summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-14ASoC: codecs: arizona: Use guard() for mutex locksbui duc phuc
Clean up the code using guard() for mutex locks. Merely code refactoring, and no behavior change. Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260708125002.202515-5-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14ASoC: codecs: arizona-jack: Use guard() cleanup helpersbui duc phuc
Clean up the code using guard() helpers for mutex locking and PM runtime management. No functional change intended. Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260708125002.202515-4-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14ASoC: codecs: ak4613: Use guard() for mutex locksbui duc phuc
Clean up the code using guard() for mutex locks. Merely code refactoring, and no behavior change. Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260708125002.202515-3-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14ASoC: codecs: ab8500: Use guard() for mutex locksbui duc phuc
Clean up the code using guard() for mutex locks. Merely code refactoring, and no behavior change. Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260708125002.202515-2-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14dmaengine: fsl-edma: Add error handling for devm_kasprintfGriffin Kroah-Hartman
Add error handling statement to fls_edma3_irq_init() for the devm_kasprintf call. Assisted-by: gkh_clanker_2000 Cc: stable <stable@kernel.org> Cc: Frank Li <Frank.Li@nxp.com> Cc: Vinod Koul <vkoul@kernel.org> Cc: imx@lists.linux.dev Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/2026070605-frying-fling-b9c5@gregkh Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-14dt-bindings: dma: qcom,bam-dma: Increase iommus maxItems to 7Kuldeep Singh
Qualcomm Shikra platform describes the BAM DMA node with 7 iommus entries. The current schema limit to 6, so update the binding to allow up to 7 entries. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Kuldeep Singh <kuldeep.singh@oss.qualcomm.com> Link: https://patch.msgid.link/20260714-b4-shikra_crypto_changse-v4-5-06a4ea97c209@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-07-14ASoC: tas2781: bound firmware description string parsingPengpeng Hou
The TAS2781 firmware parser reads several variable-length description strings with strlen() before checking that the string terminator is present inside the firmware blob. A malformed firmware image without a NUL terminator can therefore make the parser walk past the end of the firmware buffer before the later size checks run. Add a small bounded string-length helper and use it for all description fields that are parsed from the firmware buffer. Keep the existing size checks for the fixed bytes that follow each string. Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260706144540.93929-1-pengpeng@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14ASoC: codecs: aw88261: only check PLL and clock state at power-upJorijn van der Graaf
The SYSST check performed during device start requires SWS (amplifier switching, bit 8) and BSTS (boost finished, bit 9) on top of PLL lock and clock stability. Those bits cannot be asserted at this point in the sequence: the check runs after amppd release but before the hmute/ULS-hmute release, and the amplifier neither switches nor finishes ramping its boost converter while it is still muted. With the Fairphone (Gen. 6) firmware profile, aw88261_dev_start() therefore always fails with check sysst fail, reg_val=0x0011, check:0x311 and playback aborts, even though the amplifier is fine and PLL lock and stable clocks are present. Check only PLL lock and clock stability, for which a definition already exists; this still re-validates the clocks after amppd release (aw88261_dev_check_syspll() checked them before it). This matches the vendor aw882xx driver, which only validates PLL lock and clock stability at this stage, and the in-tree aw88399 driver, which skips the SWS check whenever the amplifier may legitimately not be switching (AW88399_BIT_SYSST_NOSWS_CHECK). Fixes: 028a2ae25691 ("ASoC: codecs: Add aw88261 amplifier driver") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net> Link: https://patch.msgid.link/20260704192857.88366-1-jorijnvdgraaf@catcrafts.net Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14spi: dw-dma: Wait for controller idle before completing TxWang YuWei
dw_spi_dma_wait_tx_done() polls dw_spi_dma_tx_busy(), which only checks DW_SPI_SR_TF_EMPT. An empty TX FIFO merely means the last data word has been moved into the shift register; the transfer is not complete on the bus until DW_SPI_SR_BUSY is also cleared. As a result the wait can return while the controller is still shifting out the final word. Any caller that tears down or reconfigures the controller right after the transfer can then lose the tail of the transfer. The memory-operation path in spi-dw-core.c already waits for both DW_SPI_SR_BUSY == 0 and DW_SPI_SR_TF_EMPT == 1. Use the same completion condition in the DMA path so the transfer is guaranteed to be finished on the bus before the wait returns. Signed-off-by: Wang YuWei <1973615295@qq.com> Link: https://patch.msgid.link/tencent_4EA7B5C94669ED4C38A5F6C1C9126E5D9106@qq.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-14MAINTAINERS: Merge int3472 driver patches via the media tree by defaultSakari Ailus
The int3472 driver (under drivers/platform/x86/intel/int3472) implements an effective kernel API (via instantiating regulators, clocks and GPIOs) that is primarily used by the drivers under drivers/media. This means that there are often dependencies between patches to the int3472 driver and the camera sensor drivers whereas dependencies to other parts of the x86 platform tree are fairly rare. Assign the int3472 driver tree to the Media tree. Patches that have dependencies elsewhere than in the Media tree will be coordinated with the respective maintainers as usual. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Acked-by: Daniel Scally <dan.scally@ideasonboard.com>
2026-07-14pwm: tegra: Add support for Tegra264Mikko Perttunen
Tegra264 changes the register layout to accommodate wider fields for duty and scale, and adds configurable depth which will be supported in a later patch. The enable bit also moves from CSR_0 to a separate CSR_1 register. To support the new enable register location, introduce an enable_reg field in struct tegra_pwm_soc that identifies which register contains the PWM_ENABLE bit. tegra_pwm_enable() and tegra_pwm_disable() read/write this field accordingly, and tegra_pwm_config() skips OR-ing PWM_ENABLE into its CSR_0 write on SoCs where the enable bit is not in CSR_0. Update the top comment to describe the register layout in more detail. Co-developed-by: Yi-Wei Wang <yiweiw@nvidia.com> Signed-off-by: Yi-Wei Wang <yiweiw@nvidia.com> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-6-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14pwm: tegra: Parametrize duty and scale field widthsMikko Perttunen
Tegra264 has wider fields for the duty and scale register fields. Parameterize the scale field width. The depth value becomes disconnected from the duty field width, so define it separately and remove the duty field width definition. Co-developed-by: Yi-Wei Wang <yiweiw@nvidia.com> Signed-off-by: Yi-Wei Wang <yiweiw@nvidia.com> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-5-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14pwm: tegra: Modify read/write accessors for multi-register channelMikko Perttunen
On Tegra264, each PWM instance has two registers (per channel, of which there is one). Update the tegra_pwm_readl/tegra_pwm_writel helper functions to take channel (as struct pwm_device *) and offset separately. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-4-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14pwm: tegra: Avoid hard-coded max clock frequencyYi-Wei Wang
The clock driving the Tegra PWM IP can be sourced from different parent clocks. Hence, let dev_pm_opp_set_rate() set the max clock rate based upon the current parent clock that can be specified via device-tree. After this, the Tegra194 SoC data becomes redundant, so get rid of it. Signed-off-by: Yi-Wei Wang <yiweiw@nvidia.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Co-developed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-3-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14pwm: tegra: Prefix driver-local macros and functionsMikko Perttunen
Prefix driver-local defines and functions with tegra_/TEGRA_ to clearly distinguish them from any general PWM related symbols. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-2-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14dt-bindings: pwm: Document Tegra264 controllerThierry Reding
Add a new compatible string for the PWM controller found on Tegra264. The controller is similar to earlier generations but not compatible with them. Signed-off-by: Thierry Reding <treding@nvidia.com> [mperttunen: Drop extra Tegra194 compatible string] Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Link: https://patch.msgid.link/20260701-t264-pwm-v6-1-2718f61f411f@nvidia.com Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
2026-07-14can: raw: add locking for raw flags bitfieldOliver Hartkopp
With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock") the formerly separate integer values have been integrated into a single bitfield. This led to a read-modify-write operation when changing a flag in raw_setsockopt() which now needs a locking to prevent concurrent access. Instead of adding a lock/unlock hell in each of the flag manipulations this patch introduces a wrapper for a new raw_setsockopt_locked() function analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock") Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr> Closes: https://lore.kernel.org/linux-can/20260503112200.22727-1-eulgyukim@snu.ac.kr/ Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Reviewed-by: Vincent Mailhol <mailhol@kernel.org> Tested-by: Vincent Mailhol <mailhol@kernel.org> Link: https://patch.msgid.link/20260504111928.41856-1-socketcan@hartkopp.net [mkl: use Closes tag instead of Link] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-07-14ALSA: seq: close a re-opened queue timer in the destructorNorbert Szetei
queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Link: https://patch.msgid.link/422FDB81-2A68-47C7-A22D-2D3301E2E86D@doyensec.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-14xfs: don't zap bmbt forks if they are MAXLEVELS tallDarrick J. Wong
LOLLM noticed a discrepancy between the bmbt level checks in the libxfs bmbt code vs. the inode repair code. We do actually allow a bmbt root that proclaims to have a height of XFS_BM_MAXLEVELS. Cc: stable@vger.kernel.org # v6.8 Fixes: e744cef2060559 ("xfs: zap broken inode forks") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: clamp timestamp nanoseconds correctlyDarrick J. Wong
LOLLM noticed an off-by-one error in the nsec clamping; fix that so that we never have tv_nsec == 1e9. Cc: stable@vger.kernel.org # v6.8 Fixes: 2d295fe65776d1 ("xfs: repair inode records") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: fully check the parent handle when it points to the rootdirDarrick J. Wong
LOLLM noticed that the directory tree path checking declares the path to be ok if the inumber in the parent pointer reaches the root directory. Unfortunately, it neglects to check that the generation is correct. Fix that by moving the generation check up. Cc: stable@vger.kernel.org # v6.10 Fixes: 928b721a11789a ("xfs: teach online scrub to find directory tree structure problems") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: handle non-inode owners for rtrmap record checkingDarrick J. Wong
LOLLM noticed that two helper functions in the rtrmapbt scrub code don't actually handle non-inode owners correctly -- CoW staging extents and rgsuperblock extents are not shareable, but they are mergeable. Fix these two helpers. Cc: stable@vger.kernel.org # v6.14 Fixes: 2d9a3e98053e8c ("xfs: allow overlapping rtrmapbt records for shared data extents") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: fix off-by-one error when calling xchk_xref_has_rt_ownerDarrick J. Wong
LOLLM noticed an off-by-one error when computing the length of the rtrmap to cross-check. Cc: stable@vger.kernel.org # v6.14 Fixes: 037a44d8277adf ("xfs: cross-reference the realtime rmapbt") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: set xfarray killable sort correctlyDarrick J. Wong
LOLLM noticed that we *disable* interruptible sorts when the KILLABLE flag is set. This is backwards. Fix the incorrect logic, and rename the variable to make the connection more obvious. Cc: stable@vger.kernel.org # v6.10 Fixes: 271557de7cbfde ("xfs: reduce the rate of cond_resched calls inside scrub") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: grab rtrmap btree when checking rgsuperDarrick J. Wong
LOLLM noticed that we aren't grabbing the rtrmap btree when we check the realtime group superblock. As a result, none of the cross-referencing checks have ever run. Fix this. Cc: stable@vger.kernel.org # v6.14 Fixes: 428e4884656db9 ("xfs: allow queued realtime intents to drain before scrubbing") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: write the rg superblock when fixing itDarrick J. Wong
The rtgroup superblock fixer should write the rtgroup superblock. LOLLM noticed this, oops. :/ Cc: stable@vger.kernel.org # v6.13 Fixes: 1433f8f9cead37 ("xfs: repair realtime group superblock") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: use the rt version of the cow staging checkerDarrick J. Wong
LOLLM also noticed that xchk_rtrmapbt_xref ought to be using the rtdev version of the "is this a cow extent?" helper function, not the datadev one. Cc: stable@vger.kernel.org # v6.14 Fixes: 91683bb3f264c0 ("xfs: cross-reference checks with the rt refcount btree") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_stagingDarrick J. Wong
LOLLM points out that we pass the wrong btree cursor here. We want the rtrefcount btree cursor, not the non-rt one. This is fairly benign since it only affects tracing data. Cc: stable@vger.kernel.org # v6.14 Fixes: 91683bb3f264c0 ("xfs: cross-reference checks with the rt refcount btree") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: don't wrap around quota ids in dqiterateDarrick J. Wong
LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64. Cc: stable@vger.kernel.org # v6.8 Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: move cow_replace_mapping to xfs_bmap_util.cDarrick J. Wong
Move the actual details of (partially) replacing a COW fork mapping to xfs_bmap_util.c so that all the code doing hairy operations on subsets of bmbt_irecs are kept together. Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: make cow repair somewhat flaky when debugging knob enabledDarrick J. Wong
Introduce a new behavior for the cow fork repair code: if the debugging knob is enabled, we'll pick a random subrange of each cow fork mapping to mark as bad. This will exercise the xrep_cow_replace_mapping more thoroughly. Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14xfs: don't replace the wrong part of the cow forkDarrick J. Wong
LOLLM points out that xfs_iext_lookup_extent can return a @got where got->br_startoff < startoff. In this case, xrep_cow_replace_range replaces the entire mapping instead of just the part that had been marked bad in the bitmap, but advances the bitmap cursor in xrep_cow_replace by the amount replaced. As a result, we fail to replace the end of the bad range, and replace part of the good range. Fix this by rewriting the replace method to handle replacing the middle of a cow fork mapping. This we do by returning both the current mapping as @got, and the subset of the mapping that we want to replace as @rep, using @rep to store the results of the new allocation, and comparing @rep to @got to figure out the exact transformations needed. Cc: stable@vger.kernel.org # v6.8 Fixes: dbbdbd0086320a ("xfs: repair problems in CoW forks") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14x86/boot: Validate console=uart8250 baud rate to fix early boot hangThorsten Blum
When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in early_serial_init(). Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent an early system hang. Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev
2026-07-14xfs: resample the data fork mapping after cycling ILOCKDarrick J. Wong
xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. Cc: hch@lst.de Cc: stable@vger.kernel.org # v4.11 Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-07-14can: esd_usb: kill anchored URBs before freeing netdevsFan Wu
esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev->nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)), clear active_tx_jobs, and reset priv->tx_contexts[]. Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs. This issue was found by an in-house static analysis tool. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.5 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Link: https://patch.msgid.link/20260709164159.497640-1-fanwu01@zju.edu.cn Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-07-14dt-bindings: soc: mediatek: mutex: Improve title and descriptionAngeloGioacchino Del Regno
Improve both the title and the description of this hardware to disambiguate its functionality from a hardware mutex and/or from a hwspinlock. Though in datasheets this is called "DISP_MUTEX", the meaning is is "Mute-X" (where "X" means "any hardware trigger signal") really as this is what this piece of hardware does: muting or unmuting of signals in each sub-IP of the display or other multimedia related controllers. Based on that, also clarify the description text, as to make sure that the information is actually accurate. While at it, also avoid forcing literal blocks in the description as there is nothing in there needing that (no ascii graph or other stuff that needs a literal block anyway), and add myself in the list of maintainers. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2026-07-14can: vxcan: Kconfig: fix description stating no local echo providedAlexander Hölzl
The Kconfig description of the vxcan kernel module erroneously states the the vxcan interface does not provide a local echo of sent can frames. However this behavior changed in commit 259bdba27e32 ("vxcan: enable local echo for sent CAN frames") and vxcan interfaces now provide a local echo. Change the description of the vxcan module in the Kconfig to reflect this change. Signed-off-by: Alexander Hölzl <alexander.hoelzl@gmx.net> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260619090035.17769-1-alexander.hoelzl@gmx.net [mkl: rephrase patch description] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-07-14drm/xe: Hold a dma-buf reference for imported BOsNitin Gote
An imported dma-buf BO is created as a ttm_bo_type_sg BO whose reservation object is the exporter's dma_buf->resv. The importer, however, only takes a dma-buf reference after a successful dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive, so if the exporter is freed while the BO still references its resv, a later access to that resv is a use-after-free: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b9c Workqueue: ttm ttm_bo_delayed_delete [ttm] RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0 This can be reached on two paths: - dma_buf_dynamic_attach() fails, or - ttm_bo_init_reserved() fails during BO creation. In both cases the BO already has bo->base.resv pointing at the exporter resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which locks bo->base.resv asynchronously - potentially after the exporter has been freed. Take the dma-buf reference in xe_bo_init_locked(), before ttm_bo_init_reserved(), so it also covers a creation failure there, and release it in xe_ttm_bo_destroy(). The reference is held for the whole BO lifetime, keeping the shared resv alive on every path. v2: - Reworked the fix to avoid creating the imported sg BO before dma_buf_dynamic_attach() succeeds. - Attach with importer_priv == NULL and make invalidate_mappings ignore incomplete imports. v3: - Dropped the xe-side reordering approach since importer_priv must be valid when dma_buf_dynamic_attach() publishes the attachment. - Per Christian's suggestion on the v1 thread, keyed the check on import_attach rather than removing the sg guard entirely. - Fixes both xe and amdgpu in a single TTM patch. v4: - Moved import_attach check to after dma_resv_copy_fences() so fences are copied before returning for successful imports (Thomas). - Removed exporter-alive claim from commit message (Thomas). v5: - Add drm/xe patch to keep imported sg BOs off the LRU before attach succeeds; the TTM fix alone is not sufficient for xe if the BO is already LRU-visible. (Thomas) v4 patch: https://patchwork.freedesktop.org/patch/736663/?series=169129&rev=2 - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4. v6: - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv individualization (v1-v5) plus the xe off-LRU/placement handling (v5), just hold a dma-buf reference for the imported BO lifetime so the shared resv can never be freed while the BO still references it. Single xe patch, no TTM change. (Thomas) - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved() so a TTM creation failure is covered too (Thomas). - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost BO that outlived the exporter. Link to v5: https://patchwork.freedesktop.org/series/169984/ v7: - Move changelog above --- so it stays in the commit message. - Reorder changelog entries oldest-to-newest. (Thomas) Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Cc: Christian Konig <christian.koenig@amd.com> Cc: Matthew Auld <matthew.auld@intel.com> Suggested-by: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Nitin Gote <nitin.r.gote@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260710191027.260160-2-nitin.r.gote@intel.com
2026-07-14arm64: dts: renesas: r9a09g047: Fix PCIe dma-ranges memory space codeLad Prabhakar
The RZ/G3E SoC supports up to 8 GiB of memory. Update the PCIe dma-ranges property to use the 64-bit prefetchable memory space code. Fixes: 1ac57c9830cb ("arm64: dts: renesas: r9a09g047: Add PCIe node") Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708172849.227915-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g056: Fix PCIe dma-ranges memory space codeLad Prabhakar
The RZ/V2N SoC supports up to 8 GiB of memory. Update the PCIe dma-ranges property to use the 64-bit prefetchable memory space code. Fixes: 4c443296ff17 ("arm64: dts: renesas: r9a09g056: Add PCIe node") Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708172849.227915-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable PCIeLad Prabhakar
Enable the PCIE1 slot which is connected to PCIe0 channel. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708163311.222176-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g057: Add PCIe nodesLad Prabhakar
Add PCIe nodes to Renesas RZ/V2H(P) ("R9A09G057") SoC DTSI. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708163311.222176-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14ARM: dts: renesas: r9a06g032-rzn1d400-eb: Enable SPI-FRAMWolfram Sang
Activate the FRAM and the SPI bus which it is attached to. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260626180326.9593-5-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14ARM: dts: renesas: r9a06g032: Describe SPI controllersWolfram Sang
Add nodes for the 6 SPI controllers of the Renesas RZ/N1D SoC. The first 4 can only be controllers, the latter 2 can only be targets. DMA nodes are not added yet because DMA needs some extra code in the drivers and cannot be tested yet. Basic FIFO mode works reliably, though. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Herve Codina <herve.codina@bootlin.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260626180326.9593-4-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzt2h-n2h-evk-common: Add memory nodesLad Prabhakar
Add memory nodes for the RZ/T2H and RZ/N2H EVK boards. These boards populate 8GiB of DDR memory, which is exposed through two address ranges. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260622170733.1703585-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: Add soc: labels to soc nodesMarek Vasut
Add soc: labels to the /soc {} nodes to align DTS with r8a77951.dtsi which already has that soc: label. The soc: label is useful in U-Boot where it is used in U-Boot extras DT fragments. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260621025052.406507-1-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-2-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-3-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-4-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-5-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-6-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-7-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-8-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-9-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g047e57-smarc: Add DA7212 audio codec supportJohn Madieu
RZ/G3E SMARC board has a DA7212 audio codec connected via I2C1 for sound input/output using SSI3/SSI4 where: - The codec receives its master clock from the Versa3 clock generator present on the SoM, - SSI4 shares clock pins with SSI3 to provide a separate data line for full-duplex audio capture. Enable audio support on RZ/G3E SMARC2 EVK boards with a DA7212 audio codec. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Link: https://patch.msgid.link/20260619083951.3777556-5-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzg3e-smarc-som: Add audio pinmux definitionsJohn Madieu
Add pinmux definitions for SSI3/SSI4 audio interface on RZ/G3E SMARC SoM: - sound_clk_pins: AUDIO_CLKB and AUDIO_CLKC clock outputs, - sound_pins: SSI3_SCK, SSI3_WS, SSI3_SDATA (playback) and SSI4_SDATA (capture). Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-4-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzg3e-smarc-som: Add Versa3 clock generatorJohn Madieu
Add the Renesas 5P35023 (Versa3) programmable clock generator on the I2C2 bus along with its 24MHz input clock (x2 oscillator) to feed the audio subsystem. The Versa3 provides the following clock outputs: - Output 0: 24MHz (reference), - Output 1: 12.288MHz (audio, 48kHz family), - Output 2: 11.2896MHz (audio, 44.1kHz family), - Output 3: 12.288MHz (audio), - Output 4: 25MHz (DIFF1, Ethernet). These clocks are required for the audio codec and the Ethernet controller found on the RZ/G3E SMARC EVK. Output 5 (DIFF2) is left out, as it is not connected on this board. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g047: Add RZ/G3E Sound supportJohn Madieu
Add the snd_rzg3e node for the RZ/G3E SoC with all sub-components: - SSI (Serial Sound Interface) units 0-9, - SSIU (Serial Sound Interface Unit) units 0-27, - SRC (Sample Rate Converter) units 0-9, - CTU (Channel Transfer Unit) units 0-7, - DVC (Digital Volume Control) units 0-1, - MIX (Mixer) units 0-1. Sub-node names follow the new RZ/G3E sound binding: unprefixed 'ssi', 'ssiu', 'src', 'dvc', 'mix', 'ctu' wrapper nodes instead of the legacy 'rcar_sound,xxx' R-Car prefix. Wire up all 5 DMA controllers (dmac0-dmac4) for each audio sub-node with repeated channel names, so that the DMA core can pick the first available controller. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-27 12:17:12 +0000