summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-17staging: rtl8723bs: Split multiple assignments in _rtw_open_pktfileAmin Madani
In _rtw_open_pktfile(), multiple variables are assigned on the same line. According to the Linux kernel coding style, multiple assignments on a single line should be avoided. Split them into separate lines to improve readability. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260716083822.2898-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: sm750fb: remove unused set_all_eng_off fieldHungyu Lin
The set_all_eng_off field is only initialized to 0 and is never set by any caller. Remove the unused field together with the dead cleanup path guarded by it. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Link: https://patch.msgid.link/20260716044613.2659-1-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Fix spacing around ternary operator in sdio_intf.cAmin Madani
Add spaces around '?' and ':' in the return statement in sdio_intf.c according to the Linux kernel coding style. Signed-off-by: Amin Madani <aminmadani112@gmail.com> Link: https://patch.msgid.link/20260715170606.96002-1-aminmadani112@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error pathsCong Nguyen
issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from the driver's fixed-size management-TX pools via alloc_mgtxmitframe(). On the normal path the frame is handed to dump_mgntframe(), which transfers ownership and eventually returns both objects to their pools (the frame and, for beacons, the buf in rtl8723bs_mgnt_xmit(); other bufs via the pending-xmitbuf/TX-completion path). Several error/edge paths return early after a successful alloc_mgtxmitframe() but before dump_mgntframe(), so ownership is never transferred and neither object is freed: - issue_beacon(): beacon larger than 512 bytes - issue_probersp(): cur_network->ie_length > MAX_IE_SZ - issue_probersp(): kzalloc() of the SSID scratch buffer fails - issue_asocrsp(): pkt_type is neither ASSOCRSP nor REASSOCRSP Because alloc_mgtxmitframe() removes the frame and buf from their free lists (list_del_init) without placing them on any pending list, an orphaned pair is on no list and referenced by nobody, so it is only reclaimed at driver teardown. Repeated hits progressively exhaust the management-TX pools until alloc_mgtxmitframe() returns NULL and the interface can no longer send beacons or probe/assoc responses. Free the frame and buffer on these paths, matching the existing correct error handling in issue_assocreq(). Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Cong Nguyen <congnt264@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260715111710.295052-1-congnt264@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: rtw_mlme: make rtw_add_network() staticGongwei Li
Function rtw_add_network() used only in rtw_mlme.c file, so it should be declared static. Remove the redundant prototype and add static keyword to the definition. Signed-off-by: Gongwei Li <ligongwei@kylinos.cn> Link: https://patch.msgid.link/20260715085542.1648015-1-13875017792@163.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: greybus: uart: return tty_alloc_driver() errorsAlfie Varghese
gb_tty_init() maps any tty_alloc_driver() failure to -ENOMEM. tty_alloc_driver() currently always returns -ENOMEM on failure, so this does not change behavior in practice. However, returning PTR_ERR(gb_tty_driver) is more correct and consistent with kernel conventions, preserving any future error codes the function might return. Signed-off-by: Alfie Varghese <alfievarghese22@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260714134921.817-1-alfievarghese22@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: convert rtw_xmitframe_coalesce() to return errnoHungyu Lin
Convert rtw_xmitframe_coalesce() to return 0 on success and a negative errno on failure. Propagate errno values returned by the helper functions instead of converting them to _FAIL. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-6-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: simplify rtw_xmitframe_coalesce() control flowHungyu Lin
Replace goto-based error handling with direct returns and remove the temporary res variable. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-5-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: convert xmitframe_addmic() to return errnoHungyu Lin
Convert xmitframe_addmic() to return 0 on success and a negative errno on failure. Update the immediate caller to handle errno return values while preserving the existing _SUCCESS/_FAIL semantics. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-4-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: convert rtw_make_wlanhdr() to return errnoHungyu Lin
Convert rtw_make_wlanhdr() to return 0 on success and a negative errno on failure. Update the immediate caller to handle errno return values while preserving the existing _SUCCESS/_FAIL semantics. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-3-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove redundant return variable in rtw_make_wlanhdr()Hungyu Lin
The temporary return variable is no longer needed because the only error path returns directly. Remove the redundant variable and exit label, and return _SUCCESS directly on the success path. No functional change intended. Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/20260713070537.15903-2-dennylin0707@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Remove unused parameter pnetdevDalvin-Ehinoma Noah Aiguobas
Remove unused parameter pnetdev from the function loadparam. This function is called once and the argument is adjusted as well. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260712215617.35003-1-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: axis-fifo: Fix kernel-doc return value warningsBabanpreet Singh
The kernel-doc comments for axis_fifo_read() and axis_fifo_write() describe their return values as free text, which kernel-doc does not recognize as a return section: $ scripts/kernel-doc -Wall -none drivers/staging/axis-fifo/axis-fifo.c Warning: drivers/staging/axis-fifo/axis-fifo.c:121 No description found for return value of 'axis_fifo_read' Warning: drivers/staging/axis-fifo/axis-fifo.c:214 No description found for return value of 'axis_fifo_write' These warnings only show up in a direct kernel-doc invocation or a W=2 build (-Wall is added to kernel-doc only when KBUILD_EXTRA_WARN contains 2), which is why W=1 builds appear clean. Convert the trailing "Returns ..." sentences into Return: sections so kernel-doc recognizes the existing return value documentation. No functional change. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Link: https://patch.msgid.link/20260712214115.7-1-bbnpreetsingh@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: nvec: nvec_power: use GFP_KERNEL in probe()Igor Putko
nvec_power_probe() calls devm_kzalloc() with GFP_NOWAIT, which disables direct reclaim and is meant for atomic context. probe() runs in normal process context and may sleep, so this needlessly risks a spurious -ENOMEM under memory pressure instead of just waiting for reclaim like every other probe() allocation does. nvec.c's own tegra_nvec_probe() already uses GFP_KERNEL for the identical pattern, confirming this is an oversight, not intentional. Signed-off-by: Igor Putko <igorpetindev@gmail.com> Acked-by: Marc Dietrich <marvin24@gmx.de> Link: https://patch.msgid.link/20260710150113.3041-1-igorpetindev@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: rename Switch_DM_Func to switch_dm_funcAnirban Bose
I changed the Switch_DM_Func() to switch_dm_func() to fix the CamelCase, I changed it in every instance where it was present Signed-off-by: Anirban Bose <boses156@gmail.com> Link: https://patch.msgid.link/20260712142846.3369-1-boses156@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Fix logical operator alignment in rtw_mlme.cDalvin-Ehinoma Noah Aiguobas
Move logical operators to the end of continuation lines and adjust indentation in rtw_mlme.c to comply with the Linux kernel coding style. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260712061143.2982-1-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove unused 'bTXPowerDataReadFromEEPORM'Nikolay Kulikov
The 'bTXPowerDataReadFromEEPORM' field of the struct hal_com_data is set but never used; remove it. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260710165220.68599-6-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove unused EEPROMBluetoothType from hal_com_dataNikolay Kulikov
The value 'BT_RTL8723B' is written to this field, but it is not used in any other way, so remove it. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260710165220.68599-5-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove unused EEPROMVersion from struct hal_com_dataNikolay Kulikov
A value is written to this field, but it is never used. Remove it, along with the associated functions and macros, to simplify the code. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260710165220.68599-4-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove unused ForcedDataRate from hal_com_dataNikolay Kulikov
This field is set once and never used, so remove it. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260710165220.68599-3-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: remove unused 'EEPROMCustomerID' from hal_com_dataNikolay Kulikov
This field is set during initialization but never used, so remove it. Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com> Link: https://patch.msgid.link/20260710165220.68599-2-nikolayof23@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Rename camelcase enum values dot11AuthAlgrthm_WAPI and ↵Dalvin-Ehinoma Noah Aiguobas
dot11AuthAlgrthm_MaxNum Rename enum values dot11AuthAlgrthm_WAPI and dot11AuthAlgrthm_MaxNum to fix checkpatch.pl CamelCase finding. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260710162017.5660-6-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Rename camelcase enum value dot11AuthAlgrthm_SharedDalvin-Ehinoma Noah Aiguobas
Rename enum value dot11AuthAlgrthm_Shared to dot11_auth_algrthm_shared to fix checkpatch.pl CamelCase finding. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260710162017.5660-5-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Rename camelcase enum value dot11AuthAlgrthm_AutoDalvin-Ehinoma Noah Aiguobas
Rename enum value dot11AuthAlgrthm_Auto to dot11_auth_algrthm_auto to fix checkpatch.pl CamelCase finding. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260710162017.5660-4-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Rename camelcase enum value dot11AuthAlgrthm_OpenDalvin-Ehinoma Noah Aiguobas
Rename enum value dot11AuthAlgrthm_Open to dot11_auth_algrthm_open in enum to fix checkpatch.pl CamelCase finding. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260710162017.5660-3-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17staging: rtl8723bs: Rename camelcase enum value dot11AuthAlgrthm_8021XDalvin-Ehinoma Noah Aiguobas
Rename enum value dot11AuthAlgrthm_8021X to dot11_auth_algrthm_8021x to fix the checkpatch.pl CamelCase finding. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260710162017.5660-2-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17Pull UDF symlink corruption handling fix.Jan Kara
2026-07-17dmaengine: dw-edma: Enable HDMA 64R/W ChannelsDevendra K Verma
As per 'Designware Cores PCI Express Controller Databook', Section 7.1 - Overview, HDMA supports 64 Read and 64 Write channels. Current controller driver supports up to 8 read and write channels only. In order to utilize all the channels the controller driver need to have the channel related structs and variables as per the number of channels supported by IP. Following changes are made to enable 64 Read / 64 Write channel support: o Defined HDMA specific macros to reflect the channel count. o The count of ll_regions and dt_regions in dw_edma_chip and dw_edma_pcie_data shall be in accordance to number of read and write channels. o In dw_edma_probe() configure the channels as per the channels of the IP used. o Changed mask types to u64 for higher channel counts. Signed-off-by: Devendra K Verma <devendra.verma@amd.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260713064854.4065262-1-devverma@amd.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-17UDF symlink pathComponent header OOB readDavid Lee
udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed symlink data that would otherwise make udf_pc_to_char() perform an out-of-bounds read. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: David Lee <david.lee@trailofbits.com> Assisted-by: Codex:gpt-5.5 Link: https://patch.msgid.link/20260717104722.41446-1-david.lee@trailofbits.com Signed-off-by: Jan Kara <jack@suse.cz>
2026-07-17net: mana: Add debug knob to skip TX timeout recovery resetAditya Garg
Add a per-port debugfs boolean "tx_timeout_skip_reset" that, when enabled, makes mana_tx_timeout() log the TX timeout and return without queueing the per-port detach/attach recovery work. This is a debug-only aid for bringup and qualification: skipping the recovery reset keeps the device and queue state intact so a TX timeout can be correlated with hardware telemetry. The knob defaults to false, so production recovery behaviour is unchanged. Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260710132229.2851441-1-gargaditya@linux.microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=nWeiming Shi
On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does. Fixes: 196cfebf8972 ("net/mpls: Handle kernel side filtering of route dumps") Assisted-by: Claude:claude-opus-4-8 Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260711114958.1009619-3-bestswngs@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17llc: fix SAP refcount leak when creating incoming socketsXuanqiang Luo
llc_sap_add_socket() takes a SAP reference for each socket added to a SAP, and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes an additional SAP reference after adding the child socket. This extra reference was balanced by an explicit llc_sap_put() in llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") removed that put. The corresponding hold in the accept path was left behind. When such a child socket is removed, only the reference taken by llc_sap_add_socket() is released. The extra reference keeps the SAP alive after its last socket is removed. Remove the obsolete hold. Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling") Cc: stable@vger.kernel.org Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17selftests: netconsole: only restore MAC when it changed on resumeAndre Carvalho
The "mac" bind mode reactivation downs the interface, restores the saved MAC and renames it to trigger a target resume. This assumes the recreated interface comes back with a different MAC, which is true under MACAddressPolicy=none (as on the Netdev CI) but not when MACs are persistent. In the persistent case netconsole resumes the target on its own, and the down/restore/rename flow instead drops it and fails the test. Guard the block on the MAC having actually changed so the test passes under both policies. Fixes: 6ecc08329bab ("selftests: netconsole: validate target resume") Reported-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Closes: https://lore.kernel.org/netdev/f398373e-2cb4-4649-a491-9763df94d98b@kernel.org/ Signed-off-by: Andre Carvalho <asantostc@gmail.com> Tested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netcons-mac-reload-v1-1-3fb1bcc70b4a@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17serial: sc16is7xx: implement gpio get_direction() callbackHugo Villeneuve
It's strongly recommended for GPIO drivers to always implement the .get_direction() callback - even when the direction is tracked in software. The GPIO core emits a warning when the callback is missing and a user reads the direction of a line, e.g. via /sys/kernel/debug/gpio. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable <stable@kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260716210813.2582826-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR ↵Jiangshan Yi
platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replaced the dnv_board setup and exit callbacks with PTR_IF(false, ...), which evaluates to NULL. However, the three call sites in mid8250_probe() and mid8250_remove() unconditionally dereference these function pointers without NULL checks, causing a NULL pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), or Snowridge (SNR) platform. Fix this by adding the missing NULL checks before calling the setup and exit callbacks. Fixes: b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") Cc: stable <stable@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Link: https://patch.msgid.link/20260715073546.1875083-1-yijiangshan@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17fuse: publish io-uring queues with release semanticsJoanne Koong
fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it. WRITE_ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before. Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined. Fixes: 24fe962c86f5 ("fuse: {io-uring} Handle SQEs - register commands") Cc: stable@vger.kernel.org Reviewed-by: Bernd Schubert <bernd@bsbernd.com> Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-07-17fuse: use release/acquire for fch->initializedJoanne Koong
fuse_chan_set_initialized() sets values for the connection state and then sets fch->initialized to true, but lockless readers read fch->initialized and if true, go to read the connection state values, without using any barriers. There are a few instances where this happens (fuse_uring_cmd() before dispatching register / commit-and-fetch cmds, fuse_dev_do_wriite() for handling notify retrieves, etc). To make this as simple as possible, use release/acquire semantics for writing/reading fch->initialized. Add the missing read barriers. This is not marked for stable as these are not realistically reachable on a well-behaved server, and buggy/malicious servers who trigger this path fail benignly rather than crash or deadlock the kernel. Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-07-17fuse: fix missing barrier when checking io-uring readinessJoanne Koong
fuse_block_alloc() reads fch->initialized and then fch->io_uring. fch->io_uring is set before fch->initialized, ordered by the smp_wmb() in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching read barrier between the two loads. This may lead a CPU to observe fch->initialized=1 but fch->io_uring=0, and skip the check that blocks request allocation until the io-uring queues are ready. This can reintroduce the lock-order inversion deadlock that commit 3393ff964e0f prevents. Add an smp_rmb() barrier to pair with the smp_wmb() in fuse_chan_set_initialized() to prevent this. Fixes: 3393ff964e0f ("fuse: block request allocation until io-uring init is complete") Cc: stable@vger.kernel.org Reviewed-by: Bernd Schubert <bernd@bsbernd.com> Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-07-17tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64Karl Mehltretter
hvc_dcc drives the JTAG DCC via the ARMv6/v7 CP14 debug registers (mrc/mcr p14, 0, rX, c0, c1/c5, 0 in asm/dcc.h). That encoding is undefined on older ARM cores, and also on ARMv7-M, but HVC_DCC only depends on ARM, so it can be enabled on e.g. ARM926 (ARCH_MULTI_V5), where hvc_dcc_console_init() runs __dcc_putchar() at boot and takes an undefined-instruction trap before the console is up: Internal error: Oops - undefined instruction: 0 [#1] ARM PC is at hvc_dcc_check+0x50/0x8c hvc_dcc_check from hvc_dcc_console_init+0x18/0x48 hvc_dcc_console_init from console_init+0x58/0x170 Kernel panic - not syncing: Fatal exception Restrict HVC_DCC to the CPUs where that encoding is valid: the CPU_V6 || CPU_V6K || CPU_V7 set that arch/arm/include/debug/icedcc.S guards it with, plus ARM64. Fixes: 16c63f8ea49c ("drivers: char: hvc: add arm JTAG DCC console support") Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260717071616.91423-1-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17dt-bindings: serial: snps-dw-apb-uart: Add RV1106 compatibleSimon Glass
Add the compatible for the UARTs of the Rockchip RV1106, which are compatible with the Synopsys DesignWare APB UART. Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260714132035.v2.1.c1d92213393f49330ec14d0c670a802181b4fcbf@changeid Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: qcom_geni: Add panic notifier to stop UART on panicPraveen Talari
When a VM crashes with an active UART DMA transfer in progress, the SMMU raises context faults as the DMA engine continues to access IOVAs that are invalidated when the VM's memory context is torn down. These faults can affect other VMs sharing the same SMMU instance and obscure the root cause of the crash. Additionally, a stuck TX transfer on the panic console UART can cause the panic handler to stall, dropping the panic output. Register a panic notifier to stop TX and RX. The notifier does not take the port lock, since panic can be entered with the lock already held by the interrupted context, and there is no safe way to detect that here; instead, the device's runtime PM status is checked first so that TX/RX are only stopped while the hardware is still clocked and accessible, and the register accesses are skipped entirely once the device is runtime suspended. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260715-add_shutdown_and_panic_notifier_serial-v1-2-23e3787c7109@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: qcom_geni: Add shutdown callback to quiesce hardware on rebootPraveen Talari
During system reboot, an active UART DMA transfer can leave the GENI Serial Engine in an indeterminate state. On VM-based platforms, if a DMA transfer is in progress when the VM is shut down, the SMMU can raise context faults as the DMA engine continues to access IOVAs that have already been invalidated during VM teardown. Add a shutdown callback to stop TX and RX and bring the hardware to idle before the system resets, preventing both hardware state corruption on reboot and SMMU faults during VM shutdown. The port lock is not taken here since shutdown runs from process context with the device already quiesced from the UART core's perspective; instead, the runtime PM status is checked so that TX/RX are only stopped while clocks and resources are still active, avoiding any register access once the device is runtime suspended. Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260715-add_shutdown_and_panic_notifier_serial-v1-1-23e3787c7109@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: qcom-geni: Add tracepoints for Qualcomm GENI serial driverPraveen Talari
Add tracing to the Qualcomm GENI serial driver to improve runtime observability. Trace hooks are added at key points including termios and clock configuration, manual control get/set, interrupt handling, and data TX/RX paths. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com> Link: https://patch.msgid.link/20260710-add-tracepoints-for-qcom-geni-serial-v6-2-2bb6b6836dfd@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: core: display 32 for MEM32 and MEM32BE UPIO typesHugo Villeneuve
Displaying "32be" is wrong for UPIO_MEM32. Fix and simplify by displaying "32" for MEM32 and MEM32BE UPIO types. Fixes: 86305190f307 ("serial: uniformize serial port I/O infos display") Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260716211216.2583291-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17serial: 8250: fix compile error with hub6_match_port() when compiled as a moduleHugo Villeneuve
With CONFIG_SERIAL_8250_HUB6=m, we have the following compile error: ../drivers/tty/serial/8250/8250_hub6.c:46:6: error: redefinition of 'hub6_match_port' Fix hub6_match_port() prototype definition by using IS_REACHABLE() to support both built-in and module values, and substitute empty prototype otherwise. Fixes: 3d406299d8829 ("serial: 8250_hub6: add hub6_match_port()") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607150717.2YxVdWpX-lkp@intel.com/ Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260715153707.4181828-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17Revert "serial: qcom-geni: remove .pm callback, use runtime PM in ↵Greg Kroah-Hartman
startup/shutdown" This reverts commit 3d71f8d7eeb374d0eb84c64c6ffd68bdcc0d42d4. It causes lots of build problems both in linux-next and reported by the 0-day bot. Reported-by: Mark Brown <broonie@kernel.org> Reported-by: kernel test robot <lkp@intel.com> Cc: Praveen Talari <praveen.talari@oss.qualcomm.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607110008.JQ2vBeKC-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202607150830.LsNxeVYw-lkp@intel.com/ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-17net: airoha: add preliminary support to configure tx hw QoS queue during ↵Lorenzo Bianconi
flowtable offloading Add the plumbing to program the AIROHA_FOE_QID field in the PPE FOE entry with a per-flow priority value during flowtable offload. This allows the hardware to steer offloaded flows to a specific QoS queue on the egress QDMA block for traffic forwarded between two interfaces via hardware acceleration, bypassing the kernel forwarding path. The priority parameter is currently always zero because netfilter does not yet provide a mechanism to pass the skb priority field to the flowtable offload driver. Once that support is added in the netfilter subsystem, the driver will be able to extract the priority from the flow rule and map it to the appropriate hardware queue. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260703-airoha-hw-qos-queue-stub-v1-1-ef253ffdd093@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17ethtool: link 10000baseCR to SFF-8431, Appendix-E SFP+ DASiddaraju DH
Add comment to clarify the physical media 10000baseCR follows. 10000baseCR does not correspond to any IEEE 802.3 *base-CR PMD. It has no autonegotiation, no link training, and no mandatory FEC. The industry standard for this media type is SFF-8431 Appendix-E Direct Attach cable, also known as 10G_SFI_DA. Link: https://lore.kernel.org/r/SN7PR11MB69003D33489DB1D6B17EF72A9AF52@SN7PR11MB6900.namprd11.prod.outlook.com Signed-off-by: Siddaraju DH <siddaraju.dh@intel.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260703100537.1109838-1-siddaraju.dh@intel.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17MIPS: BCM47XX: Convert buttons to software nodesDmitry Torokhov
Convert the legacy gpio-keys platform device on BCM47XX boards to use software nodes/properties. This allows us to describe the GPIO keys and their GPIO bindings using software nodes, so that support for platform data can eventually be removed from the gpio-keys driver. Detect the active bus type (BCMA or SSB) and reference the corresponding GPIO controller's software node (bcma_gpio_swnode or ssb_gpio_swnode) in the button properties. Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-07-17ssb: gpio: Add and register software node for GPIO controllerDmitry Torokhov
We want to convert the legacy gpio-keys platform device on BCM47XX boards to use software nodes. To do this properly and allow referencing the GPIO controller by address rather than relying on name-based matching (which is being removed from the gpiolib core), we need to associate the GPIO controller with a software node. Introduce ssb_gpio_swnode, register it, and associate it with the gpio_chip. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-29 06:11:17 +0000