Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,383,257 Commits 1 Branch 933 Tags 8.5 GiB
Commit Graph

1383257 Commits

Author SHA1 Message Date
Chen Pei 4d330fe541 ACPI: SPCR: Support Precise Baud Rate field 
The Microsoft Serial Port Console Redirection (SPCR) specification
revision 1.09 comprises additional field: Precise Baud Rate [1].

It is used to describe non-traditional baud rates (such as those
used by high-speed UARTs).

It contains a specific non-zero baud rate which overrides the value
of the Configured Baud Rate field. If this field is zero or not
present, Configured Baud Rate is used.

Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table [1]
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Link: https://patch.msgid.link/20250913070815.16758-1-cp0613@linux.alibaba.com
[ rjw: Corrected typo in the subject ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2025-09-22 19:13:08 +02:00
Chen Pei bf4206d7ac ACPI: SPCR: Add support for DBG2 RISC-V SBI port subtype 
Commit 4aca2bef90 ("ACPICA: Headers: Add RISC-V SBI Subtype to
DBG2") added the definition of ACPI_DBG2_RISCV_SBI_CON.

Continue to implement its function so that the parameters of UART can
be configured correctly.

Subsequent calls to setup_earlycon() will reuse the earlycon based on
SBI.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Reviewed-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
Link: https://patch.msgid.link/20250910094136.4423-1-cp0613@linux.alibaba.com
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2025-09-15 21:37:40 +02:00
Linus Torvalds f83ec76bf2 Linux 6.17-rc6 2025-09-14 14:21:14 -07:00
Linus Torvalds 79e8447ec6 Generic phy driver fixes for 6.17 
- Qualcomm repeater override properties, qmp pcie bindings fix for
    clocks and initialization sequence for firmware power down case
  - Marvell comphy bindings clock and child node constraints
  - Tegra xusb device reference leaks fix
  - TI omap usb device ref leak on unbind and RGMII IS settings fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmjG+jkACgkQfBQHDyUj
 g0cpfxAAs18gXubWL1FgF91hyt3UQBCTJbbGfbSg93F1iE2nK0wPIFj6ZwshuUpv
 H28sB06jU+SumoKI+ICVxWmWVTpWz3+k9biYouIWjy0y7E1BWaSFTSF2ud/JglHn
 zLWaimkNfBbY6fJFb/AirUIWRY4cEYRTjG9UqhF3o830g88ZW3JK8P+Z2Az9eszR
 69/Ntg8830osLlueffIOZH+uYPFwYwyBxYOErw1jDNjKXTCDBEUUrNknLPJNXqoI
 QRmMLc0O3erhCFj5rGP0RRrOeXT6tkY9g763MlemT864MXxrbgBqdGrLEsrk4qFJ
 nU+H84YplfMBu28cefTi80HfFdgM+3YEk9Q+d185YbhcPDR1jFB5MzQ6NoXvsmsx
 gecAKJlQcYNoQ0tI+2rx6CsXSC7SvAc49iaMQQyRb/MbUO4yMXv054kPQR/MziA3
 ggS+fVIY+xfI2e/xqczlL4ZqgR+gFHBrdDARgf5OwsR5cXZ96uqldR3uo/0jcMjx
 znZxSMyfBlnRbns/w5V2K5AFul1Z+d5TnyAm4naiedzY4szTjpQBQubr6Or3N+E3
 ZL0ZdaBTEh2ZhkdyPxHk3fJetfMmIvdpoCP9RgNaTSclpACSJPyIUam04oKhG4gH
 /AK55pJ2ZIKzoSzBQsCaYEEbk4VTqg0lxRZK095CLnHSpGU+Sgc=
 =9aeb
 -----END PGP SIGNATURE-----

Merge tag 'phy-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull generic phy driver fixes from Vinod Koul:

 - Qualcomm repeater override properties, qmp pcie bindings fix for
   clocks and initialization sequence for firmware power down case

 - Marvell comphy bindings clock and child node constraints

 - Tegra xusb device reference leaks fix

 - TI omap usb device ref leak on unbind and RGMII IS settings fix

* tag 'phy-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: qcom: qmp-pcie: Fix PHY initialization when powered down by firmware
  phy: ti: gmii-sel: Always write the RGMII ID setting
  dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings
  phy: ti-pipe3: fix device leak at unbind
  phy: ti: omap-usb2: fix device leak at unbind
  phy: tegra: xusb: fix device and OF node leak at probe
  dt-bindings: phy: marvell,comphy-cp110: Fix clock and child node constraints
  phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
 2025-09-14 13:17:30 -07:00
Linus Torvalds 0676181a87 dmaengine fixes for v6.17 
Couple of driver fixes for:
  - Intel idxd fixes for idxd_free() handling, refcount underflow on
    module unload, double free in idxd_setup_wqs().
  - Qualcomm bam dma missing properties and handing for channels with ees
  - dw device reference leak in rzn1_dmamux_route_allocate()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmjG9/8ACgkQfBQHDyUj
 g0emdBAAkBy+Nuft8OcjhfHGFP6aMpVccNoNJUqPDc49yhVPTlu0i360i0wYIwwf
 K06NRBSvAQf611ghyPkKPhlLB/+Dcos2KSBQBsdMi3RTreym2K+4nEw/5l+fznTB
 VtJ8xSDKILPMy1HVPC9y7zo6ak7DjtyFcZkVN1TH+T+EIfbp5vVV81vHGNFcRIUB
 gsRu4mpz/WEkI52FGjnbqS1/SePspbbXt8CC+U1Ypx7aHr6fLyOm5mS0xPbvSM/c
 xeuBXqcQd/VPdGa6RJcuV4td3sKXEIWdz7Q1rI/CDCwVvg/AathePsvemE6aCn2t
 9erMbXGHmRiGqFvH9+y3lwfpnctALgA8bAOuK1PrrCrjlbmoq7bVNzxWNnNi4Wtu
 sTNyebbNtLgPV9IGVQX8Y3lk4uK9H3s0KTVz5yD2Uki2KbK1yJJstIa87167omDx
 LcbxyTb2nRKKjDn+JZ5MFXqt8stJ8hv4jPl7UkY6dfmjAobpnobsgn33J+a++/Ta
 ZjCIk+sb2QVcl8UNoy1QS6dKFPtiVsGQ6prY2GuotU4289LIioXP1/D/ACqEilQs
 +nZqg39yj5VPLEZWC96ta6/16RbXbAmdyrGeadmefd4MTIWa5ZmVPwDJgLQM9SWX
 +w3icOPDx4h56Qeouy7PfBdeHL9775JM7MUGstzCYVEYDnrwroI=
 =ei5l
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine fixes from Vinod Koul:

 - Intel idxd fixes for idxd_free() handling, refcount underflow on
   module unload, double free in idxd_setup_wqs()

 - Qualcomm bam dma missing properties and handing for channels with ees

 - dw device reference leak in rzn1_dmamux_route_allocate()

* tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  dmaengine: idxd: Fix double free in idxd_setup_wqs()
  dmaengine: idxd: Fix refcount underflow on module unload
  dmaengine: idxd: Remove improper idxd_free
  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  dt-bindings: dma: qcom: bam-dma: Add missing required properties
 2025-09-14 13:06:06 -07:00
Linus Torvalds 1519fc7cd3 TTY/Serial fixes for 6.17-rc6 
Here are some small tty and serial driver fixes for 6.17-rc6 that
 resolve some reported problems.  Included in here are:
   - 8250 driver dt bindings fixes
   - broadcom serial driver binding fixes
   - hvc_console bugfix
   - xilinx serial driver bugfix
   - sc16is7xx serial driver bugfix
 
 All of these have been in linux-next for the past week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaMar1w8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yk8AQCgx9deB0WhbxP/+3sVJ+0swX/bWdoAn3hCCy8f
 P+QkteZ02Mmz25DS+gMB
 =3mTh
 -----END PGP SIGNATURE-----

Merge tag 'tty-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.17-rc6 that
  resolve some reported problems. Included in here are:

   - 8250 driver dt bindings fixes

   - broadcom serial driver binding fixes

   - hvc_console bugfix

   - xilinx serial driver bugfix

   - sc16is7xx serial driver bugfix

  All of these have been in linux-next for the past week with no
  reported issues"

* tag 'tty-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: xilinx_uartps: read reg size from DTS
  tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  dt-bindings: serial: 8250: allow "main" and "uart" as clock names
  dt-bindings: serial: 8250: move a constraint
  dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  serial: sc16is7xx: fix bug in flow control levels init
 2025-09-14 10:54:54 -07:00
Linus Torvalds d6b42787f3 USB fixes for 6.17-rc6 
Here are some small USB driver fixes and new device ids for 6.17-rc6.
 Included in here are:
   - new usb-serial driver device ids
   - dummy-hcd locking bugfix for rt-enabled systems (which is crazy, but
     people have odd testing requirements at times...)
   - xhci driver bugfixes for reported issues
   - typec driver bugfix
   - midi2 gadget driver bugfixes
   - usb core sysfs file regression fix from -rc1
 
 All of these, except for the last usb sysfs file fix, have been in
 linux-next with no reported issues.  The sysfs fix was added to the tree
 on Friday, and is "obviously correct" and should not have any problems
 either, it just didn't have any time for linux-next to pick up (0-day
 had no problems with it.)
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaMas6Q8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynTnQCcCnZGqZrq8wiioAa4AzwRkM0PqAAAn3N0yrx4
 BXF8pTnpOkYZmjX1cIzK
 =GoFM
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes and new device ids for 6.17-rc6.
  Included in here are:

   - new usb-serial driver device ids

   - dummy-hcd locking bugfix for rt-enabled systems (which is crazy,
     but people have odd testing requirements at times...)

   - xhci driver bugfixes for reported issues

   - typec driver bugfix

   - midi2 gadget driver bugfixes

   - usb core sysfs file regression fix from -rc1

  All of these, except for the last usb sysfs file fix, have been in
  linux-next with no reported issues. The sysfs fix was added to the
  tree on Friday, and is "obviously correct" and should not have any
  problems either, it just didn't have any time for linux-next to pick
  up (0-day had no problems with it)"

* tag 'usb-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  USB: core: remove the move buf action
  usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  usb: gadget: midi2: Fix missing UMP group attributes initialization
  usb: typec: tcpm: properly deliver cable vdms to altmode drivers
  USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  xhci: fix memory leak regression when freeing xhci vdev devices depth first
  xhci: dbc: Fix full DbC transfer ring after several reconnects
  xhci: dbc: decouple endpoint allocation from initialization
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions
 2025-09-14 10:28:15 -07:00
Linus Torvalds df86f912b4 Fix a CPU topology parsing bug on AMD guests, and address 
a lockdep warning on the resctrl filesystem.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmjGjXMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jPsg/+O0Oyk4MkKtTip3Xf3XFFZUigCk5Lg9Ib
 AMCICzDUPSTbaGhH8hCErE0YgD8Rk7gyO+w0qKNH5q2DAhkuLFc609cHwldsZgMz
 n8WncqL/NxrtqmROyhGFs9i9TcX8W1qR5zHopov6EgCXQ1448PftA0jQLhQlww9j
 SqYPSVii78hHFKBUiaWw0nc40wDHsIMzdUxTUrqd9Qi/7RsTikApTqwUINb65uFS
 XLYPUVauZLh1dU2qJKMt2GHuslxn6sBKV1sRXkjsxI+KzuKd61CHDUNcbFCrsjBE
 3nJwd0Oc4+2Pdx8Qu3I/8K+IHnwYLxd/0NT2ROCnn8Grqp1AzMmoGpnajF30yPYg
 ncLRazjlfNb5EKIQyRJN/Um9dY0yraHlIgfvJ8lZ9Aqon80WxSmPRCg2SdipKdZh
 /XJw0kP4dUCH7X9xnhAsz02VwQTXITeZMzK8jev02nzxkPodcv5Gq4mD0CclM3VJ
 LeGwasWkba7hcZy8+pICtKkZ+1O/+Cd1w0cE9YkPN+c+bqDXIQRmaFIZHTM/lVRx
 HFmfn0gd0EVidKu1CAuRHH7BDOI2K95LLTChdR0toKfkI3ra7oUFZN2BXLxfYV2J
 3t1PWrJvHMCjifOq2F8m7WGbg7VzoTjOGaZIFvBxGKKB1azBm7Hxlq1OMjp8LUcx
 3T5TPE1agtw=
 =pmQD
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:
 "Fix a CPU topology parsing bug on AMD guests, and address
  a lockdep warning in the resctrl filesystem"

* tag 'x86-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters
  x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
 2025-09-14 08:39:48 -07:00
Linus Torvalds 8378c89172 Fix a lost-timeout CPU hotplug bug in the hrtimer code, which 
can trigger with certain hardware configs and regular HZ.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmjGirsRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1i91g//QWtFBkjSJgDaCwABsSIr7Z5vgzlidtx5
 ZI6bP7Fjt2nMnRXqp+KojMhoVx5WNi8XnQHL+tXIx685ILg8pusxJZ8RplwgccxZ
 jApW6PWEvrznWQn4i/uPsH2sDud1T7lI/K74JGPri3xaxpWxfk5LBzHDv296ygi6
 PShGP2RDjc1WpOtTs/K/1BHpwodDGB9k7V9CNjydaYKtbuRtNfbvpqTt+Syto8O8
 UuFG22j2ZRyPbwuw3PouwaZgBOrks0H9cXW9s6E3wHJA4p+90LVDdhSXcYo2YtJG
 VHJM1wUSN/Tth4DIUwxcXwk5ya5AKvQvokPv9n/FL3ceO2CdfyR/hJ2euB+l/dCl
 kNooAjaIQzTLowyMigMO+tT7jKTLuwUrq/l6rHSEIoLWoWLH9Ii55fXDlKr9zihu
 y5H/jjbNKULIPzZ03gfuIqz4/+t7hFthMcyH+x4xHgPNayT9BJ2X/T59i3wATeZu
 s7hscdCb1rNE11Or2mggSX/pMDJxDMzEaD1JmD/4qJeFSipLmKbxcZZgq96RF//2
 tU5zrZhm5GIqaK8o/xp1ps15xAwSnDyYjH59U7To0drfoV9uBg7lczPhaAoVAW/F
 lQoepSFrw9hV34YRAebimza7/+5IRk+SBCWwYg++xviGaxFt5TStJITOTk3UbHSx
 miCA3D/MDeM=
 =m+Ze
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Ingo Molnar:
 "Fix a lost-timeout CPU hotplug bug in the hrtimer code, which can
  trigger with certain hardware configs and regular HZ"

* tag 'timers-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  hrtimers: Unconditionally update target CPU base after offline timer migration
 2025-09-14 08:38:05 -07:00
Linus Torvalds 563b3f6ef5 Input updates for v6.17-rc5 
- a quirk to i8042 for yet another TUXEDO laptop
 
 - a fix to mtk-pmic-keys driver to properly handle MT6359
 
 - a fix to iqs7222 driver to only enable proximity interrupt if it is
   mapper to a key or a switch event
 
 - an update to xpad controller driver to recognize Flydigi Apex 5
   controller
 
 - an update to maintainers file to drop bounding entry for Melfas touch
   controller.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaMYYKAAKCRBAj56VGEWX
 nOvAAP9IkaFQyTC8hWVUU8w6Q5gC7+pF3lccnOckdDxvoY6kVAEAsQMz8J4Df7ZK
 OEaOPUCzWn5mcrAR74+LGXqGgRYGAwk=
 =ctHa
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - a quirk to i8042 for yet another TUXEDO laptop

 - a fix to mtk-pmic-keys driver to properly handle MT6359

 - a fix to iqs7222 driver to only enable proximity interrupt
   if it is mapped to a key or a switch event

 - an update to xpad controller driver to recognize Flydigi Apex 5
   controller

 - an update to maintainers file to drop bounding entry for Melfas
   touch controller

* tag 'input-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  MAINTAINERS: Input: Drop melfas-mip4 section
  Input: mtk-pmic-keys - MT6359 has a specific release irq
  Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  Input: iqs7222 - avoid enabling unused interrupts
  Input: xpad - add support for Flydigi Apex 5
 2025-09-14 08:09:37 -07:00
Krzysztof Kozlowski 30989f6765 MAINTAINERS: Input: Drop melfas-mip4 section 
Emails to the sole melfas-mip4 driver maintainer bounce:

  550 <jeesw@melfas.com> No such user here (connected from melfas.com)

so clearly this is not a supported driver anymore.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250910142526.105286-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 2025-09-13 17:50:38 -07:00
Linus Torvalds f83a4f2a4d Changes since last update: 
- Fix invalid algorithm dereference in encoded extents;
 
  - Add missing dax_break_layout_final(), since recent FSDAX fixes
    didn't cover EROFS;
 
  - Arrange long xattr name prefixes more properly.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmjGAqURHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qq2BA/+M205rUNBMV4FemrcWyf1VOJ4D2uQBp5T
 JKKw3JcVg8lhYTDDrZHGcsauqRpBJ15xE+gafOi1cLgUoqS5ZEX2+Mey9Lu6ERWX
 JRorsFYAdALdikCxhL5dfIlc+jpBxop/AzBLUTOoJvV+xZbeZUZXR1wD3VCmC2yf
 Xrzn6BQCwoOsg5/k+jxzjPUEsVjQZo9glZaBJYgBssWNpGEb98qk8tuHncvTilNm
 6Gy7+yUZVfNK9+hP8lUYs8+/k4pCmiMfpLYAAwGnH+zAw/gw3O6wIaHt9vwmMSlc
 gWsPnhLacDk9xo8xmsi2t0u8zmfBl1MNDY58VYyUQNAeUAnSUzdOv+PTWwzQM4MS
 m3pXyMNJNFlTJMufnqsftW3l2CB64EFMiF/IH09//EL+jInzKzkahoDqRFAv7LSm
 yIuvGW9c1ZDoTnF95JBzQEnLJVoOjiy7i3n/YeB7Z2DWqG1L/GYZxHRrWuM72Fzj
 21Te8OoMk9LtaOFTmN2o5G6KQN+s4w+ywIBWNItvou2lY1cZkVAWRa0Jy9+PHYss
 InPUKXJP8JvE9Jfa+xO+Wz9t5cr6xNzbfhCs/vGpLkKh2/zk34Rsbh+4ovHZqNJG
 rMDAE/GJc/kN/W0d8sEN/GfIPmq03dHIpKKeTty2bWDrjfjf/qYJq6rW18drpt0O
 CT/fUDSL2ks=
 =iM5A
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs fixes from Gao Xiang:

 - Fix invalid algorithm dereference in encoded extents

 - Add missing dax_break_layout_final(), since recent FSDAX fixes
   didn't cover EROFS

 - Arrange long xattr name prefixes more properly

* tag 'erofs-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: fix long xattr name prefix placement
  erofs: fix runtime warning on truncate_folio_batch_exceptionals()
  erofs: fix invalid algorithm for encoded extents
 2025-09-13 17:16:52 -07:00
Linus Torvalds 5cd64d4f92 A fix for a race condition around r_parent tracking that took a long 
time to track down from Alex and some fixes for potential crashes on
 accessing invalid memory from Max and myself.  All marked for stable.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmjFk5wTHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi/b1B/9Wm5Sb1Gja4BK04xrtQ76VWAquiPp+
 CSB685OnFPr3437sIe06ZDZjVnqqLyYVFBmUlVOlkSfYaR4uHtznpvdvhVlerN+y
 UaP/qHp5vacEf3n+MWCUXnDTqau65J+wDri64HNOWyl3UvZ/aaxz9UdZROqNQUMj
 H1OdYgGr1n4DLT/iBntr8t9GAuZ5/bjwXWJGZ7xkaO4hjth6fAzw45BpX4Iuoox9
 3ZPBJjz5p1SiXtREDL1eiyipE5o7Fg+R0QIIH6tQaH8KORyZYZDjdj2jyPg2+Wq2
 N1vFP6IxRZyZ3hapK3ZCQjnAM26lZJ+aaWvFjT45VdLz88HJxvDDV/1k
 =c7ou
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-6.17-rc6' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A fix for a race condition around r_parent tracking that took a long
  time to track down from Alex and some fixes for potential crashes on
  accessing invalid memory from Max and myself.

  All marked for stable"

* tag 'ceph-for-6.17-rc6' of https://github.com/ceph/ceph-client:
  libceph: fix invalid accesses to ceph_connection_v1_info
  ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
  ceph: always call ceph_shift_unused_folios_left()
  ceph: fix race condition where r_parent becomes stale before sending message
  ceph: fix race condition validating r_parent before applying state
 2025-09-13 10:45:11 -07:00
Linus Torvalds 395d68e5dd regulator: Fix for v6.17 
One fix for sy7636a which got confused about which device to use to
 manage the lifecycle of the power good GPIO because it's looked up from
 the parent device due to the way DT bindings work.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmjFYoQACgkQJNaLcl1U
 h9A5dgf+ITq9vjSnnGw2RKk7AATDIe9YQZQoqadKVrHwEbv2J1iH2MxCXttKz6JQ
 DL0p/B6QpT64Df/FztrX24AQsK+cUZOnKsrKW7uEKTUcbrC2fInr9jQ1BEwHb/ch
 4/mURACeO7YsXGEET3r6voT4HaAeApaB6InPeGcnvWWA7DZBZ+yNp94nCCu+tk6k
 U/7lrHByGkyablCvNhq2RrSbI17kasBdq6Tvt3XI7tCmvy7Aqjp4QsEkttS9yYE+
 U/RGDoO+OzvXcZ6C6oeJKn7sdsDukcakTzFZBSldt4oS08CatZOynyJSM6y2DZx1
 sfCICr3qssLJRdMl0I1G/0dJt9XZ5A==
 =6rOw
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "One fix for sy7636a which got confused about which device to use to
  manage the lifecycle of the power good GPIO because it's looked up
  from the parent device due to the way DT bindings work"

* tag 'regulator-fix-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: sy7636a: fix lifecycle of power good gpio
 2025-09-13 10:40:50 -07:00
Linus Torvalds b891d11b74 Driver core fixes for 6.17-rc6 
- Fix UAF in cgroup pressure polling by using kernfs_get_active_of()
     to prevent operations on released file descriptors.
 
   - Fix unresolved intra-doc link in the documentation of struct Device
     when CONFIG_DRM != y.
 
   - Update the DMA Rust MAINTAINERS entry.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaMU9HgAKCRBFlHeO1qrK
 LucTAQCpnAg/IpT60owrTQLZkP9MAj4+h53ubl3jQJXGQJl8qQD8CWT8u5iZvEhb
 HutUdZpcWU/XzDCqSXEa+DY8hIg1KQQ=
 =Ui/p
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Fix UAF in cgroup pressure polling by using kernfs_get_active_of()
   to prevent operations on released file descriptors

 - Fix unresolved intra-doc link in the documentation of struct Device
   when CONFIG_DRM != y

 - Update the DMA Rust MAINTAINERS entry

* tag 'driver-core-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  MAINTAINERS: Update the DMA Rust entry
  kernfs: Fix UAF in polling when open file is released
  rust: device: fix unresolved link to drm::Device
 2025-09-13 10:36:06 -07:00
Linus Torvalds 22f20375f5 pci-v6.17-fixes-3 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmjEOk4UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vy/6BAAuG1tHr0eS8N91izFldT+aVt8pAdW
 wOUsHzj6CkcxSYHuAc1wnSKBb7xxqNLdotsfSOAAUQrCctvlNiy2sxkDp31wrZcJ
 5up0h7VXqIV8Vbirde4nrlN3ey8Op1xUGn/V2VulzH+BCRauIjtXBcZVUmgVJ0xw
 MZ9n9I0GKbykNUiQIZCgJEZvI25rNbAalhfxN7JtY/U0Ra60XI+s6Z6Vi1T8whGt
 SupYOnNUXubStEDDu2QzPMinHTU266ory3zPU0mbrRSOq1aqfljTuVQsTREjrKVR
 Q6GnOlB3o9q2E5UfrZcJlskwdN+cT1FvZx97Ec6Izjj4sCsF47CtfYGfwSakdCRU
 Y2cyGzi1MEwuFmRsiLCmiuW5pk5SzU8vYpC7Vpoi+cyrfF3T8hSIuiMyUsuq/b9x
 lZv4z/1KLZNdbKX/ZDTaTWq0rKZzvxrpSFfSq+HWzzPj9w3rvSf3p5lVX8gY+pqN
 WD1uMtv3NKgTeZkxCXkeVBd9x5o0jWWGaohCuuOLTr0FEG63Yg1x4/blCdf1YPCi
 ZIqcd7aAiKzQAsWylqpJCOvYlRsCDo4mY1HvpPi5mwCtjM9cYmi85L0CwLW/mgZ8
 NHLmzlUOOmbqwvHjjmocOFZnxmXlYRlO61S572Lc3H136KrveXv41m8YHubbr8K8
 8lt6NE8Cc11M7Ac=
 =LR29
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fix from Bjorn Helgaas:

 - Fix mvebu PCI enumeration regression caused by converting to
   for_each_of_range() iterator (Klaus Kudielka)

* tag 'pci-v6.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: mvebu: Fix use of for_each_of_range() iterator
 2025-09-12 10:46:10 -07:00
Linus Torvalds 965c995c9a drm fixes for 6.17-rc6 
MAINTAINERS:
 - add rust tree to MAINTAINERS
 - fix X entries for nova/nouveau
 
 nova:
 - depend on 64-bit
 
 i915:
 - Fix size for for_each_set_bit() in abox iteration
 
 xe:
 - Don't touch survivability_mode on fini
 - Fixes around eviction and suspend
 - Extend Wa_13011645652 to PTL-H, WCL
 
 amdgpu:
 - PSP 11.x fix
 - DPCD quirk handing fix
 - DCN 3.5 PG fix
 - Audio suspend fix
 - OEM i2c clean up fix
 - Module unload memory leak fix
 - DC delay fix
 - ISP firmware fix
 - VCN fixes
 
 amdkfd:
 - P2P topology fix
 - APU mem limit calculation fix
 
 mediatek:
 - fix potential OF node use-after-free
 
 panthor:
 - out-of-bounds check
 
 nouveau:
 - revert waitqueue removal for sched teardown
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmjDn2AACgkQDHTzWXnE
 hr6+bg//VqfUDERVM5/midDbpa8PCHN645tkMYXgids9lFoj4yzwnr8IlDnaQgIw
 0P+KeyFm/JpuKKPULi0xXD1A5M8mPJ1jgtIrWsL4DNXzvNmgSqMd+SX4GmhWfCOp
 ZtczGMyiO+QJQ0+3HkJ2+SCmi2TVQKHdJE0/tobhMdZTl+gMjmB6VVmWojuAbA21
 e+Yxq0UA5JAYWYWTaoKMgvX7HG9g/SplHmu8aosi+2FxgUAppC6Hvk00vlRmZOjH
 JQmFF+eDuZpMreIqe5x/Ng4gIrS1kXVdr6dFHS+6Me97KDxatsLvUXqmRzu3h007
 sNPZJLx2qysfTJP4hPb0n7d15nj6XpajM4ncwsxdWcvOI+hSdWfPChPJRCOFYNJy
 cEYF45gWfjrCpi9ldcNR+u4KYAUUbITapkkhJS0I6xy2l/roAKIvlZ4QJZDbYCYM
 PFCzC7FgyLleVLGkJIVZPr8SC6wa5mm7zoPo973HAhujPvDJvRHFuZWIxohQvc+j
 MsP+f+kiDeSowcBVuZrFlCnhIOxM/9eGR3NRof38AvWVj/mjNR6yu+2UMb4w6Vv8
 jglmoGFA1Up96oi+aq7yTPCO4YdX89Z5GBLS94Y66bQg/V+nAfmonRMSYBOdTEnN
 9v6Eb8GNzN0Dj6OyaAd5r4gTLtNuMu6d3S3W8l2LO6pI7bb3crM=
 =wPUA
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-09-12' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly pull fixes for drm, mostly amdgpu and xe, with a revert for
  nouveau and some maintainers updates, and misc bits, doesn't seem too
  out of the normal.

  MAINTAINERS:
   - add rust tree to MAINTAINERS
   - fix X entries for nova/nouveau

  nova:
   - depend on 64-bit

  i915:
   - Fix size for for_each_set_bit() in abox iteration

  xe:
   - Don't touch survivability_mode on fini
   - Fixes around eviction and suspend
   - Extend Wa_13011645652 to PTL-H, WCL

  amdgpu:
   - PSP 11.x fix
   - DPCD quirk handing fix
   - DCN 3.5 PG fix
   - Audio suspend fix
   - OEM i2c clean up fix
   - Module unload memory leak fix
   - DC delay fix
   - ISP firmware fix
   - VCN fixes

  amdkfd:
   - P2P topology fix
   - APU mem limit calculation fix

  mediatek:
   - fix potential OF node use-after-free

  panthor:
   - out-of-bounds check

  nouveau:
   - revert waitqueue removal for sched teardown

* tag 'drm-fixes-2025-09-12' of https://gitlab.freedesktop.org/drm/kernel: (25 commits)
  MAINTAINERS: drm-misc: fix X: entries for nova/nouveau
  drm/mediatek: clean up driver data initialisation
  drm/mediatek: fix potential OF node use-after-free
  drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  drm/amd/amdgpu: Declare isp firmware binary file
  drm/amd/display: use udelay rather than fsleep
  drm/amdgpu: fix a memory leak in fence cleanup when unloading
  drm/xe: Extend Wa_13011645652 to PTL-H, WCL
  drm/xe: Block exec and rebind worker while evicting for suspend / hibernate
  drm/xe: Allow the pm notifier to continue on failure
  drm/xe: Attempt to bring bos back to VRAM after eviction
  drm/xe/configfs: Don't touch survivability_mode on fini
  amd/amdkfd: correct mem limit calculation for small APUs
  drm/amdkfd: fix p2p links bug in topology
  drm/amd/display: remove oem i2c adapter on finish
  drm/amd/display: Drop dm_prepare_suspend() and dm_complete()
  drm/amd/display: Correct sequences and delays for DCN35 PG & RCG
  drm/amd/display: Disable DPCD Probe Quirk
  drm/i915/power: fix size for for_each_set_bit() in abox iteration
  ...
 2025-09-12 09:29:59 -07:00
Linus Torvalds cb780b79b2 Two smb3 client fixes, both for stable 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmjDjK0ACgkQiiy9cAdy
 T1Fodgv/VLiUtR685w1bAdjgf0y/LKG1LKbewiC2p6Tk8I2auDn/gMRTMPbV+RFZ
 7fm2H/RVVOV9gDokWFWIjwe8FIEGuGlKpVGNtzn1fHKllL1/XpzaEgwmaKy+O4Cq
 7eNhXX1XQM7CdsnNnlxPfbtHqkyVbbkXJbzLjF0DY755iF47PUN5F679OVP4Vtlf
 LN/NHvPrOGVk4bxMx9Pd3VCkl98vqd9xFLAcwLR9hgsNF9Jcr2TaduRRsVXI9++C
 nQQpd/rjItOlrUALYECsiJyr82qZk52X4H2ibhPgGWaA9pemc/n6rW3C5q60Y8oy
 wfwL6vPEk/ob6Z7SD/MkbLtYlsXB5D63V0AglO/HX6Ahr5HQMp8/iZfRUpVr9H6N
 ysK/TagVQMpjjgtYv9nxBRvaOvolFVIMyVsOxC21lU4rZp2ojlS8f/y3vhPZ5cw2
 w2qlNlh8ZZ/QmqzKCn6FzutDSs4HPdWTQMbPW5N0hgUX2T6j/08k/VuZDRCEhn2e
 OkKraJRc
 =DheL
 -----END PGP SIGNATURE-----

Merge tag 'v6.17-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:
 "Two smb3 client fixes, both for stable:

   - Fix encryption problem with multiple compounded ops

   - Fix rename error cases that could lead to data corruption"

* tag 'v6.17-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: fix data loss due to broken rename(2)
  smb: client: fix compound alignment with encryption
 2025-09-12 09:03:01 -07:00
Edward Adam Davis 9dfec4a51d USB: core: remove the move buf action 
The buffer size of sysfs is fixed at PAGE_SIZE, and the page offset
of the buf parameter of sysfs_emit_at() must be 0, there is no need
to manually manage the buf pointer offset.

Fixes: 711d41ab4a ("usb: core: Use sysfs_emit_at() when showing dynamic IDs")
Reported-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b6445765657b5855e869
Tested-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://lore.kernel.org/r/tencent_B32D6D8C9450EBFEEE5ACC2C7B0E6C402D0A@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-09-12 13:41:55 +02:00
Greg Kroah-Hartman 7609fb63ce USB serial device ids for 6.17-rc6 
Here are some new modem device ids.
 
 Everything has been in linux-next with no reported issues.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQHbPq+cpGvN/peuzMLxc3C7H1lCAUCaMPXVAAKCRALxc3C7H1l
 CIToAQDoULIp/C7gzVUPgHpIeMGPHspAsVqjZ5TDO0Bhc6oM4QEAtpsmzbiZ76xh
 jxTtlUiCmVedSTu/OMRTXW2Xz/CRgAU=
 =U3Rs
 -----END PGP SIGNATURE-----

Merge tag 'usb-serial-6.17-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB serial device ids for 6.17-rc6

Here are some new modem device ids.

Everything has been in linux-next with no reported issues.

* tag 'usb-serial-6.17-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions
 2025-09-12 10:41:15 +02:00
Dave Airlie 9a3f210737 - Don't touch survivability_mode on fini (Michal) 
- Fixes around eviction and suspend (Thomas)
 - Extend Wa_13011645652 to PTL-H, WCL (Julia)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmjC6toACgkQ+mJfZA7r
 E8q/IQf8CNF5UxeohpunvIR6lO/igxmy4JxPPGt8/GLhz3rktJqXM/YWfZTBuy31
 0w/egd/nxtisTjgfZHPNUeMwVrNfer8w4VtwWfANVj6iQCRGDbwReo1vO3FK6ISA
 4bNUtv3kDx9VcaGMvyn13I8beAR+EHxNQ8qMGMczYvO3luCr6OcWTqIUmm4coEBL
 Cbiolupi8SSDIXRC+FUXSgwK9VU5928UVxmyim88sFT63FJSRO5CX+5u53LfBrlv
 qdlSO3wXnjE5RbCAxVnAPnfT5DYa0KEuzG8c+KpI3iQ9oDLUgqHafhW7B7L4XIB7
 iHrlRsvfRgZNGuiTFTj9kr+OEZjj8w==
 =xwQv
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-09-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- Don't touch survivability_mode on fini (Michal)
- Fixes around eviction and suspend (Thomas)
- Extend Wa_13011645652 to PTL-H, WCL (Julia)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://lore.kernel.org/r/aMLq7QlaEPHGKXKX@intel.com
 2025-09-12 09:44:07 +10:00
Linus Torvalds 320475fbd5 SPI NAND fix: 
- Wrong OOB layout for Winbond W25N01JW SPI NAND devices
 
 Raw NAND fixes:
 - Atmel raw NAND controller timings
 - Buffer handling in stm32_fmc2 driver
 - Error handling in Nuvoton's driver
 
 MTD devices fixes:
 - Wrong depends-on dependencies on the Intel DRM driver
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmjC7bIACgkQJWrqGEe9
 VoRFUwf6AnaDLEAvyyJF3mGPbL8zB9+3JVr78Zvpcy949QMvi17l5W07JBdZJkVI
 kByT0Y+XLFgSG1UtK1yCYSWM2achx33W1C1rp9D7Yp/yMZDCPoi4DcxMj+48A20s
 M58EjdCqlSRFmfl0D/w3UZ1vbDIo/cTInh+NpwHJktgW8JuNN1dzUaXyRG732pz8
 wwC2wLKJwKGPquiEcCCuWKa2syoMAr440Gx21tB3hz/ypGj33+I9Hoj7N4sMjo+b
 0ZZPq0lwMkwwhILHNybaOYIKmbK57KHRJYQrcUvkzQZA/swxK91vO13MxwIAylN6
 2g2hM5x8TgKH17VNdxexU6eq0tkN/A==
 =rIOi
 -----END PGP SIGNATURE-----

Merge tag 'mtd/fixes-for-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull mtd fixes from Miquel Raynal:
 "SPI NAND fix:
   - Wrong OOB layout for Winbond W25N01JW SPI NAND devices

  Raw NAND fixes:
   - Atmel raw NAND controller timings
   - Buffer handling in stm32_fmc2 driver
   - Error handling in Nuvoton's driver

  MTD devices fixes:
   - Wrong depends-on dependencies on the Intel DRM driver

* tag 'mtd/fixes-for-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spinand: winbond: Fix oob_layout for W25N01JW
  mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  mtd: rawnand: stm32_fmc2: fix ECC overwrite
  mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  mtd: rawnand: nuvoton: Fix an error handling path in ma35_nand_chips_init()
  mtd: MTD_INTEL_DG should depend on DRM_I915 or DRM_XE
 2025-09-11 16:35:06 -07:00
Dave Airlie dab1f85526 A maintainer update, an out-of-bound check for panthor and a revert for 
nouveau to fix a race.
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCaMLy9QAKCRAnX84Zoj2+
 dsYUAX9Bt5DDci551vnKMVVoR8zMLT+qIx/cCOcYLaXFq9eAmm0hT/fpnWNhOXIF
 WuLWeJABf1WW2ahPXpkyFk2kwtmvEDPchdNsdEDPNO3KLqN9/tjLxZMwy4HCq4K1
 FyF9D/vM0A==
 =mqBh
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2025-09-11' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

A maintainer update, an out-of-bound check for panthor and a revert for
nouveau to fix a race.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://lore.kernel.org/r/20250911-glistening-uakari-of-serendipity-06ceb1@houat
 2025-09-12 09:34:48 +10:00
Dave Airlie f2c8bbb6e9 Mediatek DRM Fixes - 20250910 
1. fix potential OF node use-after-free
 -----BEGIN PGP SIGNATURE-----
 
 iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmjBdZEYHGNodW5rdWFu
 Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4kq+YP/3Ujdf9xfBJ8sqS7AyFJdLDz
 wb1eJbhgvuce+jHJU5NLdNSLCVdcU1RKYHkrMbY0DhdxevN/a2LKZMYDjyv9NlA9
 jreTvGC7BVmZvadkBNY0bMD2GjTGs4/PlHgclApVB6GIQxbWCWPvy7XlaGVcTSRO
 EsZ3RFDVaIL6516wX7/kNNBpMtGaQRScptw8bDTguZtMc+bfCcZbO9LVHS5x5DVu
 h6WrBynLzPxoft0Tk3UIsvGsTAoH0MWymIERWd/2x7NgABPE1vVeyjBOcdn+7Zsv
 ZS2QIvYTlF6/bCNGD3/WJvbe3xdI4W1o5uSd13FhdhT6MSTbs32TTDlSGBgfvaTt
 pq/n+dZJLXzOLiB+lkVEn9pVhALmL3v90CYCG1b77n126kKa10HYEHgmnPxUBn6a
 qYAyaBRZmvaTXLMQWqV71imrvVyYkJFsHIAHjBNTqht0FQ2FdPXqY2ZVrtmYRgb+
 Cf9U3D32E5xC1ofMGly2dmOyyq9DwnqEuLmm34yRD40txbzgh2aSnUUcS6pWMnF9
 +iZQ6X2FvI46iS2UOL2M4iX/hPuw94HNJ9JhBjecqHHpuf3BSY+OdqDFkDM7/5aF
 c0bockFtYgEIhTV773b44pw6jI+9V2dkT+mY44raRAUZUdqKg/H6ZRbwqEKq1XA+
 MtlOMEncm6EJneBgE5yi
 =7CAS
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-fixes-20250910' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes

Mediatek DRM Fixes - 20250910

1. fix potential OF node use-after-free

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://lore.kernel.org/r/20250910231813.3526-1-chunkuang.hu@kernel.org
 2025-09-12 09:31:27 +10:00
Dave Airlie 1d00adb873 amd-drm-fixes-6.17-2025-09-10: 
amdgpu:
 - PSP 11.x fix
 - DPCD quirk handing fix
 - DCN 3.5 PG fix
 - Audio suspend fix
 - OEM i2c clean up fix
 - Module unload memory leak fix
 - DC delay fix
 - ISP firmware fix
 - VCN fixes
 
 amdkfd:
 - P2P topology fix
 - APU mem limit calculation fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaMGmiwAKCRC93/aFa7yZ
 2IEjAP9j+7yMgZUOrvoQAQcs/Y60zSJF2qRvQRc5q8JrJJHCOgD5AVtiVLnimhor
 VjnS6UwVjHquePksYg4ix6sJhiTtFw4=
 =2uez
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.17-2025-09-10' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.17-2025-09-10:

amdgpu:
- PSP 11.x fix
- DPCD quirk handing fix
- DCN 3.5 PG fix
- Audio suspend fix
- OEM i2c clean up fix
- Module unload memory leak fix
- DC delay fix
- ISP firmware fix
- VCN fixes

amdkfd:
- P2P topology fix
- APU mem limit calculation fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20250910162855.2507853-1-alexander.deucher@amd.com
 2025-09-12 09:24:57 +10:00
Dave Airlie 467360e295 Merge tag 'drm-intel-fixes-2025-09-10' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes 
- Fix size for for_each_set_bit() in abox iteration [display] (Jani Nikula)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Tvrtko Ursulin <tursulin@igalia.com>
Link: https://lore.kernel.org/r/aMFUtRdJ46qK-EXl@linux
 2025-09-12 09:21:20 +10:00
Dave Airlie 2c38074c36 - Add drm-rust tree to MAINTAINERS 
- Require CONFIG_64BIT for Nova
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEg5KilE1kBwrxSL2yBFi+7ljGOUYFAmi6rMQACgkQBFi+7ljG
 OUZk1BAAmfVVGcZ7tmLB1BCYygmb6IHaaEH29jHk6sBb25fdX1UcVduOYsBNiTe/
 1SEEbGcy02aSehOYP8aJ6WiX1bY6lWRvtSnE1AwzOobX1/IF3KieJdnmZt7eo8DS
 FJZMEkVhIQAuWqILiBRG6IO3uKxYLlAHbCfUTFV4XoazQnxi2mLgBX0p8nLbMOf7
 v+BfqYf4+PtkC94yWx7DK2Ezyum+JUeV1nuhPfnJ0jEV7vg/GkUvf6c3olRhF8uF
 qaHfYw72FEv8XCXWg70UDQtRLf0HEyLd8RHOO+7PCLtOxt3gyO650m5uTgOKY+ig
 LjBCGjku/zPJrVJnVO1b68T0hAxaa++IL39mYw8KZFIvudobKXunyaB535E+mReF
 FWXJn9bfHdkKfci7Nm9TJZtqEjpVu0Yez1cCX5oz9Haj2cYew6myJ268Jh1d0ntr
 JuE4b/m01fUZSD+8XCuvLf7Btl9a32cHldS1JGl3bJMHP86+2mb5XtzucURYdowg
 U7j+WONF7jbRn8Sg0JTD5T5KhSYwtggP3XHm26bCnIV7Zdrl3c6N9lRAzdYKmO8W
 nwH5ewYBUs5xDCR+EBk8E2vyTgR2aFJ8OGrtzLLo5Co6JJ+BePvqhewtT2K+1Jxw
 i30b+z4C7twDdV6xR+S1T3TCa08HqLwCPkT68M0B48+fGImcMcQ=
 =9plZ
 -----END PGP SIGNATURE-----

Merge tag 'drm-rust-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes

- Add drm-rust tree to MAINTAINERS
- Require CONFIG_64BIT for Nova

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/aLquN1YvdyI_6PJS@google.com
 2025-09-12 09:05:42 +10:00
Danilo Krummrich f6d2900f28 MAINTAINERS: Update the DMA Rust entry 
Update the DMA Rust maintainers entry in the following two aspects:

  (1) Change Abdiel's entry to 'Reviewer'.

  (2) Take patches through the driver-core tree.

Abdiel won't do any more maintainer work on the DMA (or scatterlist)
infrastructure, but he'd like to be kept in the loop, hence change is
entry to 'R:'.

Analogous to [1], the DMA (and scatterlist) helpers are closely coupled
with the core device infrastructure and the device lifecycle, hence take
patches through the driver-core tree by default.

Cc: Abdiel Janulgue <abdiel.janulgue@gmail.com>
Link: https://lore.kernel.org/r/20250725202840.2251768-1-ojeda@kernel.org [1]
Acked-by: Abdiel Janulgue <abdiel.janulgue@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
 2025-09-11 22:09:22 +02:00
Gao Xiang 1fcf686def erofs: fix long xattr name prefix placement 
Currently, xattr name prefixes are forcibly placed into the packed
inode if the fragments feature is enabled, and users have no option
to put them in plain form directly on disk.

This is inflexible. First, as mentioned above, users should be able
to store unwrapped long xattr name prefixes unconditionally
(COMPAT_PLAIN_XATTR_PFX). Second, since we now have the new metabox
inode to store metadata, it should be used when available instead
of the packed inode.

Fixes: 414091322c ("erofs: implement metadata compression")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
 2025-09-12 03:37:07 +08:00
Linus Torvalds db87bd2ad1 Including fixes from CAN, netfilter and wireless. 
We have an IPv6 routing regression with the relevant fix still
 a WiP. This v2 includes a last-minute revert to avoid more
 problems.
 
 Current release - new code bugs:
 
   - wifi: nl80211: completely disable per-link stats for now
 
 Previous releases - regressions:
 
   - dev_ioctl: take ops lock in hwtstamp lower paths
 
   - netfilter:
     - fix spurious set lookup failures
     - fix lockdep splat due to missing annotation
 
   - genetlink: fix genl_bind() invoking bind() after -EPERM
 
   - phy: transfer phy_config_inband() locking responsibility to phylink
 
   - can: xilinx_can: fix use-after-free of transmitted SKB
 
   - hsr: fix lock warnings
 
   - eth: igb: fix NULL pointer dereference in ethtool loopback test
 
   - eth: i40e: fix Jumbo Frame support after iPXE boot
 
   - eth: macsec: sync features on RTM_NEWLINK
 
 Previous releases - always broken:
 
   - tunnels: reset the GSO metadata before reusing the skb
 
   - mptcp: make sync_socket_options propagate SOCK_KEEPOPEN
 
   - can: j1939: implement NETDEV_UNREGISTER notification hanidler
 
   - wifi: ath12k: fix WMI TLV header misalignment
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmjC4tYSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkNwcQAIh8d10PYJ6iJvyxqBKVNT2CTr4wVk27
 lT9rB9t4Jdq4EhuDdRmolVPrkXEt4FiGnqPOsYIK+tPN5j6fgPaksA/lCKr3HMhT
 N7qfhCzUFUJQqZEA3pBy5RnRIzNupdTP3rcXFG8QPnGfzdcOZ2m1Tu/36rjt6lmE
 lB+9pLQBjI15r67v08ZzEGHfTX4FqlnlCu/jbcYhXNF6erv3jZRboneytJ3fxbMW
 kRdmi9wctMprKmWVFmaA0OPkwigMBO8xILnYOCcFhQcGKLugc58YGsjzBJbp/yUA
 Qmxb3Gl9pFe97u/URoLPXUE+2hF1X7ydT9hMXrle/gcXVnmU6rN+4xQuEzVPBOK7
 J3qh8IH5joMLaQS4VKSD/Wh0RrtDHJdduLDcjtL8qRkFyS30FqY0USd8prMkIE7I
 /s9Wdi96nC3WEZQtZKg0mRrSeTtbRR0/KO5gEb6MHaAE8ffKJa7MsMZlrh9VoJvM
 PC4PJnOr0Qy5MNAA1MxBWK6Dcsnor4cBkvE35uMoCkUoxOeTnKuruo0kyZYqmrIh
 VOnKrb3+w/I4lDXgQ4kIcpyQfrqMky8R6EGvQvjm2c2OLWZBCmBRU1c0Fjw789O4
 jMdzjs7H9ild2KwBZK4e7KfdoUnlxIza2Yh4pFLUf2R3NqBZ2vQTkpoCF4AK+wzU
 636F5GITLcVe
 =XjZM
 -----END PGP SIGNATURE-----

Merge tag 'net-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from CAN, netfilter and wireless.

  We have an IPv6 routing regression with the relevant fix still a WiP.
  This includes a last-minute revert to avoid more problems.

  Current release - new code bugs:

   - wifi: nl80211: completely disable per-link stats for now

  Previous releases - regressions:

   - dev_ioctl: take ops lock in hwtstamp lower paths

   - netfilter:
       - fix spurious set lookup failures
       - fix lockdep splat due to missing annotation

   - genetlink: fix genl_bind() invoking bind() after -EPERM

   - phy: transfer phy_config_inband() locking responsibility to phylink

   - can: xilinx_can: fix use-after-free of transmitted SKB

   - hsr: fix lock warnings

   - eth:
       - igb: fix NULL pointer dereference in ethtool loopback test
       - i40e: fix Jumbo Frame support after iPXE boot
       - macsec: sync features on RTM_NEWLINK

  Previous releases - always broken:

   - tunnels: reset the GSO metadata before reusing the skb

   - mptcp: make sync_socket_options propagate SOCK_KEEPOPEN

   - can: j1939: implement NETDEV_UNREGISTER notification hanidler

   - wifi: ath12k: fix WMI TLV header misalignment"

* tag 'net-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  hsr: hold rcu and dev lock for hsr_get_port_ndev
  hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  hsr: use rtnl lock when iterating over ports
  wifi: nl80211: completely disable per-link stats for now
  net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info
  MAINTAINERS: add Phil as netfilter reviewer
  netfilter: nf_tables: restart set lookup on base_seq change
  netfilter: nf_tables: make nft_set_do_lookup available unconditionally
  netfilter: nf_tables: place base_seq in struct net
  netfilter: nft_set_rbtree: continue traversal if element is inactive
  netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
  netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation
  can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  can: j1939: implement NETDEV_UNREGISTER notification handler
  selftests: can: enable CONFIG_CAN_VCAN as a module
  ...
 2025-09-11 08:54:42 -07:00
Linus Torvalds e59a039119 s390 fixes for 6.17-rc6 
- ptep_modify_prot_start() may be called in a loop, which might lead
   to the preempt_count overflow due to the unnecessary preemption
   disabling. Do not disable preemption to prevent the overflow
 
 - Events of type PERF_TYPE_HARDWARE are not tested for sampling and
   return -EOPNOTSUPP eventually. Instead, deny all sampling events by
   CPUMF counter facility and return -ENOENT to allow other PMUs to be
   tried
 
 - The PAI PMU driver returns -EINVAL if an event out of its range.
   That aborts a search for an alternative PMU driver. Instead, return
   -ENOENT to allow other PMUs to be tried
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCaMLF8hccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8IB/AP9qreFJZBVctpXAlwa+ZEE+ne07
 0nWtan8mP/GpdTvx7gD+LhsJwYtmWUO6RWUOcQP2wJg+AZDJUp8c+A2M0eAn+w8=
 =F/H0
 -----END PGP SIGNATURE-----

Merge tag 's390-6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Alexander Gordeev:

 - ptep_modify_prot_start() may be called in a loop, which might lead to
   the preempt_count overflow due to the unnecessary preemption
   disabling. Do not disable preemption to prevent the overflow

 - Events of type PERF_TYPE_HARDWARE are not tested for sampling and
   return -EOPNOTSUPP eventually.

   Instead, deny all sampling events by CPUMF counter facility and
   return -ENOENT to allow other PMUs to be tried

 - The PAI PMU driver returns -EINVAL if an event out of its range. That
   aborts a search for an alternative PMU driver.

   Instead, return -ENOENT to allow other PMUs to be tried

* tag 's390-6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/cpum_cf: Deny all sampling events by counter PMU
  s390/pai: Deny all events not handled by this PMU
  s390/mm: Prevent possible preempt_count overflow
 2025-09-11 08:46:30 -07:00
Linus Torvalds a1228f048a Power management fixes for 6.17-rc6 
- Restore a pm_restrict_gfp_mask() call in hibernation_snapshot() that
    was removed incorrectly during the 6.16 development cycle (Rafael
    Wysocki)
 
  - Introduce a function for registering a perf domain without triggering
    a system-wide CPU capacity update and make the intel_pstate driver
    use it to avoid reocurring unsuccessful attempts to update capacities
    of all CPUs in the system (Rafael Wysocki)
 
  - Fix setting of CPPC.min_perf in the active mode with performance
    governor in the amd-pstate driver to restore its expected behavior
    changed recently (Gautham Shenoy)
 
  - Avoid mistakenly setting EPP to 0 in the amd-pstate driver after
    system resume as a result of recent code changes (Mario Limonciello)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmjCw/YSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1SP8H/3O8D4ZFg7CxwuTn5MofPH5BBAg3FkwB
 RhXZ3WA/qjz+0CusYBJO3hsJVIfUrDUzow47zi0H4tbdqqdI7CUbOPoWnGt/N2hd
 ngxL4m+t91XkngLi0eOorxFPQ1/dA1p0g5BHXrzVpuMdE94V3gxb92g3SPrvjcAF
 N6fVCL3RMQqDwl5ZbadvWfXdE+07nxwogKTF/NKa+DF3SHSy3SOznKgn/AlhQEo3
 RKqAhaO3+RxzfTn8M0ie/flYUFApkMbdLdxYau2Lg4Ne3MhrID3ljhssGEFaQdQ0
 8z3OGmfOOOLu21F1iYaZiWWXc8wB6v47NchJvuU1FF/JQ+uXdsZZdNA=
 =ZGx1
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix a nasty hibernation regression introduced during the 6.16
  cycle, an issue related to energy model management occurring on Intel
  hybrid systems where some CPUs are offline to start with, and two
  regressions in the amd-pstate driver:

   - Restore a pm_restrict_gfp_mask() call in hibernation_snapshot()
     that was removed incorrectly during the 6.16 development cycle
     (Rafael Wysocki)

   - Introduce a function for registering a perf domain without
     triggering a system-wide CPU capacity update and make the
     intel_pstate driver use it to avoid reocurring unsuccessful
     attempts to update capacities of all CPUs in the system (Rafael
     Wysocki)

   - Fix setting of CPPC.min_perf in the active mode with performance
     governor in the amd-pstate driver to restore its expected behavior
     changed recently (Gautham Shenoy)

   - Avoid mistakenly setting EPP to 0 in the amd-pstate driver after
     system resume as a result of recent code changes (Mario
     Limonciello)"

* tag 'pm-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  PM: hibernate: Restrict GFP mask in hibernation_snapshot()
  PM: EM: Add function for registering a PD without capacity update
  cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume
  cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor
 2025-09-11 08:11:16 -07:00
Linus Torvalds b10c31b70b for-6.17-rc5-tag 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmjCW90ACgkQxWXV+ddt
 WDu03RAAon4XytPNZa3OK65kzgiVjzh7pVwTFWn//tYTwnA0g3y3Avwr5A7im6od
 Kd5HBKujx94n876rrHSLw/FZ44CYNu6v/yrvU5W/MUcnW5jhGt56WWcMIkXER/2l
 +Tui4deICr9pAGlA2g+rIy30thmJBW93Emu/jpdXiImvfW6mwQPRTx9OVrYWo/vy
 NJclTfXUp9bLjKOeJhJXDVrL2H723rlEs79Ewr2h/LhsqTP3XcT5DTGPw6AEKeaD
 j2K9jbTSYvJ0wZOv7k+kRmontFtNmC7Iq1IeXkrbrRlIHcpdOvya8ryXPKm773v4
 A3vJTK1KS4pKNP1T8q+8NXgD2oEXKJn6951N4RVxowdwhCcEEsGI2p6OGbbQxw/Q
 A+JCqVK/zHjsDpRaeubPfOrl0uZb5zga7akJfszOxbyt0+Kg0m7n7HhK3MYHQ3eb
 e5sTOr4c5lUax/yoyU7kV4UE7mx2AYBJpEp8cGfKFSeLt9p8l4hGMPuxvf3w7FJE
 wDckz1F5S9Px3eA0tydUdb+tPV324nqaRdqpw7qk8kddOz1NhF+RL5lWsjZyGYrR
 HEHUguiwjTJgdror+8BS4/EEfDv+KdJefZzl78MNmcaL3d/OOOjHxEsAc5GghwyN
 sFsJbTpQGC638H+gBK7QvR14IhHkr5fh5HkZ5JVRyDs4ZZf35PM=
 =XrCl
 -----END PGP SIGNATURE-----

Merge tag 'for-6.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:

 - fix delayed inode tracking in xarray, eviction can race with
   insertion and leave behind a disconnected inode

 - on systems with large page (64K) and small block size (4K) fix
   compression read that can return partially filled folio

 - slightly relax compression option format for backward compatibility,
   allow to specify level for LZO although there's only one

 - fix simple quota accounting of compressed extents

 - validate minimum device size in 'device add'

 - update maintainers' entry

* tag 'for-6.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: don't allow adding block device of less than 1 MB
  MAINTAINERS: update btrfs entry
  btrfs: fix subvolume deletion lockup caused by inodes xarray race
  btrfs: fix corruption reading compressed range when block size is smaller than page size
  btrfs: accept and ignore compression level for lzo
  btrfs: fix squota compressed stats leak
 2025-09-11 08:01:18 -07:00
Linus Torvalds 02ffd6f89c bpf-fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmjB/6gACgkQ6rmadz2v
 bToSCg//Z8Q2ToTV/BOLTzFYLvcTm2YRlqqIe3SFxyxLQCIhC0kxQAT94baVQHky
 /6ASbPjDWXdGVHNoMopA6lpMx22Tq4xi6qO5fzJHDuSqh5KTi8l5/GyJeA3egPzD
 7RIvKvvgePpCx0xm9rm5O5vvUeFrsxhQPRRiN/fsOibiTJjBpRAJDp9k+pvnK6mb
 HaZcHF+In5Vg7XozuHAUMzsp+4njzdLrMXL2Q54o2MrIoeBg8/oAnhLujskGMnXK
 mgUA+skW42IEkw+TYUu9888/5PMDkto3BZIx0plcAIVAIvcU5BFzLt11llQswgVl
 q740k50oRKrmwHyEVDwugV7WeGQMks48lMHtLKytYmdEhdTfEYUKHeBpcI87fUYy
 IpOdSUT49nBxOmGl59ccBcdzsndTjo7Zrl7dMf4umN0SSjfdohwj0uu7rmZCaOdd
 m/TxH13Ae7na4QzVx0N911qxBYw07uYNiq3Ati+x327ySozvvNfLIYK/sS/clJkd
 lOpz3kpjwgV+PUfv2NBqEJm4nSPTtW7fiEQ8p/yBvK90nB6NnHIbq9a2rPBKeDKx
 RpkDB9nhJ1J6OMKWkUDasMiP5tAXt9RrI+la/CgBxMcP/G4HxH6yf22Mf3Hzhe8V
 UfjAgHqXvmrjqpgIbO0AVkfwDvlOM37DGvY0H3bMFeOXCk0DDw4=
 =09/9
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
 "A number of fixes accumulated due to summer vacations

   - Fix out-of-bounds dynptr write in bpf_crypto_crypt() kfunc which
     was misidentified as a security issue (Daniel Borkmann)

   - Update the list of BPF selftests maintainers (Eduard Zingerman)

   - Fix selftests warnings with icecc compiler (Ilya Leoshkevich)

   - Disable XDP/cpumap direct return optimization (Jesper Dangaard
     Brouer)

   - Fix unexpected get_helper_proto() result in unusual configuration
     BPF_SYSCALL=y and BPF_EVENTS=n (Jiri Olsa)

   - Allow fallback to interpreter when JIT support is limited (KaFai
     Wan)

   - Fix rqspinlock and choose trylock fallback for NMI waiters. Pick
     the simplest fix. More involved fix is targeted bpf-next (Kumar
     Kartikeya Dwivedi)

   - Fix cleanup when tcp_bpf_send_verdict() fails to allocate
     psock->cork (Kuniyuki Iwashima)

   - Disallow bpf_timer in PREEMPT_RT for now. Proper solution is being
     discussed for bpf-next. (Leon Hwang)

   - Fix XSK cq descriptor production (Maciej Fijalkowski)

   - Tell memcg to use allow_spinning=false path in bpf_timer_init() to
     avoid lockup in cgroup_file_notify() (Peilin Ye)

   - Fix bpf_strnstr() to handle suffix match cases (Rong Tao)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Skip timer cases when bpf_timer is not supported
  bpf: Reject bpf_timer for PREEMPT_RT
  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
  bpf: Allow fall back to interpreter for programs with stack size <= 512
  rqspinlock: Choose trylock fallback for NMI waiters
  xsk: Fix immature cq descriptor production
  bpf: Update the list of BPF selftests maintainers
  selftests/bpf: Add tests for bpf_strnstr
  selftests/bpf: Fix "expression result unused" warnings with icecc
  bpf: Fix bpf_strnstr() to handle suffix match cases better
  selftests/bpf: Extend crypto_sanity selftest with invalid dst buffer
  bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
  bpf: Check the helper function is valid in get_helper_proto
  bpf, cpumap: Disable page_pool direct xdp_return need larger scope
 2025-09-11 07:54:16 -07:00
Paolo Abeni 63a796558b Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" 
This reverts commit 5537a46794 ("net: usb: asix: ax88772: drop
phylink use in PM to avoid MDIO runtime PM wakeups"), it breaks
operation of asix ethernet usb dongle after system suspend-resume
cycle.

Link: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com/
Fixes: 5537a46794 ("net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Link: https://patch.msgid.link/2945b9dbadb8ee1fee058b19554a5cb14f1763c1.1757601118.git.pabeni@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 16:46:04 +02:00
Rafael J. Wysocki bddce1c7a5 Merge branches 'pm-sleep' and 'pm-em' 
Merge a hibernation regression fix and an fix related to energy model
management for 6.17-rc6

* pm-sleep:
  PM: hibernate: Restrict GFP mask in hibernation_snapshot()

* pm-em:
  PM: EM: Add function for registering a PD without capacity update
 2025-09-11 14:22:35 +02:00
Paolo Abeni 62e1de1d33 Some more fixes: 
- iwlwifi: fix 130/1030 devices
  - ath12k: fix alignment, power save
  - virt_wifi: fix crash
  - cfg80211: disable per-link stats due
              to buffer size issues
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmjCnjEACgkQ10qiO8sP
 aABQVA/+K5XB1WJD8FMVKsZnB8+bNNxSeCFJUvsSdA1uyogpNXIuWpbfRye051Ee
 HGiQC7Qmn7PyeCXzICOaG4PY+c1WiWnf3wr4NwSsGd4+aX47389OBuhHkq6spxXp
 nJ4SCsx6+q+SXGLeQzEgoRx0rLBx6GQz5pgXn30heItewYV1MVIJ8H9PIUefrU8G
 AxHyNjYw8HLAAxNFXrQxWWd2d1EoGWq6SzjQvxtsQ7QctXGgX7/h6RsrNuM1Knar
 gWFxBORZOyEWxWiYs+NUGBrQBDEVL5mGJoRe8yxNjXmeHEwjDlH7L0ZNNrbBiyZ5
 8LOHdYHclURYq1qQmvjw7l9/ZM8Qn2X7TFKaua8lNMxoV3KdmTZsa2AnD+DHen7B
 /mcgKs/+ZPOzdDOvCwJdl7APcPruoWLhE2PvzUw8fZpjvceqYoQ5ov6O5ty8xRC0
 7PQi8GgI4RdI53mN3gVJFjnTsDQkmjsgFD5QEtFoxh1hPm+obeR3ra45HZOPEy8W
 jG+O7PG0MDZcjc3HrkzucVwIYzQHsxGIFRPyQnA8SSvyfbp5KI4wC4cR0mNjazeO
 pf1agZ0d/82Wo8eVmZh9sU+ILuIluJH0ncXpjkzzJ+OQTOIRkKhCf/QncHHpsqMI
 MgtK+dGNZ1/GZEPgencDCG0LVVO6oupff0ecoFFlImpxC9m3vYk=
 =QhnZ
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Some more fixes:
 - iwlwifi: fix 130/1030 devices
 - ath12k: fix alignment, power save
 - virt_wifi: fix crash
 - cfg80211: disable per-link stats due
             to buffer size issues

* tag 'wireless-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: nl80211: completely disable per-link stats for now
  wifi: virt_wifi: Fix page fault on connect
  wifi: cfg80211: Fix "no buffer space available" error in nl80211_get_station() for MLO
  wifi: iwlwifi: fix 130/1030 configs
  wifi: ath12k: fix WMI TLV header misalignment
  wifi: ath12k: Fix missing station power save configuration
====================

Link: https://patch.msgid.link/20250911100345.20025-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 12:49:53 +02:00
Paolo Abeni 9b1fbd3539 Merge branch 'hsr-fix-lock-warnings' 
Hangbin Liu says:

====================
hsr: fix lock warnings

hsr_for_each_port is called in many places without holding the RCU read
lock, this may trigger warnings on debug kernels like:

  [   40.457015] [  T201] WARNING: suspicious RCU usage
  [   40.457020] [  T201] 6.17.0-rc2-virtme #1 Not tainted
  [   40.457025] [  T201] -----------------------------
  [   40.457029] [  T201] net/hsr/hsr_main.c:137 RCU-list traversed in non-reader section!!
  [   40.457036] [  T201]
                          other info that might help us debug this:

  [   40.457040] [  T201]
                          rcu_scheduler_active = 2, debug_locks = 1
  [   40.457045] [  T201] 2 locks held by ip/201:
  [   40.457050] [  T201]  #0: ffffffff93040a40 (&ops->srcu){.+.+}-{0:0}, at: rtnl_link_ops_get+0xf2/0x280
  [   40.457080] [  T201]  #1: ffffffff92e7f968 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5e1/0xb20
  [   40.457102] [  T201]
                          stack backtrace:
  [   40.457108] [  T201] CPU: 2 UID: 0 PID: 201 Comm: ip Not tainted 6.17.0-rc2-virtme #1 PREEMPT(full)
  [   40.457114] [  T201] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
  [   40.457117] [  T201] Call Trace:
  [   40.457120] [  T201]  <TASK>
  [   40.457126] [  T201]  dump_stack_lvl+0x6f/0xb0
  [   40.457136] [  T201]  lockdep_rcu_suspicious.cold+0x4f/0xb1
  [   40.457148] [  T201]  hsr_port_get_hsr+0xfe/0x140
  [   40.457158] [  T201]  hsr_add_port+0x192/0x940
  [   40.457167] [  T201]  ? __pfx_hsr_add_port+0x10/0x10
  [   40.457176] [  T201]  ? lockdep_init_map_type+0x5c/0x270
  [   40.457189] [  T201]  hsr_dev_finalize+0x4bc/0xbf0
  [   40.457204] [  T201]  hsr_newlink+0x3c3/0x8f0
  [   40.457212] [  T201]  ? __pfx_hsr_newlink+0x10/0x10
  [   40.457222] [  T201]  ? rtnl_create_link+0x173/0xe40
  [   40.457233] [  T201]  rtnl_newlink_create+0x2cf/0x750
  [   40.457243] [  T201]  ? __pfx_rtnl_newlink_create+0x10/0x10
  [   40.457247] [  T201]  ? __dev_get_by_name+0x12/0x50
  [   40.457252] [  T201]  ? rtnl_dev_get+0xac/0x140
  [   40.457259] [  T201]  ? __pfx_rtnl_dev_get+0x10/0x10
  [   40.457285] [  T201]  __rtnl_newlink+0x22c/0xa50
  [   40.457305] [  T201]  rtnl_newlink+0x637/0xb20

Adding rcu_read_lock() for all hsr_for_each_port() looks confusing.

Introduce a new helper, hsr_for_each_port_rtnl(), that assumes the
RTNL lock is held. This allows callers in suitable contexts to iterate
ports safely without explicit RCU locking.

Other code paths that rely on RCU protection continue to use
hsr_for_each_port() with rcu_read_lock().
====================

Link: https://patch.msgid.link/20250905091533.377443-1-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 11:49:29 +02:00
Hangbin Liu 847748fc66 hsr: hold rcu and dev lock for hsr_get_port_ndev 
hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock.
On the other hand, before return the port device, we need to hold the
device reference to avoid UaF in the caller function.

Suggested-by: Paolo Abeni <pabeni@redhat.com>
Fixes: 9c10dd8eed ("net: hsr: Create and export hsr_get_port_ndev()")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250905091533.377443-4-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 11:49:19 +02:00
Hangbin Liu 393c841fe4 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr 
hsr_port_get_hsr() iterates over ports using hsr_for_each_port(),
but many of its callers do not hold the required RCU lock.

Switch to hsr_for_each_port_rtnl(), since most callers already hold
the rtnl lock. After review, all callers are covered by either the rtnl
lock or the RCU lock, except hsr_dev_xmit(). Fix this by adding an
RCU read lock there.

Fixes: c5a7591172 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250905091533.377443-3-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 11:49:19 +02:00
Hangbin Liu 8884c69399 hsr: use rtnl lock when iterating over ports 
hsr_for_each_port is called in many places without holding the RCU read
lock, this may trigger warnings on debug kernels. Most of the callers
are actually hold rtnl lock. So add a new helper hsr_for_each_port_rtnl
to allow callers in suitable contexts to iterate ports safely without
explicit RCU locking.

This patch only fixed the callers that is hold rtnl lock. Other caller
issues will be fixed in later patches.

Fixes: c5a7591172 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250905091533.377443-2-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2025-09-11 11:49:19 +02:00
Johannes Berg c3f8d13357 wifi: nl80211: completely disable per-link stats for now 
After commit 8cc71fc3b8 ("wifi: cfg80211: Fix "no buffer
space available" error in nl80211_get_station() for MLO"),
the per-link data is only included in station dumps, where
the size limit is somewhat less of an issue. However, it's
still an issue, depending on how many links a station has
and how much per-link data there is. Thus, for now, disable
per-link statistics entirely.

A complete fix will need to take this into account, make it
opt-in by userspace, and change the dump format to be able
to split a single station's data across multiple netlink
dump messages, which all together is too much development
for a fix.

Fixes: 82d7f841d9 ("wifi: cfg80211: extend to embed link level statistics in NL message")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 2025-09-11 08:50:31 +02:00
Linus Torvalds 4f553c1e2c 20 hotfixes. 15 are cc:stable and the remainder address post-6.16 issues 
or aren't considered necessary for -stable kernels.  14 of these fixes are
 for MM.
 
 This includes
 
 - a 3-patch kexec series from Breno that fixes a recently introduced
   use-uninitialized bug,
 
 - e 2-patch DAMON series from Quanmin Yan that avoids div-by-zero
   crashes which can occur if the operator uses poorly-chosen insmod
   parameters.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaMI7WQAKCRDdBJ7gKXxA
 jq3sAQDkflIN0qW3R7yqgUZfdO78T2LMmGlPW1L7F/ZXkxLk7gD/WgkWoec5cqi0
 ACiL81h6btIYBLHJ+SqJuowPMhaelQg=
 =fquW
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2025-09-10-20-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "20 hotfixes. 15 are cc:stable and the remainder address post-6.16
  issues or aren't considered necessary for -stable kernels. 14 of these
  fixes are for MM.

  This includes

   - kexec fixes from Breno for a recently introduced
     use-uninitialized bug

   - DAMON fixes from Quanmin Yan to avoid div-by-zero crashes
     which can occur if the operator uses poorly-chosen insmod
     parameters

   and misc singleton fixes"

* tag 'mm-hotfixes-stable-2025-09-10-20-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  MAINTAINERS: add tree entry to numa memblocks and emulation block
  mm/damon/sysfs: fix use-after-free in state_show()
  proc: fix type confusion in pde_set_flags()
  compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
  ocfs2: fix recursive semaphore deadlock in fiemap call
  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  mm/mremap: fix regression in vrm->new_addr check
  percpu: fix race on alloc failed warning limit
  mm/memory-failure: fix redundant updates for already poisoned pages
  s390: kexec: initialize kexec_buf struct
  riscv: kexec: initialize kexec_buf struct
  arm64: kexec: initialize kexec_buf struct in load_other_segments()
  mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
  mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
  mm/damon/core: set quota->charged_from to jiffies at first charge window
  mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
  init/main.c: fix boot time tracing crash
  mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()
  mm/khugepaged: fix the address passed to notifier on testing young
 2025-09-10 21:19:34 -07:00
Linus Torvalds 223ba8ee0a Mitigate VMSCAPE issue with indirect branch predictor flushes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmi58uwACgkQaDWVMHDJ
 krCIBxAAj/8/RBSSK6ULtDLKbmpRKMVpwEE1Yt8vK95Z/50gVSidtQtofIet+CPY
 NeN5Y4Aip3w/JFoIQafop8ZASOFjNjhqVEjE75RdtdDacQCyluqWg/2PrJpKkBVv
 OWTVVVPD9aSZAY0Tk/79ABV8Fbp/EBID5mhJ40GrBhkLZku2ALDj1eQINEjoBedB
 2+sCO1MMqynlmglt8FltwFtl0rHgtlhGviuc/QmsxH9FrLIGBlgciW4Rma+LOtAE
 4iD1Ij/ICuwA78kPAgrxvs+B1w3QGZhTPvOHjj0c9kKM3jBqphWoMWFUKbFfUK8i
 6rM0jZMB8iaUcKJ+Ra+stNmvddLkbya7J9wwHgQWi/kxEMZMxbbbOXwfl1Ya8sha
 n/kKxm8Lsrjex3RTnd1hoXvGY2blr0dZ97jfjgOqVuYBZih5yWzixQbuf3TAbCZO
 Kb+fbfC7EsI1N0zuFh42Q1hT0zxYYshNIxtGPjDwspJRkHvhmNjNswXr7sccXhFo
 P5araDcYN0ul85SlAhQRMB17mle47ETSgh04LRM4Rq3rbweXzghoRj//WcY4YqYS
 qSJEFzSC7hVwNabG+NBexUaZL8bZRMoE7qx5lmo0q+tTMIQkEG2rqrFz9b1d4JON
 g6aKyrD8YyRCoBjZAF0tjCwhQgxSKXGsVwzBYl0+RcY+1Lo1L2U=
 =8wrr
 -----END PGP SIGNATURE-----

Merge tag 'vmscape-for-linus-20250904' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull vmescape mitigation fixes from Dave Hansen:
 "Mitigate vmscape issue with indirect branch predictor flushes.

  vmscape is a vulnerability that essentially takes Spectre-v2 and
  attacks host userspace from a guest. It particularly affects
  hypervisors like QEMU.

  Even if a hypervisor may not have any sensitive data like disk
  encryption keys, guest-userspace may be able to attack the
  guest-kernel using the hypervisor as a confused deputy.

  There are many ways to mitigate vmscape using the existing Spectre-v2
  defenses like IBRS variants or the IBPB flushes. This series focuses
  solely on IBPB because it works universally across vendors and all
  vulnerable processors. Further work doing vendor and model-specific
  optimizations can build on top of this if needed / wanted.

  Do the normal issue mitigation dance:

   - Add the CPU bug boilerplate

   - Add a list of vulnerable CPUs

   - Use IBPB to flush the branch predictors after running guests"

* tag 'vmscape-for-linus-20250904' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/vmscape: Add old Intel CPUs to affected list
  x86/vmscape: Warn when STIBP is disabled with SMT
  x86/bugs: Move cpu_bugs_smt_update() down
  x86/vmscape: Enable the mitigation
  x86/vmscape: Add conditional IBPB mitigation
  x86/vmscape: Enumerate VMSCAPE bug
  Documentation/hw-vuln: Add VMSCAPE documentation
 2025-09-10 20:52:16 -07:00
Jakub Kicinski 3a1a66d124 netfilter pull request nf-25-09-10 
-----BEGIN PGP SIGNATURE-----
 
 iQJBBAABCAArFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmjBygQNHGZ3QHN0cmxl
 bi5kZQAKCRBwkajZrV/2APf0EACrhhtQp2s8e5NgRXICowc7d+1w4w+9fpeC1ISn
 oBOQNtobO1JnmbO2urYHwsYVjKejTJSPsiwmAWYNxTWDxl7wlxdbyZH7TGZ+Q98D
 L57oOEjW6wPoD5ljmW1g3nmNZ3Jh9zvoZ9p3jeR5mMk0du2N7Nz+LJQdOfAklFab
 ZBGM/J5CM3VLOLgvBPPNbSL1hOa0IbPna7WUOTlyMxBsIv0/7RumkkOD40yBAKy0
 NA0ruFnBARdFIFqeYCwRUt6HasSew+jxZZBkt4VOnAruM56ry1RUtBLPYuOxBCe8
 pDXmCeBbGL36rZFdwYneaj1YdZM3lRqZMdbHFyLUlj613QG8DVXgpyVuN8Xx254x
 QTxA0wbag3AimVn2593LqXxFvYHRvcolCcuJSw5Rcl4BLpWg2up0JwGFXmKGq0C1
 FGfEEuzyV9gEtpvPnlpBgqlIQRC946+iW+xBKVgDRerezRqTht6W08zzWqK0t836
 HeC8B9ZUtjHWakL3f5eQ/2ojVbJMUwUeY/bkwJm7WsE3fjr6aH/WI5i0OYXLnlf9
 4Vux3B0m1hJiFivoAph5ha+ZbOHZc+yzdFsdCUW4+xkcY4eQ4b9IzrIcL0sxEPuK
 eLGZI1G2QANrv6gvxcQqi1BM3cJlynMIvbiOuEMwv5bObJ3SVxX6aeTxurE8vehO
 xwgX/A==
 =zNV6
 -----END PGP SIGNATURE-----

Merge tag 'nf-25-09-10-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Florian Westpha says:

====================
netfilter pull request nf-25-09-10

First patch adds a lockdep annotation for a false-positive splat.
Last patch adds formal reviewer tag for Phil Sutter to MAINTAINERS.

Rest of the patches resolve spurious false negative results during set
lookups while another CPU is processing a transaction.

This has been broken at least since v4.18 when an unconditional
synchronize_rcu call was removed from the commit phase of nf_tables.

Quoting from Stefan Hanreichs original report:

 It seems like we've found an issue with atomicity when reloading
 nftables rulesets. Sometimes there is a small window where rules
 containing sets do not seem to apply to incoming traffic, due to the set
 apparently being empty for a short amount of time when flushing / adding
 elements.

Exanple ruleset:
table ip filter {
  set match {
    type ipv4_addr
    flags interval
    elements = { 0.0.0.0-192.168.2.19, 192.168.2.21-255.255.255.255 }
  }

  chain pre {
    type filter hook prerouting priority filter; policy accept;
    ip saddr @match accept
    counter comment "must never match"
  }
}

Reproducer transaction:
while true:
nft -f -<<EOF
 flush set ip filter match
 create element ip filter match { \
    0.0.0.0-192.168.2.19, 192.168.2.21-255.255.255.255 }
EOF
done

Then create traffic. to/from e.g. 192.168.2.1 to 192.168.3.10.
Once in a while the counter will increment even though the
'ip saddr @match' rule should have accepted the packet.

See individual patches for details.

Thanks to Stefan Hanreich for an initial description and reproducer for
this bug and to Pablo Neira Ayuso for reviewing earlier iterations of
the patchset.

* tag 'nf-25-09-10-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  MAINTAINERS: add Phil as netfilter reviewer
  netfilter: nf_tables: restart set lookup on base_seq change
  netfilter: nf_tables: make nft_set_do_lookup available unconditionally
  netfilter: nf_tables: place base_seq in struct net
  netfilter: nft_set_rbtree: continue traversal if element is inactive
  netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
  netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation
====================

Link: https://patch.msgid.link/20250910190308.13356-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2025-09-10 19:36:49 -07:00
Jakub Kicinski ccf78f7f05 linux-can-fixes-for-6.17-20250910 
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEn/sM2K9nqF/8FWzzDHRl3/mQkZwFAmjBpO8THG1rbEBwZW5n
 dXRyb25peC5kZQAKCRAMdGXf+ZCRnJOOB/9r35uZBD1+ZZVpvoByhil8XY7K42Vv
 LrARJ8+kh1Q6mcuB4V/176GBPJ7JabSUTGqvqvYbJBAB5obONhLU5Bkb/7lM2z1G
 MOUe0DMiBP+J3K8zqXcEKhqeW0qQO6pqfnv8iIj97Kxwd5JRPJq8pMpCIC/RLzOY
 Ot7+fcsE+cSZt9VumnQTx/S1fzGoY1C9VCglSr9B0O6IiTZZBIPNg8EwIGvbm7oh
 uofnFRocRZaWQ6OErdRSTLK4hu11DeFUmEAA6YN2ikpAdshUsf3U8HYaz2LIEEuu
 zGflFXrMekXqDod1SvhklLPUY/ssC11dUon+4Cgz/yK6I+lFvD/cuLIP
 =/YxL
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-6.17-20250910' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2025-09-10

The 1st patch is by Alex Tran and fixes the Documentation of the
struct bcm_msg_head.

Davide Caratti's patch enabled the VCAN driver as a module for the
Linux self tests.

Tetsuo Handa contributes 3 patches that fix various problems in the
CAN j1939 protocol.

Anssi Hannula's patch fixes a potential use-after-free in the
xilinx_can driver.

Geert Uytterhoeven's patch fixes the rcan_can's suspend to RAM on
R-Car Gen3 using PSCI.

* tag 'linux-can-fixes-for-6.17-20250910' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  can: j1939: implement NETDEV_UNREGISTER notification handler
  selftests: can: enable CONFIG_CAN_VCAN as a module
  docs: networking: can: change bcm_msg_head frames member to support flexible array
====================

Link: https://patch.msgid.link/20250910162907.948454-1-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2025-09-10 19:29:40 -07:00
Jakub Kicinski a2ddf8a51c Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 
Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2025-09-09 (igb, i40e)

For igb:
Tianyu Xu removes passing of, no longer needed, NAPI id to avoid NULL
pointer dereference on ethtool loopback testing.

Kohei Enju corrects reporting/testing of link state when interface is
down.

For i40e:
Michal Schmidt corrects value being passed to free_irq().

Jake sets hardware maximum frame size on probe to ensure
expected/consistent state.

* '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
  i40e: fix Jumbo Frame support after iPXE boot
  i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  igb: fix link test skipping when interface is admin down
  igb: Fix NULL pointer dereference in ethtool loopback test
====================

Link: https://patch.msgid.link/20250909203236.3603960-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2025-09-10 19:21:11 -07:00
Oleksij Rempel 5537a46794 net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups 
Drop phylink_{suspend,resume}() from ax88772 PM callbacks.

MDIO bus accesses have their own runtime-PM handling and will try to
wake the device if it is suspended. Such wake attempts must not happen
from PM callbacks while the device PM lock is held. Since phylink
{sus|re}sume may trigger MDIO, it must not be called in PM context.

No extra phylink PM handling is required for this driver:
- .ndo_open/.ndo_stop control the phylink start/stop lifecycle.
- ethtool/phylib entry points run in process context, not PM.
- phylink MAC ops program the MAC on link changes after resume.

Fixes: e0bffe3e68 ("net: asix: ax88772: migrate to phylink")
Reported-by: Hubert Wiśniewski <hubert.wisniewski.25632@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Tested-by: Hubert Wiśniewski <hubert.wisniewski.25632@gmail.com>
Tested-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://patch.msgid.link/20250908112619.2900723-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2025-09-10 17:49:09 -07:00
Russell King (Oracle) 6fef6ae764 net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info 
In C, enumerated types do not have a defined size, apart from being
compatible with one of the standard types. This allows an ABI /
compiler to choose the type of an enum depending on the values it
needs to store, and storing larger values in it can lead to undefined
behaviour.

The tx_type and rx_filters members of struct kernel_ethtool_ts_info
are defined as enumerated types, but are bit arrays, where each bit
is defined by the enumerated type. This means they typically store
values in excess of the maximum value of the enumerated type, in
fact (1 << max_value) and thus must not be declared using the
enumated type.

Fix both of these to use u32, as per the corresponding __u32 UAPI type.

Fixes: 2111375b85 ("net: Add struct kernel_ethtool_ts_info")
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Link: https://patch.msgid.link/E1uvMEK-00000003Amd-2pWR@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2025-09-10 17:43:28 -07:00
Linus Torvalds 7aac71907b NFS client bugfixes for Linux 6.17 
Stable patches:
  - Revert "SUNRPC: Don't allow waiting for exiting tasks" as it is
    breaking ltp tests.
 
 Bugfixes:
  - Another set of fixes to the tracking of NFSv4 server capabilities
    when crossing filesystem boundaries.
  - Localio fix to restore credentials and prevent triggering a BUG_ON().
  - Fix to prevent flapping of the localio on/off trigger.
  - Protections against 'eof page pollution' as demonstrated in xfstests
    generic/363.
  - Series of patches to ensure correct ordering of O_DIRECT i/o and
    truncate, fallocate and copy functions.
  - Fix a NULL pointer check in flexfiles reads that regresses 6.17.
  - Correct a typo that breaks flexfiles layout segment processing.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEESQctxSBg8JpV8KqEZwvnipYKAPIFAmjBjysACgkQZwvnipYK
 APJkNg/9Gd2IWoWse0PeOkijLhsxwnH6S6huvX3ouD9RziWobJAHbk7zpgycMt5/
 C+DYoqhpM/uIKRBjLPafnMFXQhsx/jEJcBSZOP3C1AD5OEvA/qtaE5nfGw9Zbnyr
 /j+B5yVhC8yPrDGFH9PlQ6UeFxnK9frqqqbNXDoCn5QCpmAjlbyESOiQ6ZZKUpZV
 vXPv9C4DeSZoZ2CsXMAWsLarGcrHE3ctpi+Bpfq7iDdUCdeYBOtaJHrgKtgwmCQy
 My5J3l7KRKmAy22XWvu+sRn7wQO0y5UOWtXUiDZD73ufC4hF1IIRuBWHW/5IBYD+
 6ojdBxYqTW01JeFWt4MoT8f+AKbej36x7abnf0ztxVpzXhp19KXiF+ddWrcyjKvc
 bjohM0slddM4TLAz/98D6Kwm7N/KFOD7DHPBv9vvMA8ci2efx+cQvKToNRnxK0xi
 FNmIi8+ZuKz9Pr32JINHHC1RFtl1dTb39l7jJVIK2niGYTjPwlxpcE7bax9CL1S7
 ke9m7GtX5dUyBYG2rKzLjihpTthL4GQgW6PlSMhIk2BA/m1ZZUVLAxI8xh9TR02V
 oMlxq78fsFNCxCvvqlUeo93IH7YHGSl1PbUqPjD0fs5k8lOX6rHXmHULqYgkmsC/
 QCAiXDg6gh2Rj69/9yvkWPe0KIXIULKGT++oZakgbMQPujNEtxE=
 =5TC7
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-6.17-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client fixes from Trond Myklebust:
 "Stable patches:

   - Revert "SUNRPC: Don't allow waiting for exiting tasks" as it is
     breaking ltp tests

  Bugfixes:

   - Another set of fixes to the tracking of NFSv4 server capabilities
     when crossing filesystem boundaries

   - Localio fix to restore credentials and prevent triggering a
     BUG_ON()

   - Fix to prevent flapping of the localio on/off trigger

   - Protections against 'eof page pollution' as demonstrated in
     xfstests generic/363

   - Series of patches to ensure correct ordering of O_DIRECT i/o and
     truncate, fallocate and copy functions

   - Fix a NULL pointer check in flexfiles reads that regresses 6.17

   - Correct a typo that breaks flexfiles layout segment processing"

* tag 'nfs-for-6.17-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFSv4/flexfiles: Fix layout merge mirror check.
  SUNRPC: call xs_sock_process_cmsg for all cmsg
  Revert "SUNRPC: Don't allow waiting for exiting tasks"
  NFS: Fix the marking of the folio as up to date
  NFS: nfs_invalidate_folio() must observe the offset and size arguments
  NFSv4.2: Serialise O_DIRECT i/o and copy range
  NFSv4.2: Serialise O_DIRECT i/o and clone range
  NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  NFS: Serialise O_DIRECT i/o and truncate()
  NFSv4.2: Protect copy offload and clone against 'eof page pollution'
  NFS: Protect against 'eof page pollution'
  flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  nfs/localio: avoid bouncing LOCALIO if nfs_client_is_local()
  nfs/localio: restore creds before releasing pageio data
  NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported
  NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  NFSv4: Don't clear capabilities that won't be reset
 2025-09-10 12:38:41 -07:00