damon.ding@rock-chips.com> # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-7-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: dw-hdmi: warn on unsupported attach combinationLuca Ceresoli
dw-hdmi can operate in two different modes, depending on the platform data as set by the driver: A. hdmi->plat_data->output_port = 0: the HDMI output (port@1) in device tree is not used B. hdmi->plat_data->output_port = 1: the HDMI output (port@1) is parsed to find the next bridge Only case B is supported when the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is passed to the attach callback. Emit a warning when this is violated. Also return -EINVAL which would be returned by drm_bridge_attach() right after anyway. Reviewed-by: Liu Ying <victor.liu@nxp.com> Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Tested-by: Damon Ding <damon.ding@rock-chips.com> # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-6-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/bridge: dw-hdmi: document the output_port fieldLuca Ceresoli
The meaning of this flag may not be obvious at first sight. Reviewed-by: Liu Ying <victor.liu@nxp.com> Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Tested-by: Damon Ding <damon.ding@rock-chips.com> # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-5-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: move iteration-specific variables declaration inside loop ↵Luca Ceresoli
in lcdif_attach_bridge The bridge and ret variables are per-iteration variables, whose values don't have to be carried to the next iteration or be used after the loop end. Move their declaration inside the loop scope as a cleanup and to make code clearer. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-4-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: use dev_err_probe() consistently in lcdif_attach_bridgeLuca Ceresoli
lcdif_attach_bridge() uses dev_err_probe() in some error paths, dev_err() + return in others. Use dev_err_probe() for all of them to make code consistent, simpler and with better error reporting. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-3-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: simplify ep pointer management using __freeLuca Ceresoli
Putting the ep device_node reference requires a of_node_put(ep) in many return points. Use a cleanup action to simplify the code. Reviewed-by: Liu Ying <victor.liu@nxp.com> Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-2-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14drm/mxsfb/lcdif: simplify remote pointer management using __freeLuca Ceresoli
Putting the remote device_node reference requires a of_node_put(remote) in two places. Use a cleanup action to simplify the code. Reviewed-by: Liu Ying <victor.liu@nxp.com> Tested-by: Martyn Welch <martyn.welch@collabora.com> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> # TQMa8MPxL/MBa8MPxL Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-1-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-04-14ASoC: SOF: Intel: NVL/NVL-S: add platform nameMark Brown
Bard Liao <yung-chuan.liao@linux.intel.com> says: The platform name will be used in the topology name. Link: https://patch.msgid.link/20260413060800.3156425-1-yung-chuan.liao@linux.intel.com
2026-04-14ASoC: SOF: Intel: NVL-S: add platform nameBard Liao
The platform name will be used in the topology name. Fixes: d3df422f66e8a ("ASoC: SOF: Intel: add initial support for NVL-S") Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20260413060800.3156425-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14ASoC: SOF: Intel: NVL: add platform nameBard Liao
The platform name will be used in the topology name. Fixes: 1800bcdc68ead ("ASoC: SOF: Intel: add support for Nova Lake NVL") Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20260413060800.3156425-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14net: airoha: Fix VIP configuration for AN7583 SoCLorenzo Bianconi
EN7581 and AN7583 SoCs have different VIP definitions. Introduce get_vip_port callback in airoha_eth_soc_data struct in order to take into account EN7581 and AN7583 VIP register layout and definition differences. Introduce nbq parameter in airoha_gdm_port struct. At the moment nbq is set statically to value previously used in airhoha_set_gdm2_loopback routine and it will be read from device tree in subsequent patches. Fixes: e4e5ce823bdd ("net: airoha: Add AN7583 SoC support") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260412-airoha-7583-vip-fix-v1-1-c35e02b054bb@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14net: caif: clear client service pointer on teardownZhengchuan Liang
`caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer referenced by `adap_layer->dn`, but leaves that pointer stale. When the socket is later destroyed, `caif_sock_destructor()` calls `caif_free_client()` again and dereferences the freed service pointer. Clear the client/service links before releasing the service object so repeated teardown becomes harmless. Fixes: 43e369210108 ("caif: Move refcount from service layer to sock and dev.") Cc: stable@kernel.org Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Co-developed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Yuan Tan <yuantan098@gmail.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Tested-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Link: https://patch.msgid.link/9f3d37847c0037568aae698ca23cd47c6691acb0.1775897577.git.zcliangcn@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-14ASoC: rt1320: fix the warning 'rae_fw' from request_firmware() not releasedShuming Fan
New smatch warnings: sound/soc/codecs/rt1320-sdw.c:1575 rt1320_rae_load() warn: 'rae_fw' from request_firmware() not released on lines: 1575. Fixes: 22937af75abb ("ASoC: rt1320: support RAE parameters loading") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Closes: https://lore.kernel.org/r/202604111548.EL450PMb-lkp@intel.com/ Signed-off-by: Shuming Fan <shumingf@realtek.com> Link: https://patch.msgid.link/20260414071441.1524039-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-14drm/xe/pf: Derive admin-only PF mode from xe_device stateSatyanarayana K V P
Stop tracking admin-only PF mode in a separate `xe->sriov.pf.admin_only` field and use `xe_device_is_admin_only(xe)` as the single source of admin mode. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260413095637.2871287-2-satyanarayana.k.v.p@intel.com
2026-04-14drm/xe/pf: Restrict device query responses in admin-only PF modeSatyanarayana K V P
When a PF is configured in admin-only mode, it is intended for management only and must not expose workload-facing capabilities to userspace. Limit the exposed ioctl set in admin-only PF mode to XE_DEVICE_QUERY and XE_OBSERVATION, and suppress capability-bearing query payloads so that the userspace cannot discover execution-related device details in this mode. Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Piotr Piórkowski <piotr.piorkowski@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: Dunajski Bartosz <bartosz.dunajski@intel.com> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com> Cc: dri-devel@lists.freedesktop.org Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Acked-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260409154423.2499340-5-satyanarayana.k.v.p@intel.com
2026-04-14net: strparser: fix skb_head leak in strp_abort_strp()Luxiao Xu
When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in strp_abort_strp(), which leaks the partially assembled message and can be triggered repeatedly to exhaust memory. Fix this by freeing strp->skb_head and resetting the parser state in the abort path. Leave strp_stop() unchanged so final cleanup still happens in strp_done() after the work and timer have been synchronized. Fixes: 43a0c6751a32 ("strparser: Stream parser for messages") Cc: stable@kernel.org Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Co-developed-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Yuan Tan <yuantan098@gmail.com> Suggested-by: Xin Liu <bird@lzu.edu.cn> Tested-by: Yuan Tan <yuantan098@gmail.com> Signed-off-by: Luxiao Xu <rakukuip@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Link: https://patch.msgid.link/ade3857a9404999ce9a1c27ec523efc896072678.1775482694.git.rakukuip@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>