summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-26x86/bugs: Make Safe-RET robust against interrupt injectionBorislav Petkov (AMD)
An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return sequence, potentially leading to data leakage through speculative execution. Fixup register state as if the Safe-RET sequence executed successfully by "emulating" it, in a manner of speaking, and avoid executing a RET instruction after returning from the interrupt. Co-developed-by: David Kaplan <David.Kaplan@amd.com> Signed-off-by: David Kaplan <David.Kaplan@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
2026-07-26ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completesNorbert Szetei
snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close ends in remove_slave_links(), which leaves timeri->timer NULL, so a second close is already harmless through the timer == NULL path; the early return can only be reached by an instance that was opened again in between. For such an instance the close unlinks nothing, so snd_timer_instance_free() frees an object that is still on timer->open_list_head, still on snd_timer_master_list if it was opened with a slave key, still owns any adopted slaves, and still holds its timer and module references. snd_seq_timer_open() reopens an instance exactly like that: it retries its fallback open on the same object after a failure that has already run snd_timer_close_locked() internally. An unprivileged user with access to /dev/snd/timer and /dev/snd/seq can force that failure, since snd_timer_check_master() returns -EBUSY when a pending slave matches the new master's (slave_class, slave_id) key and the target timer has reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class = SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a sequencer queue's key can be forged. The freed instance is afterwards dereferenced by any further snd_timer_open() on that timer, by snd_timer_check_slave(), and by /proc/asound/timers, which faults on the stale ti->owner pointer. The flag only has to be visible while the close is in progress, which is all its other users need. Clear it in remove_slave_links(), under the same timer->lock that sets it, once the instance is off every list. Fixes: da3039e91d1f ("ALSA: timer: Forcibly close timer instances at closing") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/CA41AA48-75BF-45E9-A36D-3A5D2F124F60@doyensec.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: hda/realtek: Add quirk for Infinix INBOOK X3 SlimGunal Seenivasagan
The Infinix INBOOK X3 Slim (ALC269VB, subsystem 0x2782:0250) has its internal speakers wired to pin 0x1b, but the BIOS pin configuration table declares 0x1b as "no physical connection" (0x411111f0). It instead declares pin 0x14 as the internal speaker, although nothing is connected to 0x14. As a result the internal speakers are silent under Linux while the headphone jack works correctly. The codec output path to 0x14 is fully open (DAC assigned and streaming, mixer and pin unmuted, EAPD asserted), so the failure is silent with no error reported. The speakers work under Windows, where the vendor driver supplies its own pin table. Add a fixup that disables the unconnected pin 0x14 and declares pin 0x1b as the internal speaker. Reusing the existing ALC269VC_FIXUP_INFINIX_Y4_MAX was tried first, since it also remaps 0x1b to an internal speaker. It is not sufficient here: it leaves 0x14 declared, so autoconfig finds two line_outs line_outs=2 (0x14/0x1b/0x0/0x0/0x0) type:speaker and binds the primary "Speaker" control to the unconnected pin 0x14 while demoting the working speaker at 0x1b to "Bass Speaker". Audio is audible that way, but the volume and mute controls a desktop actually uses end up attached to a pin that is not wired to anything. Disabling 0x14 is what produces a single correct Speaker output. Verified on the affected machine: with the corrected pin configuration the driver's autoconfig reports line_outs=1 (0x1b/0x0/0x0/0x0/0x0) type:speaker both channels play, headphone auto-mute switches correctly in both directions, and audio survives codec runtime suspend (D3) and resume. Signed-off-by: Gunal Seenivasagan <gunal2002@gmail.com> Link: https://patch.msgid.link/20260726085715.229802-1-gunal2002@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26dt-bindings: iommu: Fix interrupt type in exampleAshish Mhetre
The CMDQV interrupt on Tegra264 is edge-triggered per the hardware interrupt documentation, but the binding example describes it as level-triggered. Correct the example to use IRQ_TYPE_EDGE_RISING so that it does not propagate the wrong trigger type. Fixes: 8a59954192eb ("dt-bindings: iommu: Add NVIDIA Tegra CMDQV support") Reported-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Ashish Mhetre <amhetre@nvidia.com> Acked-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Nicolin Chen <nicolinc@nvidia.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Clear stale page faults before enabling stallJiaxing Hu
Boot firmware can leave an IOMMU bank in PAGE_FAULT_ACTIVE before the driver has configured paging: PAGE_FAULT_ACTIVE=1 STALL_ACTIVE=0 IDLE=1 Such a bank ignores CMD_ENABLE_STALL and never reaches STALL_ACTIVE, so rk_iommu_enable_stall()'s readx_poll_timeout() spins until it times out (seen on the RK3576 NPU, whose MMUs share this poll across banks). Rather than special-casing these banks in the stall path, acknowledge the stale fault with CMD_PAGE_FAULT_DONE before enabling stall, so every bank starts from a clean state and the normal stall sequence applies to all of them. Banks without a pending fault are untouched. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Take all DT clocksJiaxing Hu
rk_iommu only enabled a fixed {aclk,iface} pair. On the RK3576 NPU the MMU sits behind the CBUF/DSU gates, so writes to DTE_ADDR are silently dropped until those clocks run too (reads work, writes need more clocks). Use devm_clk_bulk_get_all() to take every clock the devicetree provides instead of a fixed pair, so a platform can list the full set it needs. Clocks stay optional for the older clock-less devicetrees. Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Fix silent probe success when all MMU resources failZhaoJinming
When all MMU register mappings fail in rk_iommu_probe(), the error path returns PTR_ERR(iommu->bases[0]). However, bases[0] can be NULL if the first platform_get_resource() also returned NULL, causing PTR_ERR(NULL) to evaluate to 0 and the probe to succeed silently. Return -ENODEV directly instead. Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26iommu/rockchip: Drop global rk_ops in favor of per-device opsSimon Xue
The driver currently uses a global rk_ops pointer, forcing all IOMMU instances to share the same operations. This restricts the driver from supporting SoCs that might integrate different versions of IOMMU hardware. Since the IOMMU framework passes the master device information to iommu_paging_domain_alloc(), the global variable is no longer needed. Fix this by moving rk_ops into struct rk_iommu and struct rk_iommu_domain. Initialize it per-device during probe via of_device_get_match_data(), and replace all global references with the instance-specific pointers. Signed-off-by: Simon Xue <xxm@rock-chips.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-26Merge patch series "Make liveupdate selftests library"Mike Rapoport (Microsoft)
Vipin Sharma <vipinsh@google.com> says: Refactor liveupdate selftests as a library. The library exposes common liveupdate ioctls which can be used for liveupdate testing in other subsystems like VFIO and IOMMU. * patches from: https://patch.msgid.link/20260720203202.1964557-1-vipinsh@google.com selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIs selftests/liveupdate: Move luo_test_utils.* into a reusable library Link: https://patch.msgid.link/20260720203202.1964557-1-vipinsh@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26selftests/liveupdate: Move luo_test_utils.* into a reusable libraryVipin Sharma
Move luo_test_utils.[ch] into a lib/ directory and make libliveupdate library. Pull the rules to build them out into a separate libliveupdate.mk script. This will enable these utilities to be also built by and used within other selftests (such as VFIO). Update path in vmtest.sh as that one uses hardcoded path for util. No functional change intended. Co-developed-by: David Matlack <dmatlack@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Vipin Sharma <vipinsh@google.com> Link: https://patch.msgid.link/20260720203202.1964557-3-vipinsh@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIsVipin Sharma
Use luo_test_utils.c for all live update ioctl calls. Remove direct ioctl calls in liveupdate.c. This avoids code duplication and use common interface. While at it, make ioctl error check stricter as liveupdate APIs don't return postive numbers as a valid result. Co-developed-by: David Matlack <dmatlack@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org> Signed-off-by: Vipin Sharma <vipinsh@google.com> Link: https://patch.msgid.link/20260720203202.1964557-2-vipinsh@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocationsGou Hao
alloc_skb() with the __GFP_NOFAIL flag will never return NULL, so the subsequent NULL checks and error handling are unreachable dead code. Remove them. Signed-off-by: Gou Hao <gouhao@uniontech.com> Link: https://patch.msgid.link/20260724022851.466017-7-gouhao@uniontech.com Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26Merge branch 'spacemit-for-clk-fixes' into spacemit-for-nextYixun Lan
2026-07-26riscv: dts: spacemit: enable PCIe on OrangePi R2SChukun Pan
Enable the two RTL8125 network controllers and corresponding PHYs connected via the PCIe controllers on the OrangePi R2S. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260602100000.2402784-1-amadeus@jmu.edu.cn Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1Jennifer Berringer
Enable i2c1 for k3-com260-ifx and use it for a 24c02 eeprom. This eeprom, unlike the one connected to i2c2, is part of the carrier board. Some boards do not have any data programmed on this eeprom from factory. Signed-off-by: Jennifer Berringer <jberring@redhat.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260722202848.1817988-3-jberring@redhat.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: k3-com260: add eeprom on i2c2Jennifer Berringer
Enable i2c2 on the K3 CoM260 compute module and use it for a 24c02 eeprom. This eeprom stores the product name, a MAC address, and a serial number. Signed-off-by: Jennifer Berringer <jberring@redhat.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260722202848.1817988-2-jberring@redhat.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: add SPI controllers for K3Zhengyu He
Add the SPI controller nodes for K3. Signed-off-by: Cody Kang <cody.kang.hk@outlook.com> Signed-off-by: Zhengyu He <hezhy472013@gmail.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260717-k3-com260-spi-v7-2-rc2-b4-preview-20260716-v1-3-969a1b0f783f@gmail.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: add K3 PDMA request numbersliyeshan
Add a local DTS header that gives symbolic names to the SpacemiT K3 PDMA request lines of the non-secure peripherals. Device trees can use these K3_PDMA_* macros instead of hard-coded request numbers when wiring a peripheral "dmas" property. Signed-off-by: liyeshan <yeshan.li@spacemit.com> Signed-off-by: Guodong Xu <docular.xu@gmail.com> Signed-off-by: Zhengyu He <hezhy472013@gmail.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260717-k3-com260-spi-v7-2-rc2-b4-preview-20260716-v1-1-969a1b0f783f@gmail.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: Fix phy id check for the phy on com260 boardInochi Amaoto
Current phy framework can not re-initialize the phy correctly, as it will assert the phy reset GPIO so the phy id can not be read. Setting the phy id of board com260 manually so the phy id dectection can be skipped. Fixes: cfe5c91cb73c ("riscv: dts: spacemit: k3: Initial support for CoM260-IFX board") Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260725233351.55004-3-inochiama@gmail.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26riscv: dts: spacemit: Fix phy id check for the phy on pico-itx boardInochi Amaoto
Current phy framework can not re-initialize the phy correctly, as it will assert the phy reset GPIO so the phy id can not be read. Setting the phy id of board pico-itx manually so the phy id detection can be skipped. Fixes: 74657a376960 ("riscv: dts: spacemit: Add ethernet device for K3") Reported-by: E Shattow <e@freeshell.de> Reported-by: Inochi Amaoto <inochiama@gmail.com> Closes: https://lore.kernel.org/netdev/20260712045233.800748-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Tested-by: E Shattow <e@freeshell.de> Reviewed-by: Yixun Lan <dlan@kernel.org> Link: https://patch.msgid.link/20260725233351.55004-2-inochiama@gmail.com Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-07-26ALSA: 6fire: Fix UAF at error handling during probeTakashi Iwai
Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a UAF. This patch addresses it by doing the almost same cleanup procedure like the normal disconnect phase at the error path. Reported-and-tested-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Closes: https://lore.kernel.org/20260724030900.1984491-1-shuangpeng.kernel@gmail.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260726074821.2288158-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26liveupdate: luo_file: Add internal APIs for file preservationPasha Tatashin
Live update orchestrator file handlers depend on the preservation of other files. To make sure that the dependency is preserved, the file handlers needs to fetch the preservation token of the preserved dependency. Similarly during restore, a file handler wants to fetch the restored file of the dependency. Add APIs that allows fetching token of dependency during preservation, and fetching the restored file dependency during restore. Reviewed-by: Pranjal Shrivastava <praan@google.com> Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Samiullah Khawaja <skhawaja@google.com> Link: https://patch.msgid.link/20260723202912.1467112-2-skhawaja@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()Baul Lee
snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> Fixes: 4434ade8c933 ("ALSA: usb-audio: add support for Akai MPD16") Suggested-by: Takashi Iwai <tiwai@suse.de> Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com> Reported-by: Baul Lee <baul.lee@xbow.com> Cc: stable@vger.kernel.org Signed-off-by: Baul Lee <baul.lee@xbow.com> Link: https://patch.msgid.link/20260726074500.50145-1-baul.lee@xbow.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26RDMA/selftests: Add rxe_netns_names testJiri Pirko
Add a kselftest script that exercises per-netns RDMA device naming with RXE. Cover duplicate names across namespaces, move conflict handling, move-with-rename, and same-namespace rename requests. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-15-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Implement disassociate_ucontext callbackJiri Pirko
Implement an empty disassociate_ucontext() callback so the RDMA core can move rxe devices between net namespaces. The core requires this callback to reset user contexts without waiting for userspace. rxe needs no teardown here: its user-mapped queues live in reference-counted vmalloc memory (see rxe_mmap.c) that stays valid while userspace holds the mappings. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-14-jiri@resnulli.us Reviewed-by: Yanjun Zhu <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/rxe: Allow queue VMAs to outlive ucontextsJiri Pirko
Prepare queue mappings for asynchronous ucontext disassociation during device disable. Rely on the VMA page references to preserve mapped memory until the final unmap. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-13-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Make device names unique per net namespaceJiri Pirko
Use rdma_dev_access_netns() to scope RDMA device name lookup and "%d" name allocation to the relevant net namespace. Keep shared mode and CONFIG_NET_NS=n behaviour system-wide. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-12-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Document the SELinux ibendport net namespace limitationJiri Pirko
Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-11-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cma: Document that CM configfs cannot be net namespace scopedJiri Pirko
Document the rdma_cm configfs limitation: configfs is global, so same-named RDMA devices in different net namespaces cannot both be represented there. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-10-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/cgroup: Disambiguate devices across net namespacesJiri Pirko
RDMA device names are unique only within a network namespace, but an RDMA cgroup can account resources for devices from multiple namespaces. Duplicate names therefore make cgroup output ambiguous and can cause limit writes to select the wrong device. Use the system-wide RDMA device index to distinguish duplicate names while preserving the existing UAPI for unique names. Reject ambiguous name-only writes with -ENOTUNIQ and expose a complete device view to administrators. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-9-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/srp: Make the SRP sysfs class net namespace awareJiri Pirko
Tag srp_class by the RDMA device's net namespace so SRP hosts derived from same-named RDMA devices can coexist across namespaces. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-8-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26net/smc: Look up the pnetid ib device within the net namespaceJiri Pirko
Scope smc_pnet_find_ib() to the caller's net namespace so pnetid setup cannot bind to a same-named RDMA device from another namespace once names become per-netns. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-7-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Allow setting the device name while changing net namespaceJiri Pirko
Accept RDMA_NLDEV_ATTR_DEV_NAME together with RDMA_NLDEV_NET_NS_FD so a netlink move can rename the device in the destination namespace. Keep the name semantics aligned with the existing RDMA rename path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-6-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/nldev: Report net namespace move errors through extackJiri Pirko
Thread extack through the existing net namespace move helper and report the main failure reasons from the core path. Keep the existing move UAPI shape unchanged. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-5-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Support renaming a device when changing its net namespaceJiri Pirko
Allow namespace moves to request a destination device name. Keep requested names on the same literal-name path as the existing RDMA rename operation, and keep teardown fallback naming on the trusted kernel-controlled path. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-4-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Handle device name conflicts when changing net namespaceJiri Pirko
Prepare namespace moves for per-netns names. Check user-initiated moves for destination-name conflicts before disabling the device, keep same-netns moves as no-ops, and make teardown moves detach from the exiting namespace even if fallback naming fails. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-3-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26RDMA/core: Pass the net namespace to the device name lookupsJiri Pirko
Prepare for per-netns RDMA device names by passing the target net namespace through the name lookup and allocation helpers. Keep current global uniqueness behaviour. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-2-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26ALSA: usb-audio: fix stack info leak in RME Digiface statusBaul Lee
snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor control-IN transfer does not return a negative error, copies all four words into the caller's status[]. snd_usb_ctl_msg() copies the full requested size back into the caller's buffer regardless of how many bytes the data stage actually delivered: buf = kmemdup(data, size, GFP_KERNEL); err = usb_control_msg(dev, pipe, request, requesttype, value, index, buf, size, timeout); memcpy(data, buf, size); usb_control_msg() returns the transferred length on a short control-IN, which is a non-negative value, and writes only that many bytes. The remainder of the copy back is the kmemdup()ed image of the caller's buffer, so a device answering with a short data stage leaves the trailing words of buf[] holding leftover kernel stack. The only guard in the caller is err < 0, so those words are stored into status[]. They then reach user space: snd_rme_digiface_get_status_val() selects a 16-bit halfword of status[] per the control's reg/mask, and the eight Digiface status controls together expose the whole 16-byte frame to an unprivileged reader of /dev/snd/controlC*. Zero-initialise the buffer so a short read yields zeros instead of stack residue. This mirrors snd_rme_get_status1(), which already clears its output word before the same kind of vendor read. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> Fixes: 611a96f6acf2 ("ALSA: usb-audio: Add mixer quirk for RME Digiface USB") Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com> Reported-by: Baul Lee <baul.lee@xbow.com> Cc: stable@vger.kernel.org Signed-off-by: Baul Lee <baul.lee@xbow.com> Link: https://patch.msgid.link/20260726065020.46070-1-baul.lee@xbow.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: ump: fix double free of out_cvts on rawmidi errorBaul Lee
snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> Fixes: 33cd7630782d ("ALSA: ump: Export MIDI1 / UMP conversion helpers") Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com> Reported-by: Baul Lee <baul.lee@xbow.com> Cc: stable@vger.kernel.org Signed-off-by: Baul Lee <baul.lee@xbow.com> Link: https://patch.msgid.link/20260726051633.41206-1-baul.lee@xbow.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: usb-audio: fix use-after-free in ump_to_endpoint()Baul Lee
create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data, but it never installs an ump->private_free hook and never clears that pointer. If a later step of snd_usb_midi_v2_create() fails, its error path calls free_all_midi2_umps(), which kfree()s the snd_usb_midi2_ump object while the already-registered endpoint keeps pointing at it. The created /dev/snd/umpC*D* node stays exposed, so the first operation of any UMP open, ump_to_endpoint(), dereferences the dangling ump->private_data and reads rmidi->eps[dir] out of freed memory. A malicious USB MIDI 2.0 device that makes creation fail after the endpoint is registered can thus trigger a slab use-after-free read on a subsequent open of the UMP node. Clear the endpoint's back-pointer before freeing the object, and let ump_to_endpoint() tolerate a NULL private_data so the open/close/trigger callbacks fail cleanly (their callers already handle a NULL endpoint) instead of dereferencing a stale pointer. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> Fixes: ff49d1df79ae ("ALSA: usb-audio: USB MIDI 2.0 UMP support") Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com> Reported-by: Baul Lee <baul.lee@xbow.com> Cc: stable@vger.kernel.org Signed-off-by: Baul Lee <baul.lee@xbow.com> Link: https://patch.msgid.link/20260726051337.41124-1-baul.lee@xbow.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: hda/realtek: Fix headset mic on Acer Nitro 5 AN515-46Marcos Paulo Medeiros
The Acer Nitro 5 AN515-46 (SSID 1025:159e, Realtek ALC287) has a combo headset jack whose microphone does not work out of the box: the BIOS leaves pin 0x19 unconfigured, so no headset mic is created. Apply ALC2XX_FIXUP_HEADSET_MIC, the same fixup already used by the sibling models AN515-57 (1025:1539) and AN517-55 (1025:1597), which makes the headset microphone work correctly. Tested on an Acer Nitro 5 AN515-46 by overriding the model via a patch firmware with model=alc2xx-fixup-headset-mic. Signed-off-by: Marcos Paulo Medeiros <maarcospm1996@gmail.com> Link: https://patch.msgid.link/20260725214131.25872-1-maarcospm1996@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: hda/realtek: Add quirk for TongFang X6SP45xUEckhart Mohr
TongFang X6KK45xU and X6SP45xU have actually different PCI IDs. This patch Adds the missing PCI ID to fix headphone detection and clarifies the naming. Fixes: d595255241e5 ("ALSA: hda/realtek: Add quirk for TongFang X6xx45xU") Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com> Cc: stable@vger.kernel.org Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20260724190109.169889-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: usb-audio: Add iface reset and delay quirk for JKY Technology Q2ALianqin Hu
Setting up the interface when suspended/resuming fails on this card. Adding a reset and delay quirk will eliminate this problem. Note: This device's VID conflicts with Apple's (0x05ac). usb 1-1: New USB device found, idVendor=05ac, idProduct=110b usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: Q2A usb 1-1: Manufacturer: JKY Technology usb 1-1: SerialNumber: 330270D2251225 Suggested-by: Rong Zhang <i@rong.moe> Signed-off-by: Lianqin Hu <hulianqin@vivo.com> Reviewed-by: Rong Zhang <i@rong.moe> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/TYUPR06MB6217566CFD33F57D3AE46816D2CF2@TYUPR06MB6217.apcprd06.prod.outlook.com
2026-07-26ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxxMadhavender Singh
This laptop with an ALC236 codec requires the ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup for its mute LED to function correctly. Add the subsystem ID 0x103c:0x86c8 to the quirk table to apply this fixup. Signed-off-by: Madhavender Singh <madhav@disroot.org> Link: https://patch.msgid.link/20260723104736.23386-1-madhav@disroot.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-26ALSA: lx6464es: fix period byte count for 16-bit streamsXu Rao
The lx6464es driver advertises both 16-bit and packed 24-bit PCM formats, but lx_trigger_start() and lx_interrupt_request_new_buffer() calculate the DMA period size as runtime->period_size * runtime->channels * 3. That is only correct for the packed 24-bit formats. For 16-bit streams the driver submits buffers that are 50% larger than the actual ALSA period and advances the DMA address by the same wrong amount. For example, with 2 channels, 256 frames and 4 periods, the third buffer already extends beyond the ALSA buffer and the fourth buffer starts outside it. Use snd_pcm_lib_period_bytes() so the byte count matches the runtime format, channel count and period size. Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Link: https://patch.msgid.link/8BB12E8D92A7CDBA+20260723085710.2567463-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-25tools/build: selftests: Remove some duplicate toolchain definitionsJames Clark
Try to remove some, but not all duplicate toolchain definitions. In these instances, their makefiles already include tools/scripts/Makefile.include which defines these in a consistent way. STRIP is the only one that was set with an '=', but I don't think it was significant so that difference can be dropped. Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Ian Rogers <irogers@google.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-25tools/build: Allow versioning LLVM readelfJames Clark
Documentation/kbuild/llvm.rst mentions that readelf is included in the LLVM toolchain, but it's not currently included in this block. Add it so that LLVM=... options also apply to readelf. Users in tools/ were Perf which was hardcoding it, and another was the BPF makefile. Both already include Makefile.include so convert them to use the new variables. Where readelf wasn't doing anything arch specific, use HOSTREADELF because it's more likely to be installed. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: James Clark <james.clark@linaro.org> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-25tools/build: Indent if else blocksJames Clark
These blocks are quite big and unreadable without indentation. Indent them. No functional changes intended. Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Ian Rogers <irogers@google.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-25tools/build: Allow versioning of all LLVM tools defined in Makefile.includeJames Clark
The version of LLVM tools can be given on the build command with LLVM=-15, but this isn't applied to all tools. For example $(CC) gets versioned, but $(CLANG) doesn't. This causes a Perf build with LTO=1 to fail with an error about mixed clang versions: ld.lld: error: libperf/core.o: Unknown attribute kind (86) (Producer: 'LLVM18.1.8' Reader: 'LLVM 15.0.7') This file has two "ifneq ($(LLVM),)" blocks adjacent to each other, so merge these blocks making it obvious that all tools should be versioned consistently and there is nothing special about each block. This also reveals that ?= and "allow-override" are used inconsistently between the blocks. "allow-override" is technically only required for builtin variables, but isn't only used on them, and doesn't do any harm if used on a non-builtin. Make them all "allow-override" for consistency. The only functional difference this will cause is if there is a file level definition of one of the variables followed by an "#include of Makefile.include" which will now overwrite. But this isn't done and in a later commit some of the duplicate definitions will be removed for good measure. There are also some other LLVM tools that are not defined here and will be moved in a later commit. Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Ian Rogers <irogers@google.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Fixes: e9c281928c24 ("kbuild: Make $(LLVM) more flexible") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-25Input: inexio - replace printk with dev_dbg and fix missing spaceBivash Kumar Singh
Replace printk(KERN_DEBUG) with dev_dbg() using the serio device, which is the correct logging style for driver code. Also fix missing space after comma in the function argument, and remove the redundant 'inexio.c:' filename prefix from the message. Signed-off-by: Bivash Kumar Singh <bivashraj750@gmail.com> Link: https://patch.msgid.link/20260725130803.6763-1-bivashraj750@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-11 06:33:39 +0000