summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-28staging: sm750fb: Clean up whitespace and comment spacing in headersMohit Mishra
Clean up minor formatting inconsistencies in sm750.h and sm750_accel.h: - Remove a redundant consecutive blank line in sm750.h. - Add missing spaces in comment blocks in sm750.h and sm750_accel.h. - Align DE_SOURCE_X_K1_MONO_MASK macro definition in sm750_accel.h with spaces instead of tabs to match surrounding macros. Signed-off-by: Mohit Mishra <mishraloopmohit@gmail.com> Link: https://patch.msgid.link/20260722175817.213235-2-mishraloopmohit@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: most: video: replace pr_err with dev_errNils Lehnen
The MOST core and the already converted net component log with device context, while the video component still uses bare pr_err(), which leaves its messages without any hint of the originating interface. Both affected functions have the most_interface at hand, so log through dev_err(iface->dev, ...) exactly like drivers/most/core.c does. All English text in this patch (commit message and code comments) was translated from a German draft with the assistance of Claude Fable 5. Assisted-by: Claude:claude-fable-5 sparse Signed-off-by: Nils Lehnen <nils.lehnen@proton.me> Link: https://patch.msgid.link/20260718004223.54943-1-nils.lehnen@proton.me Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: use kfree_sensitive() for key materialIvy Lopez
The set_stakey_parm struct contains a 16-byte encryption key. Use kfree_sensitive() instead of kfree() to ensure the key material is zeroed before the memory is freed, preventing potential information leaks. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Ivy Lopez <skunkolee@gmail.com> Link: https://patch.msgid.link/20260717220135.17836-1-skunkolee@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: wrap line over 100 charactersDalvin-Ehinoma Noah Aiguobas
Fix checkpatch warning by wrapping the lines. Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260717161329.3400-3-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: change struct member bDriverStoppedDalvin-Ehinoma Noah Aiguobas
Member name does not adhere to linux coding style. Changed type as well since b indicates a boolean type and in every instance of setting the variable the values true and false are used. bDriverStopped -> driver_stopped Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com> Link: https://patch.msgid.link/20260717161329.3400-2-fliegbert2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: reformat rtw_efuse_read_1_byte() signatureMoksh Panicker
Reformat the multi-line function signature to a single line to fix the following checkpatch.pl warning: WARNING: function definition argument 'struct adapter *Adapter' should also have an identifier name Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com> Link: https://patch.msgid.link/20260717160328.8739-1-mokshpanicker.7@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename Update_RA_Entry to update_ra_entryAnirban Bose
I changed the Update_RA_Entry() function to update_ra_entry() to fix the camelcase warning by checkpatch, I updated every instance it was present and I have checked it successfully building the driver with the changes I have done. Signed-off-by: Anirban Bose <boses156@gmail.com> Link: https://patch.msgid.link/20260717140006.2443-1-boses156@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28staging: rtl8723bs: rename camelcase variable psurveyParaMax Raulea
Reported style issue by checkpatch in the rtl8723bs driver. changed the variable name to survey_para to adhere to Linux Kernel coding style. Signed-off-by: Max Raulea <max.raulea@gmail.com> Link: https://patch.msgid.link/amhTbmQRr1MzBa6G@archlinux Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-28Merge patch series "afs: Miscellaneous fixes"Christian Brauner
David Howells <dhowells@redhat.com> says: (1) Fix afs_fs_fetch_data() to set call->async. (2) Fix afs_fs_fetch_data() to subtract transferred from len instead of adding it. (3) Fix a UAF when sending a message if the call is completed so quickly that the sending code hasn't finished with it when it gets freed. * patches from https://patch.msgid.link/20260723113452.566619-1-dhowells@redhat.com: afs: Fix UAF when sending a message afs: Fix afs_fs_fetch_data() to subtract transferred from len afs: Fix afs_fs_fetch_data() to set call->async Link: https://patch.msgid.link/20260723113452.566619-1-dhowells@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-28afs: Fix UAF when sending a messageDavid Howells
In afs_make_call(), there's a race with async call reception and destruction. If a call is dispatched that doesn't have call->write_iter set (used to specify the data content for FS.StoreData), then the first rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr. Once rxrpc_send_data() queues the last request packet, the response could come in at any time and cause the call to be completed and put. However, afs_make_call() will look at the call again to see it ->write_iter should be handled - something it's only allowed to do if it has its own ref on the call. Whilst this is the case for synchronous calls, it isn't true for async calls such as FS.FetchData. There's also a potential UAF in afs_make_call() in the event that an asynchronous call is being sent, but the call fails in some way (e.g. it gets aborted from the server). The problem there is that afs_make_call() tries to abort a call if the rxrpc send fails, but the asynchronous notification from rxrpc may have caused the afs_call to be torn down. generic/650 plays games with randomly taking CPUs offline, and can interject a significant delay such that the call is deallocated before afs_make_call() gets to check call->write_iter - and a UAF ensues (caught by KASAN). BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs] Read of size 8 at addr ffff888035e050e8 by task fsstress/1409 Fix this by making afs_make_op_call() give the op->call its own ref rather than transferring the caller's ref to it and then dropping the ref when afs_make_call() returns. This also means that the afs_make_call() func never loses its ref on the call now. Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation") Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept") Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Link: https://patch.msgid.link/20260723113452.566619-4-dhowells@redhat.com cc: Jeffrey Altman <jaltman@auristor.com> cc: linux-afs@lists.infradead.org cc: stable@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-28afs: Fix afs_fs_fetch_data() to subtract transferred from lenDavid Howells
Fix afs_fs_fetch_data() to subtract subreq->transferred from subreq->len rather than adding it. Fixes: f28fc2010d62 ("afs: Eliminate afs_read") Link: https://sashiko.dev/#/patchset/20260713081022.2186481-1-dhowells%40redhat.com Signed-off-by: David Howells <dhowells@redhat.com> Link: https://patch.msgid.link/20260723113452.566619-3-dhowells@redhat.com cc: Marc Dionne <marc.dionne@auristor.com> cc: Jeffrey Altman <jaltman@auristor.com> cc: linux-afs@lists.infradead.org cc: stable@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-28afs: Fix afs_fs_fetch_data() to set call->asyncDavid Howells
Fix afs_fs_fetch_data() to set call->async on an async operation as does afs_fs_fetch_data64(). Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation") Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com Signed-off-by: David Howells <dhowells@redhat.com> Link: https://patch.msgid.link/20260723113452.566619-2-dhowells@redhat.com cc: Marc Dionne <marc.dionne@auristor.com> cc: Jeffrey Altman <jaltman@auristor.com> cc: linux-afs@lists.infradead.org cc: stable@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-28powerpc/serial: Fix include guard commentThorsten Blum
Replace _PPC64_SERIAL_H with _ASM_POWERPC_SERIAL_H to match the actual macro name. Remove an empty comment while at it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260623153825.403819-2-thorsten.blum@linux.dev
2026-07-28powerpc/perf: Use strstarts() to simplify is_thread_imc_pmu()Thorsten Blum
Replace the open-coded implementation with strstarts() to simplify is_thread_imc_pmu(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Athira Rajeev <atrajeev@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260704121353.201583-3-thorsten.blum@linux.dev
2026-07-28powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()Thorsten Blum
If lv1_put_iopte() fails in dma_ioc0_map_pages(), the error path decrements iopage but keeps using the failed mapping's offset. As a result, it repeatedly tries to invalidate the failed IOPTE slot and leaves the already installed IOPTEs valid. Recompute offset and invalidate the installed IOPTEs instead. Fixes: 6bb5cf102541 ("[POWERPC] PS3: System-bus rework") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260711130931.740719-3-thorsten.blum@linux.dev
2026-07-28powerpc/ps3: Remove unused struct table in setup_areas()Thorsten Blum
The local table structure is not used - remove it. Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260713091731.97212-3-thorsten.blum@linux.dev
2026-07-28powerpc/boot: Fix treeboot-akebono CPU node lookup checkThorsten Blum
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly. Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260702211554.56923-6-thorsten.blum@linux.dev
2026-07-28powerpc/boot: Fix treeboot-currituck CPU node lookup checkThorsten Blum
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly. Fixes: 228d55053397 ("powerpc/47x: Add support for the new IBM currituck platform") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260702211554.56923-5-thorsten.blum@linux.dev
2026-07-28powerpc/boot: Fix simpleboot CPU node lookup checkThorsten Blum
fdt_node_offset_by_prop_value() returns a negative error code on failure - fix the check accordingly. Fixes: d2477b5cc8ca ("[POWERPC] bootwrapper: Add a firmware-independent simpleboot target.") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260702211554.56923-4-thorsten.blum@linux.dev
2026-07-28powerpc: Fix exit_flags field placement in pt_regs for ptraceMukesh Kumar Chaurasiya (IBM)
Commit d7a6797e0bc1 ("powerpc: add exit_flags field in pt_regs") added the exit_flags field to struct pt_regs to pass internal exit control flags (e.g. _TIF_RESTOREALL) from syscall_exit_prepare() to the low-level assembly exit path. However, the field was placed in a way that was visible to userspace tools such as strace via PTRACE_GETREGS, or caused a struct layout or size regression observable through ptrace. The field is purely kernel-internal and must not be exposed beyond the user_pt_regs boundary. Move exit_flags into struct thread_info where it is only accessible to the kernel, and keep it out of the ptrace-visible register window entirely. Fixes: d7a6797e0bc1 ("powerpc: add exit_flags field in pt_regs") Reported-by: Dmitry V. Levin <ldv@strace.io> Closes: https://lore.kernel.org/all/20260722070155.GA11808@strace.io/ Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260723194809.4046600-1-mkchauras@gmail.com
2026-07-28powerpc/970: fix nap return address corruption on async interrupt exitMukesh Kumar Chaurasiya (IBM)
On PowerMac G5 (PPC970, CONFIG_PPC_970_NAP) the system panics shortly after boot with symptoms including instruction fetch faults, kernel data access faults, and stack corruption, predominantly on SMP and always somewhere inside softirq processing. The PPC970 idle path works by setting _TLF_NAPPING in the current thread's local flags before entering the MSR_POW nap loop. When any async interrupt wakes the CPU, nap_adjust_return() is expected to detect _TLF_NAPPING, clear it, and rewrite regs->NIP to power4_idle_nap_return so that the interrupt returns cleanly to the caller of power4_idle_nap() rather than back into the nap spin loop. DEFINE_INTERRUPT_HANDLER_ASYNC generates the following sequence: irq_enter_rcu(); ____func(regs); /* timer_interrupt / do_IRQ body */ irq_exit_rcu(); /* softirqs run here, irqs re-enabled */ arch_interrupt_async_exit_prepare(regs); /* nap_adjust_return was here */ irqentry_exit(regs, state); irq_exit_rcu() calls invoke_softirq() -> do_softirq_own_stack(), which runs softirqs with hardware interrupts re-enabled. A nested async interrupt can therefore arrive while _TLF_NAPPING is still set. That nested interrupt reaches nap_adjust_return() in its own arch_interrupt_async_exit_prepare() call, finds _TLF_NAPPING set, and redirects *its own* regs->NIP to power4_idle_nap_return. Returning via that blr with an unrelated LR on the softirq stack jumps to a garbage address, causing the observed crashes. The comment that previously lived in arch_interrupt_async_exit_prepare() even described this exact hazard ("must come before irq_exit()"), but nap_adjust_return() was placed after irq_exit_rcu() in the macro, so the protection was never effective. Fix this by calling nap_adjust_return() inside DEFINE_INTERRUPT_HANDLER_ASYNC immediately before irq_exit_rcu(), ensuring _TLF_NAPPING is cleared and regs->NIP is adjusted before any code that can re-enable interrupts or invoke softirqs runs. Move the explanatory comment into nap_adjust_return() itself and remove it from arch_interrupt_async_exit_prepare(). Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") Closes: https://lore.kernel.org/all/87wlvazrdy.fsf@igel.home/ Reported-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Tested-by: John Ogness <john.ogness@linutronix.de> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260707172430.790040-1-mkchauras@gmail.com
2026-07-28powerpc/pseries: Skip vpa_init() for boot cpu in smp_setup_cpu()Vaibhav Jain
During pSeries_setup_arch(), VPA for boot-cpu is first to be initialized. However later in the boot, smp_setup_cpu() is called for setting up VPA on boot and secondary cpus that were brought online. This results in vpa_init() being called twice for boot-cpu and three redundant H_REGISTER_VPA hcalls being made to the hypervisor. Fix this by adding an extra condition in smp_set_cpu() to call vpa_init() only on non boot-cpus. Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708015842.274690-1-vaibhav@linux.ibm.com
2026-07-28powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crashVaibhav Jain
Currently pseries_kexec_cpu_down() skips unregistering vpa, slb_shadow and dtl areas during a crash and kexec shutdown path. It was done to avoid doing an HCALL while crashing. However recently Anushree reported that during kernel crash while the kdump kernel was coming up, Hypervisor reported invalid values for 'vpa.yield_count' while it dispatching L2-KVM Guest vcpus. The error manifested as debug build Hypervisor assert triggering to indicate possible VPA corruption. Looking at the kexec cpu offline path it was discovered that during crash kernel doesn't unregister the VPA/SLB-Shadow/DTL area with Hypervisor. Instead it re-allocates and re-registers these areas for cpus during boot. During kexec boot the previously allocated areas can get overwritten with new content without hypervisor knowledge. This creates a small window where while kexec kernel boots and the L2-VCPUs are being dispatched, Hypervisor may try to read/write to a wrong memory area which previously belonged to older VPA. Fix this possible race and memory corruption by updating pseries_kexec_cpu_down() to also unregister vpa,slb_shadow & dtl areas during a kernel crash. Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708015802.274271-1-vaibhav@linux.ibm.com
2026-07-27hfs: rework MDB locking schemeViacheslav Dubeyko
hfs_mdb_commit() used to hold the primary MDB buffer_head (mdb_bh) locked for the whole commit, including writing the alternate MDB and the volume bitmap. A corrupted image can set drVBMSt so the bitmap block aliases mdb_bh. The bitmap writeback path then calls lock_buffer() on that same buffer_head while it is already locked by hfs_mdb_commit(). Finally, we have a deadlock during flushing the MDB to the file system volume. However, even for valid images, the locking scheme of holding the mdb_bh locked across this much unrelated I/O is fragile anyway. This patch adds a dedicated sbi->mdb_lock and take it around every hfs_mdb_commit() caller (hfs_sync_fs(), flush_mdb(), and the initial hfs_mdb_get() in hfs_fill_super()). Additionally, this patch makes sbi->mdb/sbi->alt_mdb independent in-memory copies (allocated with kmemdup()) instead of pointers into mdb_bh's/alt_mdb_bh's page cache data. Every MDB field read or write in hfs_mdb_commit(), hfs_mdb_close() and hfs_mdb_get() now operates on these copies. Also, hfs_mdb_publish() and hfs_alt_mdb_publish() are the only places left that touch the buffer_heads. The hfs_mdb_put() frees the two copies. Reported-by: Yue Sun <samsun1006219@gmail.com> Link: https://lore.kernel.org/all/CAEkJfYMB47v1yOWHB8q2dc8kf=uj-rLO=+yMyudwPguJ8Kd3jA@mail.gmail.com/ Signed-off-by: Yue Sun <samsun1006219@gmail.com> cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> cc: Yangtao Li <frank.li@vivo.com> cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com> Link: https://lore.kernel.org/r/20260720184414.195213-2-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-07-27arm64: dts: socfpga: use consistent QSPI boot partition labelTze Yee Ng
Several SoCFPGA board DTS files labeled the first QSPI MTD partition (qspi_boot / partition@0 under fixed-partitions) as "u-boot" while others already used "Boot and fpga data". Align the QSPI boot partition label only so naming matches the combined boot + FPGA image layout and stays consistent across Agilex, N5X, and Stratix 10 SoCDK variants. No QSPI partition layout or reg properties are changed. Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-07-28ata: libata-eh: Increase STANDBY IMMEDIATE timeoutMatt Vollrath
Correct a previous change (see Fixes) which reduced the standby timeout from 30 to 5 seconds. Increase it to 15 seconds. I was troubleshooting an error spotted during system suspend: [ 1217.152867] ata1.00: Entering standby power mode [ 1222.322948] ata1.00: qc timeout after 5000 msecs (cmd 0xe0) [ 1222.324010] ata1.00: STANDBY IMMEDIATE failed (err_mask=0x4) This drive is a Samsung 870 EVO SSD in good SMART standing, and I wasn't aware of any reason it should be taking so long to standby. The issue is intermittent, but I observed it sometimes taking 7 seconds to manually standby. I assume this was interruption of background maintenance after a power outage. As a desktop user, I would prefer to wait the extra 2 seconds at suspend to let the drive finish its business rather than drop the rails from under it. The change from 30 to 5 seconds was implicit when switching suspend from START STOP UNIT to an internal command with no timeout table entry. No reason was stated for the change. Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") Cc: stable@vger.kernel.org Signed-off-by: Matt Vollrath <tactii@gmail.com> Assisted-by: Claude:claude-5-fable Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-28ata: libata: avoid kernel-doc warningsRandy Dunlap
Modify comments to prevent kernel-doc warnings: - use "/*" for a non-kernel-doc comment - add a Returns: section for ata_id_major_version() Warning: include/linux/ata.h:770 Cannot find identifier on line: * Warning: include/linux/ata.h:782 function parameter 'id' not described in 'ata_id_sct_data_tables' Warning: include/linux/ata.h:782 expecting prototype for Word(). Prototype was for ata_id_sct_data_tables() instead Warning: include/linux/ata.h:820 No description found for return value of 'ata_id_major_version' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-07-27x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilitiesAhmed S. Darwish
Transmeta CPUs allow masking CPUID(0x1).EDX feature flags via MSR writes. If a bit is cleared in the 0x80860004 MSR, its corresponding feature flag is not reported by CPUID. Refresh the CPUID parser's CPUID(0x1) cache after all MSR bits are unmasked. Note, the MSR 0x80860004 semantics are documented in the "BIOS Programmer's Guide: Transmeta Crusoe Processor" document, dated June 14, 2002. Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260528153923.403473-9-darwi@linutronix.de
2026-07-27arm64: dts: qcom: glymur: add SoCCP DT nodeSibi Sankar
The SoC Control Processor (SoCCP) is a small RISC-V MCU that controls USB Type-C, battery charging, and various other functions on Qualcomm SoCs. Add the nodes required to enable SoCCP on Glymur/Mahua SoCs. Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Co-developed-by: Ananthu C V <ananthu.cv@oss.qualcomm.com> Signed-off-by: Ananthu C V <ananthu.cv@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709-glymur-soccp-v6-4-16f70227547d@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27arm64: dts: qcom: glymur: fix SoCCP memory mappingsAnanthu C V
The currently listed SoCCP and SoCCP DTB reserved memory regions don't align with the memory requested by the SoCCP Firmware. Fix this by updating the SoCCP/SoCCP DTB memory regions to reflect the memory region requirements of the SoCCP firmware, as described in the Glymur v21 memory map release. Fixes: 41b6e8db400c ("arm64: dts: qcom: Introduce Glymur base dtsi") Signed-off-by: Ananthu C V <ananthu.cv@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260709-glymur-soccp-v6-3-16f70227547d@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27cifs: add fscache_resize_cookie() to cifs_setsize()Frank Sorenson
Several code paths update the VFS inode size by calling netfs_resize_file() and cifs_setsize(), but omit the corresponding fscache_resize_cookie() call, leaving the fscache cookie out of sync with the actual file size: - cifs_file_set_size() in inode.c: server-side truncation via setattr - cifs_do_truncate() in file.c: truncates to zero on O_TRUNC open - smb2_duplicate_extents() in smb2ops.c: file clone extending EOF - smb3_simple_falloc() in smb2ops.c: two branches that extend EOF via write-range and SMB2_set_eof respectively Since every caller of cifs_setsize() must resize the fscache cookie, add the call to cifs_setsize() itself, consistent with how truncate_pagecache() is already consolidated there. Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite") Fixes: 93a43155127f ("cifs: Fix missing set of remote_i_size") Fixes: 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC") Fixes: 7a06d3b816d7 ("smb/client: emulate small EOF-extending mode 0 fallocate ranges") Cc: stable@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Cc: Paulo Alcantara <pc@manguebit.org> Cc: Huiwen He <hehuiwen@kylinos.cn> Signed-off-by: Frank Sorenson <sorenson@redhat.com> Reviewed-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-07-27net: dns_resolver: allow shorter names in dns_query()Paulo Alcantara
Customer reported a problem with mounting CIFS shares where the server hostname was 2 chars long. Turned out that the CIFS client wasn't able to resolve NetBIOS names shorter than 3 chars. Fix this by allowing a minimum of one character per hostname in dns_query(). Reproducer with samba server: # 'ab' and 'srv' hotnames resolve to same ip address $ ssh srv ln -s 'msdfs:\\ab\\share' /home/shares/dfs/link1 $ mount.cifs //srv/dfs/link1 /mnt -o ... [EINVAL] Reported-by: Pierguido Lambri <plambri@redhat.com> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Acked-by: David Howells <dhowells@redhat.com> Acked-by: Frank Sorenson <sorenson@redhat.com> Link: https://patch.msgid.link/20260722-net-dns_resolver-v1-1-c3385898ccf9@manguebit.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27ethtool: Embed FEC hist ranges as buffer in structEric Joyner
When a driver's .get_fec_stats() handler is called and the driver supports FEC histogram stats, the driver supplies the histogram bin ranges via a pointer. This pointer is assigned while under the netdev ops lock in fec_prepare_data(), but the actual data is only read after the lock is released; so this allows the driver to change the ranges (e.g. from another .get_fec_stats() call) while the current call chain is reading them in fec_fill_reply(). Fix this by adding an ethtool core-owned buffer, ranges_buf, to struct ethtool_fec_hist. Drivers whose ranges are built dynamically (currently just mlx5) fill ranges_buf and then point the existing ranges pointer at it, giving ethtool a consistent copy that stays valid after the netdev ops lock is dropped and later in fec_fill_reply(). Drivers whose ranges are compile-time constants (bnxt, netdevsim) are unaffected by the potential race and keep setting the existing ranges pointer to their constant array, without making copies. Fixes: cc2f08129925 ("ethtool: add FEC bins histogram report") Signed-off-by: Eric Joyner <eric.joyner@amd.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260723041342.39238-1-eric.joyner@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net/mlx5: E-Switch, defer fwd2vport egress ACL allocationYael Chemla
On every VF/SF vport enable, esw_acl_egress_ofld_setup() allocates an egress ACL flow table and a fwd_grp whenever the device supports egress_acl_forward_to_vport. The only consumer of that group is the active/passive fwd2vport rule installed when two representor netdevs are bonded - a path that almost never fires. As a result, hosts with many VFs/SFs pay a per-vport flow table and flow group cost for a feature most ports never use. Defer the flow table and fwd_grp creation to the moment they are actually needed, when mlx5e_rep_esw_bond_netevent() drives mlx5_esw_acl_egress_vport_bond() for the passive vport: - esw_acl_egress_ofld_setup() now returns early unless prio_tag_required is set. When prio_tag_required is set the flow table is still allocated eagerly for the VLAN pop rule, and its size is grown by one when fwd2vport is supported so the lazy fwd_grp can later be added without re-creating the table. Only the VLAN group is built up-front. - A new helper, esw_acl_egress_ofld_fwd2vport_setup(), allocates the egress ACL flow table (size 1) and the fwd_grp on demand, and rolls back the flow table if group creation fails and the helper had just allocated it. Existing cleanup paths (esw_acl_egress_ofld_cleanup() -> *_groups_destroy() / *_table_destroy()) already tolerate NULL fields, so vport disable continues to free everything that was actually allocated. - mlx5_esw_acl_egress_vport_bond() calls the helper for the passive vport before installing the fwd2vport rule. The active vport does not need the flow table on its own: with a NULL fwd_dest, esw_acl_egress_ofld_rules_create() is a no-op unless prio_tag_required is set, in which case the eager path already built the table. mlx5_esw_acl_egress_vport_bond() and mlx5_esw_acl_egress_vport_unbond() now take esw->state_lock for the duration of the operation, because they may mutate vport->egress.acl, which is also written by the vport enable/disable path under the same lock. Signed-off-by: Yael Chemla <ychemla@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260723070427.1861502-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net/mlx5e: SHAMPO, Remove dead CWR handling in GRO header updateDragos Tatulea
mlx5e_shampo_update_ipv{4,6}_tcp_hdr() runs only from the gro_count > 1 path in mlx5e_shampo_flush_skb(). HW-GRO flushes the current session on a CWR packet and delivers it as a single-segment skb via napi_gro_receive(), so the aggregated (gro_count > 1) skb never carries a CWR-set TCP header. This patch drops the unreachable branch. Discussion context: https://lore.kernel.org/all/8b610e49-ff64-497e-8712-588b2228df02@nvidia.com/ Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com> Cc: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260723072829.1864366-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net/mlx5e: Remove _once from PCI heuristic debug printGal Pressman
The _once rate-limiting in slow_pci_heuristic() is unnecessary because this function only runs during probe. Worse, it interacts poorly with dynamic debug: if the first probe happens before dynamic debug is enabled for this callsite, the _once flag is permanently consumed and the message becomes unreachable without reloading the module. Additionally, only the first probed device values were printable in case of multiple devices. Replace with mlx5_core_dbg() which allows enabling the print via dynamic debug at any time and observing it on the next probe. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Alex Lazar <alazar@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260723081743.1868357-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-sideBjorn Andersson
rpmsg client drivers are allowed to invoke rproc_report_crash() on their grandparent when they determine that the otherwise seemingly healthy remoteproc has entered a functionally broken state. In the crash handling path qcom_q6v5_request_stop() is invoked, which is based on the current rproc state whether to request a graceful shutdown. But the current rproc `state` will be RPROC_CRASHED regardless of where the crash handler was initiated from, and empirical data shows that unless the firmware is taking part of the shutdown the system state is often left such that it's not possible to start the subsystem again. Use the `running` state in the q6v5 driver to make the decision instead, as this does represent the actual state of the firmware. This makes it possible to reliably trigger a restart from client drivers. Fixes: 3cc889eb83f5 ("remoteproc: qcom: q6v5: Avoid setting smem bit in case of crash shutdown") Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-q6v5-host-side-crash-v1-1-23bd53db90a7@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27net/mlx5e: Fix indentation in mlx5e_free_mpwqe_rq_drop_page()Tariq Toukan
Remove a stray leading space before __free_pages() call. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607142323.qm25Crps-lkp@intel.com/ Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Link: https://patch.msgid.link/20260723094452.1888786-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-28f2fs: fix dentry folio leak in find_in_levelGuanghui Yang
find_in_level() gets a dentry folio with f2fs_find_data_folio() before calling find_in_block(). If find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the dentry folio. This leaks the folio reference on the find_in_block() error path. Drop the dentry folio before returning the error to the caller. Fixes: 7ad08a58bf67 ("f2fs: Handle casefolding with Encryption") Cc: stable@vger.kernel.org Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Guanghui Yang <3497809730@qq.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-07-27remoteproc: Force shutdown during device removalBjorn Andersson
rproc_del() is subjected to the reference counted shutdown path, as such a remoteproc with more than one reference will be left running as its resources are released underneath it. Refactor the shutdown path such that the reference count value is ignored when called from rproc_del(). Assisted-by: OpenCode:GPT-5.5 Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-3-546dfd5de0e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27remoteproc: Prevent crash handling to race with rproc_del()Bjorn Andersson
There's no synchronization between rproc_crash_handler_work() and rproc_del(), as such it's possible for a driver to be removed while crash-handler work is scheduled, or even executing - resulting in use-after-free issues. To avoid this the scheduled work need to be cancelled and synchronized against before the removal proceeds. In order to ensure that this doesn't race with the reporting, and thereby scheduling new work, a "deleting" flag is introduced. This is similar to the RPROC_DELETE state that was introduced to ensure that "start" didn't race with rproc_del(), but the existing mechanism can not be used as it's valid to call rproc_report_crash() in atomic context - and the "state" is protected by a mutex. In the event that work is cancelled the pm_stay_awake() is left unbalanced and need to be unrolled. The blocking and cancelling of crash-handler work prior to the actual rproc_shutdown() call does have the explicit side-effect that crashes resulting from the shutdown process will not enter the crash-handling path, and as such will not generate devcoredumps etc. Due to the existing mutual exclusion between these code paths there's no concrete reduction in functionality, but further work would be needed to handle this case. Assisted-by: OpenCode:GPT-5.5 Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes") Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27remoteproc: Allow shutdown of crashed processorsBjorn Andersson
rproc_shutdown() rejects a remoteproc in RPROC_CRASHED state, and rproc_del() ignores that error. The result of these two decisions is that a user cannot stop a remoteproc that with recovery disabled that has entered a crash state, and removal of an associated remoteproc driver will release resources without first stopping the remoteproc. Allow rproc_shutdown() to stop crashed processors. Propagate the crash state to subdevice teardown, to allow subdevices to dismantle things appropriately. Assisted-by: OpenCode:GPT-5.5 Fixes: 5e6a0e05270e ("remoteproc: core: Move state checking to remoteproc_core") Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-1-546dfd5de0e6@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-27rtase: fix double free of multi-frag skb on DMA map failureYun Lu
In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once. Fixes: d6e882b89fdf ("rtase: Implement .ndo_start_xmit function") Signed-off-by: Yun Lu <luyun@kylinos.cn> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Justin Lai <justinlai0215@realtek.com> Link: https://patch.msgid.link/20260721023836.6691-1-luyun_611@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27fs: hfsplus: remove redundant NULL check before kfree()Mohammad Shahid
kfree() safely handles NULL pointers, so the explicit NULL check before calling kfree() is unnecessary. This issue was reported by ifnullfree.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Link: https://lore.kernel.org/r/20260726064228.248199-1-mdshahid03@gmail.com Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-07-27s390/qeth: Check CAP_NET_ADMIN for private ioctlsAswin Karuvally
Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN capable check to ensure unprivileged users cannot invoke them. Fixes: 18787eeebd71 ("qeth: use ndo_siocdevprivate") Cc: stable@vger.kernel.org Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Alexandra Winter <wintera@linux.ibm.com> Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com> Link: https://patch.msgid.link/20260723140050.762991-1-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27selftests: net: Add a missing config optionAlice Mikityanska
Commit 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") used iptables match comment, which was missed from the CI kernel config. Add the missing config option. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Matthieu Baerts <matttbe@kernel.org> Link: https://patch.msgid.link/20260723140241.132120-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27Merge branch 'docs-netdev-a-couple-of-updates'Jakub Kicinski
Paolo Abeni says: ==================== docs: netdev: a couple of updates Explicitly covers a couple of relevant spots currently left out in the dark. Likely the first one was too obvious to ever spell out loud and the latter too new. Both cases are increasingly relevant, at least to me. Keep the update in the netdev subsystem, as others may have slightly different preferences. ==================== Link: https://patch.msgid.link/cover.1784884817.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27docs: netdev: clarify expected interactions with LLMsPaolo Abeni
The official documentation has not captured yet the current impact of AI-generated reviews on the patch process. Explicitly state the status quo and expectations. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/83360de7addb13a3b5f4d5e722148f248fdb2ae0.1784884817.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27docs: netdev: clarify handling of idle patchesPaolo Abeni
Off-list pings are very bad, but unfortunately too common. Explicitly state that, so that at least LLMs could learn it. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/38b75373f813354ad0ee8bfde12ae5a42e9a11b6.1784884817.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27Merge tag 'nf-next-26-07-24' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for net-next, just a small batch with accumulated pending updates: 1) In IPVS, use system_dfl_long_wq instead of system_long_wq, from Ismael Luceno. 2) Add missing .checkentry in xt_tcpmss for IPv6, this is a follow up to a recent harderning, from Florian Westphal. 3) Address a sashiko report in the NAT SIP helper, from Florian Westphal. 4) Tear down flow entries with stale routes using the GC, this is to detect route updates when hardware offload is enabled. 5) Pass master conntrack as parameter to functions instead of using exp->master as preparation work to turn exp->master into a cookie. 6) Move expectation event_mask to the nf_conntrack_expect object, again as preparation work to turn exp->master into a cookie. 7) In IPVS, use kzalloc_obj{s}() typesafe allocations, from Subasri S. * tag 'nf-next-26-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: ipvs: use type-safe allocation helpers in ip_vs_rht_alloc netfilter: nf_conntrack_expect: store event cache in expectation netfilter: conntrack_helper: pass master conntrack to helper functions netfilter: flowtable: tear down flow entries with stale dst from GC netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet netfilter: xt_tcpmss: extend checkentry to ipv6 ipvs: Move defense_work and est_reload_work to system_dfl_long_wq ==================== Link: https://patch.msgid.link/20260724104932.437729-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-20 23:43:00 +0000