summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
11 dayswifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreementFelix Fietkau
The flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind that mt7915_mac_twt_sched_list_add() later walks. Fixes: 3782b69d03e7 ("mt76: mt7915: introduce mt7915_mac_add_twt_setup routine") Link: https://patch.msgid.link/20260724124813.3961474-17-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
11 dayswifi: mt76: mt7996: leave PS when a 4-address connection is establishedPeter Chiu
Because 4 address non-AMSDU packets do not have a bssid field, the hardware cannot get the bssid. Without the bssid, stations are not able to leave PS mode due to HW design. Wake up non-setup links when 4-address mode is established to prevent this issue. mt7992 and mt7990 handle this via the BSSID mapping band config instead, so restrict the command to mt7996. Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Link: https://patch.msgid.link/20260724124813.3961474-16-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name>
11 daysefi: apple-properties: validate setup data header lengthPengpeng Hou
map_properties() remaps the Apple properties setup_data payload and then reads the properties header fields. Reject a truncated payload before checking the header version and length fields. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
11 daysKVM: riscv: Fix infinite loop in NACL hfence entry allocationZongmin Zhou
try_count is initialized to 5 but never decremented in the retry path, making the `if (try_count)` check always true. If all NACL shared memory hfence entries remain in the pending state after sync, the function loops forever, causing a soft lockup. Decrement try_count on each retry so the fallback warning and return become reachable. Fixes: d466c19cead5 ("RISC-V: KVM: Add common nested acceleration support") Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260716073756.44153-1-min_halo@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Account VM-scoped allocations to the VM cgroupYuhang.chen
Charge the per-VM and per-vCPU allocations (stage-2 PGD, APLIC state, IMSIC context, vector context, FWFT config, PMU snapshot) to the allocating process's memory cgroup via GFP_KERNEL_ACCOUNT / __GFP_ACCOUNT. Per-CPU module-init allocations and transient scratch buffers are left unaccounted. Measured results (KVM guest run in a memory cgroup; VM cgroup memory.current after guest boot): VM cgroup memory.current 1044480 bytes Assisted-by: YuanSheng:deepseek-v4-pro Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Yuhang.chen <yhchen312@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260716064112.2387938-1-yhchen312@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Introduce make_xfence_request_nodata for FENCE.I requestsWang Yechao
FENCE.I does not need hfence data, but it currently goes through the generic make_xfence_request() path with NULL data, incurring unnecessary per-VCPU checks. Split out a separate make_xfence_request_nodata() function to handle FENCE.I directly, and move the data validity check to the top of the generic function to avoid redundant checks. Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731093833.1551341-3-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Separate req and fallback_req masks in make_xfence_requestWang Yechao
When handling hfence requests in make_xfence_request(), the current code uses a single 'actual_req' variable and a single vcpu_mask. If any VCPU fails to enqueue the hfence data (because its queue is full), the request falls back to 'fallback_req' for all VCPUs, even if other VCPUs still have available queue space. This can cause unnecessary fallback for healthy VCPUs, and more seriously, those healthy VCPUs will not process their already-enqueued hfence requests because no 'req' is set for them. As a result, their queues will quickly become full as well, degrading performance for SMP guests. Fix this by maintaining two separate bitmaps: one for VCPUs that successfully enqueued the hfence data (req_vcpu_mask) and another for those that failed (fallback_req_vcpu_mask). Then send the appropriate requests to each group. This ensures that fallback is only applied to VCPUs that actually need it, preserving the efficiency of the normal path for others. Fixes: 13acfec2dbcc ("RISC-V: KVM: Add remote HFENCE functions based on VCPU requests") Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731093833.1551341-2-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysapparmor: fix implicit declaration of function 'decompress_zstd'John Johansen
When CONFIG_ZSTD_DECOMPRESS is not enabled, and neither CONFIG_SECURITY_APPARMOR_EXPORT_BINARY nor CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY are enabled. The build will fail with implicit declaration of function 'decompress_zstd' because there is not an appropriate stub function, for when the zstd decompression isn't enabled. In addition fix compress_min, and compress_max to be conditional on CONFIG_SECURITY_APPARMOR_EXPORT_BINARY, as they are used with the exported policy. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608010834.9yIVzhG2-lkp@intel.com/ Fixes: 1c5f27e845e84 ("apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled") Signed-off-by: John Johansen <john.johansen@canonical.com>
11 daysRISC-V: KVM: Add the eager_page_split module parameterWang Yechao
Add an eager_page_split module parameter for RISC-V KVM, following the same approach as on x86. This parameter controls whether eager page splitting is enabled. The default value is on. When eager page splitting is enabled, KVM proactively splits large pages (huge pages) into smaller pages when needed for dirty logging or other operations. Disabling it can be beneficial for VM workloads that rarely perform writes, or that only write to a small region of memory, as it allows huge pages to remain intact for read accesses. Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731091215.1549430-6-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Split huge pages during KVM_CLEAR_DIRTY_LOGWang Yechao
Split huge pages on the range specified using KVM_CLEAR_DIRTY_LOG. And do not split when enabling dirty logging if KVM_DIRTY_LOG_INITIALLY_SET is set. Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731091215.1549430-5-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Remove redundant TLB flush operationsWang Yechao
The function kvm_arch_mmu_enable_log_dirty_pt_masked() is invoked from two distinct call paths: kvm_clear_dirty_log_protect() kvm_arch_mmu_enable_log_dirty_pt_masked() kvm_vm_ioctl_reset_dirty_pages() kvm_dirty_ring_reset() kvm_reset_dirty_gfn() kvm_arch_mmu_enable_log_dirty_pt_masked() In both scenarios, the caller already performs a remote TLB flush after dirty logging is enabled, so the TLB flush inside kvm_arch_mmu_enable_log_dirty_pt_masked() is unnecessary. Remove it. Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731091215.1549430-4-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Split huge pages when dirty logging is enabledWang Yechao
Split huge pages eagerly when enabling dirty logging. The goal is to avoid doing it while faulting on write-protected pages, which negatively impacts guest performance. The benefits of eager page splitting are the same as in x86 and arm64, added with commit a3fe5dbda0a4 ("KVM: x86/mmu: Split huge pages mapped by the TDP MMU when dirty logging is enabled") and commit e7bf7a490c68 ("KVM: arm64: Split huge pages when dirty logging is enabled") Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731091215.1549430-3-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysRISC-V: KVM: Add the split page cache for ioctl contextWang Yechao
Add the split page cache for dirty logging enablement and the KVM_CLEAR_DIRTY_LOG ioctl. Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260731091215.1549430-2-wang.yechao255@zte.com.cn Signed-off-by: Anup Patel <anup@brainfault.org>
11 daysaccel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()Lizhi Hou
In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP). When userspace subsequently accesses the memory, drm_gem_shmem_fault() handles the page fault and attempts to map the backing shmem page via vmf_insert_pfn() which calls vmf_insert_pfn_prot(). Because the backing shmem page is normal system memory (pfn_valid(pfn) is true) and the VMA now has VM_MIXEDMAP set, won't this predictably trigger the explicit assertion BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn)) Fix by removing the vm_flags_mod() call and replacing the vm_insert_pages() pre-population with the handle_mm_fault() loop that was already used for the import (dma-buf) path. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260731185955.3449311-1-lizhi.hou@amd.com
11 daysPCI: Use %pe format specifier to print error pointersKrzysztof Wilczyński
Currently, several files in the PCI tree print error pointers using the %ld format specifier together with an explicit PTR_ERR() conversion, which prints the numeric errno value. Thus, at every affected call site, use the %pe format specifier, which exists specifically to print error pointers, and pass the error pointer directly. With CONFIG_SYMBOLIC_ERRNAME enabled, this prints a symbolic error name such as -ENOMEM, falling back to the numeric errno value otherwise. As such, the explicit PTR_ERR() conversion is no longer needed. No functional changes intended. Link: https://patch.msgid.link/20260720210839.1507406-1-kwilczynski@kernel.org Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
11 daysMerge tag 'kbuild-fixes-7.2-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nathan Chancellor: - Fix regression with MO= when building out of tree kernel modules due to incorrectly overwriting build tree's Makefile - Avoid stripping .BTF sections from modules when building debug .rpm packages * tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: rpm-pkg: Preserve BTF sections in kernel modules during debuginfo stripping kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos
11 daysMerge tag 'trace-v7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Reset dropped_count in mmio_reset_data() When mmio_reset_data() is called, it does not reset the dropped_count so that subsequent runs will have incorrect reporting. - Add NULL check for mmio_trace_array in logging functions The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may have the 'tr' variable passed to it as NULL. But they both dereference it without checking if it is NULL first. - Check return value of __register_event() in trace_module_add_events() If __register_event() fails, the __add_event_to_tracers() call after it will create a file for it. If the module fails to load and its memory is freed, the file will still point to it and it will not be removed as the registering of the event did not complete. Only call __add_event_to_tracers() if the __register_event() was successful. - Fix false positive match in regex_match_full() The regex full matching uses a strncmp() to test against the match string and the value. It should not match if value is a prefix of the string to match. Check to make sure the length of the strings match before comparing. - Fix reader page read offset for remote buffers A page swapped in by __rb_get_reader_page_from_remote() retains its stale read offset, causing subsequent reads to skip events or read past valid data. - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. * tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path ring-buffer: Fix reader page read offset for remote buffers tracing/filters: Fix false positive match in regex_match_full() tracing: Check return value of __register_event() in trace_module_add_events() tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
11 daysx86/cpu/scattered: Sort it properlyBorislav Petkov (AMD)
Sort it according to the following precedence of struct cpuid_bit fields: (level) -> (sub_leaf) -> (reg) -> (bit). No functional changes. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
11 daysASoC: spear: Update the SPDIF drivers for current ASoC APIsMark Brown
bui duc phuc <phucduc.bui@gmail.com> says: While cleaning up the SPEAr SPDIF driver probe path by removing redundant error messages, build testing revealed several compilation failures caused by outdated ASoC APIs. The series first removes the redundant error messages, then updates the driver to match the current ASoC APIs by replacing the removed capture_dma_data field usage with the corresponding helper API, and moving the DAI probe callback to struct snd_soc_dai_ops. Link: https://patch.msgid.link/20260730095407.33894-1-phucduc.bui@gmail.com
11 daysASoC: spear: spdif_out: Move DAI probe callback to snd_soc_dai_opsbui duc phuc
The .probe callback is no longer part of struct snd_soc_dai_driver and is now provided through struct snd_soc_dai_ops. Move spdif_soc_dai_probe() accordingly so the driver follows the current ASoC API and builds correctly on modern kernels. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260730095407.33894-5-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: spear: spdif_in: Move DAI probe callback to snd_soc_dai_opsbui duc phuc
The .probe callback is no longer part of struct snd_soc_dai_driver and is now provided through struct snd_soc_dai_ops. Move spdif_in_dai_probe() accordingly so the driver follows the current ASoC API and builds correctly on modern kernels. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260730095407.33894-4-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: spear: spdif_in: Switch to snd_soc_dai_dma_data_set_capture()bui duc phuc
Replace the legacy direct access to dai->capture_dma_data with snd_soc_dai_dma_data_set_capture(). The capture_dma_data field no longer exists in struct snd_soc_dai, making the previous implementation incompatible with current ASoC APIs. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260730095407.33894-3-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: spear: spdif_in: Drop redundant error messagesbui duc phuc
The called functions already log failures where appropriate. Return the original error directly and avoid duplicate error messages. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260730095407.33894-2-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: use .auto_selectable_formatsMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: This is v3 of "ASoC: use .auto_selectable_formats", but separated into small blocks. It is Step1, and it will be Step4 in total. x: this patch-set [x] Step1: ASoC: a to b [ ] Step2: ASoC: codec: ... [ ] Step3: ASoC: d to r [ ] Step4: ASoC: r to x Current ASoC supports snd_soc_daifmt_parse_format() which can specify DAI format by "dai-format" property from DT. But strictly speaking, it is SW settings, so doesn't match to DT's policy. Current ASoC is supporting auto format select via snd_soc_dai_ops :: .auto_selectable_formats. But the user is very few today. DT doesn't need to specify the DAI format via "dai-format", if both CPU and Codec drivers were supporting .auto_selectable_formats. It will be automatically selected from .auto_selectable_formats. One note is that auto select might not find best format on some CPU/Codec combination. So "dai-format" is necessary anyway. Link: https://lore.kernel.org/r/8733zfj5jj.wl-kuninori.morimoto.gx@renesas.com Link: https://lore.kernel.org/r/87pl0r20qo.wl-kuninori.morimoto.gx@renesas.com Link: https://patch.msgid.link/87zezljgxy.wl-kuninori.morimoto.gx@renesas.com
11 daysASoC: cirrus: use .auto_selectable_formatsKuninori Morimoto
We can use .auto_selectable_formats. Let's adds it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87se5djgw5.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: bcm: use .auto_selectable_formatsKuninori Morimoto
We can use .auto_selectable_formats. Let's adds it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87tsptjgwa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: au1x: use .auto_selectable_formatsKuninori Morimoto
We can use .auto_selectable_formats. Let's adds it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87v7a9jgwh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: atmel: use .auto_selectable_formatsKuninori Morimoto
We can use .auto_selectable_formats. Let's adds it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87wlupjgwp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: apple: use .auto_selectable_formatsKuninori Morimoto
We can use .auto_selectable_formats. Let's adds it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87y0f5jgx2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
11 daysASoC: qcom: sc8280xp: add Monaco/Monza (MAX98090) support on QCS8275Mark Brown
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> says: This series adds sound support for the Monaco/Monza (VENTUNO-Q) platform on the QCS8275 board, which uses a MAX98091 codec on an LPI MI2S link. Patch 2 (from Neil) registers the LPASS MCLK1..MCLK5 clock IDs in q6prm-clocks.c. Without these entries the DT clock reference "clocks = <&q6prmcc LPASS_CLK_ID_MCLK_3 ...>" that the MAX98091 node uses cannot resolve at probe, and the codec silently runs without MCLK. Note: this patch has been posted to the list more than once from Oct 2025 and does not appear to be actively pursued by anyone. I am picking it up here because the rest of this series depends on it to get sound working on QCS8275, and it makes little sense to send the machine-driver changes without the clock IDs they rely on. With these patches now we have full audio working on Arduino VENTUNO-Q. Link: https://patch.msgid.link/20260731162626.1588561-1-srinivas.kandagatla@oss.qualcomm.com
11 daysnet/mlx5: fw_tracer, return NULL on create errorMichael Guralnik
Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same way. This also causes a crash in the core dump logic, which is missing the ERR_PTR check and ends up dereferencing it, as shown in the trace below. Switch tracer creation to return NULL on failure only, so callers only need a single NULL check. Internal error: Oops: 0000000096000006 [#1] SMP Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none) Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core] pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core] sp : ffff800081cf3c40 x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05 x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000 x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0 x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650 x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8 x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e Call trace: mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P) mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core] devlink_health_do_dump+0x9c/0x160 devlink_health_report+0x1c0/0x288 mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core] process_one_work+0x15c/0x3d8 worker_thread+0x18c/0x320 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Code: b9400000 5ac00800 7a401800 540003ca (3940a260) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x000000,00078031,75fce5a1,35fffe67 Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- Fixes: fd1483fe1f9f ("net/mlx5: Add support for FW reporter dump") Signed-off-by: Michael Guralnik <michaelgur@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260729080402.2427184-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet/mlx5: SF, Handle function changed eventChris Mi
When host is powered off, firmware does not send vhca_state event for every probed host SF on the DPU because it may have deployed thousands of SFs to the host. Instead it sends a function changed event. Currently, only VFs handle this event. This commit extends support to SFs. When DPU user deactivates[1] SFs, mlx5 expects vhca_state event and leaves the SF in dangling state[2]. When DPU user deletes[3] SFs, mlx5 also expects vhca_state event and destroys the SF resources[4]. Fix it by changing SF to the right state and freeing SF resources when the function changed event is received. When this event is received, driver checks all SF states. - If state is in_use, change it to active. - If state is teardown_request, change it to allocated. And SF hardware table entry is freed if it is pending for delete. [1] # devlink port function set en3f0c1pf0sf0 state inactive [2] # devlink port function set en3f0c1pf0sf0 state active Error: mlx5_core: SF is inactivated but it is still attached. kernel answers: Device or resource busy [3] # devlink port show pci/0000:03:00.0/229376: type eth netdev en3f0c1pf0sf0 \ flavour pcisf controller 1 pfnum 0 sfnum 0 splittable false function: hw_addr 00:00:00:00:00:00 state active opstate attached \ roce enable trust off max_uc_macs 4096 max_io_eqs 8 # devlink port del en3f0c1pf0sf0 [4] # devlink port add pci/0000:03:00.0 flavour pcisf pfnum 0 sfnum 0 \ controller 1 Error: mlx5_core: SF already exist. Choose different sfnum. kernel answers: File exists Fixes: 6a3273217469 ("net/mlx5: SF, Port function state change support") Signed-off-by: Chris Mi <cmi@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260729071622.2423270-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysdevlink: fix net namespace reference leak in reloadOr Har-Toov
devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference. Add the missing put_net() on this error path. Fixes: 2edd92570441 ("devlink: don't allow to change net namespace for FW_ACTIVATE reload action") Signed-off-by: Or Har-Toov <ohartoov@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Antoine Tenart <atenart@kernel.org> Link: https://patch.msgid.link/20260729080600.2427721-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysMerge branch 'add-support-for-rtl8261c-d'Jakub Kicinski
Javen Xu says: ==================== Add support for RTL8261C/D Add support for RTL8261C/D and add support for loading firmware. ==================== Link: https://patch.msgid.link/20260728073106.1515-1-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: phy: realtek: add support for RTL8261DJaven Xu
RTL8261D is also 10g phy. It's sub_phy_id is 0x81. And it does not need any firmware. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-6-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: phy: realtek: load firmware for RTL8261C_CGJaven Xu
This patch adds support for loading firmware. Download some parameters for RTL8261C_CG. Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260728073106.1515-5-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: phy: realtek: add support for RTL8261C_CGJaven Xu
This patch adds support for Realtek phy chip RTL8261C_CG. Its PHY ID is 0x001cc898. This patch introduces a distinct family of handlers (probe, get_features, config_aneg, read_status, config_intr, handle_interrupt). Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-4-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: phy: c45: add setup and read master/slave helpersJaven Xu
This patch adds two static helpers in drivers/net/phy/phy-c45.c to configure and read back master-slave roles for non BASE-T1 Clause 45 PHYs via the 10GBASE-T AN control/status registers. These helpers are wired into genphy_c45_config_aneg() and genphy_c45_read_status(). This changes the observable ethtool output for drivers using the generic c45 read path. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-3-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: phy: c45: add genphy_c45_pma_soft_reset()Javen Xu
Add a generic Clause 45 software reset helper. The helper sets the reset bit in the PMA/PMD control register and waits until the bit is cleared by hardware. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Javen Xu <javen_xu@realsil.com.cn> Link: https://patch.msgid.link/20260728073106.1515-2-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysnet: hisilicon: hix5hd2_gmac: remove redundant NAPI deleteJiawen Liu
hix5hd2_dev_remove() calls netif_napi_del() before unregister_netdev(). This is not needed because free_netdev() deletes all NAPI instances attached to the net_device. Remove the redundant call and let the networking core tear down the NAPI instance during unregister_netdev(). The probe error path still keeps its explicit netif_napi_del(), because the device has not been registered there. Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver") Signed-off-by: Jiawen Liu <1298662399@qq.com> Link: https://patch.msgid.link/tencent_5FFD37A252B4FEA6A80AD25B17C8E904F005@qq.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysocteontx2-af: add new mbox to support sync cycle on rx pathSatha Rao
sync ensures that all packets that were in flight are flushed out to memory. This can be used to assist in the tearing down of an active RQ. To complete disabling RQs or disabling SMQ and its SQs, LF software send mbox to AF to complete RX_SW_SYNC. Both VF and PF and invoke this mbox. Signed-off-by: Satha Rao <skoteshwar@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260727101608.300290-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysMerge branch 'bpf-fix-trampoline-handling-of-128-bit-values'Kumar Kartikeya Dwivedi
Yonghong Song says: ==================== bpf: Fix trampoline handling of 128-bit values The BPF trampoline preserves only 8 bytes of a target function's return value (R0), and its register save area under-allocates space for 128-bit arguments for x86_64. These two problems lead to memory corruption or incorrect values observed by BPF programs and the real caller. This series fixes both issues and adds two selftests, otherwise, each of them will fail if without the corresponding fix. Changelogs: v4 -> v5: - v4: https://lore.kernel.org/bpf/1c4223ae-a5ba-48a4-95d3-57c8ff241055@linux.dev/ - For function test_fexit_int128_ret(), guard with __x86_64__ and __aarch64__ to avoid s390x failure v3 -> v4: - v3: https://lore.kernel.org/bpf/20260710225206.4013062-1-yonghong.song@linux.dev/ - Add Ack from Leon Hwang v2 -> v3: - v2: https://lore.kernel.org/bpf/20260710182204.1085329-1-yonghong.song@linux.dev/ - Align __int128 argument at even position enforced by arm64. v1 -> v2: - v1: https://lore.kernel.org/bpf/20260710144404.2579671-1-yonghong.song@linux.dev/ - Also handle __int128 arguments for x86_64. ==================== Link: https://patch.msgid.link/20260729050154.2585468-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
11 daysselftests/bpf: Add tests for >8 byte return value and 128-bit argumentsYonghong Song
The BPF trampoline preserves only 8 bytes of the target's return value (R0), so attaching an fexit/fmod_ret/fsession program to a function that returns a >8 byte value is now rejected by the verifier. Add a bpf_testmod function returning __int128 and an fexit program that targets it. The program is expected to fail to load with the "with a >8 byte return value is not supported for this attach type" message. A 128-bit __int128 argument is passed in a register pair and occupies two trampoline context slots. Add a bpf_testmod function taking a leading __int128 argument followed by an int and a long, and an fexit program that reads those two trailing arguments and the return value, verifying that the trampoline reserves enough stack for the 128-bit argument and places the following arguments and the return value at the right context slots. __int128 is only available on 64-bit targets (where the compiler defines __SIZEOF_INT128__). The argument test additionally depends on the calling convention: x86_64 and arm64 pass an __int128 in a register pair as the trampoline expects, while other architectures pass it differently (e.g. s390x passes larger arguments by reference), so that subtest runs only on x86_64 and arm64 and is skipped elsewhere. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260729050209.2587581-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
11 daysbpf, x86: Fix trampoline stack size for 128-bit argumentsYonghong Song
btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots. Compute the register count from arg_size for all arguments to fix it. Fixes: a9c5ad31fbdc ("bpf: x86: Support in-register struct arguments in trampoline programs") Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260729050204.2586457-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
11 daysbpf: Reject >8 byte return values on return-reading trampoline pathsYonghong Song
btf_distill_func_proto() builds the function model used for the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has accepted a 16-byte __int128 return value since the trampoline was introduced: __get_type_size() returns the integer's type size, and the return-type check only rejected ret < 0. But the BPF trampoline preserves only 8 bytes of the return value (RAX on x86, i.e. R0). For an attach type that reads the target's return value the second half (RDX / R3) is neither saved nor restored, so a program attached to a function returning a 16-byte value corrupts the value seen by the real caller and itself observes only half of it. struct_ops trampolines have the same limitation. This affects the attach types that read the target's return value: fexit, fmod_ret and fsession (plus the _multi variants of fexit and fsession), and struct_ops. fentry/fentry_multi run before the target returns and are unaffected. Reject a >8 byte return value for these attach types in bpf_check_attach_target() and bpf_check_attach_btf_id_multi(), and for struct_ops in bpf_struct_ops_desc_init(). Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline") Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Reviewed-by: Eduard Zingerman <eddyz87@gmail.com> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260729050159.2585809-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
11 daysMerge tag 'ntfs-for-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Keep RECALL_ON_OPEN in inode flags when reloading them from $FILE_NAME - Check runlist reallocation sizes for negative values and overflow - Drop stale page cache after shrinking non-resident attributes to prevent writeback failures and data loss * tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: drop stale page-cache when shrinking a non-resident attr ntfs: harden runlist realloc size calculations ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
11 daysMerge tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbdLinus Torvalds
Pull smb server fixes from Steve French: - Use memcmp() when comparing fixed-size binary ClientGUIDs, so embedded NUL bytes are handled correctly - Reject repeated SMB2 NEGOTIATE requests after dialect selection This prevents preauth_info leaks, enforces the SMB2 protocol requirements, and serializes negotiation state updates. - Fix a use-after-free in __close_file_table_ids() by removing the volatile file ID from the owning IDR before dropping the IDR reference * tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use memcmp() to compare ClientGUIDs ksmbd: reject repeated SMB2 NEGOTIATE requests ksmbd: fix use-after-free in __close_file_table_ids()
11 daysnet/sched: cls_route: fix fastmap use-after-free on filterJamal Hadi Salim
The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers. Fixes: 1109c00547fc ("net: sched: RCU cls_route") Reported-by: zdi-disclosures@trendmicro.com Reported-by: Santosh Kalluri <santosh.kalluri129@gmail.com> Suggested-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Victor Nogueira <victor@mojatatu.com> Tested-by: Santosh Kalluri <santosh.kalluri129@gmail.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20260729094411.46257-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysMerge tag 'ata-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix PCI resource initialization in the sata_mv driver to keep legacy Marvell boards functional (Rosen) - Fix ahci_ceva driver initialization error path (Radhey) - Fix libata header file to remove a kernel doc compilation warning (Randy) - Increase the timeout for the STANDBY IMMEDIATE command to avoid suspend failures with drives that are slow to respond to this command (Matt) - Fixes for the handling of timed out commands in the presence of deferred non-NCQ commands, to avoid excessive delays in executing the error handler (me) - Disable link power management for a couple of WD drives that have been identified as not functioning properly when power management is used (Niklas) - Fix the device iteration loop when checking for link power management support to correctly handle port multiplier setups (Niklas) * tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-core: Disable LPM on WD Green 2.5 480GB ata: libata-core: Disable LPM on some WD drives scsi: libsas: terminate deferred commands on time out ata: libata-scsi: schedule deferred atapi command ata: libata-scsi: terminate deferred commands on time out ata: libata-eh: Increase STANDBY IMMEDIATE timeout ata: libata: avoid kernel-doc warnings ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe
11 daysinet: frags: publish queues before arming timerZhiling Zou
inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.1784948849.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-12 04:11:02 +0000