summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-22Merge tag 'phy-fixes-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL lock failure fix - Apple typec switch/mux leak fix - Marvell incoorect register fix for mvebu utmi phy - Tegra per-pad calibration fix * tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config phy: apple: atc: Fix typec switch/mux leak on unbind phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init() phy: eswin: Fix incorrect error check in probe() phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870 phy: tegra: xusb: Fix per-pad high-speed termination calibration phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff phy: qcom: edp: Fix AUX_CFG8 programming for DP mode phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables phy: qcom: edp: Add eDP/DP mode switch support phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
2026-05-22Merge tag 'spi-fix-v7.1-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Another batch of driver fixes from Johan fixing error handling paths, plus another from Felix. We also have a new device ID added in the DT bindings for SpacemiT K3" * tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: fsl-qspi: support SpacemiT K3 spi: ti-qspi: fix use-after-free after DMA setup failure spi: sprd: fix error pointer deref after DMA setup failure spi: qup: fix error pointer deref after DMA setup failure spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() spi: ep93xx: fix error pointer deref after DMA setup failure
2026-05-22Merge tag 'regulator-fix-v7.1-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes here, one very minor Kconfig fix and a fix for a nasty issue with error reporting in the tps65219 driver" * tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: tps65219: fix irq_data.rdev not being assigned regulator: Kconfig: fix a typo in help
2026-05-22Merge tag 'pinctrl-v7.1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Implement the GPIO .get_direction() callback in the Mediatek driver to rid dmesg warnings - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin function, so there is no conflict with orthogonal muxing - Fix incorrect settings of the "PUPD" (pull-up-pull-down) register during suspend/resume in the Renesas RZG2L - Fix the SMT register cache to be per-bank in the Renesas RZG2L - Fix the QDSS track clock and control pin group names in the Qualcomm Eliza driver - Fix a deadlock in the Amlogic driver, caused by playing around in sysfs - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a similar fix for the Qualcomm SM8150 - Allow parsing DTs without explicit function nodes in the Freescale i.MX1 driver - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk * tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11 pinctrl: imx1: Allow parsing DT without function nodes pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615 pinctrl: meson: amlogic-a4: fix deadlock issue pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names pinctrl: renesas: rzg2l: Fix SMT register cache handling pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function pinctrl: mediatek: moore: implement gpio_chip::get_direction()
2026-05-22Merge tag 'gpio-fixes-for-v7.1-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - propagate the error code from regulator_enable() in resume path in gpio-pca953x - take the device lock when calling device_is_bound() in virtual GPIO drivers - fix software node leak in remove path in gpio-aggregator - fix a potential use-after-free in gpio-aggregator - harden the GPIO character device uAPI: check that line config attributes are correctly zeroed * tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: virtuser: lock device when calling device_is_bound() gpio: aggregator: lock device when calling device_is_bound() gpio: sim: lock device when calling device_is_bound() gpio: aggregator: remove the software node when deactivating the aggregator gpio: aggregator: fix a potential use-after-free gpio: cdev: check if uAPI v2 config attributes are correctly zeroed gpio: pca953x: propagate regulator_enable() error from resume
2026-05-22Merge tag 'sound-7.1-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "As expected, we still continue receiving lots of small fixes. One major change is about HD-audio pending IRQ handling, but this would influence only on odd machines or slow VMs. There are a few other fixes for the core part, but most of them are not-too-serious UAF fixes, while the rest are mostly device-specific fixes and quirks. ALSA Core: - Fix for PCM silencing with bogus iov_iter - Fixes for past-the-end iterators in timer and seq - Serialization of UMP output teardown - Rate-limit ELD parsing errors HD-audio: - Fixes for IRQ work handling and SSID matching - Various Realtek quirks for HP and ASUS laptops, including LED fixes ASoC: - Intel: ACPI match table updates for PTL, NVL, and ARL platforms - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm - DT-binding fix for MediaTek Others: - USB ua101: Reject too-short USB descriptors - Scarlett2: Fix for flash writes - ASIHPI: Fix for potential OOB access - AMD SPI: Fix for bus number in ACPI probe MAINTAINERS: - Updates for SOF and TI maintainers" * tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits) ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table. ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform ASoC: cs-amp-lib: Fix typo in error message: write -> read ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup() ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data() ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer ALSA: seq: Serialize UMP output teardown with event_input ALSA: scarlett2: Allow flash writes ending at segment boundary ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6 ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream ALSA: hda: Move irq pending work into hda-intel stream ASoC: soc-utils: Add missing va_end in snd_soc_ret() ALSA: ua101: Reject too-short USB descriptors ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() ...
2026-05-22Merge tag 'block-7.1-20260522' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Fix memory leak for peer-to-peer addresses - Fix dma map leaks on resource errors - Another bio integrity fix, fixing a recent regression - Fix for an issue with the request pre-allocation and caching when IO is queued, where if a bio split occurred and ended up blocking, the list could be corrupted * tag 'block-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: avoid use-after-free in disk_free_zone_resources() blk-mq: pop cached request if it is usable nvme-pci: fix dma mapping leak on data setup error nvme-pci: fix dma_vecs leak on p2p memory bio-integrity-fs: pass data iter to bio_integrity_verify()
2026-05-22Merge tag 'io_uring-7.1-20260522' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for an issue with IORING_OP_NOP and using injection results - Fix for an issue in IORING_OP_WAITID, where the info state was assumed cleared by the lower level syscall handler, but for some cases it is not. Just clear the data upfront, so that non-initialized data isn't copied back to userspace - Fix for a lockdep reported issue, where IORING_OP_BIND enters file create and hence hits mnt_want_write(), which creates a three part lockdep cycle between the super lock, io_uring's uring_lock, and the cred mutex - Fix a regression introduced in this cycle with how linked timeouts are deleted - Ensure that the ->opcode nospec indexing on the opcode issue side covers all the cases * tag 'io_uring-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/nop: pass all errors to userspace io_uring/timeout: splice timed out link in timeout handler io_uring: propagate array_index_nospec opcode into req->opcode io_uring/waitid: clear waitid info before copying it to userspace io_uring/net: punt IORING_OP_BIND async if it needs file create
2026-05-22vsock: keep poll shutdown state consistentZiyu Zhang
vsock_poll() reads vsk->peer_shutdown before taking the socket lock to set EPOLLHUP and EPOLLRDHUP, then reads it again after taking the lock to report EOF readability. A shutdown packet can update peer_shutdown while poll is waiting for the lock, so one poll invocation can report EOF readability without the corresponding HUP/RDHUP bits. For connectible sockets, take one peer_shutdown snapshot after lock_sock() and use it for all peer-shutdown-derived poll bits. For datagram sockets, which do not take lock_sock() in poll(), take one lockless READ_ONCE() snapshot and pair it with WRITE_ONCE() on the writer side. This keeps the peer-shutdown-derived bits internally consistent for each poll pass. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Ziyu Zhang <ziyuzhang201@gmail.com> Link: https://patch.msgid.link/20260519165636.62542-1-ziyuzhang201@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22Merge branch ↵Jakub Kicinski
'net-convert-atm-xdp-af_iucv-l2tp_ppp-rxrpc-tipc-to-getsockopt_iter' Breno Leitao says: ==================== net: convert atm/xdp/af_iucv/l2tp_ppp/rxrpc/tipc to getsockopt_iter This series continues the conversion of the remaining proto_ops getsockopt callbacks to the new getsockopt_iter callback introduced in commit 67fab22a7adc ("net: add getsockopt_iter callback to proto_ops"). The new callback takes a sockopt_t — a type-safe wrapper around iov_iter plus an optlen field — instead of raw __user pointers. This: - Replaces (char __user *optval, int __user *optlen) with sockopt_t *opt - Reads the input buffer size from opt->optlen instead of get_user() - Writes the option value via copy_to_iter() instead of copy_to_user() - Reports the returned length via opt->optlen instead of put_user(), independently of the bytes copied through the iter Each conversion is a behaviour-preserving and code-style-preserving refactor; no big changes being introduced, even when the code looks weird. ==================== Link: https://patch.msgid.link/20260520-getsock_four-v3-0-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22tipc: convert to getsockopt_iterBreno Leitao
Convert TIPC sockets (msg, packet, stream proto_ops) to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt - Use sopt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() The sockopt_t parameter is named sopt to avoid collision with the existing optname parameter named opt. Note: Dropped the unnecessary parentheses to make checkpatch happier. Also dropped two now-stale comments that referred to the old "res" variable handling. Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-6-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22rxrpc: convert to getsockopt_iterBreno Leitao
Convert RxRPC socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-5-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22l2tp: ppp: convert to getsockopt_iterBreno Leitao
Convert PPPoL2TP socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-4-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22xdp: convert to getsockopt_iterBreno Leitao
Convert XDP socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-3-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22atm: convert to getsockopt_iterBreno Leitao
Convert the ATM SVC and PVC sockets, along with the shared vcc_getsockopt() helper, to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-2-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22af_iucv: convert to getsockopt_iterBreno Leitao
Convert IUCV socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() Acked-by: Stanislav Fomichev <sdf@fomichev.me> Acked-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260520-getsock_four-v3-1-b8c0b16b7780@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22net: mana: Expose hardware diagnostic info via debugfsErni Sri Satya Vennela
Add debugfs entries to expose hardware configuration and diagnostic information that aids in debugging driver initialization and runtime operations without adding noise to dmesg. The debugfs directory for each PCI device is named using pci_name() (the unique BDF address), and its creation and removal is integrated into mana_gd_setup() and mana_gd_cleanup_device() respectively, so that all callers (probe, remove, suspend, resume, shutdown) share a single code path. Device-level entries (under /sys/kernel/debug/mana/<BDF>/): - num_msix_usable, max_num_queues: Max resources from hardware - gdma_protocol_ver, pf_cap_flags1: VF version negotiation results - num_vports, bm_hostmode: Device configuration Per-vPort entries (under /sys/kernel/debug/mana/<BDF>/vportN/): - port_handle: Hardware vPort handle - max_sq, max_rq: Max queues from vPort config - indir_table_sz: Indirection table size - steer_rx, steer_rss, steer_update_tab, steer_cqe_coalescing: Last applied steering configuration parameters Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260519064621.772154-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22Merge tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull smb client fixes from Steve French: - Fix missing lock - Fix dentry in use after unmounting - cifs.upcall security fix - require CAP_NET_ADMIN for swn netlink - change allocation in DUP_CTX_STR to GFP_KERNEL - minor smbdirect debug fix - handle_read_data() folio fix * tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: change allocation requirements in DUP_CTX_STR macro smb: client: require net admin for CIFS SWN netlink smb: smbdirect: divide, not multiply, milliseconds by 1000 cifs: Fix busy dentry used after unmounting smb: client: use data_len for SMB2 READ encrypted folioq copy smb: client: reject userspace cifs.spnego descriptions smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
2026-05-22Merge tag 'zonefs-7.1-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: - Avoid potential overflow when converting a zonefs file number string to an inode number (from Johannes) * tag 'zonefs-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: handle integer overflow in zonefs_fname_to_fno
2026-05-22tun: free page on build_skb failure in tun_xdp_one()Weiming Shi
When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform. Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260521163312.1479805-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22tap: free page on error paths in tap_get_user_xdp()Weiming Shi
tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()") Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260521163230.1478627-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22selftests/tc-testing: Adapt idempotent qdisc notify callback tests to recent ↵Victor Nogueira
fq_codel changes Commit 150061a20651 ("net/sched: fq_codel: local packets no longer count against memory limit") made fq_codel not account for local packets in the memory limit. Since tests a4bb, a4be, a4bf, a4c0, a4c1 were relying on these packets being accounted so that parent's qlen notify callback was executed, they broke. Fix the tests by adding the qdiscs to ifb instead and making it see mirred packets that came from scapy. That way the packets are accounted in the memory limit and the parent's qlen notify callback is still executed. Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Acked-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260521150811.1896373-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22selftests/tc-testing: Add support for ifb devicesVictor Nogueira
Add support for ifb devices in tdc so that tests with the nsPlugin are able to use it when necessary. Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20260521150811.1896373-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()Thomas Fourier
The input buffer size is pcu->max_in_size, but pcu->max_out_size is passed to usb_free_coherent(). Change size to match the allocation size. Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260522085412.45430-2-fourier.thomas@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-22thermal: sysfs: remove space before tab in macroMayur Kumar
Adjust white space in thermal_trip_of_attr(). Signed-off-by: Mayur Kumar <kmayur809@gmail.com> [ rjw: Added changelog, added tabs before backslash ] Link: https://patch.msgid.link/20260511175246.217788-1-kmayur809@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22thermal: core: Add WQ_UNBOUND to alloc_workqueue() usersMarco Crivellari
This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. This workqueue has no benefits being per-CPU, so make it unbound adding WQ_UNBOUND, removing also the WQ_POWER_EFFICIENT flag. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> [ rjw: Subject tweak ] Link: https://patch.msgid.link/20260515084920.70544-1-marco.crivellari@suse.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: intel_pstate: Improve warning message on HWP-disabled hybrid CPUsYohei Kojima
Improve warning message on HWP-disabled hybrid processors to state that intel_pstate requires HWP to be enabled on such processors [1]. Previously it warned that "intel_pstate: CPU model not supported", but it was misleading. Link: https://docs.kernel.org/admin-guide/pm/intel_pstate.html [1] Signed-off-by: Yohei Kojima <yohei.kojima@sony.com> [ rjw: Changelog tweaks ] Link: https://patch.msgid.link/87f69971a9bf89fb4b51f128e8ae519cbaf5894e.1779406085.git.yohei.kojima@sony.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: elanfreq: Drop support for AMD Elan SC4*Sean Young
Since commit 8b793a92d862 ("x86/cpu: Remove M486/M486SX/ELAN support"), the AMD Elan SC4* is no longer supported, so the CPU frequency driver is no longer needed. Signed-off-by: Sean Young <sean@mess.org> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> [ rjw: Changelog tweaks ] Link: https://patch.msgid.link/20260507090107.10113-1-sean@mess.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: clean up dead dependencies on X86 in KconfigJulian Braha
The Kconfig in the parent directory already has an 'if X86' condition wrapping the inclusion of this file, meaning that each of the individual 'depends on' statements in this file is a duplicate dependency (dead code). Leave the outer 'if X86...endif' and remove the individual 'depends on X86' statement from each option. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260417230652.305414-1-julianbraha@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: conservative: Simplify frequency limit handlingLifeng Zheng
cs_dbs_update() performs explicit checks against policy->min/max before updating the target frequency. These checks are redundant as __cpufreq_driver_target() already clamps the requested frequency to the valid policy limits. Remove the unnecessary boundary checks and simplify the update logic. This also fixes an issue introduced by commit 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates"), where stale target comparisons could cause frequency updates to be skipped entirely after deferred adjustments. Closes: https://lore.kernel.org/all/20260421123545.1745998-1-zhenglifeng1@huawei.com/ Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates") Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com> Co-developed-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Link: https://patch.msgid.link/292e6d937890f135e30ec0d2107eaad47cb9a976.1779423281.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: Avoid redundant target() calls for unchanged limitsViresh Kumar
Drivers setting CPUFREQ_NEED_UPDATE_LIMITS expect target() to be invoked even if the target frequency remains unchanged, so they can update their internal policy limits state. Currently the core invokes target() unconditionally whenever the requested frequency matches policy->cur for such drivers, even if policy->min and policy->max haven't changed since the previous update. Track pending policy limit updates explicitly and skip redundant target() invocations when neither the target frequency nor the effective limits changed. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Link: https://patch.msgid.link/d0107c364b709abca21acf88072220bc05478594.1779423281.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: Fix typo in commentViresh Kumar
Replace "diver" with "driver" in the comment describing CPUFREQ_NEED_UPDATE_LIMITS. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Reviewed-by: Lifeng Zheng <zhenglifeng1@huawei.com> Link: https://patch.msgid.link/396f64411431ffbb5b4f07d1f2e0bbf9763d468f.1779423281.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22selftests/cgroup: enable memory controller in hugetlb memcg testGuopeng Zhang
test_hugetlb_memcg creates a child cgroup and then writes memory.max and memory.swap.max. When the test is run standalone, the memory controller may not be enabled in the test root cgroup's subtree_control. In that case, the child cgroup is created without the memory control files, and the test fails during setup before reaching the hugetlb memcg accounting checks. Skip the test when the memory controller is unavailable. Otherwise, enable it in subtree_control before creating the test cgroup. Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn> Acked-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-22clk: canaan: Add clock driver for Canaan K230Xukai Wang
This patch provides basic support for the K230 clock, which covers all clocks in K230 SoC. The clock tree of the K230 SoC consists of a 24MHZ external crystal oscillator, PLLs and an external pulse input for timerX, and their derived clocks. Co-developed-by: Troy Mitchell <TroyMitchell988@gmail.com> Signed-off-by: Troy Mitchell <TroyMitchell988@gmail.com> Signed-off-by: Xukai Wang <kingxukai@zohomail.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-05-22soc: ti: k3-ringacc: Use str_enabled_disabled() helperNishanth Menon
Coccinelle (scripts/coccinelle/api/string_choices.cocci) flags an opportunity to replace the open-coded ternary expression in the probe dev_info() call: k3-ringacc.c:1439:3-32: opportunity for str_enabled_disabled(ringacc->dma_ring_reset_quirk) Replace the ternary with str_enabled_disabled() and add the required include for <linux/string_choices.h>. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-12-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_dma: Use IOMEM_ERR_PTR() in pktdma_get_regs()Nishanth Menon
pktdma_get_regs() returns a void __iomem * but uses ERR_PTR() on the error path, causing sparse to warn about an address space mismatch. Replace ERR_PTR() with IOMEM_ERR_PTR() to resolve the warning cleanly. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-11-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_dma: Remove dead check on unsigned args.args[0]Nishanth Menon
smatch warns: knav_dma.c:390 of_channel_match_helper() warn: unsigned 'args.args[0]' is never less than zero. of_phandle_args.args[] is uint32_t, so the 'args.args[0] < 0' check is always false. of_parse_phandle_with_fixed_args() already handles errors by returning a non-zero code, which is checked immediately above. Remove the dead check. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-10-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_dma: Remove unused DMA_PRIO_MASK macroNishanth Menon
DMA_PRIO_MASK (GENMASK(3, 0)) is defined alongside the other priority macros but is never referenced in the code. tx_priority and rx_priority are only ever assigned DMA_PRIO_DEFAULT (0) and are never sourced from device tree or user-controlled input, so no out-of-range value is possible. W=2 builds report: knav_dma.c:32:9: warning: macro is not used [-Wunused-macros] 32 | #define DMA_PRIO_MASK GENMASK(3, 0) Remove the dead macro. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-9-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss_acc: Fix kernel-doc Return: tagNishanth Menon
Fix knav_init_acc_range() use of 'Return ...' instead of 'Return:' kernel-doc comment, which produces a warning with W=2: knav_qmss_acc.c:473: No description found for return value of 'knav_init_acc_range' Tested-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260512170623.3174416-8-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Fix __iomem annotations and __be32 typeNishanth Menon
Fix several address-space and type annotation issues reported by sparse: - Change pdsp->command from 'void __iomem *' to 'u32 __iomem *' to match the other union members (acc_command, qos_command); adjust the offset in knav_queue_load_pdsp() from +0x18 to +0x6 to preserve the 24-byte offset. - Fix knav_queue_pdsp_wait() declaration: correct the parameter annotation from 'u32 * __iomem' (pointer-in-iomem-space) to 'u32 __iomem *' (pointer-to-iomem); use 'unsigned int' for the timeout parameter instead of bare 'unsigned'; fix the continuation- line alignment. - Use IOMEM_ERR_PTR() in knav_queue_map_reg() instead of ERR_PTR() when returning an error as void __iomem *. - Annotate the firmware data array as 'const __be32 *' instead of 'u32 *', as be32_to_cpu() requires __be32 input. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-7-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Use %pe to print PTR_ERR()Nishanth Menon
Coccinelle (scripts/coccinelle/misc/ptr_err_to_pe.cocci) flags the dev_err() call in knav_pool_create(): knav_qmss_queue.c:789:9-16: WARNING: Consider using %pe to print PTR_ERR() Replace the %ld / PTR_ERR() pair with %pe and pass the error pointer directly to also print the symbolic error name. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-6-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Fix kernel-doc Return: tagsNishanth Menon
Fix functions that use inline 'Returns ...' instead of 'Return:' kernel-doc comments, producing warnings with W=2: knav_qmss_queue.c:524: No description found for return value of 'knav_queue_open' Tested-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260512170623.3174416-5-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Inline lockdep condition in for_each_handle_rcuNishanth Menon
knav_dev_lock_held() is a single-use wrapper around lockdep_is_held(&knav_dev_lock), used only as the lockdep condition in for_each_handle_rcu. When CONFIG_PROVE_RCU_LIST is disabled, list_for_each_entry_rcu() elides the condition argument entirely, causing clang to report the macro as unused with W=2: knav_qmss_queue.c:30:9: warning: macro is not used [-Wunused-macros] 30 | #define knav_dev_lock_held() \ Remove the intermediate macro and open-code lockdep_is_held() directly in the for_each_handle_rcu definition. Reviewed-by: Andrew Davis <afd@ti.com> Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-4-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Rename global kdev to knav_qdev to fix -WshadowNishanth Menon
Building with W=2 (clang, LLVM=1) produces 22 -Wshadow warnings in knav_qmss_queue.c because the file-scoped singleton 'kdev' is shadowed by a parameter of the same name in 21 internal functions and one local variable, e.g.: knav_qmss_queue.c:194:49: warning: declaration shadows a variable in the global scope [-Wshadow] 194 | knav_queue_match_id_to_inst(struct knav_device *kdev, unsigned id) Rename the global singleton from kdev to knav_qdev rather than renaming all ~21 function parameters, as this requires fewer changes and leaves function signatures, struct field accesses, and header macros in knav_qmss.h untouched. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-3-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22soc: ti: knav_qmss: Remove remaining redundant ENOMEM printksNishanth Menon
Commit 168d2fb78055 ("soc: ti: knav_qmss: Remove ENOMEM printks") removed redundant dev_err() calls after allocation failures in knav_queue_setup_regions, knav_queue_init_qmgrs and knav_queue_init_pdsps, but missed three further instances in knav_pool_create, knav_queue_setup_region and knav_setup_queue_range. Remove the missed instances. Reviewed-by: Sai Sree Kartheek Adivi <s-adivi@ti.com> Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com> Link: https://patch.msgid.link/20260512170623.3174416-2-nm@ti.com Signed-off-by: Nishanth Menon <nm@ti.com>
2026-05-22cpufreq: intel_pstate: Sync policy->cur during CPU offlineFushuai Wang
When a CPU goes offline with HWP disabled, intel_pstate_set_min_pstate() sets the MSR_IA32_PERF_CTL to minimum frequency to prevent SMT siblings from being restricted. However, the policy->cur value was not updated, leaving it at the previous value. When the CPU comes back online, governor->limits() checks if target_freq equals policy->cur and skips the frequency adjustment if they match. Since policy->cur still holds the previous value, the governor does not call cpufreq_driver->target to update MSR_IA32_PERF_CTL. Fix this by synchronizing policy->cur with the hardware state when setting minimum pstate during CPU offline. Fixes: bb18008f8086 ("intel_pstate: Set core to min P state during core offline") Cc: stable@vger.kernel.org # 3.15+ Suggested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com> [ rjw: Subject refinement ] Link: https://patch.msgid.link/20260520032119.30615-1-fushuai.wang@linux.dev Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22cpufreq: Documentation: fix sampling_down_factor rangePengjie Zhang
The ondemand governor implementation accepts sampling_down_factor values from 1 to 100000 via MAX_SAMPLING_DOWN_FACTOR, but the documentation in admin-guide/pm/cpufreq.rst still says the valid range is 1 to 100. Update the documentation to match the actual code. Fixes: 2a0e49279850 ("cpufreq: User/admin documentation update and consolidation") Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com> Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com> Link: https://patch.msgid.link/20260518133457.2408463-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22Revert "accel/amdxdna: Support read-only user-pointer BO mappings"Lizhi Hou
This reverts commit f649e63d4a6423eda8eb208638849fd6396aedd7. The read-only feature requires further consideration. Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260521162930.1451042-1-lizhi.hou@amd.com
2026-05-22vfio/pci: Use a private flag to prevent power state change with VFsRaghavendra Rao Ananta
The current implementation uses pci_num_vf() while holding the memory_lock to prevent changing the power state of a PF when VFs are enabled. This creates a lockdep circular dependency warning because memory_lock is held during device probing. [ 286.997167] ====================================================== [ 287.003363] WARNING: possible circular locking dependency detected [ 287.009562] 7.0.0-dbg-DEV #3 Tainted: G S [ 287.015074] ------------------------------------------------------ [ 287.021270] vfio_pci_sriov_/18636 is trying to acquire lock: [ 287.026942] ff45bea2294d4968 (&vdev->memory_lock){+.+.}-{4:4}, at: vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.036530] [ 287.036530] but task is already holding lock: [ 287.042383] ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x44d/0x7b0 [ 287.051879] [ 287.051879] which lock already depends on the new lock. [ 287.051879] [ 287.060070] [ 287.060070] the existing dependency chain (in reverse order) is: [ 287.067568] [ 287.067568] -> #2 (&new_dev_set->lock){+.+.}-{4:4}: [ 287.073941] __mutex_lock+0x92/0xb80 [ 287.078058] vfio_assign_device_set+0x66/0x1b0 [ 287.083042] vfio_pci_core_register_device+0xd1/0x2a0 [ 287.088638] vfio_pci_probe+0xd2/0x100 [ 287.092933] local_pci_probe_callback+0x4d/0xa0 [ 287.098001] process_scheduled_works+0x2ca/0x680 [ 287.103158] worker_thread+0x1e8/0x2f0 [ 287.107452] kthread+0x10c/0x140 [ 287.111230] ret_from_fork+0x18e/0x360 [ 287.115519] ret_from_fork_asm+0x1a/0x30 [ 287.119983] [ 287.119983] -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}: [ 287.127219] __flush_work+0x345/0x490 [ 287.131429] pci_device_probe+0x2e3/0x490 [ 287.135979] really_probe+0x1f9/0x4e0 [ 287.140180] __driver_probe_device+0x77/0x100 [ 287.145079] driver_probe_device+0x1e/0x110 [ 287.149803] __device_attach_driver+0xe3/0x170 [ 287.154789] bus_for_each_drv+0x125/0x150 [ 287.159346] __device_attach+0xca/0x1a0 [ 287.163720] device_initial_probe+0x34/0x50 [ 287.168445] pci_bus_add_device+0x6e/0x90 [ 287.172995] pci_iov_add_virtfn+0x3c9/0x3e0 [ 287.177719] sriov_add_vfs+0x2c/0x60 [ 287.181838] sriov_enable+0x306/0x4a0 [ 287.186038] vfio_pci_core_sriov_configure+0x184/0x220 [ 287.191715] sriov_numvfs_store+0xd9/0x1c0 [ 287.196351] kernfs_fop_write_iter+0x13f/0x1d0 [ 287.201338] vfs_write+0x2be/0x3b0 [ 287.205286] ksys_write+0x73/0x100 [ 287.209233] do_syscall_64+0x14d/0x750 [ 287.213529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.219120] [ 287.219120] -> #0 (&vdev->memory_lock){+.+.}-{4:4}: [ 287.225491] __lock_acquire+0x14c6/0x2800 [ 287.230048] lock_acquire+0xd3/0x2f0 [ 287.234168] down_write+0x3a/0xc0 [ 287.238019] vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.243436] __rpm_callback+0x8c/0x310 [ 287.247730] rpm_resume+0x529/0x6f0 [ 287.251765] __pm_runtime_resume+0x68/0x90 [ 287.256402] vfio_pci_core_enable+0x44/0x310 [ 287.261216] vfio_pci_open_device+0x1c/0x80 [ 287.265947] vfio_df_open+0x10f/0x150 [ 287.270148] vfio_group_fops_unl_ioctl+0x4a4/0x7b0 [ 287.275476] __se_sys_ioctl+0x71/0xc0 [ 287.279679] do_syscall_64+0x14d/0x750 [ 287.283975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.289559] [ 287.289559] other info that might help us debug this: [ 287.289559] [ 287.297582] Chain exists of: [ 287.297582] &vdev->memory_lock --> (work_completion)(&arg.work) --> &new_dev_set->lock [ 287.297582] [ 287.310023] Possible unsafe locking scenario: [ 287.310023] [ 287.315961] CPU0 CPU1 [ 287.320510] ---- ---- [ 287.325059] lock(&new_dev_set->lock); [ 287.328917] lock((work_completion)(&arg.work)); [ 287.336153] lock(&new_dev_set->lock); [ 287.342523] lock(&vdev->memory_lock); [ 287.346382] [ 287.346382] *** DEADLOCK *** [ 287.346382] [ 287.352315] 2 locks held by vfio_pci_sriov_/18636: [ 287.357125] #0: ff45bea208ed3e18 (&group->group_lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x3e3/0x7b0 [ 287.367048] #1: ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x44d/0x7b0 [ 287.376976] [ 287.376976] stack backtrace: [ 287.381353] CPU: 191 UID: 0 PID: 18636 Comm: vfio_pci_sriov_ Tainted: G S 7.0.0-dbg-DEV #3 PREEMPTLAZY [ 287.381355] Tainted: [S]=CPU_OUT_OF_SPEC [ 287.381356] Call Trace: [ 287.381357] <TASK> [ 287.381358] dump_stack_lvl+0x54/0x70 [ 287.381361] print_circular_bug+0x2e1/0x300 [ 287.381363] check_noncircular+0xf9/0x120 [ 287.381364] ? __lock_acquire+0x5b4/0x2800 [ 287.381366] __lock_acquire+0x14c6/0x2800 [ 287.381368] ? pci_mmcfg_read+0x4f/0x220 [ 287.381370] ? pci_mmcfg_write+0x57/0x220 [ 287.381371] ? lock_acquire+0xd3/0x2f0 [ 287.381373] ? pci_mmcfg_write+0x57/0x220 [ 287.381374] ? lock_release+0xef/0x360 [ 287.381376] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381377] lock_acquire+0xd3/0x2f0 [ 287.381378] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381379] ? lock_is_held_type+0x76/0x100 [ 287.381382] down_write+0x3a/0xc0 [ 287.381382] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381383] vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381384] ? __pfx_pci_pm_runtime_resume+0x10/0x10 [ 287.381385] __rpm_callback+0x8c/0x310 [ 287.381386] ? ktime_get_mono_fast_ns+0x3d/0xb0 [ 287.381389] ? __pfx_pci_pm_runtime_resume+0x10/0x10 [ 287.381390] rpm_resume+0x529/0x6f0 [ 287.381392] ? lock_is_held_type+0x76/0x100 [ 287.381394] __pm_runtime_resume+0x68/0x90 [ 287.381396] vfio_pci_core_enable+0x44/0x310 [ 287.381398] vfio_pci_open_device+0x1c/0x80 [ 287.381399] vfio_df_open+0x10f/0x150 [ 287.381401] vfio_group_fops_unl_ioctl+0x4a4/0x7b0 [ 287.381402] __se_sys_ioctl+0x71/0xc0 [ 287.381404] do_syscall_64+0x14d/0x750 [ 287.381405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.381406] ? trace_irq_disable+0x25/0xd0 [ 287.381409] entry_SYSCALL_64_after_hwframe+0x77/0x7f Introduce a private flag 'sriov_active' in the vfio_pci_core_device struct. This allows the driver to track the SR-IOV power state requirement without relying on pci_num_vf() while holding the memory_lock. The lock is now only held to set the flag and ensure the device is in D0, after which pci_enable_sriov() can be called without the lock. Fixes: f4162eb1e2fc ("vfio/pci: Change the PF power state to D0 before enabling VFs") Cc: stable@vger.kernel.org Suggested-by: Jason Gunthorpe <jgg@ziepe.ca> Suggested-by: Alex Williamson <alex@shazbot.org> Signed-off-by: Raghavendra Rao Ananta <rananta@google.com> Link: https://lore.kernel.org/r/20260514173449.3282188-1-rananta@google.com [promote bitfield to plain bool to avoid storage-unit races] Signed-off-by: Alex Williamson <alex@shazbot.org>
2026-05-22tun: free page on short-frame rejection in tun_xdp_one()Weiming Shi
tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function. Fixes: 049584807f1d ("tun: add missing verification for short frame") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260520160020.375349-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-07-06 18:50:29 +0000