summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-13wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work()Lorenzo Bianconi
Delete stale station links announced in the reconfiguration IE transmitted by the AP in the beacon frames. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260309-mac80211-reconf-remove-sta-link-v2-1-1582aac720c6@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: b43: use register definitions in nphy_op_software_rfkillJoshua Peisach
Replaces uses of hardcoded register addresses with proper definitions, for readability. Signed-off-by: Joshua Peisach <jpeisach@ubuntu.com> Acked-by: Michael Büsch <m@bues.ch> Link: https://patch.msgid.link/20260307170135.167460-1-jpeisach@ubuntu.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: cfg80211: split control freq check from chandef checkJohannes Berg
In order to introduce NPCA later, split the control frequency check out of cfg80211_chandef_valid(). Link: https://patch.msgid.link/20260303152641.11b31e4878a7.I534669506008e12ffcd6c115161777e528fdc838@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: mac80211: always use full chanctx compatible checkJohannes Berg
For NPCA, we need to treat the channel request differently for AP and other interfaces (APs can share NPCA, under the assumption that userspace will set them up with the same BSS color.) This is difficult if we have to check against a chanreq made up from the chanctx, but this isn't a code path that needs to be highly optimised, so just always use the (originally) recheck functionality to check against all users of the chanctx. Link: https://patch.msgid.link/20260303152641.1a3ff6ead82b.I486f1a94b9a32e0b045815cbbb22679c8cef56e4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: mac80211: refactor chandef tracing macrosJohannes Berg
We don't need to duplicate the macros, just make a generic one that gets the name prefix to be used, and use that to create the others. While at it, add the puncturing bitmap to the trace and simplify the ternary expressions. Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260303152641.ca32d70055f8.I8138a31ceb75715d928d807554288baccc33cd8c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: mac80211: validate HE 6 GHz operation when EHT is usedJohannes Berg
When in strict mode, validate that the HE 6 GHz operation is valid even when EHT operation is used instead. This checks that APs are advertising correct information for HE clients, without testing with such clients. Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260303150832.74b934163b99.If4d1db3f39c37900cf0d0f4669cd5f8b677daaa0@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13wifi: nl80211: split out UHR operation informationJohannes Berg
The beacon doesn't contain the full UHR operation, a number of fields (such as NPCA) are only partially there. Add a new attribute to contain the full information, so it's available to the driver/mac80211. Link: https://patch.msgid.link/20260303221710.866bacf82639.Iafdf37fb0f4304bdcdb824977d61e17b38c47685@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-13drm/i915/hdcp: Take force_hdcp14 into account during check_linkSuraj Kandpal
During intel_hdcp_check_link phase we need to take into account if we are currently forcing HDCP 1.4 or not. This is because we check for HDCP 2.x Link first and only if HDCP 2.x is not being used check for HDCP 1.4. With force_hdcp14 in picture we should not be going into intel_hdcp2_check_link because of which we may end up trying to disable HDCP2.x even if HDCP 1.4 was enabled causing a lot of issues while IGT tests this. Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260225065045.3040787-1-suraj.kandpal@intel.com
2026-03-12netlink: update outdated commentKexin Sun
The function netlink_clear_multicast_users() was removed as unused in commit 2173f8d953e7 ("netlink: cleanup tap related functions"). Update the comment in netlink_change_ngroups() to remove the stale reference, replacing it with a general description of the behavior while preserving the warning. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Link: https://patch.msgid.link/20260311133519.688-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12qlcnic: update outdated commentKexin Sun
The function pci_unmap_page() was a compatibility wrapper around dma_unmap_page(), and was removed by commit 7968778914e5 ("PCI: Remove the deprecated pci-dma-compat.h API"). Update the comment accordingly. Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Link: https://patch.msgid.link/20260311133012.519-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12mpls: add missing unregister_netdevice_notifier to mpls_initSabrina Dubroca
If mpls_init() fails after registering mpls_dev_notifier, it never gets removed. Add the missing unregister_netdevice_notifier() call to the error handling path. Fixes: 5be2062e3080 ("mpls: Handle error of rtnl_register_module().") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/7c55363c4f743d19e2306204a134407c90a69bbb.1773228081.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12net: add skb_defer_disable_key static keyEric Dumazet
Add a static key to bypass skb_attempt_defer_free() steps if net.core.skb_defer_max is set to zero. Main benefit is the atomic_long_inc_return() avoidance. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260311191340.1996888-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATSEric Dumazet
Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and pcpu_dstats is different. 32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten. This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it. Fixes: 6fa6de302246 ("geneve: Handle stats using NETDEV_PCPU_STAT_DSTATS.") Fixes: be226352e8dc ("vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Guillaume Nault <gnault@redhat.com> Link: https://patch.msgid.link/20260311123110.1471930-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12net/rose: fix NULL pointer dereference in rose_transmit_link on reconnectJiayuan Chen
syzkaller reported a bug [1], and the reproducer is available at [2]. ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN, TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING (-ECONNREFUSED), but lacks a check for TCP_SYN_SENT. When rose_connect() is called a second time while the first connection attempt is still in progress (TCP_SYN_SENT), it overwrites rose->neighbour via rose_get_neigh(). If that returns NULL, the socket is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL. When the socket is subsequently closed, rose_release() sees ROSE_STATE_1 and calls rose_write_internal() -> rose_transmit_link(skb, NULL), causing a NULL pointer dereference. Per connect(2), a second connect() while a connection is already in progress should return -EALREADY. Add this missing check for TCP_SYN_SENT to complete the state validation in rose_connect(). [1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271 [2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+d00f90e0af54102fb271@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0027.GAE@google.com/T/ Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260311070611.76913-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12net: page_pool: scale alloc cache with PAGE_SIZENimrod Oren
The current page_pool alloc-cache size and refill values were chosen to match the NAPI budget and to leave headroom for XDP_DROP recycling. These fixed values do not scale well with large pages, as they significantly increase a given page_pool's memory footprint. Scale these values to better balance memory footprint across page sizes, while keeping behavior on 4KB-page systems unchanged. Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Nimrod Oren <noren@nvidia.com> Link: https://patch.msgid.link/20260309081301.103152-1-noren@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12bridge: cfm: Fix race condition in peer_mep deletionHyunwoo Kim
When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable. Fixes: dc32cbb3dbd7 ("bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.") Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/abBgYT5K_FI9rD1a@v4bel Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-13lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace errorJosh Law
__xbc_open_brace() pushes entries with post-increment (open_brace[brace_index++]), so brace_index always points one past the last valid entry. xbc_verify_tree() reads open_brace[brace_index] to report which brace is unclosed, but this is one past the last pushed entry and contains stale/zero data, causing the error message to reference the wrong node. Use open_brace[brace_index - 1] to correctly identify the unclosed brace. brace_index is known to be > 0 here since we are inside the if (brace_index) guard. Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/ Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes") Cc: stable@vger.kernel.org Signed-off-by: Josh Law <objecting@objecting.org> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-03-12Merge branch 'genetlink-apply-reject-policy-for-split-ops-on-the-dispatch-path'Jakub Kicinski
Jakub Kicinski says: ==================== genetlink: apply reject policy for split ops on the dispatch path Looks like I somehow missed adding default reject policies to commands in families using split Netlink ops. I realized this randomly trying to dump page pools for a specific device and always getting all of them back. The per-device dump is simply not implemented so the request should have been rejected. Patch 2 is the real change, the rest is just accompaniment. ==================== Link: https://patch.msgid.link/20260311032839.417748-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12selftests: net: add test for Netlink policy dumpsJakub Kicinski
Add validation for the nlctrl family, accessing family info and dumping policies. TAP version 13 1..4 ok 1 nl_nlctrl.getfamily_do ok 2 nl_nlctrl.getfamily_dump ok 3 nl_nlctrl.getpolicy_dump ok 4 nl_nlctrl.getpolicy_by_op # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20260311032839.417748-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12selftests: net: make sure that Netlink rejects unknown attrs in dumpJakub Kicinski
Add a test case for rejecting attrs if policy is not set. dev_get dump has no input policy (accepts no attrs). Link: https://patch.msgid.link/20260311032839.417748-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12genetlink: apply reject policy for split ops on the dispatch pathJakub Kicinski
Commit 4fa86555d1cd ("genetlink: piggy back on resv_op to default to a reject policy") added genl_policy_reject_all to ensure that ops without an explicit policy reject all attributes rather than silently accepting them. This change was applied to net. When split ops were later introduced in net-next in commit b8fd60c36a44 ("genetlink: allow families to use split ops directly"), genl_op_fill_in_reject_policy_split() was added and called from genl_op_from_split() (used for policy dumping and registration). However, genl_get_cmd_split(), which is called for incoming messages, copies split_ops entries as-is without applying the reject policy. This means that split ops without policy accept all inputs. This looks like an omission / mistake made when splitting the changes between net and net-next. Let's try to re-introduce the checking. Not considering this a fix given the regression potential. If anyone reports issues we should probably fill in fake policies for specific ops rather than reverting this. Link: https://patch.msgid.link/20260311032839.417748-3-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12genetlink: use maxattr of 0 for the reject policyJakub Kicinski
Commit 4fa86555d1cd ("genetlink: piggy back on resv_op to default to a reject policy") added genl_policy_reject_all to ensure that ops without an explicit policy reject all attributes rather than silently accepting them. The reject policy had maxattr of 1. Passing info->attrs of size 2 may surprise families. Devlink, for instance, assumes that if info->attrs is set it's safe to access DEVLINK_ATTR_BUS_NAME (1) and DEVLINK_ATTR_DEV_NAME (2). Before plugging reject policies into split ops we need to make sure the genetlink code will not populate info->attrs if family had no explicit policy for the op. While even shared code paths within the families can figure out that given op has no policy fairly easily themselves, passing attrs with fixed size of 2 feels fairly useless and error prone. This change has no user-visible impact, reject attrs are not reported to the user space via getpolicy. We do have to remove the safety check in netlink_policy_dump_get_policy_idx() but it seems to have been there to catch likely faulty input, the code can handle maxattr = 0 just fine. Link: https://patch.msgid.link/20260311032839.417748-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12net: phy: vitesse: add inband caps and configurationRussell King (Oracle)
Add support for VSC8662 reporting its inband capabilities, and also hook to configure the PHY's inband mode. This fixes a regression in the macb driver caused by commit 1338cfef1ff1 ("net: macb: fix SGMII with inband aneg disabled") Cc: stable+noautosel@kernel.org # neither this nor commit under fixes should be backported Reported-by: Conor Dooley <conor@kernel.org> Link: https://lore.kernel.org/r/20260304-nebulizer-rounding-40fbc81a2ba1@spud Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Conor Dooley <conor.dooley@microchip.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Fixes: 1338cfef1ff1b958 ("net: macb: fix SGMII with inband aneg disabled") Link: https://patch.msgid.link/E1w082O-0000000ChNc-1wDz@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12ynl: ethtool: remove duplicated unspec entryHangbin Liu
There is a duplicated unspec entry. Remove it. No user impact expected, found by inspection. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260311-b4-drop_dup_unspec-v1-1-e0dfa47b5981@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12docs: octeontx2: fix typo in documentationShravyaPanchagiri
Fix spelling mistake "Crate" to "Create" in the documentation. Signed-off-by: ShravyaPanchagiri <shravy112@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260311030450.8461-1-shravy112@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-13Merge tag 'drm-rust-fixes-2026-03-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes Core Changes: - Fix safety issue in dma_read! and dma_write!. Driver Changes (Nova Core): - Fix UB in DmaGspMem pointer accessors. - Fix stack overflow in GSP memory allocation. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/abNBSol3CLRCqlkZ@google.com
2026-03-13Merge tag 'amd-drm-fixes-7.0-2026-03-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-03-12: amdgpu: - SMU13 fix - SMU14 fix - Fixes for bringup hw testing - Kerneldoc fix - GC12 idle power fix for compute workloads - DCCG fixes amdkfd: - Fix missing BO unreserve in an error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260312180351.3874990-1-alexander.deucher@amd.com
2026-03-12ARM: dts: omap: dm816x: Correct pinctrl registerAndrew Goodbody
The declaration in the pinmux device for the pinctrl registers is not correct. These registers are actually 32 bits wide, not 16. Also the mask for functional bits is also wrong. Functional bits are 0-4, not 0-3. So the mask needs to changed to 0x1f. This information is taken from the TMS320DM816x DaVinci Digital Media Processors Technical Reference Manual. SPRUGX8C March 2015 Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Christopher Obbard <christopher.obbard@linaro.org> Tested-by: Christopher Obbard <christopher.obbard@linaro.org> Link: https://patch.msgid.link/20260312-dm816x_dt-v1-1-ed3370b20799@linaro.org [khilman: fix minor typo: s/delcaration/declaration/] Signed-off-by: Kevin Hilman <khilman@baylibre.com>
2026-03-12regulator: da9063: kzalloc + kcalloc to kzallocRosen Penev
Reduce main allocation to a single kzalloc call by using a flexible array member. Allows using __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260311004159.32374-1-rosenp@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-13Merge branch 'page-table-check-support' of ↵Vasily Gorbik
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into features Add s390 support for CONFIG_PAGE_TABLE_CHECK. * 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Enable page table check for debug_defconfig s390/pgtable: Add s390 support for page table check s390/pgtable: Use set_pmd_bit() to invalidate PMD entry mm/page_table_check: Pass mm_struct to pxx_user_accessible_page() Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-03-13s390: Enable page table check for debug_defconfigAlexander Gordeev
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Link: https://lore.kernel.org/r/975007c27f8563e46d66a1fbb4b14ae6a4147edd.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-03-13s390/pgtable: Add s390 support for page table checkTobias Huschle
Add page table check hooks into routines that modify user page tables. Unlike other architectures s390 does not have means to distinguish between kernel and user page table entries. Rely on the fact the page table check infrastructure itself operates on non-init_mm memory spaces only. Use the provided mm_struct to verify that the memory space is not init_mm (aka not the kernel memory space) indeed. That check is supposed to be succeeded already (on some code paths even twice). If the passed memory space by contrast is init_mm that would be an unexpected semantical change in generic code, so do VM_BUG_ON() in such case. Unset _SEGMENT_ENTRY_READ bit to indicate that pmdp_invalidate() was applied against a huge PMD and is going to be updated by set_pmd_at() shortly. The hook pmd_user_accessible_page() should skip such entries until that, otherwise the page table accounting falls apart and BUG_ON() gets hit as result. The invalidated huge PMD entry should not be confused with a PROT_NONE entry as reported by pmd_protnone(), though the entry characteristics exactly match: _SEGMENT_ENTRY_LARGE is set while _SEGMENT_ENTRY_READ is unset. Since pmd_protnone() implementation depends on NUMA_BALANCING configuration option, it should not be used in pmd_user_accessible_page() check, which is expected to be CONFIG_NUMA_BALANCING-agnostic. Nevertheless, an invalidated huge PMD is technically still pmd_protnone() entry and it should not break other code paths once _SEGMENT_ENTRY_READ is unset. As of now, all pmd_protnone() checks are done under page table locks or exercise GUP-fast and HMM code paths, which are expected to be safe against concurrent page table updates. Alternative approach would be using the last remaining unused PMD entry bit 0x800 to indicate that pmdp_invalidate() was called on a PMD. That would allow avoiding collisions with pmd_protnone() handling code paths, but saving the bit is more preferable way to go. Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Signed-off-by: Tobias Huschle <huschle@linux.ibm.com> Co-developed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Link: https://lore.kernel.org/r/4db8a681205bd555298d62441cdcfca43317a35a.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-03-13s390/pgtable: Use set_pmd_bit() to invalidate PMD entryAlexander Gordeev
Commit 3a5a8d343e1c ("mm: fix race between __split_huge_pmd_locked() and GUP-fast") failed to follow the convention and used direct PMD entry modification instead of set_pmd_bit(). Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Link: https://lore.kernel.org/r/a9248694a38cc898d3f0628f59b8abb57d56a416.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-03-13mm/page_table_check: Pass mm_struct to pxx_user_accessible_page()Tobias Huschle
Unlike other architectures, s390 does not have means to distinguish kernel vs user page table entries - neither an entry itself, nor the address could be used for that. It is only the mm_struct that indicates whether an entry in question is mapped to a user space. So pass mm_struct to pxx_user_accessible_page() callbacks. [agordeev@linux.ibm.com: rephrased commit message, removed braces] Acked-by: Madhavan Srinivasan <maddy@linux.ibm.com> Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> #powerpc Signed-off-by: Tobias Huschle <huschle@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Link: https://lore.kernel.org/r/ca77f3489453c2fe01b25e50e53b778929e0dfc5.1772812343.git.agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-03-13Merge tag 'drm-intel-fixes-2026-03-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Avoid hang when configuring VRR [icl] (Ville Syrjälä) - Fix sg_table overflow with >4GB folios (Janusz Krzysztofik) - Fix PSR Selective Update handling [psr] (Jouni Högander) - Fix eDP ALPM read-out sequence [dp] (Arun R Murthy) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Tvrtko Ursulin <tursulin@igalia.com> Link: https://patch.msgid.link/abJ_MQ7o-5ghyaNW@linux
2026-03-13Merge tag 'drm-misc-fixes-2026-03-12' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pixel byte swap fix for st7586, a null pointer dereference fix for gud, two timings fixes for ti-sn65dsi83, an initialization fix for ivpu, and a runtime suspend deadlock fix for amdxdna. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260312-accurate-ambrosial-trout-bfabf8@houat
2026-03-12PCI: Use pr_warn_once() for ACS parameter parse failureRichard Cheng
When the ACS command line parameter cannot be parsed, the kernel skips applying the requested ACS override. This indicates an invalid boot parameter and should not be logged at informational level. Use pr_warn_once() so the message is surfaced as a warning while still avoiding repeated log spam during device enumeration. Signed-off-by: Richard Cheng <icheng@nvidia.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Tushar Dave <tdave@nvidia.com> Link: https://patch.msgid.link/20260312115441.8168-1-icheng@nvidia.com
2026-03-12hfsplus: set ctime after setxattr and removexattrViacheslav Dubeyko
The generic/728 test-case complains that: (1) Expected ctime needs to be changed after setxattr; (2) Expected ctime needs to be changed after removexattr. This patch adds calling inode_set_ctime_current() in __hfsplus_setxattr() and hfsplus_removexattr(). sudo ./check generic/728 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 7.0.0-rc1+ #6 SMP PREEMPT_DYNAMIC Mon Mar 9 14:29:30 PDT 2026 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/728 35s ... 44s Ran: generic/728 Passed all 1 tests cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> cc: Yangtao Li <frank.li@vivo.com> cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20260309214947.1114618-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-03-12driver core: Add conditional guard support for device_lock()Li Ming
Introduce conditional guard version of device_lock() for scenarios that require conditional device lock holding. Suggested-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Ming <ming.li@zohomail.com> Link: https://patch.msgid.link/20260310-fix_access_endpoint_without_drv_check-v1-1-94fe919a0b87@zohomail.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-12Merge tag 'nvme-7.0-2026-03-12' of git://git.infradead.org/nvme into block-7.0Jens Axboe
Pull NVMe fixes from Keith: "- Fix nvme-pci IRQ race and slab-out-of-bounds access (Sungwoo Kim) - Fix recursive workqueue locking for target async events (Chaitanya) - Various cleanups (Maurizio Lombardi, Thorsten Blum)" * tag 'nvme-7.0-2026-03-12' of git://git.infradead.org/nvme: nvme: Annotate struct nvme_dhchap_key with __counted_by nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue() nvme-pci: Fix race bug in nvme_poll_irqdisable() nvmet: move async event work off nvmet-wq nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
2026-03-12net: xgbe: use device_get_mac_addrRosen Penev
device_get_mac_addr is basically device_property_read_u8_array with an is_valid_ether_addr call. Allows just checking for ret. Remove XGBE_MAC_ADDR_PROPERTY. device_get_mac_addr supports more properties than just "mac-address". Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Sai Krishna <saikrishnag@marvell.com> Link: https://patch.msgid.link/20260310194647.3794-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12af_unix: Give up GC if MSG_PEEK intervened.Kuniyuki Iwashima
Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes: 118f457da9ed ("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov <sysroot314@gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12drm/xe/wa: Drop redundant entries for Wa_16021867713 & Wa_14019449301Matt Roper
The Xe2_HPM-specific RTP table entries for Wa_16021867713 and Wa_14019449301 were removed by commit 941f538b0af8 ("drm/xe: Consolidate workaround entries for Wa_16021867713") and commit aa0f0a678370 ("drm/xe: Consolidate workaround entries for Wa_14019449301") in favor of alternate entries earlier in the table that cover a wider range of IP versions. However these Xe2_HPM-specific entries were accidentally resurrected during a backmerge, which causes the Xe driver to complain on probe about two entries trying to program the same registers+bits: <3> [48.491155] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1c3f1c (clear: 00000008, set: 00000008, masked: no, mcr: no): ret=-22 <3> [48.491211] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1d3f1c (clear: 00000008, set: 00000008, masked: no, mcr: no): ret=-22 <3> [48.491225] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1c3f08 (clear: 00000020, set: 00000020, masked: no, mcr: no): ret=-22 <3> [48.491238] xe 0000:03:00.0: [drm] *ERROR* Tile0: GT1: discarding save-restore reg 1d3f08 (clear: 00000020, set: 00000020, masked: no, mcr: no): ret=-22 Re-drop the redundant Xe2_HPM-specific entries to eliminate the dmesg errors. Fixes: 58351f46de26 ("Merge v7.0-rc3 into drm-next") Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7608 Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch> Link: https://patch.msgid.link/20260312-wa_merge_fix-v1-1-2ec6607f1e0c@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-03-12Merge back ACPI OS services layer (OSL) material for 7.1Rafael J. Wysocki
2026-03-12Merge back cpuidle material for 7.1Rafael J. Wysocki
2026-03-12Merge tag 'pm-7.0-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: - Make the idle loop skip the cpuidle governor .reflect() callback after it has skipped the .select() one (Rafael Wysocki) - Fix swapped power/energy unit labels in cpupower (Kaushlendra Kumar) - Add support for setting EPP via systemd service and intel_pstate turbo boost support to cpupower (Jan Kiszka, Zhang Rui) * tag 'pm-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: sched: idle: Make skipping governor callbacks more consistent cpupower: Add intel_pstate turbo boost support for Intel platforms cpupower: Add support for setting EPP via systemd service cpupower: fix swapped power/energy unit labels
2026-03-12Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.0-rc4). drivers/net/ethernet/mellanox/mlx5/core/en_rx.c db25c42c2e1f9 ("net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ") dff1c3164a692 ("net/mlx5e: SHAMPO, Always calculate page size") https://lore.kernel.org/aa7ORohmf67EKihj@sirena.org.uk drivers/net/ethernet/ti/am65-cpsw-nuss.c 840c9d13cb1ca ("net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support") a23c657e332f2 ("net: ethernet: ti: am65-cpsw: Use also port number to identify timestamps") https://lore.kernel.org/abK3EkIXuVgMyGI7@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-12Merge tag 'acpi-7.0-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: - On some platforms, the ACPI companion object of the ACPI video bus platform device is shared with multiple other platform devices which leads to driver probe issues, so replace that device with an auxiliary one (which arguably is a better match for the given use case) and update the ACPI video bus driver accordingly (Rafael Wysocki) - Address sparse warnings in acpi_os_initialize() by adding __iomem to a local variable declaration (Ben Dooks) * tag 'acpi-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() ACPI: video: Switch over to auxiliary bus type
2026-03-12Merge tag 'nfs-for-7.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfsLinus Torvalds
Pull NFS client fixes from Anna Schumaker: - Fix NFS KConfig typos - Decrement re_receiving on the early exit paths - return EISDIR on nfs3_proc_create if d_alias is a dir * tag 'nfs-for-7.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Fix NFS KConfig typos xprtrdma: Decrement re_receiving on the early exit paths nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
2026-03-12accel/amdxdna: Allow forcing IOVA-based DMA via module parameterLizhi Hou
The amdxdna driver normally performs DMA using userspace virtual address plus PASID. For debugging and validation purposes, add a module parameter, force_iova, to force DMA to go through IOMMU IOVA mapping. When force_iova=1 is set, the driver will allocate and map DMA buffers using IOVA. Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260126193001.1400545-1-lizhi.hou@amd.com
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-17 07:17:46 +0000