summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-29MAINTAINERS: Update HiSilicon SPI Controller driver maintainerYang Shen
Add Yang Shen as the maintainer of the HiSilicon SPI Controller driver, replacing Jay Fang. Signed-off-by: Yang Shen <shenyang39@huawei.com> Reviewed-by: Jay Fang <f.fangjian@huawei.com> Link: https://patch.msgid.link/20250529061406.183992-1-shenyang39@huawei.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-05-29drm/xe/vm: move xe_svm_init() earlierMatthew Auld
In xe_vm_close_and_put() we need to be able to call xe_svm_fini(), however during vm creation we can call this on the error path, before having actually initialised the svm state, leading to various splats followed by a fatal NPD. Fixes: 6fd979c2f331 ("drm/xe: Add SVM init / close / fini to faulting VMs") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4967 Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20250514152424.149591-4-matthew.auld@intel.com
2025-05-29drm/xe/vm: move rebind_work init earlierMatthew Auld
In xe_vm_close_and_put() we need to be able to call flush_work(rebind_work), however during vm creation we can call this on the error path, before having actually set up the worker, leading to a splat from flush_work(). It looks like we can simply move the worker init step earlier to fix this. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.8+ Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20250514152424.149591-3-matthew.auld@intel.com
2025-05-29Merge tag 'linux-can-fixes-for-6.16-20250529' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-05-29 this is a pull request of 1 patch for net/main. The patch is by Fedor Pchelkin and fixes a slab-out-of-bounds access in the kvaser_pciefd driver. linux-can-fixes-for-6.16-20250529 * tag 'linux-can-fixes-for-6.16-20250529' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: kvaser_pciefd: refine error prone echo_skb_max handling logic ==================== Link: https://patch.msgid.link/20250529075313.1101820-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29drm/xe/bo: optimise CCS case for WB pagesMatthew Auld
Dealing with CCS state is significant on LNL+, where we end up clearing the compression state on every page alloc using the blitter for user buffers, including also saving and restoring it when moving between domains, plus we need to alloc extra pages to hold the raw CCS state for the save step. However all compression PAT modes, on platforms like LNL, also require coh_none, meaning that only WC memory can use compression in the first place. With this we can be sneaky and completely ignore CCS for WB buffers, which is likely the common case anyway. This would then skip all blitter moves/clears between sys <-> tt and then also means we can drop the extra CCS pages. This should be safe since there is no way to interact with the compression state (potentially uncleared) without using a PAT enabled index (which is rejected at bind), including if trying to be malicious and copy the raw CCS state from userpace, which should give back all zeroes if the src surface (indirect) is lacking compressed PAT index. Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: José Roberto de Souza <jose.souza@intel.com> Reviewed-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Link: https://lore.kernel.org/r/20250516153810.223530-2-matthew.auld@intel.com
2025-05-29net/mlx4_en: Prevent potential integer overflow calculating HzDan Carpenter
The "freq" variable is in terms of MHz and "max_val_cycles" is in terms of Hz. The fact that "max_val_cycles" is a u64 suggests that support for high frequency is intended but the "freq_khz * 1000" would overflow the u32 type if we went above 4GHz. Use unsigned long long type for the mutliplication to prevent that. Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according to HW frequency") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/aDbFHe19juIJKjsb@stanley.mountain Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29fuse: increase readdir buffer sizeMiklos Szeredi
Increase the buffer size to the count requested by userspace. This improves performance. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu> Signed-off-by: Bernd Schubert <bschubert@ddn.com>
2025-05-29readdir: supply dir_context.count as readdir buffer size hintMiklos Szeredi
This is a preparation for large readdir buffers in fuse. Simply setting the fuse buffer size to the userspace buffer size should work, the record sizes are similar (fuse's is slightly larger than libc's, so no overflow should ever happen). Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Jaco Kroon <jaco@uls.co.za>
2025-05-29fuse: don't allow signals to interrupt getdents copyingMiklos Szeredi
When getting the directory contents, the entries are first fetched to a kernel buffer, then they are copied to userspace with dir_emit(). This second phase is non-blocking as long as the userspace buffer is not paged out, making it interruptible makes zero sense. Overload d_type as flags, since it only uses 4 bits from 32. Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for writebackJoanne Koong
Add support for folios larger than one page size for writeback. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for readaheadJoanne Koong
Add support for folios larger than one page size for readahead. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for queued writesJoanne Koong
Add support for folios larger than one page size for queued writes. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for storesJoanne Koong
Add support for folios larger than one page size for stores. Also change variable naming from "this_num" to "nr_bytes". Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for symlinksJoanne Koong
Support large folios for symlinks and change the name from fuse_getlink_page() to fuse_getlink_folio(). Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for folio readsJoanne Koong
Add support for folios larger than one page size for folio reads into the page cache. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for writethrough writesJoanne Koong
Add support for folios larger than one page size for writethrough writes. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: refactor fuse_fill_write_pages()Joanne Koong
Refactor the logic in fuse_fill_write_pages() for copying out write data. This will make the future change for supporting large folios for writes easier. No functional changes. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support large folios for retrievesJoanne Koong
Add support for folios larger than one page size for retrieves. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29fuse: support copying large foliosJoanne Koong
Currently, all folios associated with fuse are one page size. As part of the work to enable large folios, this commit adds support for copying to/from folios larger than one page size. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Bernd Schubert <bschubert@ddn.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-05-29ARM: 9446/1: Disallow kernel mode NEON when IRQs are disabledArd Biesheuvel
Commit c79f81631142 ("ARM: 9283/1: permit non-nested kernel mode NEON in softirq context") relaxed the rules around the use of SIMD instructions in kernel mode on ARM, to allow such use when serving a softirq. To avoid having to preserve/restore kernel mode NEON state when such a softirq is taken, softirqs are now disabled when using the NEON from task context. However, the fact that the softirq API does not allow unmasking of softirqs with interrupts disabled was overlooked, resulting in a WARN() in some cases, as reported by Guenter: WARNING: CPU: 0 PID: 1145 at kernel/softirq.c:369 __local_bh_enable_ip+0x118/0x194 Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __warn+0x7c/0x1b8 __warn from warn_slowpath_fmt+0x19c/0x1a4 warn_slowpath_fmt from __local_bh_enable_ip+0x118/0x194 __local_bh_enable_ip from crc_t10dif_arch+0xd4/0xe8 crc_t10dif_arch from crc_t10dif_wrapper+0x14/0x1c crc_t10dif_wrapper from crc_main_test+0x178/0x360 crc_main_test from kunit_try_run_case+0x78/0x1e0 kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x1c/0x34 kunit_generic_run_threadfn_adapter from kthread+0x118/0x254 kthread from ret_from_fork+0x14/0x28 While disabling softirqs is not really needed when running with IRQs disabled (given that the only way a softirq can be delivered asynchrously is over the back of an IRQ), let's not complicate this logic more than needed, and simply disallow use of the NEON in kernel mode when IRQs are disabled. Another approach might be to only disable and re-enable softirqs if IRQs are enabled, but other than the test case above, there are no clear use cases for doing non-trivial arithmetic processing (hence using an accelerated SIMD implementation) with IRQs disabled. Reported-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/all/389b899f-893c-4855-9e30-d8920a5d6f91@roeck-us.net Reviewed-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2025-05-29driver: net: ethernet: mtk_star_emac: fix suspend/resume issueYanqing Wang
Identify the cause of the suspend/resume hang: netif_carrier_off() is called during link state changes and becomes stuck while executing linkwatch_work(). To resolve this issue, call netif_device_detach() during the Ethernet suspend process to temporarily detach the network device from the kernel and prevent the suspend/resume hang. Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver") Signed-off-by: Yanqing Wang <ot_yanqing.wang@mediatek.com> Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com> Signed-off-by: Biao Huang <biao.huang@mediatek.com> Link: https://patch.msgid.link/20250528075351.593068-1-macpaul.lin@mediatek.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29hinic3: Remove printed message during module initGeert Uytterhoeven
No driver should spam the kernel log when merely being loaded. Fixes: 17fcb3dc12bbee8e ("hinic3: module initialization and tx/rx logic") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/5310dac0b3ab4bd16dd8fb761566f12e73b38cab.1748357352.git.geert+renesas@glider.be Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29net: tipc: fix refcount warning in tipc_aead_encryptCharalampos Mitrodimas
syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Reported-by: syzbot+f0c4a4aba757549ae26c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2 Fixes: e27902461713 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net> Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech> Link: https://patch.msgid.link/20250527-net-tipc-warning-v2-1-df3dc398a047@posteo.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29rxrpc: Fix return from none_validate_challenge()David Howells
Fix the return value of none_validate_challenge() to be explicitly true (which indicates the source packet should simply be discarded) rather than implicitly true (because rxrpc_abort_conn() always returns -EPROTO which gets converted to true). Note that this change doesn't change the behaviour of the code (which is correct by accident) and, in any case, we *shouldn't* get a CHALLENGE packet to an rxnull connection (ie. no security). Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lists.infradead.org/pipermail/linux-afs/2025-April/009738.html Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Jakub Kicinski <kuba@kernel.org> cc: "David S. Miller" <davem@davemloft.net> cc: Eric Dumazet <edumazet@google.com> cc: Paolo Abeni <pabeni@redhat.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/10720.1748358103@warthog.procyon.org.uk Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cntAlok Tiwari
Previously, the RX_BUFFERS_POSTED stat incorrectly reported the fill_cnt from RX queue 0 for all queues, resulting in inaccurate per-queue statistics. Fix this by correctly indexing priv->rx[idx].fill_cnt for each RX queue. Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Link: https://patch.msgid.link/20250527130830.1812903-1-alok.a.tiwari@oracle.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29net: stmmac: platform: guarantee uniqueness of bus_idQuentin Schulz
bus_id is currently derived from the ethernetX alias. If one is missing for the device, 0 is used. If ethernet0 points to another stmmac device or if there are 2+ stmmac devices without an ethernet alias, then bus_id will be 0 for all of those. This is an issue because the bus_id is used to generate the mdio bus id (new_bus->id in drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c stmmac_mdio_register) and this needs to be unique. This allows to avoid needing to define ethernet aliases for devices with multiple stmmac controllers (such as the Rockchip RK3588) for multiple stmmac devices to probe properly. Obviously, the bus_id isn't guaranteed to be stable across reboots if no alias is set for the device but that is easily fixed by simply adding an alias if this is desired. Fixes: 25c83b5c2e82 ("dt:net:stmmac: Add support to dwmac version 3.610 and 3.710") Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20250527-stmmac-mdio-bus_id-v2-1-a5ca78454e3c@cherry.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-29can: kvaser_pciefd: refine error prone echo_skb_max handling logicFedor Pchelkin
echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloc_candev() is KVASER_PCIEFD_CAN_TX_MAX_COUNT which is 17. But later echo_skb_max is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaser_pciefd_handle_ack_packet(), though the xmit function has actually caught the same thing earlier. BUG: KASAN: slab-out-of-bounds in kvaser_pciefd_handle_ack_packet+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0 CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dump_stack_lvl lib/dump_stack.c:122 print_report mm/kasan/report.c:521 kasan_report mm/kasan/report.c:634 kvaser_pciefd_handle_ack_packet drivers/net/can/kvaser_pciefd.c:1528 kvaser_pciefd_read_packet drivers/net/can/kvaser_pciefd.c:1605 kvaser_pciefd_read_buffer drivers/net/can/kvaser_pciefd.c:1656 kvaser_pciefd_receive_irq drivers/net/can/kvaser_pciefd.c:1684 kvaser_pciefd_irq_handler drivers/net/can/kvaser_pciefd.c:1733 __handle_irq_event_percpu kernel/irq/handle.c:158 handle_irq_event kernel/irq/handle.c:210 handle_edge_irq kernel/irq/chip.c:833 __common_interrupt arch/x86/kernel/irq.c:296 common_interrupt arch/x86/kernel/irq.c:286 </IRQ> Tx max count definitely matters for kvaser_pciefd_tx_avail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echo_skb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be. Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8256e0ca6010 ("can: kvaser_pciefd: Fix echo_skb race") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Link: https://patch.msgid.link/20250528192713.63894-1-pchelkin@ispras.ru Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-29Merge branches 'clk-amlogic', 'clk-allwinner', 'clk-rockchip' and 'clk-qcom' ↵Stephen Boyd
into clk-next * clk-amlogic: clk: meson: Do not enable by default during compile testing clk: meson-g12a: add missing fclk_div2 to spicc * clk-allwinner: clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support dt-bindings: allwinner: add H616 DE33 clock binding clk: sunxi-ng: h616: Add LVDS reset for LCD TCON dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset clk: sunxi: Do not enable by default during compile testing clk: sunxi-ng: Do not enable by default during compile testing * clk-rockchip: clk: rockchip: rk3528: add slab.h header include clk: rockchip: rk3576: add missing slab.h include clk: rockchip: rename gate-grf clk file clk: rockchip: rename branch_muxgrf to branch_grf_mux clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks clk: rockchip: rk3036: mark ddrphy as critical clk: rockchip: rk3036: fix implementation of usb480m clock mux dt-bindings: clock: rk3036: add SCLK_USB480M clock-id clk: rockchip: rk3528: Add SD/SDIO tuning clocks in GRF region clk: rockchip: Support MMC clocks in GRF region dt-bindings: clock: Add GRF clock definition for RK3528 clk: rockchip: add GATE_GRFs for SAI MCLKOUT to rk3576 clk: rockchip: introduce GRF gates clk: rockchip: introduce auxiliary GRFs dt-bindings: clock: rk3576: add IOC gated clocks clk: rockchip: rk3568: Add PLL rate for 33.3MHz clk: rockchip: Drop empty init callback for rk3588 PLL type clk: rockchip: rk3588: Add PLL rate for 1500 MHz * clk-qcom: clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750 clk: qcom: rpmh: make clkaN optional clk: qcom: Add support for Camera Clock Controller on QCS8300 clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz dt-bindings: clock: add SM6350 QCOM video clock bindings clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs clk: qcom: Fix missing error check for dev_pm_domain_attach()
2025-05-29Merge branches 'clk-socfpga', 'clk-sophgo', 'clk-thead' and 'clk-samsung' ↵Stephen Boyd
into clk-next * clk-socfpga: clk: socfpga: stratix10: Optimize local variables clk: socfpga: clk-pll: Optimize local variables * clk-sophgo: clk: sophgo: Add clock controller support for SG2044 SoC clk: sophgo: Add PLL clock controller support for SG2044 SoC dt-bindings: clock: sophgo: add clock controller for SG2044 dt-bindings: soc: sophgo: Add SG2044 top syscon device clk: sophgo: Add support for newly added precise compatible dt-bindings: clock: sophgo: Use precise compatible for CV1800 series SoC * clk-thead: clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC dt-bindings: clock: thead: Add TH1520 VO clock controller * clk-samsung: clk: samsung: correct clock summary for hsi1 block clk: samsung: exynosautov920: Fix incorrect CLKS_NR_CPUCL0 definition clk: samsung: exynosautov920: add cpucl1/2 clock support dt-bindings: clock: exynosautov920: add cpucl1/2 clock definitions clk: samsung: exynosautov920: add cpucl0 clock support dt-bindings: clock: exynosautov920: add cpucl0 clock definitions clk: samsung: Use samsung CCF common function
2025-05-29Merge branches 'clk-bindings', 'clk-renesas', 'clk-spacemit' and ↵Stephen Boyd
'clk-cleanup' into clk-next * clk-bindings: dt-bindings: clock: Drop st,stm32h7-rcc.txt dt-bindings: clock: convert bcm2835-aux-clock to yaml dt-bindings: clock: Drop maxim,max77686.txt dt-bindings: clock: convert vf610-clock.txt to yaml format * clk-renesas: (26 commits) clk: renesas: r9a09g047: Add XSPI clock/reset clk: renesas: r9a09g047: Add support for xspi mux and divider dt-bindings: clock: renesas,r9a09g047-cpg: Add XSPI and GBETH PTP core clocks clk: renesas: Use str_on_off() helper clk: renesas: r9a09g057: Add clock and reset entries for USB2 dt-bindings: clock: renesas,r9a09g057-cpg: Add USB2 PHY and GBETH PTP core clocks clk: renesas: rzv2h: Use both CLK_ON and CLK_MON bits for clock state validation clk: renesas: rzv2h: Use str_on_off() helper in rzv2h_mod_clock_endisable() clk: renesas: rzv2h: Support static dividers without RMW clk: renesas: rzv2h: Add macro for defining static dividers clk: renesas: rzv2h: Add support for static mux clocks clk: renesas: r9a09g047: Add clock and reset entries for GE3D clk: renesas: rzv2h: Fix a typo clk: renesas: rzv2h: Add support for RZ/V2N SoC clk: renesas: rzv2h: Sort compatible list based on SoC part number dt-bindings: pinctrl: renesas: Document RZ/V2N SoC dt-bindings: clock: renesas: Document RZ/V2N SoC CPG dt-bindings: soc: renesas: Document SYS for RZ/V2N SoC dt-bindings: soc: renesas: Document Renesas RZ/V2N SoC variants and EVK clk: renesas: rzv2h: Simplify rzv2h_cpg_assert()/rzv2h_cpg_deassert() ... * clk-spacemit: clk: spacemit: k1: Add TWSI8 bus and function clocks clk: spacemit: Add clock support for SpacemiT K1 SoC dt-bindings: clock: spacemit: Add spacemit,k1-pll dt-bindings: soc: spacemit: Add spacemit,k1-syscon * clk-cleanup: clk: test: Forward-declare struct of_phandle_args in kunit/clk.h clk: davinci: Use of_get_available_child_by_name() clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() clk: bcm: rpi: Drop module alias clk: bcm: kona: Remove unused scaled_div_build
2025-05-28Merge tag 'qcom-clk-for-6.16' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Camera clock controller driver for Qualcomm QCS8300 - Correct wait_val values for a variety of Qualcomm GDSCs - Fix Qualcomm X Elite UFS clock settings - Allow clkaN to be optional in the Qualcomm RPMh clock controller driver if command db doesn't define it
2025-05-29drm/i915/psr: Do not disable Panel Replay in case VRR is enabledJouni Högander
Allow Panel Replay with VRR. All VRR modes are supposed to work with Panel Replay. Bspec: 68920, 68925 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-13-jouni.hogander@intel.com
2025-05-29drm/i915/psr: Fix using wrong mask in REG_FIELD_PREPJouni Högander
Wrong mask is used in PORT_ALPM_LFPS_CTL_FIRST_LFPS_HALF_CYCLE_DURATION and PORT_ALPM_LFPS_CTL_LAST_LFPS_HALF_CYCLE_DURATION. Fixes: 295099580f04 ("drm/i915/psr: Add missing ALPM AUX-Less register definitions") Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-12-jouni.hogander@intel.com
2025-05-29drm/i915/display: Add function to configure LFPS sendingJouni Högander
Add function to configre LFPS sending for Panel Replay according to link training sequence in HAS document. This assumes we are using AUX Less always if it's supported by the sink and the source. v2: - drop HAS reference - replay kerneldoc comment with a generic comment - check display version in intel_lnl_mac_transmit_lfps Bspec: 68849 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-11-jouni.hogander@intel.com
2025-05-29drm/i915/display: Add PHY_CMN1_CONTROL register definitionsJouni Högander
Add PHY_CMN1_CONTROL register and its definitions to configure port LFPS sending. Bspec: 68962 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-10-jouni.hogander@intel.com
2025-05-29drm/i915/alpm: Move port alpm configurationJouni Högander
It is specified in Bspec where port alpm configuration is supposed to be performed. Change accordingly. v2: - drop HAS reference - ensure PORT_ALPM registers are not writen on older platform Bspec: 68849 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-9-jouni.hogander@intel.com
2025-05-29drm/i915/alpm: Add new interface to check if AUXLess ALPM is usedJouni Högander
we need to know if AUXLess ALPM is used when preparing for link training. Add new interface for this and use it in existing code where possible. v2: remove kerneldoc comment Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-8-jouni.hogander@intel.com
2025-05-29drm/i915/psr: Add interface to check if AUXLess ALPM is needed by PSRJouni Högander
Currently we spread ugly PSR details into ALPM code to check if AUXLess ALPM is needed. Prepare to hide these details to PSR code by adding new interface for checking if AUXLess ALPM is needed. v2: remove kerneldoc comment Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-7-jouni.hogander@intel.com
2025-05-29drm/i915/alpm: Write PR_ALPM_CTL registerJouni Högander
PR_ALPM_CTL register contains configurations related to Adaptive sync sdp. Configure these if Adaptive Sync SDP is supported. v2: avoid using hardcoded indices Bspec: 71014 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-6-jouni.hogander@intel.com
2025-05-29drm/i915/alpm: Add PR_ALPM_CTL register definitionsJouni Högander
Add PR_ALPM_CTL register definition and bits for it. Bspec: 71014 Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-5-jouni.hogander@intel.com
2025-05-29drm/i915/psr: Read all Panel Replay capability registers from DPCDJouni Högander
There are several Panel Replay capability register in DPCD. Read them all for later use. v2: - avoid using hardcoded indices - read all Panel Replay capability registers Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-4-jouni.hogander@intel.com
2025-05-29drm/dp: Add Panel Replay capability bits from DP2.1 specificationJouni Högander
Add PANEL REPLAY CAPABILITY register (0xb1) bits. v3: - added DP_DSC_DECODE_CAPABILITY definitions - use defined shift instead of hardcoded value v2: comment about DP2.1 changed as DP2.1a Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-3-jouni.hogander@intel.com
2025-05-29drm/panelreplay: Panel Replay capability DPCD register definitionsJouni Högander
Add new definition for size of Panel Replay DPCD capability registers area. Rename existing definitions to group capability registers together. Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://lore.kernel.org/r/20250526120512.1702815-2-jouni.hogander@intel.com
2025-05-28page_pool: Fix use-after-free in page_pool_recycle_in_ringDong Chenchen
syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. Suggested-by: Jakub Kicinski <kuba@kernel.org> Link: https://lore.kernel.org/netdev/20250513083123.3514193-1-dongchenchen2@huawei.com Fixes: ff7d6b27f894 ("page_pool: refurbish version of page_pool code") Reported-by: syzbot+204a4382fcb3311f3858@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=204a4382fcb3311f3858 Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Reviewed-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20250527114152.3119109-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-05-28net: ch9200: fix uninitialised access during mii_nway_restartQasim Ijaz
In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read(). However "buff" is conditionally initialised inside control_read(): if (err == size) { memcpy(data, buf, size); } If the condition of "err == size" is not met, then "buff" remains uninitialised. Once this happens the uninitialised "buff" is accessed and returned during ch9200_mdio_read(): return (buff[0] | buff[1] << 8); The problem stems from the fact that ch9200_mdio_read() ignores the return value of control_read(), leading to uinit-access of "buff". To fix this we should check the return value of control_read() and return early on error. Reported-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=3361c2d6f78a3e0892f9 Tested-by: syzbot <syzbot+3361c2d6f78a3e0892f9@syzkaller.appspotmail.com> Fixes: 4a476bd6d1d9 ("usbnet: New driver for QinHeng CH9200 devices") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250526183607.66527-1-qasdev00@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-05-28Fix sock_exceed_buf_limit not being triggered in __sk_mem_raise_allocatedTengteng Yang
When a process under memory pressure is not part of any cgroup and the charged flag is false, trace_sock_exceed_buf_limit was not called as expected. This regression was introduced by commit 2def8ff3fdb6 ("sock: Code cleanup on __sk_mem_raise_allocated()"). The fix changes the default value of charged to true while preserving existing logic. Fixes: 2def8ff3fdb6 ("sock: Code cleanup on __sk_mem_raise_allocated()") Signed-off-by: Abel Wu <wuyun.abel@bytedance.com> Signed-off-by: Tengteng Yang <yangtengteng@bytedance.com> Link: https://patch.msgid.link/20250527030419.67693-1-yangtengteng@bytedance.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-05-28drm/xe: Fix NPD when saving default contextLucas De Marchi
xef is only valid if it's a job from userspace. For in-kernel jobs it causes a NPD like below: <4> [] RIP: 0010:xe_sched_job_create+0xbd/0x390 [xe] ... <4> [] Call Trace: <4> [] <TASK> <4> [] __xe_bb_create_job+0xa2/0x240 [xe] <4> [] ? find_held_lock+0x31/0x90 <4> [] ? xa_find_after+0x12c/0x250 <4> [] xe_bb_create_job+0x6e/0x380 [xe] <4> [] ? xa_find_after+0x136/0x250 <4> [] ? __drm_dev_dbg+0x7d/0xb0 <4> [] xe_gt_record_default_lrcs+0x542/0xb00 [xe] Since drm_file starts with 1 for the unique id, just use 0 for the in-kernel jobs. Fixes: 2956554823ce ("drm/sched: Store the drm client_id in drm_sched_fence") Cc: Christian König <christian.koenig@amd.com> Cc: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Cc: Philipp Stanner <phasta@kernel.org> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20250528-fix-sched-v1-1-c042ef23ff8b@intel.com Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
2025-05-29rust: workqueue: remove HasWork::OFFSETTamir Duberstein
Implement `HasWork::work_container_of` in `impl_has_work!`, narrowing the interface of `HasWork` and replacing pointer arithmetic with `container_of!`. Remove the provided implementation of `HasWork::get_work_offset` without replacement; an implementation is already generated in `impl_has_work!`. Remove the `Self: Sized` bound on `HasWork::work_container_of` which was apparently necessary to access `OFFSET` as `OFFSET` no longer exists. A similar API change was discussed on the hrtimer series[1]. Link: https://lore.kernel.org/all/20250224-hrtimer-v3-v6-12-rc2-v9-1-5bd3bf0ce6cc@kernel.org/ [1] Reviewed-by: Benno Lossin <benno.lossin@proton.me> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Tested-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Signed-off-by: Tamir Duberstein <tamird@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Link: https://lore.kernel.org/r/20250411-no-offset-v3-1-c0b174640ec3@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2025-05-28ubsan: integer-overflow: depend on BROKEN to keep this out of CIKees Cook
Depending on !COMPILE_TEST isn't sufficient to keep this feature out of CI because we can't stop it from being included in randconfig builds. This feature is still highly experimental, and is developed in lock-step with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it from being enabled by anyone not expecting it. Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1] Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202505281024.f42beaa7-lkp@intel.com Fixes: 557f8c582a9b ("ubsan: Reintroduce signed overflow sanitizer") Acked-by: Eric Biggers <ebiggers@kernel.org> Link: https://lore.kernel.org/r/20250528182616.work.296-kees@kernel.org Reviewed-by: Nathan Chancellor <nathan@kernel.org> Acked-by: Marco Elver <elver@google.com> Signed-off-by: Kees Cook <kees@kernel.org>
2025-05-28Merge tag 'bpf-next-6.16' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Fix and improve BTF deduplication of identical BTF types (Alan Maguire and Andrii Nakryiko) - Support up to 12 arguments in BPF trampoline on arm64 (Xu Kuohai and Alexis Lothoré) - Support load-acquire and store-release instructions in BPF JIT on riscv64 (Andrea Parri) - Fix uninitialized values in BPF_{CORE,PROBE}_READ macros (Anton Protopopov) - Streamline allowed helpers across program types (Feng Yang) - Support atomic update for hashtab of BPF maps (Hou Tao) - Implement json output for BPF helpers (Ihor Solodrai) - Several s390 JIT fixes (Ilya Leoshkevich) - Various sockmap fixes (Jiayuan Chen) - Support mmap of vmlinux BTF data (Lorenz Bauer) - Support BPF rbtree traversal and list peeking (Martin KaFai Lau) - Tests for sockmap/sockhash redirection (Michal Luczaj) - Introduce kfuncs for memory reads into dynptrs (Mykyta Yatsenko) - Add support for dma-buf iterators in BPF (T.J. Mercier) - The verifier support for __bpf_trap() (Yonghong Song) * tag 'bpf-next-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (135 commits) bpf, arm64: Remove unused-but-set function and variable. selftests/bpf: Add tests with stack ptr register in conditional jmp bpf: Do not include stack ptr register in precision backtracking bookkeeping selftests/bpf: enable many-args tests for arm64 bpf, arm64: Support up to 12 function arguments bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf: Avoid __bpf_prog_ret0_warn when jit fails bpftool: Add support for custom BTF path in prog load/loadall selftests/bpf: Add unit tests with __bpf_trap() kfunc bpf: Warn with __bpf_trap() kfunc maybe due to uninitialized variable bpf: Remove special_kfunc_set from verifier selftests/bpf: Add test for open coded dmabuf_iter selftests/bpf: Add test for dmabuf_iter bpf: Add open coded dmabuf iterator bpf: Add dmabuf iterator dma-buf: Rename debugfs symbols bpf: Fix error return value in bpf_copy_from_user_dynptr libbpf: Use mmap to parse vmlinux BTF from sysfs selftests: bpf: Add a test for mmapable vmlinux BTF btf: Allow mmap of vmlinux btf ...
generated by cgit (git 2.34.1) at 2025-09-21 16:14:43 +0000