summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
13 daysdrm/ci: Update xfails for kms_cursor_legacy regressionRob Clark
These four started failing with some change not merged thru the msm tree. Update xfails to reflect reality. Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
13 daysspi: spi-qpic-snand: remove interim 'dev_data' variable from qcom_spi_probe()Gabor Juhos
The dev_data variable in the qcom_spi_probe() function is only used to temporarily store a pointer of the device specific data before that value gets assigned to 'snandc->props'. Remove the interim variable and use 'snandc->props' directly instead in order to simplify the code. No functional changes. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Link: https://patch.msgid.link/20260908-qpic-snand-drop-dev_data-var-v1-1-147d3fab6c48@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysdt-bindings: i2c: dw: Add compatible for UltraRISC DP1000 SoCJia Wang
The DP1000 integrates four DesignWare APB I2C controllers. I2C1 supports SMBus, while I2C0, I2C2, and I2C3 support standard I2C transfers. Each controller has one register range and uses separate reference and APB interface clocks. Add the DP1000-specific compatible string with the generic one as a fallback. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260907-ultrarisc-dts-v2-6-5eb4c97477c5@ultrarisc.com
13 daysMerge tag 'vfs-7.3-rc3.fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - netfs: - Fix an uninitialized return value in netfs_unbuffered_write() when preparing the first subrequest fails - For partial unbuffered/DIO writes return the amount transferred rather than an error - Update i_size with the amount actually written when a partial transfer ends in an error - Fix a subrequest reference leak when the io_iter ends up empty - Handle netfs_alloc_subrequest() failure during unbuffered writes - Load all readahead folios into the rolling buffer upfront and drop the readahead references once the first subrequest is dispatched - Mark folios for copy-to-cache while issuing subrequests - Fix read progress reporting - afs: - Add the missing kunmap in the error path of afs_dir_search_bucket() - Fix a double kunmap in afs_edit_dir_remove() - Don't free an existing server's endpoint state when cleaning up a candidate server in afs_lookup_server() - Unbind peers removed from a server's address list - ufs: - Load the cylinder group metadata before creating the root dentry - Validate the cylinder group index and rotor positions before caching them - Treat an unreadable directory block as not empty - exec: - Close the close-on-exec files before taking exec_update_lock Closing a file can block on the filesystem, so a hung filesystem blocked everything that takes exec_update_lock and a FUSE server inspecting the calling process could deadlock - Drop the bprm loader before closing bprm->file in free_bprm() - exit: Hold a reference to thread_pid across proc_flush_pid() - reboot: Fix a use-after-free on cad_pid - nsfs: Keep the namespace tree fields out of the rcu_head used by kfree_rcu() - nstree: Check listing permission before taking a namespace reference in listns() - super: Return 0 when a nested thaw drops its hold while other freezers remain - ext4: Don't set I_METADATA_WRITEBACK during fastcommit replay - adfs: Free s_fs_info in ->kill_sb() - autofs: Free the inode info allocated in autofs_fill_super() when the root inode allocation fails - ovl: Return EINVAL instead of EIO on a user namespace mismatch now that it's a plain refusal and not an internal error - cachefiles: Don't cast the variable-length coherency data to a __be64 in the coherency tracepoint * tag 'vfs-7.3-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits) nstree: check listing permission before taking a namespace reference exec: do_close_on_exec() before taking exec_update_lock exit: hold a reference to thread_pid across proc_flush_pid fs: autofs: fix memory leak in autofs_fill_super() exec: Drop bprm loader before closing bprm->file afs: Clear stale peer app data after address list changes afs: Fix incorrect free in candidate cleanup in afs_lookup_server() afs: Fix double-unmap of directory block afs: Fix missing kunmap in afs_dir_search_bucket() ovl: return EINVAL instead of EIO in case of mismatched user_ns reboot: fix cad_pid use-after-free race cachefiles: Fix potential UAF/KASAN warning netfs: Fix read progress reporting netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs netfs: Fix readahead synchronisation issues by loading all folios upfront netfs: break unbuffered write when netfs_alloc_subrequest() fails netfs: Fix subreq ref leak netfs: Fix i_size update for partial transfer netfs: Fix error vs transferred passed to ->ki_complete() netfs: Fix unbuffered/DIO write partial transfer error return ...
13 daysi2c: Change return type to bool for i2c_check_functionality()Thorsten Blum
i2c_check_functionality() returns a bool - change the return type from int to bool and update the comment accordingly. Signed-off-by: Thorsten Blum <blum@kernel.org> Acked-by: Mukesh Kumar Savaliya <mukesh.savaliya@oss.qualcomm.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260909082053.410739-5-blum@kernel.org
13 daysmedia: i2c: isl7998x: Inline i2c_check_functionality() checkThorsten Blum
Inline the i2c_check_functionality() check, since the function returns a boolean status rather than an error code. Reviewed-by: Michael Tretter <m.tretter@pengutronix.de> Signed-off-by: Thorsten Blum <blum@kernel.org> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260909082053.410739-4-blum@kernel.org
13 daysiommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET againQinyun Tan
The selftest helper reads the new dmabuf fd from the ioctl return value: *out_fd = ioctl(fd, IOMMU_TEST_CMD, &cmd); Commit dba4254e216d ("iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()") fixed the dmabuf leak on dma_buf_fd() failure, but the applied version also changed the success path to return 0, so userspace no longer receives the fd. Note the patch as posted on the list returned rc here; the change to return 0 appeared when it was applied: https://lore.kernel.org/all/20260707030635.221577-1-seven.yi.lee@gmail.com/ Every test using test_cmd_get_dmabuf() then operates on fd 0 instead of the dmabuf, and the dmabuf_simple and dmabuf_revoke selftests fail across all fixtures: # iommufd.c:1595:dmabuf_simple:Expected -1 (-1) == _test_ioctl_ioas_map_file(...) (0) Keep the dma_buf_put() on failure but return the fd on success. Fixes: dba4254e216d ("iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()") Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com> Link: https://patch.msgid.link/20260902085414.549830-1-qinyuntan@linux.alibaba.com Tested-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
13 daysACPI: utils: Adjust message printing macros for ACPI objectsRafael J. Wysocki
The majority of acpi_handle_<level>() macros use neither pr_fmt() nor dev_fmt() and acpi_handle_debug() uses pr_fmt() like dev_fmt(), but only if dynamic debug is compiled in. For more consistency, redefine all of the macros in question to use dev_fmt() because they are more similar to the analogous dev_*() family of macros than to the pr_*() ones and make all of them use it in the same way. While at it, rephrase the comment documenting those macros for more clarity. Fixes: 45fef5b88d1f ("ACPI: add dynamic_debug support") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2300525.irdbgypaU6@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: glue: Rework the success message in acpi_device_notify()Rafael J. Wysocki
Using an ACPI handle in the acpi_device_notify() success message is somewhat misleading because the "physical" device is not bound to an ACPI namespace object in that function, but to an ACPI device object attached to it. Moreover, the message is outright confusing for the "physical" devices bound to ACPI devices without ACPI namespace objects (for example, fixed event buttons). Address this by turning that message into a dev_dbg() one printed for the "physical" device and mentioning the name of the ACPI companion. Fixes: ab06eb920401 ("ACPI: scan: Register platform devices for fixed event buttons") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2448150.ElGaqSPkdT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: glue: Reduce debug noise from acpi_device_notify()Rafael J. Wysocki
When debug is enabled in the ACPI glue code that handles binding devices to ACPI companions, acpi_device_notify() produces a lot of message noise related to devices that have no ACPI companions. Reduce that noise by checking the most obvious case, ACPI device objects, directly and returning from acpi_device_notify() in that case without printing any debug messages. Also avoid printing a debug message when there is no matching ACPI bus type definition for the given device, which is the case for the vast majority of devices. Additionally, make the debug messages that get printed more informative. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/6325978.lOV4Wx5bFT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: scan: Combine two conditionals in acpi_bus_attach()Rafael J. Wysocki
There are two conditionals in acpi_bus_attach() that can be combined, which slightly reduces the overhead and makes the code a bit easier to follow, so do that. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Tested-by: Peixin Xie <peixin.xie@linux.spacemit.com> Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/8746939.T7Z3S40VBb@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: PM: Move acpi_bus_init_power() declaration to internal header fileRafael J. Wysocki
Since acpi_bus_init_power() is only used internally in the core ACPI device enumeration and power management code, it need not be visible outside, so move its declaration to an internal header file. No functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Peixin Xie <peixin.xie@linux.spacemit.com> Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/3079955.e9J7NaK4W3@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: scan: Stop calling acpi_bus_init_power() earlyRafael J. Wysocki
There is a problem, introduced by commit 9d9bcae47fd5 ("ACPI: delay enumeration of devices with a _DEP pointing to an INT3472 device") inadvertently, that devices with missing dependencies may be put into power state D0 prematurely [1]. Namely, acpi_bus_init_power() called by acpi_bus_get_power_flags() during the early initialization of ACPI device objects, may discover that all of the power resources needed by the given device to be in power state D0 are initially on, so it will reference count those power resources and transition the device into D0. Later, if acpi_bus_attach() running for that device notices that it has missing dependencies, the enumeration of it will be deferred and its power_manageable flag will be cleared, even though it is still in D0 at that point. After the dependencies in question have been met, acpi_bus_attach() runs again for the device and now it calls acpi_bus_init_power() that takes additional references to the power resources used by the device in D0. These additional references prevent the power resources from being turned off when the device goes into D3hot/D3cold. Another problem, related to the previous one, is that ACPI power state initialization may be carried out for devices whose parents are not ready for enumeration which may lead to initialization ordering issues. To address both, stop calling acpi_bus_init_power() from acpi_bus_get_power_flags(), but also take the initialization of PCI devices into account, which needs to be done because they are initialized and bound to their ACPI companions before acpi_bus_attach() is called for the latter. To that end, notice that acpi_power_up_if_adr_present() is used for powering-up PCI devices in D3cold before walking the bus in order to discover them and the initial ACPI power state of those devices needs to be known for this purpose, so add an acpi_bus_init_power() invocation to that function. [The debug statement printed by it duplicates the debug statements printed during the acpi_bus_init_power() execution, so drop it.] Moreover, since the ACPI companions of PCI devices are associated with the corresponding PCI devices found on the bus before acpi_bus_attach() is called for them, it is not necessary or even useful to skip them in acpi_bus_attach() due to an ACPI status mismatch, so avoid doing that and complain if the ACPI status does not match the observed situation. Also use the ACPI power state tracking to decide whether or not the device's power state needs to be initialized in acpi_bus_attach() instead of using the "initialized" flag of the ACPI device object for this purpose, which is fragile and inconvenient, and clear the power_manageable flag on failure in acpi_bus_init_power() (additionally, poison the device ACPI power state as "invalid" if the initialization of it fails). That allows the clearing of the power_manageable flag for devices with unmet dependencies to be dropped. While at it, add a debug message pringing statement to acpi_bus_init_power() to facilitate diagnostics. Fixes: 9d9bcae47fd5 ("ACPI: delay enumeration of devices with a _DEP pointing to an INT3472 device") Link: https://lore.kernel.org/linux-acpi/20260820-acpi-power-resource-ref-fix-v2-1-29818173ea13@linux.spacemit.com/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Peixin Xie <peixin.xie@linux.spacemit.com> Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/2295263.irdbgypaU6@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: PM: Drop parent state update from acpi_device_get_power()Rafael J. Wysocki
The parent state update in acpi_device_get_power(), that occurs when the child device turns out to be in D0 and the parent's power state is still unknown, is highly questionable because it may cause the reference counters of the power resources used by the parent in D0 (if any) to underflow when the parent goes into a low-power state later. Moreover, there is no reason to do it on reads from the real_power_state sysfs attribute of the child. That check had been added by commit 8f7412a792bc ("ACPI / PM: Infer parent power state from child if unknown, v2") before starting to handle the "missing _PSC and no power resources" case directly in acpi_bus_init_power(), as of commit b3785492268f ("ACPI / PM: Do not power manage devices in unknown initial states"). It is not necessary any more and commit b3785492268f should have removed it. Drop it now. Fixes: b3785492268f ("ACPI / PM: Do not power manage devices in unknown initial states") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Peixin Xie <peixin.xie@linux.spacemit.com> Tested-by: Sakari Ailus <sakari.ailus@linux.intel.com> Link: https://patch.msgid.link/5147279.31r3eYUQgx@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: SBS: report relative state of charge as CAPACITYItay Shem-tov
acpi_sbs reads SBS command 0x0e (AbsoluteStateOfCharge) into battery->state_of_charge, which is exported unmodified as POWER_SUPPLY_PROP_CAPACITY. Per the Smart Battery Data Specification 1.1, 0x0e is expressed as a percentage of DesignCapacity and is explicitly permitted to exceed 100%. Documentation/ABI/testing/sysfs-class-power specifies the capacity attribute as "Valid values: 0 - 100 (percent)", so any pack whose FullChargeCapacity exceeds its DesignCapacity - the normal state of a new or recently replaced battery - makes the driver report out of range. The correct source is 0x0d (RelativeStateOfCharge), a percentage of FullChargeCapacity, which the specification bounds to 0..100. This is the same defect that was fixed in the i2c SBS driver by commit b1f092f6480e ("sbs-battery.c: Capacity attr = remaining relative capacity"), whose reasoning applies verbatim here; drivers/acpi/sbs.c was not updated at the time. drivers/power/supply/sbs-battery.c has used 0x0d since, so the two SBS drivers currently disagree about what CAPACITY means. Observed on a MacBookPro11,1 with an SMP/bq20z451 pack (FullChargeCapacity 6775 mAh, DesignCapacity 6400 mAh). Both registers read back-to-back from the pack at a full charge: 0x0d RelativeStateOfCharge = 100 % 0x0e AbsoluteStateOfCharge = 106 % /sys/class/power_supply/BAT0/capacity reported 106 while upower, which computes charge_now/charge_full itself rather than trusting the driver, reported 100. battery->state_of_charge has no other consumer, so no other property changes behaviour. Signed-off-by: Itay Shem-tov <itayst@gmail.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/20260903104244.25556-1-itayst@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysio_uring/rw: keep CQE flags on iopoll requests when adding kbuf flagsCaleb Sander Mateos
io_do_iopoll() assigns the result of io_put_kbuf() to the request's CQE flags upon completion. This overwrites any CQE flags that may have been set by the opcode-specific layer. (For example, if __io_uring_cmd_done() had set IORING_CQE_F_32, it would be cleared.) Switch the = to an |= so the kbuf flags are added to the existing CQE flags rather than replacing them. io_req_rw_complete() does the same with the io_put_kbuf() result. Fixes: e26dca67fde1 ("io_uring: add support for IORING_SETUP_CQE_MIXED") Reported-by: sashiko-bot@kernel.org Link: https://sashiko.dev/#/message/20260827191705.D53C91F000E9%40smtp.kernel.org Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Link: https://patch.msgid.link/20260902210200.2336720-1-csander@purestorage.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
13 daysio_uring/net: don't overconsume buffers when using MSG_TRUNCGabriel Krisman Bertazi
When a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than the number of bytes actually copied into the buffer. As a result, io_uring advances more of the provided buffer ring than was actually filled. Use the actual filled region size to consume the buffer, but still return the full size to preserve MSG_TRUNC semantics. Take care with multishot, because that seems to already truncate the consumption based on the available payload size. This was reported in https://github.com/axboe/liburing/issues/1619. Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260728191454.1850326-1-krisman@suse.de Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de> Link: https://patch.msgid.link/20260902230041.1320658-3-krisman@suse.de [axboe: fold in size_t unsigned fix] Signed-off-by: Jens Axboe <axboe@kernel.dk>
13 daysDocumentation: ACPI: EINJ: Update stale driver source referencePrabhakar Pujeri
The EINJ implementation was split when CXL protocol error injection support landed: einj-core.c holds the core logic, einj-cxl.c the CXL-specific part, and apei-internal.h the shared plumbing. The old drivers/acpi/apei/einj.c does not exist anymore, so the documentation points readers at a nonexistent file. Point them at the actual files instead. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com> Link: https://patch.msgid.link/20260902114912.6690-1-prabhakar.pujeri@dell.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: scan: Drop useless and noisy debug statementRafael J. Wysocki
The debug message printing statement in handle_to_device() is super-noisy because it triggers whenever the presence of an attached struct acpi_device is checked for the given object in the ACPI namespace and it turns out that there is none. That is a perfectly valid situation and the lack of an attached struct acpi_device is not particularly interesting, so drop that message. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2861358.mvXUDI8C0e@rafael.j.wysocki
13 daysMerge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhostLinus Torvalds
Pull virtio fixes from Michael Tsirkin: "Just a ton of small fixes all over the place. Also includes virtio and virtio-rng MAINTAINERS updates" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (27 commits) vduse: return compat ioctl results directly virtio_input: stop callbacks before unregistering input device virtio_input: reset device if input_register_device() fails vhost: invalidate vring access on IOTLB transitions vduse: validate virtqueue alignment vduse: do not take dev->rwsem in the virtqueue kick path vhost-scsi: clamp max_io_vqs module parameter vhost-scsi: use kvzalloc for vq array allocation virtio-pci: return IRQ_HANDLED after non-zero ISR virtio: add Eugenio Pérez as Maintainer vhost: limit outstanding IOTLB misses per virtqueue MAINTAINERS: Add a section for virtio-rng vdpa_sim_net: check TX pull result before RX copy vdpa_sim_blk: reject out-of-range sector starts virtio-vdpa: Use queue id when setting vq affinity vdpa: octeon_ep: Check dev_set_name() in dev add vdpa: ifcvf: Put device on unsupported feature error vdpa: solidrun: Free IRQs after request failure vdpa: alibaba: Keep DRIVER_OK clear if IRQ setup fails vdpa/pds: check virtqueue notify mapping ...
13 daysASoC: soc-dai: move snd_soc_xx() to soc-dai.cMark Brown
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: This patch-set moves soc-dai related functions from soc-core.c to soc-dai.c. We should have snd_soc_dai_xxx() functions on soc-dai.c. No functional changes. We have 2 type of function defines in include/sound/xx.h A is for ASoC drivers B is for ASoC framwork I think include/sound/xx.h is only for drivers (A). In other words, ASoC framework function (B) is not needed for drivers, or *shouldn't* indicate to drivers. This patch adds new sound/soc/soc-internal.h, and the functions for ASoC framework will be moved to here. Link: https://patch.msgid.link/8733vuu75t.wl-kuninori.morimoto.gx@renesas.com
13 daysASoC: soc-dai: move snd_soc_dai_{set/get}_stream() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ik4qssjl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_stream_active() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87jyp6ssjo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_tdm_mask_{get/set}() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_tdm_mask_get() -> snd_soc_dai_stream_tdm_mask_get() snd_soc_dai_tdm_mask_set() -> snd_soc_dai_stream_tdm_mask_set() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ld9mssjt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_dma_data_{get/set}() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c These macros are very similar. Will be handled by same macro snd_soc_dai_dma_data_get() -> snd_soc_dai_stream_dma_data_get() snd_soc_dai_dma_data_set() -> snd_soc_dai_stream_dma_data_set() snd_soc_dai_get_dma_data() -> snd_soc_dai_stream_dma_data_get() snd_soc_dai_set_dma_data() -> snd_soc_dai_stream_dma_data_set() This macro is not much helps code, will be removed snd_soc_dai_init_dma_data() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87mru2ssjx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_{get/set}_widget() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_get_widget() -> snd_soc_dai_stream_widget_get() snd_soc_dai_set_widget() -> snd_soc_dai_stream_widget_set() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87o6eissk1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_get_pcm_stream() to soc-dai.cKuninori Morimoto
DAI parameter will be capsuled soon, will be not enable to access from soc-dai.h. Move it to soc-dai.c It renames function name snd_soc_dai_get_pcm_stream() snd_soc_dai_pcm_stream_get() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87pkyyssk4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move soc_pcm_{apply/params/update}_symmetry()Kuninori Morimoto
soc_pcm_{apply/params/update}_symmetry() are DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-pcm.c. Move it to soc-dai.c It renames function name - soc_pcm_xxx_symmetry() + snd_soc_dai_symmetric_xxx() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87qzjessk7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move soc_pcm_set_dai_params()Kuninori Morimoto
soc_pcm_set_dai_params() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-pcm.c. Move it to soc-dai.c It renames function name - soc_pcm_set_dai_params() + snd_soc_dai_symmetric_set_params() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87se3usska.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_{un}register_dai()Kuninori Morimoto
snd_soc_{un}register_dai() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c Note1 snd_soc_{un}register_dai() needs to use client_mutex which is soc-core.c local. This patch removes static from it, and allow to use it from ASoC internal. It renames function name - snd_soc_register_dai() + snd_soc_dai_register() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87tsoasske.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_is_matching_dai()Kuninori Morimoto
snd_soc_is_matching_dai() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_is_matching_dai() + snd_soc_dai_matches_dlc() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87v78qsskh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_is_match_dai_args()Kuninori Morimoto
snd_soc_is_match_dai_args() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_is_match_dai_args() + snd_soc_dai_matches_args() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87wlt6sskk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_dai_name_get()Kuninori Morimoto
snd_soc_dai_name_get() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_dai_name_get() + snd_soc_dai_name() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87y0dmssko.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-dai: move snd_soc_add_dai_controls()Kuninori Morimoto
snd_soc_add_dai_controls() is DAI related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-dai.c It renames function name - snd_soc_add_dai_controls() + snd_soc_dai_add_controls() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87zey2ssku.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysASoC: soc-core: make fmt_{single/multiple}_name() non staticKuninori Morimoto
DAI/Component will be capsuled soon, but fmt_{single/multiple}_name() will be used form soc-dai.c / soc-component.c. Let's makes them to non static function. ASoC functions / macros are defined at linux/include/sound/xxx.h (A). ASoC framework and each vender drivers are including it. Some functions / macros which are only for ASoC framework. It shouldn't be used from vender drivers. But we can't foce it because sharing same headers (A). This patch adds new soc-internal.h (B) which is for ASoC framework internal use. Since this patch, we can separate global functions (for vender drivers) and local function (for ASoC framework internal use). Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/871pbeu75e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysACPI: OSL: Use vsnprintf() in acpi_os_vprintf()Vlatko Kosturjak
acpi_os_vprintf() formats every ACPICA diagnostic into a 512-byte static buffer with an unbounded vsprintf(): static char buffer[512]; vsprintf(buffer, fmt, args); ACPICA interpolates table-derived namespace paths into its messages, so the length is driven by table content. A malformed ACPI table can therefore produce a diagnostic longer than the buffer and overwrite whatever follows it. From the System.map of an x86_64_defconfig build, acpi_ioremap_lock sits 624 bytes into that buffer - 112 bytes past its end - so bytes 624..631 of an over-long message land on the mutex's owner field, which __mutex_lock() then dereferences. The overwritten bytes are attacker-influenced but not attacker-controlled: they are printable ASCII from a NUL-terminated string, so the resulting pointer is always non-canonical and always faults. This is a reliable denial of service, not a demonstrated pointer-control primitive. Because acpi_tb_load_namespace() parses the DSDT and every SSDT during acpi_init(), a table supplied by firmware triggers this in PID 1 inside do_one_initcall(), panicking the kernel before userspace exists. Bound the write with vsnprintf(). Truncating a diagnostic is strictly better than corrupting adjacent kernel objects. Tested on pristine Linux 7.2.2 - tag: v7.2.2., Stock x86_64_defconfig (no KASAN, no debug options), table supplied by firmware via "qemu -acpitable": [ 0.022259] ACPI: SSDT 0x000000003FFE1C52 000640 (v01 _ASUS_ Notebook 00000005 MSFT 0100000D) [ 0.353684] Oops: general protection fault, probably for non-canonical address 0x41435f2e345f2e64: 0000 [#1] SMP NOPTI [ 0.353727] RIP: 0010:__mutex_lock.constprop.0+0xbd/0xa40 [ 0.353727] RAX: 41435f2e345f2e30 RBX: 00000000fed00000 [ 0.353727] R15: ffffffff8c248530 [ 0.353727] Call Trace: [ 0.353727] acpi_os_map_iomem [ 0.353727] acpi_ex_system_memory_space_handler [ 0.353727] acpi_ev_address_space_dispatch [ 0.353727] acpi_ex_access_region [ 0.353727] acpi_ex_read_data_from_field [ 0.353727] acpi_ex_resolve_node_to_value [ 0.353727] acpi_ds_evaluate_name_path [ 0.353727] acpi_ps_parse_loop [ 0.353727] acpi_ps_execute_method [ 0.354729] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 RAX is the corrupted owner; the faulting address is RAX + 0x34. R15 matches acpi_ioremap_lock. On a KASAN build the overflow is reported directly as: BUG: KASAN: global-out-of-bounds in string. Signed-off-by: Vlatko Kosturjak <vlatko.kosturjak@gmail.com> [ rjw: Subject tweak ] Link: https://patch.msgid.link/CAPAw8HEMdsNN6WhizHkv2Orp2pkQ2-g009XCGFnKnhXoRhcKZQ@mail.gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: button: Add lid_init_state quirk for Razer Blade Stealth 13 (Early ↵Ian Gallagher
2020) RZ09-0310 This patch adds a quirk mapping for the "Blade Stealth 13 (Early 2020) - RZ09-0310" laptop, which exhibits the same issue as the following two related products already accounted for in this file. - Razer Blade Stealth 13 Late 2019 - Blade Pro 17 (Early 2020) - RZ09-0329 Summary of the issue this fixes: The firmware's _LID method still returns "closed" after resume when the lid was opened during S3, causing systemd-logind to suspend the system again within several seconds (15-40) after waking. Signed-off-by: Ian Gallagher <cdine@cdine.org> Link: https://patch.msgid.link/90ab9b58-da8b-4ffc-bd4b-adf7590545a9@app.fastmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysspi: rockchip-sfc: disable runtime PM in removeJiawen Liu
rockchip_sfc_probe enables runtime PM and leaves the device active with a usage count held by pm_runtime_get_noresume(). The remove callback only disables the clocks and does not disable runtime PM, leaving the device in an inconsistent state and leaking the runtime PM reference. Add the missing runtime PM teardown in rockchip_sfc_remove to balance the probe's enable and get_noresume calls. Signed-off-by: jiawen <1298662399@qq.com> Link: https://patch.msgid.link/tencent_DD16C0EEDFEF4ACAFAB5A23EC8235D462707@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
13 dayssamples: rpmsg: Fix mtu printk specifiersNathan Chancellor
When building rpmsg_client_sample.c for a 32-bit platform, such as during arm allmodconfig, there are a few warnings due to using an incorrect specifier for mtu: samples/rpmsg/rpmsg_client_sample.c:68:59: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 68 | dev_warn(&rpdev->dev, "invalid rpmsg MTU size = %ld\n", mtu); | ~~~ ^~~ | %zd ... samples/rpmsg/rpmsg_client_sample.c:72:50: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 72 | dev_info(&rpdev->dev, "rpmsg MTU size = %ld\n", mtu); | ~~~ ^~~ | %zd ... samples/rpmsg/rpmsg_client_sample.c:79:17: error: format specifies type 'long' but the argument has type 'ssize_t' (aka 'int') [-Werror,-Wformat] 78 | "message size %zu exceeds rpmsg MTU size %ld\n", | ~~~ | %zd 79 | strlen(MSG), mtu); | ^~~ Use '%zd', the proper specifier for a 'ssize_t' variable, to clear up the warning. Additionally, modify the last dev_err() call in rpmsg_sample_probe() to reuse msg_len instead of calling strlen(MSG) again and use '%zd' throughout the string consistently. Fixes: 1029c89bafc7 ("samples: rpmsg: Add MTU size info") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20260908-samples-rpmsg-fix-mtu-print-v1-1-f995518f0a46@kernel.org Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
13 daysACPI: pfr_update: zero-initialize capability query resultKarl Mehltretter
query_capability() copies four ACPI buffers into fixed-size fields using the firmware-supplied lengths. The existing overflow guard rejects oversized buffers, but shorter buffers are accepted and leave trailing bytes of the stack-allocated cap_hdr uninitialized. PFRU_IOC_QUERY_CAP then copies the entire structure to userspace. Zero-initialize cap_hdr before querying the firmware. This preserves the existing handling of short firmware responses while preventing disclosure of kernel stack data. Oversized buffers remain rejected. A QEMU _DSM returning one-byte buffers reproduced nonzero stack suffix bytes in all four fields. With this change, the ioctl still succeeds and each unwritten suffix is zero-filled, while 64-byte buffers continue to return -EINVAL. Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/1a001e1fee9.637da6dc3533246.238498880682901704%40a0rg.com Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260827053741.79425-1-kmehltretter@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysACPI: MRRM: Use for_each_populated_zone() in get_node_num()Sang-Heon Jeon
get_node_num() iterates over the populated zones of every online node with a nested loop. for_each_populated_zone() iterates over the same zones in the same order. So use for_each_populated_zone() instead and remove the unused variable. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Link: https://patch.msgid.link/20260821131530.3375820-1-ekffu200098@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysdrm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batchesThomas Hellström
emit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to flush the L2/HDC data cache before fence signalling, but it never requests a flush of the LSC untyped L1 data cache via the 'Untyped Data-Port Cache Flush Enable' bit in PIPE_CONTROL DWord0[11]. Per the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to also flush/invalidate the untyped L1 cache, but only depending on how HDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling between HDC Pipeline Flush and the untyped L1 cache flush no longer holds in practice, regardless of how HDC_CHICKEN0 is programmed, so relying on it is not safe on newer platforms such as BMG. Mesa's Vulkan driver (anv) has been assuming the kernel flushes both caches between submissions, and hit user-visible corruption in apps such as Llama.cpp because of this gap; it now works around it by flushing both caches again from userspace at the end of every command buffer. Correctness between submissions on the same queue is userspace's responsibility and belongs in Mesa, not the kernel. However, for security we must ensure stale data can't leak through the untyped L1 dataport cache once memory is reclaimed or evicted, which requires the KMD to flush it before releasing memory for reuse. Prior to MTL, HDC_CHICKEN0 could be programmed (as already done for DG2 via Wa_22010960976/Wa_14013347512) to reliably keep HDC Pipeline Flush coupled to the untyped L1 cache flush, so those platforms are unaffected. Mesa's own anv driver found that on MTL the HW disconnected the two independently of how HDC_CHICKEN0 is programmed, and could not bring the old behavior back even by writing the register by hand; see Mesa commit 7c2ff46a4fc3 ("anv: don't prevent L1 untyped cache flush in 3D mode"). The kernel can't reliably request the flush from the CS on MTL either, so restrict the new PIPE_CONTROL bit to GRAPHICS_VERx100 >= 2000 (Xe2 and later), where it can be relied on. Explicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together with PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on Xe2 and later, so the L1 data cache is known clean before memory is released for reuse, without depending on undocumented platform-specific HDC_CHICKEN0 behavior. Bspec: 56551 Link: https://gitlab.freedesktop.org/mesa/mesa/-/commit/7c2ff46a4fc3e537573ac9503057e0cd29b6fff3 Fixes: 9f8f93bee3ef ("drm/xe: Emit a render cache flush after each rcs/ccs batch") Reported-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/8909 Cc: José Roberto de Souza <jose.souza@intel.com> Cc: intel-xe@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v6.8+ Assisted-by: GitHub_Copilot:claude-sonnet-5 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260903114552.48634-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
13 daysdrm/xe: Guard page-fault worker with runtime PM checkVarun Gupta
During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked() on an already-suspended device, tripping:   Assertion `!xe_pm_runtime_suspended(xe)` failed!   WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe] A live VM/exec queue always holds a PM reference while it has outstanding work, so if the device is suspended at ack time, the owning context is already gone and the fault is stale. Take a runtime PM reference across the entire pagefault queue worker to safely deliver acks for torn-down VMs. v3: - Move PM ref to the generic xe_pagefault_queue_work using guard(xe_pm_runtime)(xe) instead of tracking it in the GuC backend(Matt Brost). v2: - Hold PM ref across the entire batch (begin/end) instead of per-ack. This prevents the device from autosuspending mid-batch, which would leave write_only acks written but the end flush skipped, and skip counter++, desyncing the cadence check.(Himal) - Add a comment explaining stale faults.(Himal) Fixes: f289f7807119 ("drm/xe: Add xe_guc_pagefault layer") Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Link: https://patch.msgid.link/20260907050011.497181-2-varun.gupta@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com> (cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> [Rodrigo: Added xe_device struct for compatibility while cherry-picking]
13 daysdrm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()Esben Haabendal
The error handling of sn65dsi83_reset_pipe() in sn65dsi83_reset_work() has seen a couple of changes that seems to cause a bit of confusion. While sn65dsi83_reset_work() has implemented an early exit if sn65dsi83_reset_pipe() fails since it was added, when a commit from Maxime Ripard switched to use drm_bridge_helper_reset_crtc() [1] the sn65dsi83_reset_pipe() function would no longer return an error code, so the early exit was then a no-op, and even on sn65dsi83_reset_pipe() failure, enable_irq() has been called. When drm_bridge_enter()/drm_bridge_exit() resource protection was added, the drm_bridge_exit() incidentally was always called, which is the correct approach. But only because the early exit in sn65dsi83_reset_pipe() was never hit because sn65dsi83_reset_pipe() always returns 0. In order get back to a situation where enable_irq() is not called on sn65dsi83_reset_pipe() failure, which should help protect against irq storms, we need to reintroduce a non-zero return value from sn65dsi83_reset_pipe() on error, and fix sn65dsi83_reset_work() so that we always exit the DRM bridge critical section with drm_bridge_exit(). [1] commit e17fadff7ab9 ("drm/bridge: ti-sn65dsi83: Switch to drm_bridge_helper_reset_crtc") [2] commit d2e8d1bc840b ("drm/bridge: ti-sn65dsi83: protect device resources on unplug") Fixes: e17fadff7ab9 ("drm/bridge: ti-sn65dsi83: Switch to drm_bridge_helper_reset_crtc") Cc: stable@vger.kernel.org Signed-off-by: Esben Haabendal <esben@geanix.com> Reviewed-by: Herve Codina <herve.codina@bootlin.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260831-ti-sn65dsi83-fixes-v5-1-e712765d6c4f@geanix.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
13 dayssmb: client: fail DACL rewrite when the new DACL exceeds 64KBjoern Doebel
replace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of the DACL they build in a u16. That accumulator can wrap. validate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) / 20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can grow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with one carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is therefore sizeof(struct smb_acl) + 3276 * 76 = 248984 bytes, far beyond what a u16 can hold. A wraparound is reached with 863 ACEs. After the wraparound, ndacl_ptr->size becomes meaningless and the offset will point anywhere in the ACE array. As a result, we will see corruption of the DACL, which then gets sent to the server. This is not an out-of-bounds write as the allocation now covers the worst-case expansion, so writes will always go into the buffer. Adjust the code to use a u32 internally and return -EOVERFLOW in the overflow case. The operation must be refused, because a DACL can only hold 2^16-1 bytes on the wire and larger DACLs cannot be represented. set_chmod_dacl() carries the same pattern and is fixed the same way. It only wraps once the source DACL comes within roughly 380 bytes of the 64K ceiling, but the failure mode is identical. Suggested-by: Namjae Jeon <linkinjeon@kernel.org> Cc: stable@vger.kernel.org Fixes: f5065508897a ("cifs: Retain old ACEs when converting between mode bits and ACL.") Assisted-by: Kiro:claude-opus-5 Signed-off-by: Bjoern Doebel <doebel@amazon.de> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
13 dayssmb: client: fix heap overflow in DACL owner/group rewriteBjoern Doebel
When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion: allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header and room for every ACE at maximum SID size. This replaces the previous split logic that used dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374) Cc: stable@vger.kernel.org Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") Assisted-by: Kiro:claude-opus-4.6 Signed-off-by: Bjoern Doebel <doebel@amazon.de> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Fixes: 5c3564852c58 ("cifs: Minimize the number of cifs_acl memory allocations") Signed-off-by: Paulo Alcantara <pc@manguebit.org>
13 daysASoC: nau8822: keep regcache offline while supplies are offPengpeng Hou
nau8822_suspend() disables all codec supplies and marks the register cache dirty, but leaves regmap in live I/O mode. Resume then attempts the cache replay without first leaving a corresponding cache-only state. Enter cache-only mode after the regulators have been disabled successfully, leave it after the supplies are restored, and stop the local resume sequence if cache replay fails. Do not power the codec back down on a resume error, because deferred component resume remains best effort and continues after the callback. regulator_bulk_disable() restores regulators already disabled by the same bulk operation if a later disable fails. Only publish cache-only state after the whole power-off operation succeeds, so the regmap state continues to match the hardware state on either outcome. Fixes: 1e3cb6c321be ("ASoC: nau8822: new codec driver") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260830141828.34419-1-pengpeng@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
13 daysACPI: battery: Fix bogus cycle count values on systems without _BIXArmin Wolf
Devices supporting only the legacy _BIF ACPI control method cannot know the cycle count of the associated battery, so cycle_count always remains 0. Claiming support for POWER_SUPPLY_PROP_CYCLE_COUNT on such devices can thus mislead userspace applications and prevents power supply extensions from supplying correct cycle count values. Fix this by not claiming support for POWER_SUPPLY_PROP_CYCLE_COUNT on devices without _BIX. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260806233817.622975-1-W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
13 daysMerge tag 'printk-for-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixes from Petr Mladek: - Use lazy irq_work for waking printk kthreads - Flush pending irq_work before destroying printk kthreads - Remove redundant WARN() when a printk kthread can't be created - Typo fix * tag 'printk-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY printk/nbcon: Flush nbcon_irq_work in nbcon_free() console: fix /dev/kmsg reference in flags kernel doc printk: Don't WARN on kthread_run failure.
13 daysMAINTAINERS: fix sysfs-platform-ayaneo-ec documentation pathGabriel Windlin
The documentation file for the AYANEO platform EC driver was added as Documentation/ABI/testing/sysfs-platform-ayaneo-ec, but MAINTAINERS references it without the '-ec' suffix, causing 'make refcheckdocs' to report a broken reference. Update the file entry to point to the correct file name. Signed-off-by: Gabriel Windlin <gawindlin@gmail.com> Link: https://patch.msgid.link/20260908203412.608606-1-gawindlin@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>