summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-24staging: iio: adt7316: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24iio: inv_sensors: improve period measurement by using a longer delayJean-Baptiste Maneyrol
Period measurement can be difficult when using high sampling frequency where the jitter criteria is hard to meet because of the system jitter. This new version is using the delta time between 2 distant interrupts to measure an interval of at least 20ms. 20ms is a good compromise between the mitigation of system jitter and the delay to update period. This way we decorrelate the period measurement from the interrupt timestamps syncing using only the 2 last interrupts. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24iio: inv_sensors: better timestamp alignment when using watermarkJean-Baptiste Maneyrol
Current interrupt timestamp alignment only changes the final timestamp. When the watermark is in use, we have a batch of samples for each interrupt. The current code doesn't manage to align the timestamp because the jitter is too high. Instead modify the estimated inter interrupt period and use that to adjust the timestamp alignment over the batch in a linear fashion. Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24iio: inv_sensors: convert to kernel typesJean-Baptiste Maneyrol
Convert standard types (u)intXX_t to kernel type u/sXX. Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24iio: pressure: mpl115: Fix runtime PM cleanupCan Peng
mpl115_probe() enables runtime PM when a shutdown GPIO is present and then returns the result of devm_iio_device_register(). If registration fails, runtime PM remains enabled and autosuspend remains selected. The same unmanaged runtime PM state is also left behind on driver unbind, as the IIO device registration is managed but the runtime PM setup is not. Use devm_pm_runtime_enable() so runtime PM is disabled automatically on probe failure and driver unbind, and check pm_runtime_set_active() so setup errors are reported. Set the autosuspend parameters before enabling runtime PM. Once probe has completed, the driver core queues an idle request for the device, so an explicit pm_runtime_get_noresume()/pm_runtime_put() pair is not needed to start autosuspend. Fixes: 0c3a333524a3 ("iio: pressure: mpl115: Implementing low power mode by shutdown gpio") Cc: stable@vger.kernel.org Suggested-by: jonathan.cameron@oss.qualcomm.com Signed-off-by: Can Peng <pengcan@kylinos.cn> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24gpu: nova-core: reserve vGPU WPR2 heapZhi Wang
GSP-RM needs a larger WPR2 heap when booting in vGPU mode. The heap size is firmware-dependent, so it should come from the generated firmware bindings instead of being open-coded in nova-core. Pass the detected vGPU state into the framebuffer layout calculation. Keep baremetal boots on the existing heap sizing path, and use the 570.144 vGPU default heap binding only when vGPU is enabled. The same state match also sets the VF partition count, so disabled and invalid 0/1-VF states do not enter the vGPU heap path. Cc: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260722073913.1807677-7-zhiw@nvidia.com [ Use checked arithmetic to calculate wpr2_heap_addr. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-24gpu: nova-core: set RMSetSriovMode for vGPUZhi Wang
The GSP registry setup needs to advertise SR-IOV mode when nova-core boots GSP for an enabled vGPU configuration. Without the registry entry, GSP-RM is not told to initialize in the mode required by NVIDIA vGPU. Append RMSetSriovMode to the SetRegistry command when the vGPU state detected before GSP boot is enabled. Keep the existing registry entries unchanged for non-vGPU boots. Cc: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260722073913.1807677-6-zhiw@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-24gpu: nova-core: detect and store vGPU stateZhi Wang
GSP boot needs a stable view of vGPU state before it starts building the boot-time data structures that depend on SR-IOV and firmware policy. That state must be derived once from the PCI VF count and the FSP PRC vGPU mode knob before booting GSP. Add VgpuManager to detect and retain the vGPU state during GPU construction. Keep the manager separate from the detected state because later vGPU milestones will add vGPU resources and lifecycle state to it. Keep the vGPU capability gate local to the vGPU module with per-chip HAL modules. Treat failures to detect the optional vGPU state as disabled so they do not prevent a bare-metal probe, and log both the failure and the detected state where the manager is constructed. Cc: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260722073913.1807677-5-zhiw@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-24gpu: nova-core: read vGPU mode from FSP via PRC protocolZhi Wang
vGPU boot needs to know whether firmware reports vGPU mode as active. FSP's Management Partition exposes PRC (Product Reconfiguration Control) as an API for reading device configuration knobs without firmware updates. The vGPU mode knob is one such configuration value. Add typed PRC request and response payloads for the vGPU mode object, add the PRC NVDM type, and parse the returned knob value into VgpuMode. Signed-off-by: Zhi Wang <zhiw@nvidia.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260722073913.1807677-4-zhiw@nvidia.com [ FspPrcMessage is small and short-lived; stack-allocate it instead of using KBox. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23selftests/bpf: Test passing scalar NULL to nonnull global subprogAmery Hung
Make sure the verifier reject passing a hardcoded NULL to an __arg_nonnull argument. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://patch.msgid.link/20260723221815.367797-2-ameryhung@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-23bpf: Reject passing scalar NULL to nonnull arg of a global subprogAmery Hung
A global subprogram argument tagged __arg_nonnull is set up as a non-nullable PTR_TO_MEM. However the verifier does not check against a scalar NULL, leading to real NULL pointer dereference. Reject it as well. Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args") Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260723221815.367797-1-ameryhung@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-23drm/vc4: Shut down BO cache timer before teardownLinmao Li
The BO cache timer callback schedules time_work, and time_work can rearm the timer through vc4_bo_cache_free_old(). vc4_bo_cache_destroy() deletes the timer and then cancels the work, which does not break that cycle: the work being cancelled can rearm the timer, and the timer then queues work again after teardown. Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the cycle ends with cancel_work_sync(). Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.") Cc: stable@vger.kernel.org Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260720084426.1632508-1-lilinmao@kylinos.cn Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-23drm/mediatek: mtk_hdmi_common: take i2c adapter module referenceJohan Hovold
The i2c subsystem currently blocks during adapter deregistration whenever there are consumers holding a reference. Switch to using of_get_i2c_adapter_by_node() which also takes a reference to the adapter module so that an attempt to unload the module while in use fails gracefully instead of blocking uninterruptibly. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: CK Hu <ck.hu@mediatek.com> Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260716132103.1564995-1-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2026-07-24Merge tag 'drm-xe-fixes-2026-07-23' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Skip invalidation for purgeable state updates (Arvind) - Add drm_dev guards when detaching CCS read / write buffers (Satyanarayana) - Alloc per domain unique i2c id (Raag) - Fix SVM leak on resv obj alloc failure in xe_vm_create (Shuicheng) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/amJ5-WUA_OS_RBAp@fedora
2026-07-23iio: adc: ad4080: add support for AD4883Antoniu Miclaus
Add support for the AD4883, a dual-channel, 16-bit, 40 MSPS SAR ADC. The AD4883 is the dual-channel variant of the AD4083, sharing the same register map and SPI interface as the rest of the AD4080 family. Like the AD4880, it uses two independent ADC channels, each with its own SPI configuration interface. Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-23dt-bindings: iio: adc: ad4080: add AD4883 supportAntoniu Miclaus
Add AD4883 compatible string to the AD4080 devicetree binding. The AD4883 is a dual-channel, 16-bit, 40 MSPS SAR ADC, sharing the same register map and interface as the AD4080 family. Like the AD4880, it requires two SPI chip selects and two io-backends for its independent ADC channels. The AD4883 differs from the AD4880 in resolution (16-bit vs 20-bit), which requires distinct channel configuration in the driver, precluding a fallback compatible. Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
2026-07-24Merge tag 'drm-intel-fixes-2026-07-23' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight (Suraj) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/amJDXaBKC9uUgRFt@intel.com
2026-07-23ASoC: Intel: soc-acpi: Add entry for sof_rt5682 in NVL match table.Balamurugan C
Adding rt5682 I2S codec support for NVL platforms and entry in match table. Signed-off-by: Balamurugan C <balamurugan.c@intel.com> Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20260723062121.869857-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-23PCI/portdrv: Allow probing even without child servicesBrian Norris
The PCIe port driver fails to probe if it finds no child services, presumably under the assumption that the driver is not useful in that case. However, the driver *can* still be useful for power management support -- namely, it still configures the port for runtime PM / D3, which may be important for allowing a bridge to enter low power modes. Thus, allow probe to succeed even if no IRQs and no child services are available. This also mirrors existing behavior for ports that don't support any portdrv services (PCIe hotplug, AER, DPC, PME, bwctrl), where we'd also probe successfully. This change is a bit more important after commit f5cd8a929c82 ("PCI: dwc: Remove MSI/MSIX capability for Root Port if iMSI-RX is used as MSI controller"), because it's common for some DWC-based systems to: 1. have only the "aer" and "pcie_pme" port services available and 2. not define legacy INTx interrupts properly in their device tree. After commit f5cd8a929c82, such systems may fail pcie_init_service_irqs() and so exit with -ENODEV. Link: https://lore.kernel.org/all/nyada24tqwlkzdceyoxbzitzygvp4elvj5oajnqdwb33xkcdwk@76vnrx45fsfd/ Signed-off-by: Brian Norris <briannorris@chromium.org> [bhelgaas: reorder pcie_port_device_register() decls per Lukas] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Lukas Wunner <lukas@wunner.de> Link: https://patch.msgid.link/20260722160942.v4.1.I5fd5d83f518681b3949d8ab2f16ba8244fd3e774@changeid
2026-07-23x86/topology: Add TOPO_CPU_TYPE_LOW_POWERVishal Badole
AMD heterogeneous parts report a third core type via CPUID Fn0x80000026 EBX[31:28] (Extended CPU Topology, Core Type): 0 - Performance 1 - Efficiency 2 - Low Power get_topology_cpu_type() only translates the first two, so on parts that ship low-power cores the third type falls through to TOPO_CPU_TYPE_UNKNOWN. Add TOPO_CPU_TYPE_LOW_POWER which takes care of this new type. [ bp: Massage commit message, zap the "what" explanation. ] Signed-off-by: Vishal Badole <Vishal.Badole@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260721154514.2506972-4-Vishal.Badole@amd.com
2026-07-23x86/topology: Name the AMD core-type valuesVishal Badole
Replace the bare 0/1 in get_topology_cpu_type() with named constants that mirror what the AMD APM publishes for CPUID Fn0x80000026 EBX[31:28] (Extended CPU Topology, Core Type): 0 - Performance core 1 - Efficient core 2 - Low-power core (used by a follow-up) No functional change. Suggested-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Vishal Badole <Vishal.Badole@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260721154514.2506972-3-Vishal.Badole@amd.com
2026-07-23x86/topo: Map vendor CPU types to generic Linux such typesBorislav Petkov (AMD)
Sashiko reported¹ that a confusion could ensue if a vendor-specific CPU type 0 (performance) gets attempted to be used in a x86_cpu_id match table. The current logic treats 0 as the wildcard X86_CPU_TYPE_ANY and such a thing would end up matching the wrong CPUs. This is all backwards because we started using the vendor-specific CPU type number instead of using a Linux-defined, generic CPU type which is agnostic. Convert the current logic to it before users start appearing. ¹https://sashiko.dev/#/patchset/20260629094349.533301-1-Vishal.Badole%40amd.com Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Signed-off-by: Vishal Badole <Vishal.Badole@amd.com> Link: https://patch.msgid.link/20260721154514.2506972-2-Vishal.Badole@amd.com
2026-07-23arm64: dts: mediatek: mt6858: Add pinmux macro header fileNikolai Burov
Add a header file providing macros needed for specifying MT6858 pin functions in device tree files. Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Nikolai Burov <nikolai.burov@jolla.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-23pinctrl: mediatek: Add driver for MT6858Nikolai Burov
Add a pinctrl driver for the MT6858 (MediaTek Dimensity 7100) SoC. Signed-off-by: Nikolai Burov <nikolai.burov@jolla.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-23dt-bindings: pinctrl: mediatek: Add MT6858Nikolai Burov
Add new DT bindings for the pin controller found in the MT6858 (MediaTek Dimensity 7100) SoC. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Nikolai Burov <nikolai.burov@jolla.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-07-23samples: rust_dma: use vertical import styleGuru Das Srinagesh
Convert `use` imports to vertical layout for better readability and maintainability. Signed-off-by: Guru Das Srinagesh <linux@gurudas.dev> Link: https://patch.msgid.link/20260721-rfl-vert-imp-v2-1-71ce0df519f2@gurudas.dev Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()Xiang Mei
rds_tcp_laddr_check() looks up a scoped IPv6 interface with dev_get_by_index_rcu(), drops the RCU read-side lock, and only then passes the bare struct net_device * into ipv6_chk_addr(). dev_get_by_index_rcu() only keeps the device alive within the same RCU read-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can free the net_device; ipv6_chk_addr() then dereferences the stale pointer in __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading freed memory. Keep the RCU read-side lock held across the ipv6_chk_addr() call instead of dropping it right after the lookup, so the device cannot be freed while it is in use. BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) Read of size 8 at addr ffff8880106ec000 by task exploit/153 Call Trace: ... kasan_report (mm/kasan/report.c:595) __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972) rds_tcp_laddr_check (net/rds/tcp.c:370) rds_bind (net/rds/bind.c:248) __sys_bind (net/socket.c:1920) __x64_sys_bind (net/socket.c:1956) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Fixes: eee2fa6ab322 ("rds: Changing IP address internal representation to struct in6_addr") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260722210203.565803-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-23device property: mark internal data as private for kernel-docRandy Dunlap
Mark the @value union members as private since they are an internal representation of @value. This prevents kernel-doc warnings: Warning: include/linux/property.h:406 struct member 'u8_data' not described in 'property_entry' Warning: include/linux/property.h:406 struct member 'u16_data' not described in 'property_entry' Warning: include/linux/property.h:406 struct member 'u32_data' not described in 'property_entry' Warning: include/linux/property.h:406 struct member 'u64_data' not described in 'property_entry' Warning: include/linux/property.h:406 struct member 'str' not described in 'property_entry' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260721023218.3490573-1-rdunlap@infradead.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc5). Conflicts: drivers/net/amt.c 3656a79f94c47 ("amt: re-read skb header pointers after every pull") 586c4dcf28eb6 ("amt: no longer rely on RTNL in amt_fill_info()") https://lore.kernel.org/amIaJr3aOQNS_Fvl@sirena.org.uk Adjacent changes: drivers/net/geneve.c 8efb8f8bbb35 ("geneve: require CAP_NET_ADMIN in the device netns for changelink") 0ba269933f73 ("geneve: convert config to RCU-protected pointer") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-23Bluetooth: hci_sync: Fix advertising data UAFsChengfeng Ye
hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups without that lock and, in some cases, retain the pointer while waiting for a controller response. An advertising termination event can therefore interleave as follows: hci_cmd_sync_work hci_rx_work hci_find_adv_instance() __hci_cmd_sync_status() wait for controller reply hci_dev_lock() hci_remove_adv_instance() kfree(adv) adv->scan_rsp_changed = false KASAN reported: BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 hci_schedule_adv_instance_sync+0x390/0x4c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 87: hci_add_adv_instance+0x538/0xac0 add_advertising+0x885/0x1160 Freed by task 89: kfree+0x131/0x3c0 hci_remove_adv_instance+0x1d8/0x3b0 hci_le_ext_adv_term_evt+0x17b/0x730 Protect the instance lookup and payload construction in the extended advertising, scan response, and periodic advertising data paths. Snapshot the advertising parameters under hdev->lock, but release the lock before waiting for the controller. Clear advertising-data dirty bits before issuing their commands and restore them after a failure using a fresh lookup. Likewise, update the reported transmit power through a fresh lookup after the parameter command completes. No adv_info pointer then survives an HCI command wait. Fixes: cba6b758711c ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2") Cc: stable@vger.kernel.org Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: fix BT dependency for submodulesIva Kasprzaková
The modules rfcomm (BT_RFCOMM), bnep (BT_BNEP), hidp (BT_HIDP), and bluetooth_6lowpan (BT_6LOWPAN) are dependent on the bluetooth module (BT, tristate) only transitively through the boolean BT_BREDR for the first three and through the boolean BT_LE for the bluetooth_6lowpan. Therefore, the modules can be selected as built-in even if the BT=m. The combination of BT=m and =y for the said modules leads to the kernel build system silently ignoring those modules, without ever compiling them as built-in or as loadable modules. Add BT as a direct dependency to the Kconfig of rfcomm, bnep, hidp, and bluetooth_6lowpan. The modules set to =y when BT=m will default to =m, rather then getting silently ignored by the build system. Signed-off-by: Iva Kasprzaková <iva@yenya.net> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frameJiale Yao
rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS). Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rspJiale Yao
l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_connect_rsp() and the sibling handler l2cap_le_command_rej() already use l2cap_chan_hold_unless_zero() to safely hold a reference, but l2cap_le_connect_rsp() was left unprotected. Fix by adding l2cap_chan_hold_unless_zero() after the ident lookup and l2cap_chan_put() on the exit path, consistent with other L2CAP response handlers. Fixes: f1496dee9cbd ("Bluetooth: Add initial code for LE L2CAP Connect Request") Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: HIDP: validate numbered report payloadsSangho Lee
When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload. Fixes: 0ff1731a1ae5 ("HID: bt: Add support for hidraw HIDIOCGFEATURE and HIDIOCSFEATURE") Cc: stable@vger.kernel.org Signed-off-by: Sangho Lee <kudo3228@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: HIDP: reject frames without a transaction headerSangho Lee
hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Sangho Lee <kudo3228@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: mgmt: fix pending command UAF in EIR updatesZihan Xi
MGMT_OP_SET_LOCAL_NAME is handled asynchronously on powered controllers and can run set_name_sync(). When the controller is BR/EDR capable, set_name_sync() updates the local name and then rebuilds EIR data through eir_create(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMT_OP_ADD_UUID and MGMT_OP_REMOVE_UUID. pending_eir_or_class() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMT_OP_SET_LOCAL_NAME. In addition, it walked hdev->mgmt_pending without hdev->mgmt_pending_lock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pending_eir_or_class() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed. Take hdev->mgmt_pending_lock while scanning hdev->mgmt_pending and treat MGMT_OP_SET_LOCAL_NAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SET_LOCAL_NAME request does not modify hdev->short_name. Fixes: 6fe26f694c82 ("Bluetooth: MGMT: Protect mgmt_pending list with its own lock") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: Codex:gpt-5.4 Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: btrsi: Move set_bt_context after successful HCI registrationChen Changcheng
In rsi_hci_attach(), ops->set_bt_context() stores the newly allocated h_adapter into common->bt_adapter before hci_alloc_dev() and hci_register_dev() are called. If either of these fails, h_adapter is freed but common->bt_adapter remains a non-NULL dangling pointer. This causes a deterministically reachable use-after-free when the device operates in a BT+WiFi coexistence mode and CONFIG_RSI_COEX is enabled. The following software-only trigger paths exist: 1. SDIO driver .remove (rsi_disconnect) 2. USB driver .disconnect (rsi_disconnect) 3. SDIO driver .shutdown (rsi_shutdown) 4. Hibernation .freeze (rsi_freeze) All four paths check: if (IS_ENABLED(CONFIG_RSI_COEX) && coex_mode > 1 && bt_adapter) rsi_bt_ops.detach(bt_adapter); // use-after-free coex_mode is set during rsi_91x_init(), before rsi_hci_attach() is called, and is not cleared on attach failure. Since set_bt_context() already wrote bt_adapter before the failure, the deinit paths see a non-NULL dangling pointer and proceed to detach it. Fix this by moving set_bt_context() after hci_register_dev() succeeds. On failure paths bt_adapter stays NULL, and the deinit callers correctly skip the detach call. Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Bluetooth: btintel_pcie: Remove unreachable break after gotoChen Changcheng
In the switch-case block for hardware variant detection, the default case has an unreachable 'break' statement following 'goto exit_error'. Remove the dead code. Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-07-23Merge tag 'v7.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds
Pull smb client fixes from Steve French: - Fix leak in cifs_close_deferred_file() - Fix resolving MacOS symlinks - Fix stale file size in readdir - Update git branches in MAINTAINERS file - Fix bounds check in cifs_filldir - Fix checks in parse_dfs_referrals() - Fix DFS referral checks for malformed packet * tag 'v7.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths cifs: prevent readdir from changing file size due to stale directory metadata smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target Add missing git branch info for cifs and ksmbd to MAINTAINERS file smb: client: bound dirent name against end of SMB response in cifs_filldir smb: client: validate DFS referral PathConsumed
2026-07-23MAINTAINERS: serdev: Add self for serdevMarkus Probst
Rob mentioned he needs to find someone else to maintain serdev. Link: https://lore.kernel.org/rust-for-linux/20260430195858.GA1650658-robh@kernel.org/ Link: https://lore.kernel.org/rust-for-linux/da85ceb81f51079d4a8248a1ffde6a27d2ef24ad.camel@posteo.de/ Acked-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Markus Probst <markus.probst@posteo.de> Link: https://patch.msgid.link/20260718-rust_serdev-v16-3-5809384d2e1b@posteo.de Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23samples: rust: add Rust serial device bus sample device driverMarkus Probst
Add a sample Rust serial device bus device driver illustrating the usage of the serial device bus abstractions. This drivers probes through either a match of device / driver name or a match within the OF ID table. Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Markus Probst <markus.probst@posteo.de> Link: https://patch.msgid.link/20260718-rust_serdev-v16-2-5809384d2e1b@posteo.de Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23rust: add basic serial device bus abstractionsMarkus Probst
Implement the basic serial device bus abstractions required to write a serial device bus device driver with or without the need for initial device data. This includes the following data structures: The `serdev::Driver` trait represents the interface to the driver. The `serdev::Device` abstraction represents a `struct serdev_device`. In order to provide the Serdev specific parts to a generic `driver::Registration` the `driver::RegistrationOps` trait is implemented by `serdev::Adapter`. Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Markus Probst <markus.probst@posteo.de> Link: https://patch.msgid.link/20260718-rust_serdev-v16-1-5809384d2e1b@posteo.de Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-23fs/resctrl: Pass error reading event through to user spaceReinette Chatre
Reading of event data is managed through populating a struct rmid_read with properties of event needing to be read. This data is dispatched to an appropriate CPU and upon completion any error can be found in rmid_read::err, or on success the event data will be in rmid_read::val. rmid_read::err is not updated in the unlikely scenario that the reading of the event was dispatched to a wrong CPU. If this ever occurs due to a bug in resctrl the user space read will return "success" but the data reported will be invalid. Ensure accurate error reporting so that if there may be an issue with how resctrl picks a CPU it could be learned with an error to user space instead of silent failure. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Reviewed-by: Tony Luck <tony.luck@intel.com> Tested-by: Babu Moger <babu.moger@amd.com> Link: https://patch.msgid.link/6b3c66a49788828bd8c04a6911bd74c91ccd56f3.1782857711.git.reinette.chatre@intel.com
2026-07-23fs/resctrl: Use accurate type for rdt_resource::ridReinette Chatre
Every resctrl resource has a unique ID described by enum resctrl_res_level. enum resctrl_res_level is used in all resource ID initializations and all resource ID comparisons. All functions consuming the resource ID expects an enum resctrl_res_level. Of the four structures that contain a resource ID (struct mon_data, struct mon_evt, struct rdt_domain_hdr, and struct rdt_resource) only struct rdt_resource does not use enum resctrl_res_level. Switch the type of rdt_resource::rid to be enum resctrl_res_level to make it obvious what values are valid, match the type everywhere this member is used, and obtain benefits from tools that can flag any enum misuse. Move define of RDT_NUM_RESOURCES outside the enum to enable tools to catch when a switch() on the resource ID does not handle all the resources and thus help flag which switch statements need an update when a new resource is added. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Reviewed-by: Tony Luck <tony.luck@intel.com> Tested-by: Babu Moger <babu.moger@amd.com> Link: https://patch.msgid.link/926b334c50b00b4b763c983c0dca6d4ec9083d60.1782857711.git.reinette.chatre@intel.com
2026-07-23ASoC: Series of SDCA bug fixesMark Brown
Charles Keepax <ckeepax@opensource.cirrus.com> says: Fix up some error path and size checking issues in the SDCA code. Link: https://patch.msgid.link/20260722103500.872714-1-ckeepax@opensource.cirrus.com
2026-07-23ASoC: SDCA: Ensure that Control Range is large enough for headerCharles Keepax
When reading the Ranges structure from an SDCA Control, ensure that the read data is large enough to encompass the required header before accessing it. Fixes: 64fb5af1d1bb ("ASoC: SDCA: Add parsing for Control range structures") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260722103500.872714-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-23ASoC: SDCA: Make UMP message size check more robustCharles Keepax
If message offset was larger than the buffer length the size check will pass incorrectly. Refactor the check such that it is more robust to invalid sizes. Fixes: daab108504be ("ASoC: SDCA: Add UMP buffer helper functions") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260722103500.872714-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-23ASoC: SDCA: Always free firmware in FDL pathCharles Keepax
In the case a disk firmware exists but is invalid and no SWFT firmware exists fdl_load_file() will return without calling release_firmware(). Update the code to call this to ensure the firmware is released on the error path. Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260722103500.872714-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-23ASoC: SDCA: Correct pointer passed to devm_acpi_table_putCharles Keepax
devm_acpi_table_put() takes a struct acpi_table_header * but the value passed in is struct acpi_table_header ** so the value passed to acpi_put_table() is actually the pointer not the table itself. Remove the extra reference to correct the passed value. Fixes: c4d096c3ca42 ("ASoC: SDCA: Add SDCA FDL data parsing") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260722103500.872714-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-23Merge tag 'net-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Lots of fixes, double the count even for the 'new normal'. Largely due to my time off followed by a networking conference which distracted most maintainers (less so the AI generators). Including fixes from Bluetooth and WiFi. Current release - regressions: - wifi: mt76: fix MAC address for non OF pcie cards Current release - new code bugs: - mptcp: fix BUILD_BUG_ON on legacy ARM config - wifi: cfg80211: guard optional PMSR nominal time Previous releases - regressions: - qrtr: ns: raise node count limit to 512, we arbitrarily picked 256 as a limit, turns out it was too low for real world deployments - vhost-net: fix TX stall when vhost owns virtio-net header - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - wifi: ath12k: fix low MLO RX throughput on WCN7850 Previous releases - always broken: - number of random AI fixes for SCTP, RDS and TIPC protocols - more AI-looking fixes for WiFi drivers - number of fixes for missing pointer reloading after skb pull - reject BPF redirect use from qdisc qevent block - tcp: initialize standalone TCP-AO response padding - vsock/virtio: collapse receive queue under memory pressure to avoid client OOMing the host with tiny messages - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup, make sure the ICMP response routing follows the routing policy - gro: fix double aggregation of flush-marked skbs - ovpn: fix various refcount bugs - tls: device: push pending open record on splice EOF - eth: mlx5: - use sender devcom for MPV master-up - fix MCIA register buffer overflow on 32 dword reads" * tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits) drop_monitor: perform u64_stats updates under IRQ-disabled section drop_monitor: fix size calculations for 64-bit attributes net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD mptcp: fix BUILD_BUG_ON on legacy ARM config selftests: mptcp: userspace_pm: fix undefined variable port mptcp: fix stale skb->sk reference on subflow close mptcp: pm: userspace: fix use-after-free in get_local_id mptcp: decrement subflows counter on failed passive join mac802154: hold an interface reference across the scan worker sctp: don't free the ASCONF's own transport in DEL-IP processing phonet: check register_netdevice_notifier() error in phonet_device_init() phonet: pep: fix use-after-free in pep_get_sb() bnge/bng_re: fix ring ID widths tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() mctp: check register_netdevice_notifier() error in mctp_device_init() ptp: netc: explicitly clear TMR_OFF during initialization rds: tcp: unregister sysctl before tearing down listen socket ipv6: Change allocation flags to match rcu_read_lock section requirements net: slip: serialize receive against buffer reallocation ...
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-09 05:56:30 +0000