summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-05-19mmc: sdhci_am654: Add SDHCI_QUIRK2_SUPPRESS_V1P8_ENA quirk to am62 compatibleJudith Mendez
Add a new struct for platform data for the ti,am62-sdhci compatible to apply additional quirks, namely "SDHCI_QUIRK2_SUPPRESS_V1P8_ENA", to host controllers with am62 compatible. Note, the fix was originally introduced by commit 941a7abd4666 ("mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch") but was found to be applied too broadly and had to be reverted. This fixes MMC init failures seen across am62x boards. Fixes: ac5a41b472b4 ("Revert "mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch"") Fixes: 941a7abd4666 ("mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch") Cc: stable@vger.kernel.org Suggested-by: Nishanth Menon <nm@ti.com> Signed-off-by: Judith Mendez <jm@ti.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20250516203121.3736379-1-jm@ti.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-05-19dt-bindings: can: microchip,mcp2510: Fix $id pathRob Herring (Arm)
The "$id" value must match the relative path under bindings/ and is missing the "net" sub-directory. Fixes: 09328600c2f9 ("dt-bindings: can: convert microchip,mcp251x.txt to yaml") Signed-off-by: "Rob Herring (Arm)" <robh@kernel.org> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20250507154201.1589542-1-robh@kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-19Fix spelling error for 'parallel'Anish Dabhane
Signed-off-by: Anish Dabhane <anishdabhane71@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20250518140107.21310-1-anishdabhane71@gmail.com>
2025-05-19docs: admin-guide: fix typos in reporting-issues.rstShivam Sharma
Correct pin-point to pinpoint, If that the case to If that is the case, and its only slightly modified to it's only slightly modified in Documentation/admin-guide/reporting-issues.rst for proper spelling and grammar. Signed-off-by: Shivam Sharma <10sharmashivam@gmail.com> Acked-by: Thorsten Leemhuis <linux@leemhuis.info> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20250518172658.6983-1-10sharmashivam@gmail.com>
2025-05-19llc: fix data loss when reading from a socket in llc_ui_recvmsg()Ilia Gavrilov
For SOCK_STREAM sockets, if user buffer size (len) is less than skb size (skb->len), the remaining data from skb will be lost after calling kfree_skb(). To fix this, move the statement for partial reading above skb deletion. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes") Cc: stable@vger.kernel.org Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru> Signed-off-by: David S. Miller <davem@davemloft.net>
2025-05-19drm/edid: fixed the bug that hdr metadata was not resetfeijuan.li
When DP connected to a device with HDR capability, the hdr structure was filled.Then connected to another sink device without hdr capability, but the hdr info still exist. Fixes: e85959d6cbe0 ("drm: Parse HDR metadata info from EDID") Cc: <stable@vger.kernel.org> # v5.3+ Signed-off-by: "feijuan.li" <feijuan.li@samsung.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://lore.kernel.org/r/20250514063511.4151780-1-feijuan.li@samsung.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-05-19crypto: ccp - Add missing tee info reg for teev2Mario Limonciello
The tee info reg for teev2 is the same as teev1. Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ccp - Add missing bootloader info reg for pspv5Mario Limonciello
The bootloader info reg for pspv5 is the same as pspv4. Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: sun8i-ce - move fallback ahash_request to the end of the structOvidiu Panait
'struct ahash_request' has a flexible array at the end, so it must be the last member in a struct, to avoid overwriting other struct members. Therefore, move 'fallback_req' to the end of the 'sun8i_ce_hash_reqctx' struct. Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms") Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: octeontx2 - Use dynamic allocated memory region for lmtstBharat Bhushan
Current driver uses static LMTST region allocated by firmware. Firmware allocated memory for LMTST is available in PF/VF BAR2. Using this memory have performance impact as this is mapped as device memory. There is another option to allocate contiguous memory at run time and map this in LMT MAP table with the help of AF driver. With this patch dynamic allocated memory is used for LMTST. Also add myself as maintainer for crypto octeontx2 driver Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: octeontx2 - Initialize cptlfs device info onceBharat Bhushan
Function otx2_cptlf_set_dev_info() initializes common fields of cptlfs data-struct. This function is called every time a cptlf is initialized but this needs be done once for a cptlf block. So this initialization is moved to early device probe code to avoid redundant initialization. Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: xts - Only add ecb if it is not already thereHerbert Xu
Only add ecb to the cipher name if it isn't already ecb. Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME. Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: lrw - Only add ecb if it is not already thereHerbert Xu
Only add ecb to the cipher name if it isn't already ecb. Also use memcmp instead of strncmp since these strings are all stored in an array of length CRYPTO_MAX_ALG_NAME. Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher") Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202505151503.d8a6cf10-lkp@intel.com Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Add hash export format testingHerbert Xu
Ensure that the hash state can be exported to and imported from the generic algorithm. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Use ahash for generic tfmHerbert Xu
As shash is being phased out, use ahash for the generic tfm. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Add ahash supportHerbert Xu
Add ahash support to hmac so that drivers that can't do hmac in hardware do not have to implement duplicate copies of hmac. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: testmgr - Ignore EEXIST on shash allocationHerbert Xu
Soon hmac will support ahash. For compatibility hmac still supports shash so it is possible for two hmac algorithms to be registered at the same time. The shash algorithm will have the driver name "hmac-shash(XXX-driver)". Due to a quirk in the API, there is no way to locate the shash algorithm using the name "hmac(XXX-driver)". It has to be addressed as either "hmac(XXX)" or "hmac-shash(XXX-driver)". Looking it up with "hmac(XXX-driver)" will simply trigger the creation of another instance, and on the second instantiation this will fail with EEXIST. Catch the error EEXIST along with ENOENT since it is expected. If a real shash algorithm came this way, it would be addressed using the proper name "hmac-shash(XXX-driver)". Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: algapi - Add driver template support to crypto_inst_setnameHerbert Xu
Add support to crypto_inst_setname for having a driver template name that differs from the algorithm template name. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: shash - Set reqsize in shash_algHerbert Xu
Make reqsize static for shash algorithms. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Add export_core and import_coreHerbert Xu
Add export_import and import_core so that hmac can be used as a fallback by block-only drivers. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hmac - Zero shash desc in setkeyHerbert Xu
The shash desc needs to be zeroed after use in setkey as it is not finalised (finalisation automatically zeroes it). Also remove the final function as it's been superseded by finup. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ahash - Handle partial blocks in APIHerbert Xu
Provide an option to handle the partial blocks in the ahash API. Almost every hash algorithm has a block size and are only able to hash partial blocks on finalisation. As a first step disable virtual address support for algorithms with state sizes larger than HASH_MAX_STATESIZE. This is OK as virtual addresses are currently only used on synchronous fallbacks. This means ahash_do_req_chain only needs to handle synchronous fallbacks, removing the complexities of saving the request state. Also move the saved request state into the ahash_request object as nesting is no longer possible. Add a scatterlist to ahash_request to store the partial block. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Add export_core and import_core hooksHerbert Xu
Add export_core and import_core hooks. These are intended to be used by algorithms which are wrappers around block-only algorithms, but are not themselves block-only, e.g., hmac. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: hash - Move core export and import into internel/hash.hHerbert Xu
The core export and import functions are targeted at implementors so move them into internal/hash.h. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert Marvell CESA to DT schemaRob Herring (Arm)
Convert the Marvell CESA binding to DT schema format. The marvell-cesa.txt and mv_cesa.txt are duplicate bindings. The clock properties are quite varied for each platform hence the if/then schemas. The old binding was fairly accurate with reality. The original binding didn't mention there is 1 interrupt per CESA engine. Based on users, there's a maximum of 2 engines. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert img,hash-accelerator to DT schemaRob Herring (Arm)
Convert the Imagination Technologies hardware hash accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert hisilicon,hip0{6,7}-sec to DT schemaRob Herring (Arm)
Convert the HiSilicon HIP06/7 Security Accelerator binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert brcm,spum-crypto to DT schemaRob Herring (Arm)
Convert the Broadcom SPUM/SPU2 binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert axis,artpec6-crypto to DT schemaRob Herring (Arm)
Convert the Axis Crypto engine binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Convert amd,ccp-seattle-v1a to DT schemaRob Herring (Arm)
Convert the AMD Cryptographic Coprocessor binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: Drop obsolete mediatek,eip97-cryptoRob Herring (Arm)
The mediatek,eip97-crypto binding is half abandoned. The driver was dropped in 2020 as the Mediatek platforms use InsideSecure block and the driver for it. All the platforms except MT7623 were updated. A patch to update it was submitted, but never addressed the review comments. Link: https://lore.kernel.org/all/20210303080923.16761-1-vic.wu@mediatek.com/ Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19dt-bindings: crypto: fsl,sec-v4.0: Add fsl,sec-v6.0Rob Herring (Arm)
The fsl,sec-v6.0 binding is the same as the fsl,sec-v4.0 binding, so add it to the existing schema and drop the old .txt binding. The compatibles in the .txt binding don't match the 1 user. Follow the user for the schema. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable reporting of error counters for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting of error counters through sysfs for QAT GEN6 devices and update the ABI documentation. This enables the reporting of the following: - errors_correctable - hardware correctable errors that allow the system to recover without data loss. - errors_nonfatal: errors that can be isolated to specific in-flight requests. - errors_fatal: errors that cannot be contained to a request, requiring a Function Level Reset (FLR) upon occurrence. Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: qat - enable RAS support for GEN6 devicesSuman Kumar Chakraborty
Enable the reporting and handling of errors for QAT GEN6 devices. Errors are categorized as correctable, non-fatal, or fatal. Error handling involves reading the error source registers (ERRSOU0 to ERRSOU3) to determine the source of the error and then decoding the actual source reading specific registers. The action taken depends on the error type: - Correctable and Non-Fatal errors. These error are logged, cleared and the corresponding counter is incremented. - Fatal errors. These errors are logged, cleared and a Function Level Reset (FLR) is scheduled. This reports and handles the following errors: - Accelerator engine (AE) correctable errors - Accelerator engine (AE) uncorrectable errors - Chassis push-pull (CPP) errors - Host interface (HI) parity errors - Internal memory parity errors - Receive interface (RI) errors - Transmit interface (TI) errors - Interface for system-on-chip (SoC) fabric (IOSF) primary command parity errors - Shared RAM and slice module (SSM) errors Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: ccp - Add support for PCI device 0x17D8John Allen
Add a new CCP/PSP PCI device ID. Signed-off-by: John Allen <john.allen@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19crypto: algif_hash - fix double free in hash_acceptIvan Pravdin
If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable@vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-19padata: do not leak refcount in reorder_workDominik Grzegorzek
A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 Fixes: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") Cc: <stable@vger.kernel.org> Signed-off-by: Dominik Grzegorzek <dominik.grzegorzek@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2025-05-18bcachefs: fix extent_has_stripe_ptr()Kent Overstreet
This wasn't checking indirect extents. Fixes: https://github.com/koverstreet/bcachefs/issues/887 Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-18smb: client: Fix use-after-free in cifs_fill_direntWang Zhaolong
There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning. ================================================================== BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs] Read of size 4 at addr ffff8880099b819c by task a.out/342975 CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x640 kasan_report+0xb8/0xf0 cifs_fill_dirent+0xb03/0xb60 [cifs] cifs_readdir+0x12cb/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f996f64b9f9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0d f7 c3 0c 00 f7 d8 64 89 8 RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88 R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000 </TASK> Allocated by task 408: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0x117/0x3d0 mempool_alloc_noprof+0xf2/0x2c0 cifs_buf_get+0x36/0x80 [cifs] allocate_buffers+0x1d2/0x330 [cifs] cifs_demultiplex_thread+0x22b/0x2690 [cifs] kthread+0x394/0x720 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 342979: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kmem_cache_free+0x2b8/0x500 cifs_buf_release+0x3c/0x70 [cifs] cifs_readdir+0x1c97/0x3190 [cifs] iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x134/0x220 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff8880099b8000 which belongs to the cache cifs_request of size 16588 The buggy address is located 412 bytes inside of freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001 head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000 head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== POC is available in the link [1]. The problem triggering process is as follows: Process 1 Process 2 ----------------------------------------------------------------- cifs_readdir /* file->private_data == NULL */ initiate_cifs_search cifsFile = kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL); smb2_query_dir_first ->query_dir_first() SMB2_query_directory SMB2_query_directory_init cifs_send_recv smb2_parse_query_directory srch_inf->ntwrk_buf_start = (char *)rsp; srch_inf->srch_entries_start = (char *)rsp + ... srch_inf->last_entry = (char *)rsp + ... srch_inf->smallBuf = true; find_cifs_entry /* if (cfile->srch_inf.ntwrk_buf_start) */ cifs_small_buf_release(cfile->srch_inf // free cifs_readdir ->iterate_shared() /* file->private_data != NULL */ find_cifs_entry /* in while (...) loop */ smb2_query_dir_next ->query_dir_next() SMB2_query_directory SMB2_query_directory_init cifs_send_recv compound_send_recv smb_send_rqst __smb_send_rqst rc = -ERESTARTSYS; /* if (fatal_signal_pending()) */ goto out; return rc /* if (cfile->srch_inf.last_entry) */ cifs_save_resume_key() cifs_fill_dirent // UAF /* if (rc) */ return -ENOENT; Fix this by ensuring the return code is checked before using pointers from the srch_inf. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220131 [1] Fixes: a364bc0b37f1 ("[CIFS] fix saving of resume key before CIFSFindNext") Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-05-18Linux 6.15-rc7v6.15-rc7Linus Torvalds
2025-05-18x86/msr: Remove a superfluous inclusion of <asm/asm.h>Xin Li (Intel)
The following commit: efef7f184f2e ("x86/msr: Add explicit includes of <asm/msr.h>") added a superfluous inclusion of <asm/asm.h> to drivers/acpi/processor_throttling.c. Remove it. Fixes: efef7f184f2e ("x86/msr: Add explicit includes of <asm/msr.h>") Signed-off-by: Xin Li (Intel) <xin@zytor.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: H. Peter Anvin <hpa@zytor.com> Link: https://lore.kernel.org/r/20250512084552.1586883-2-xin@zytor.com
2025-05-17Merge tag 'sunxi-clk-fixes-for-6.15' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clk driver fixes from Chen-Yu Tsai: Only two changes: - Fix the order of arguments in clk macro for SUNXI_CCU_MP_DATA_WITH_MUX_GATE_FEAT that was recently introduced in v6.15-rc1 - Add missing post-divider for D1 MMC clocks to correct halved performance * tag 'sunxi-clk-fixes-for-6.15' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: d1: Add missing divider for MMC mod clocks clk: sunxi-ng: fix order of arguments in clock macro
2025-05-17io_uring: add new helpers for posting overflowsJens Axboe
Add two helpers, one for posting overflows for lockless_cq rings, and one for non-lockless_cq rings. The former can allocate sanely with GFP_KERNEL, but needs to grab the completion lock for posting, while the latter must do non-sleeping allocs as it already holds the completion lock. While at it, mark the overflow handling functions as __cold as well, as they should not generally be called during normal operations of the ring. Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-05-17io_uring: pass in struct io_big_cqe to io_alloc_ocqe()Jens Axboe
Rather than pass extra1/extra2 separately, just pass in the (now) named io_big_cqe struct instead. The callers that don't use/support CQE32 will now just pass a single NULL, rather than two seperate mystery zero values. Move the clearing of the big_cqe elements into io_alloc_ocqe() as well, so it can get moved out of the generic code. Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-05-17io_uring: make io_alloc_ocqe() take a struct io_cqe pointerJens Axboe
The number of arguments to io_alloc_ocqe() is a bit unwieldy. Make it take a struct io_cqe pointer rather than three separate CQE args. One path already has that readily available, add an io_init_cqe() helper for the remaining two. Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-05-17io_uring: split alloc and add of overflowJens Axboe
Add a new helper, io_alloc_ocqe(), that simply allocates and fills an overflow entry. Then it can get done outside of the locking section, and hence use more appropriate gfp_t allocation flags rather than always default to GFP_ATOMIC. Inspired by a previous series from Pavel: https://lore.kernel.org/io-uring/cover.1747209332.git.asml.silence@gmail.com/ Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-05-17bcachefs: Fix bch2_btree_path_traverse_cached() when paths reallocedKent Overstreet
btree_key_cache_fill() will allocate and traverse another path (for the underlying btree), so we can't hold pointers to paths across a call - we have to pass indices. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-05-17Merge tag 'dmaengine-fix-6.15' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "This has a bunch of idxd driver fixes, dmatest revert and bunch of smaller driver fixes: - a bunch of idxd potential mem leak fixes - dmatest revert for waiting for interrupt fix as that causes issue - a couple of ti k3 udma fixes for locking and cap_mask - mediatek deadlock fix and unused variable cleanup fix" * tag 'dmaengine-fix-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: mediatek: drop unused variable dmaengine: fsl-edma: Fix return code for unhandled interrupts dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() dmaengine: idxd: Fix ->poll() return value dmaengine: idxd: Refactor remove call with idxd_cleanup() helper dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe dmaengine: idxd: fix memory leak in error handling path of idxd_alloc dmaengine: idxd: Add missing cleanups in cleanup internals dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs dmaengine: ptdma: Move variable condition check to the first place and remove redundancy dmaengine: idxd: Fix allowing write() from different address spaces dmaengine: ti: k3-udma: Add missing locking dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
2025-05-17Merge tag 'phy-fixes-6.15' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: "A bunch of renesas fixes and few smaller fixes in other drivers: - Rensas fixes for unbind ole detection, irq, locking etc - tegra fixes for error handling at init and UTMI power states and stray unlock fix - rockchip missing assignment and pll output fixes - startfive usb host detection fixes" * tag 'phy-fixes-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: Fix error handling in tegra_xusb_port_init phy: renesas: rcar-gen3-usb2: Set timing registers only once phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data phy: renesas: rcar-gen3-usb2: Move IRQ request in probe phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind phy: tegra: xusb: remove a stray unlock phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure phy: rockchip-samsung-dcphy: Add missing assignment phy: can-transceiver: Re-instate "mux-states" property presence check phy: qcom-qmp-ufs: check for mode type for phy setting phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
2025-05-17btrfs: move misplaced comment of btrfs_path::keep_locksSun YangKai
Commit 925baeddc5b0 ("Btrfs: Start btree concurrency work.") added the comment for the field keep_locks. This got moved later but without the comment, so move it to the right place and fix the comment style. Signed-off-by: Sun YangKai <sunk67188@gmail.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>