| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"It was a fairly busy development cycle - the changes spread over from
the core side to leaf drivers, with lots of cleanups and enhancements.
Here we go, some highlights:
ALSA core:
- Extension of ALSA control component list ABI
- Locking optimization and RCU conversion of ALSA sequencer core
- A few hardening fixes for UMP and sequencer core
- Drop __bitwise and __force prefix from UAPI definitions
ASoC:
- Automatic DAI format selection code deployment across many drivers
- Sorting of register default tables to prevent ordering issues in
many drivers
- Lots of code cleanups and refactoring
- Updates in Qualcomm driver stack
- New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson
2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek
RT1321 VA1/2 and RT766/7
HD-audio:
- Support for AW88399 HD-audio side codec for Lenovo Legion laptops
- Support for Hygon and Lisuan HDMI controllers
- Robustness fixes for wild device binding
- Lots of quirks/fixups: Realtek and Conexant codecs for ASUS,
Lenovo, Acer, etc
USB-audio:
- Support for Pioneer DJ DJM-S11
- Scarlett2/FCP private URB notification fixes
- Extended quirk_flags to 64bit
- Hardening fixes for 6fire, bcd2000, usx2y
- Device-specific quirks for Mackie, Valeton, SPACETOUCH
General:
- Auto-cleanup for put_device() and firmware loading across multiple
platforms"
* tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits)
ALSA: hda: Fix connection list comparison in proc output
ALSA: docs: fix dead link to Intel HD-audio spec
ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio
ALSA: hda: Add Lisuan HDMI controller and codec support
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries
ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F)
ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57
ASoC: tas2783-sdw: do not treat read-only Controls as writable
ASoC: SOF: validate topology volume range before allocation
ASoC: cs35l56: Use IRQ provided by the SoundWire core
soundwire: bus_type: Create IRQ mapping before calling driver probe()
ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq()
ASoC: cs35l56: Request IRQ in cs35l56_common_probe()
ALSA: core: Fix use-after-free in snd_card_do_free()
ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df
ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control
ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper
ASoC: dt-bindings: es8316: Fix supply property constraints
ALSA: seq: midi: Serialize input teardown with event_input
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- fix long-standing force-feedback initialization race across the
subsystem (Dmitry Torokhov)
- switch to system_dfl_wq (Marco Crivellari)
AMD-SFH:
- support for tablet-mode switch for AMD SFH-based systems (Basavaraj
Natikar)
HyperX:
- support for HyperX QuadCast 2 (Benjamin Blume)
I2C-HID:
- support for devices that provide HID descriptor solely through
the ACPI _DSM method (XIE Zhibang)
Intel-THC-HID:
- support for full I2C bus config parameters (Even Xu)
Logitech:
- HID++ 2.0 repogrammable button support (Elliot Douglas)
- Bolt receiver support for HID++ devices (Erik Håkansson)
MSI:
- support for MSI Claw (Derek J. Clark)
Steam:
- initial support for 2026 Steam Controller (Vicki Pfau)
- support for sensor events on the 2025 Steam Controller (Vicki Pfau)
And many, many other fixes for various long standing issues that were
found by new modern tools, and quite a few device ID additions"
* tag 'hid-for-linus-2026081901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (146 commits)
HID: tmff: Use 64-bit arithmetic for force feedback scaling
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
HID: sensor: custom: Fix field sysfs group cleanup on failure
HID: sensor: custom: Fix use-after-free in enable_sensor
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
HID: haptic: don't write an uninitialized value to unhandled usages
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HID: steam: Zero out inputs when disabling gamepad mode
HID: steam: Clean up locking
HID: steam: Don't set feature reports when disconnecting
HID: steam: Fix wording of connect/disconnect logs
HID: steam: Initial 2026 Steam Controller support
HID: steam: Refactor registration
HID: logitech: add Bolt receiver support for Logitech HID++ devices
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
HID: universal-pidff: stop the device when force-feedback init fails
HID: haptic: move FF initialization into .input_configured()
HID: logitech-hidpp: move FF initialization to .input_configured()
HID: megaworld: move FF initialization to .input_configured()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon updates from Guenter Roeck:
"New drivers:
- Kandou KB9002 retimer
- PolarFire SoC temp/voltage sensor
- Eswin EIC7700 PVT sensor
- PMBus:
- Analog Devices MAX16545/MAX16550 and Volterra VT7505
- Monolithic MPQ82D00 and MPQ8646
- Silergy SQ24860
Added support to existing drivers:
- asus-ec-sensors: Support for ROG STRIX Z390-E GAMING, ProArt
Z690-CREATOR WIFI, ROG STRIX X870E-E GAMING WIFI7 R2, ROG CROSSHAIR
X870E HERO, and ROG Maximus Z790 Hero
- asus_rog_ryujin: Siupport for ROG Ryujin III
- ina2xx: Support for INA232
- k10temp: Per-CCD temperature monitoring for Zen5 Turin
- nct6775: List NCT5585D as supported chip
- nzxt-kraken3: Support for NZXT Kraken 2024 Elite
- sht3x: Support for GXCAS GXHT30
- tmp102: Add device IDs for TMP110 and TMP113
- yogafan: Support for LOQ 15IAX9, XiaoXin Pro 13ARE 2020, IdeaPad 3
15ALC6, Legion Pro 7 16AFR10H, Yoga Pro 7 14IAH10, Yoga 7 16ARP8,
and Lenovo LOQ 15IAX9
- PMBus:
- max20830: Support for max20830c and max20840c
- max34440: Support for MAX34452, and support for newer version of
max34451
- adm1275: Support for ROHM BD12780 and BD12790
Other notable changes:
- Constify various device attributes
- Remove redundant dev_err() and dev_err_probe() from various drivers
- applesmc: Convert to hwmon_device_register_with_info
- adt7470: Add thermal zone sensor support
- coretemp: Fix core_data leak on CPUs without PTS
- emc1403: Drop hysteresis for low limit temperature
- max6621: Fix various over- and underflow problems
- PMBus:
- Introduce pmbus_read_smbus_i2c_block_data() and use it in
various drivers
- Export and use pmbus_check_and_notify_faults()
- Let PMBus drivers report the supported PMBus revision
Various other minor fixes and improvements"
* tag 'hwmon-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (110 commits)
hwmon: (emc1403) Drop hysteresis for low limit temperature
hwmon: (coretemp) Fix core_data leak on CPUs without PTS
hwmon: (max6621) fix negative temperature offset and crit readings
hwmon: (max6621) fix temperature clamp range
hwmon: (asus_rog_ryujin) Add ROG Ryujin III White Edition
hwmon: (asus_rog_ryujin) Add ROG Ryujin III support
hwmon: (asus_rog_ryujin) Add per-device configuration
hwmon: (k10temp) Add per-CCD temperature monitoring for Zen5 Turin
hwmon: (tmp102) Add TMP113 device ID
hwmon: (tmp102) Add TMP110 device ID
hwmon: (nct6775) Add NCT5585D to list of supported chips
Documentation: hwmon: (nct6775) Add missing NCT6797D and NCT6798D
hwmon: (emc1403) Add regulator support
hwmon: (emc1403) Convert to use OF bindings
dt-bindings: hwmon: Document SMSC EMC1402/1403/1404/1428
hwmon: (asus-ec-sensors) add ROG STRIX Z390-E GAMING
hwmon: (sysfs) Allow drivers to register const attributes
hwmon: (corsair-psu) Update documentation
hwmon: (core) Use const APIs for the dynamically allocated sysfs attributes
hwmon: (core) Constify device attributes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog updates from Guenter Roeck:
"New Drivers:
- Nuvoton MA35D1
- Lenovo SE30G2 and SE60
Added support to existing drivers:
- snps,dw-wdt: Add RV1106 compatible
- apple,wdt: Add t6030, t6031, and t8132 compatibles
Other notable changes:
- New "dump" pretimeout governor
- Propagate errors from optional IRQ lookup
- Remove redundant dev_err() and dev_err_probe() messages
- npcm, qcom: Improved bootstatus reports
- realtek-otto: Change to use regmap API
- w83627hf_wdt: Report running watchdog, identify NCT6126
Various other minor fixes and improvements"
* tag 'watchdog-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (40 commits)
watchdog: orion_wdt: Propagate errors from optional IRQ lookup
watchdog: qcom: Propagate errors from optional IRQ lookup
watchdog: aspeed: Propagate errors from optional IRQ lookup
watchdog: stm32_iwdg: Propagate errors from optional IRQ lookup
watchdog: dw_wdt: Propagate errors from optional IRQ lookup
watchdog: mediatek: Propagate errors from optional IRQ lookup
watchdog: apple: Constify some structures
watchdog: pretimeout: Convert dump pretimeout governor to tristate
nmi: Export CPU backtrace APIs for loadable modules
watchdog: booke_wdt: Document unused parameter of __booke_wdt_disable()
watchdog: wdat_wdt: map registers that fall inside ACPI NVS
watchdog: Add Nuvoton MA35D1 watchdog driver support
dt-bindings: watchdog: Add MA35D1 Watchdog
watchdog: qcom: report bootstatus on IPQ9574 and IPQ5332
watchdog: qcom: report WDIOF_POWERUNDER in bootstatus
watchdog: sprd: Remove redundant dev_err()
watchdog: sama5d4: Remove redundant dev_err()
watchdog: realtek_otto: Remove redundant dev_err_probe()
watchdog: orion: Remove redundant dev_err()
watchdog: marvell_gti: Remove redundant dev_err_probe()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"Along with a lot of driver specific work we've got a couple of core
features here. The bigger one is that we've now got support for
instantiating devices from sysfs similarly to how it's already done
for I2C, this is used with development boards with non-enumerable
expansion headers since SPI devices need to be manually specified. We
also have support for the DQS signal on higher end flash devices.
- Support for instantiating devices from sysfs, useful for
development boards with non-enumerable plugin modules, from
Vishwaroop A.
- Support for DQS in spi-mem, an additional signal used by flash
devices to avoid clock skew from Miquel Raynal.
- Support for more advanced SPI modes on DesignWare controllers from
Sudip Mukherjee.
- Changes from Jisheng Zhang to update to modern methods of
specifying the PM callbacks.
- Fixes for DMA mapping error handling, plus KUnit tests for this,
from Honghui Jiang.
- Substantial cleanup and performance work in the nxp-spi driver.
- Support for Microchip LAN969x, Nuvoton MA35D1 QSPI, Qualcomm
SA8255p and SA8797P, and StarFive JHB100 SFC"
* tag 'spi-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (132 commits)
spi: Add KUnit coverage for DMA mapping error paths
spi: Clear current DMA devices when unmapping a message
spi: Move __spi_unmap_msg() before __spi_map_msg()
spi: Fix DMA mapping ownership on partial map failure
spi: dt-bindings: sun6i: Add compatibles for A733's SPI controllers
spi: ma35d1-qspi: Use the existing update helper
spi: ma35d1-qspi: Add DTR support
spi: ma35d1-qspi: Allow several command bytes
spi: ma35d1-qspi: Move speed setting to bus configuration
spi: ma35d1-qspi: Remove redundant reset operation
spi: dw: Remove shadowed dws in dw_spi_setup()
spi: img-spfi: don't disable runtime PM on DMA deferred probe
spi: mtk-nor: Propagate errors from IRQ request
spi: mtk-nor: Propagate errors from optional IRQ lookup
spi: spi-qpic-snand: Handle Macronix quad read opcode 0x6b
spi: spi-qpic-snand: add quad mode support
spi: spi-qpic-snand: move command mapping helper
spi: hisi-sfc-v3xx: Propagate errors from optional IRQ lookup
spi: meson-spifc: use devm_pm_runtime_set_active_enabled
spi: sprd-adi: Fix probe succeeding without registering the controller
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator updates from Mark Brown:
"This is a relatively quiet release for the regulator API, we've had no
major core work and not really that much driver work either. There's a
bunch of activity, including several new devices, but nothing hugely
remarkable here.
- Reworking of the mode handling in the max14577 driver to fix issues
with collisions with enables
- Support for onsemi FAN53555BUC23X, Qualcomm IPQ9650, PM4125 VBUS
and PM8150B and Unisoc SC2730"
* tag 'regulator-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (36 commits)
regulator: fan53555: Add support for FAN53555BUC23X type
regulator: qcom-rpmh: Fix coding style issues
regulator: qcom-rpmh: readback voltage/bypass/mode set during bootup
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
soc: qcom: rpmh: Add support to read back resource settings
regulator: dt-bindings: ti,pbias-omap: Convert to DT schema
regulator: ab8500: Remove stale expand_register kernel-doc entry
regulator: dt-bindings: Correct white-space style
regulator: pfuze100: add set_suspend_disable for LDO ops
regulator: core: use system_freezable_wq for init complete work
regulator: rt6245: Restore state on enable failure
regulator: tps65185: handle gpiod_get_value_cansleep() error returns
regulator: fan53555: Add support for mode operations on Silergy devices
regulator: dt-bindings: Add fan53555 allowed modes
regulator: wm831x-isink: remove conditional return with no effect
regulator: dt-bindings: Convert ltc3589.txt to yaml format
regulator: dt-bindings: tps51632: Convert to DT schema
regulator: mcp16502: Convert to dev_err_probe() in mcp16502_probe()
regulator: adp5055: Fix error code in adp5055_of_parse_cb()
regulator: qcom_usb_vbus: add support for qcom,pm4125-vbus-reg
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap updates from Mark Brown:
"This is a relatively busy release, though it's mostly cleanup work. We
did add some new hooks for regmap-irq to support some driver work,
that should also come in as part of a shared branch with the relevant
driver work in the GPIO subsystem"
* tag 'regmap-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: clean up kernel-doc comments
regcache: Validate cache_only state in regcache_sync_region()
regcache: Warn if regcache_sync() is called in cache_only mode
regcache: Mark cache dirty if selector register rewrite fails
regcache: Preserve cache synchronization errors in regcache_sync()
regmap: maple: Workaround for another false-positive compiler warning
regcache: Make ->exit() callback return void
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain updates from Ulf Hansson:
- amlogic: Add support for A9 power domains
- bcm: Raise ASB poll timeout to 100us for bcm2835-power
- imx: Allow building power domain drivers as a modules
- mediatek:
- Add support for the MT6858 power domains
- Add support for the MT8196 HFRP DirectCTL power domains
- qcom:
- Add support for RPMh power domains for Maili
- Skip retention by default for rpmhpd
- renesas: Add support for R-Car X5H Module Controller
- rockchip: Add a regulator to the RK3568 NPU power domain
- tegra: Add support for multi-socket platforms
* tag 'pmdomain-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (24 commits)
pmdomain: renesas: Add R-Car X5H MDLC driver
dt-bindings: power: Document Renesas R-Car X5H Module Controller
pmdomain: amlogic: Add support for A9 power domains controller
dt-bindings: power: Add Amlogic A9 power domains
clk: imx: imx8qxp: add soft dependency on SCU power domain driver
pmdomain: imx: scu-pd: allow building as a module
of: export of_stdout symbol
pmdomain: imx8m{p,}-blk-ctrl: Add MODULE_DESCRIPTION
pmdomain: mediatek: Add support for MT6858 SoC
pmdomain: mediatek: Add support for secure modem power domain control
dt-bindings: power: Add MediaTek MT6858 power domain controller
pmdomain: rockchip: Add a regulator to the RK3568 NPU power domain
pmdomain: imx: Make IMX8M/IMX9 BLK_CTRL tristate
dt-bindings: power: qcom,rpmpd: document RPMh power domain for Maili
pmdomain: tegra: Add support for multi-socket platforms
pmdomain: bcm: bcm2835-power: Raise ASB poll timeout to 100us
pmdomain: mediatek: Add support for MT8196 HFRP DirectCTL domains
pmdomain: mediatek: Add support for Direct CTL simple power sequence
pmdomain: mediatek: Respect PD relationships during error cleanup
dt-bindings: power: mediatek: Add support for MT8196 direct HFRP
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c updates from Andi Shyti:
"The main changes are support for shared SCL lines in i2c-gpio, a
larger qcom-geni update covering tracing and transfer recovery and
support for R-Car Gen5.
The rest is mostly smaller driver, core and DT binding updates.
Core and helpers:
- support bus recovery with single-ended GPIOs
- acpi: clean up resource handling
- acpi: force ELAN1300 to 100 kHz
- algo-bit: allow consumers to skip the optional bus test
Drivers:
- use generic bus frequency definitions in nomadik, octeon-core,
microchip-corei2c, k1, davinci and pnx
- i2c-gpio: support multiple buses sharing the same SCL line
- qup: propagate clock enable failures
- spacemit: configure SCL timing and clean up clock handling
- amd-asf: guard against oversized firmware length
qcom-geni:
- add tracepoints for bus setup, interrupts and errors
- use dedicated completion events for abort and reset
- distinguish address and data NACK handling
- cancel transfers before falling back to abort
- simplify runtime PM and resource management
- refactor resource and serial engine initialization
DT bindings:
- convert Altera bindings to DT schema
- convert Axxia bindings to DT schema
New support:
- R-Car Gen5 and R-Car X5H
- Axiado AX3005
- Qualcomm Nord SA8797P
- Qualcomm SA8255p"
* tag 'i2c-7.3-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (33 commits)
i2c: core: support recovery for single-ended GPIOs
i2c: rcar: add R-Car Gen5 support
dt-bindings: i2c: rcar-i2c: Document R-Car X5H support
i2c: i2c-gpio: Enhance driver for buses with shared SCL
i2c: algo: bit: Allow to skip bit test
i2c: qcom-geni: Add trace events for Qualcomm GENI I2C driver
i2c: qcom-geni: trace: Add trace events for Qualcomm GENI I2C
i2c: qup: Propagate clock enable failures
i2c: qcom-geni: distinguish address-phase and data-phase NACK
i2c: qcom-geni: use dedicated completions for abort and reset events
i2c: qcom-geni: use cancel command before abort on transfer timeout
dt-bindings: i2c: cdns: add Axiado AX3005 I2C variant
i2c: qcom-geni: Use devm_pm_runtime_enable() for PM management
dt-bindings: i2c: qcom,sa8255p-geni-i2c: Add compatible for Nord SA8797P
i2c: nomadik: Use generic definitions for bus frequencies
i2c: octeon-core: Use generic definitions for bus frequencies
i2c: microchip-corei2c: Use generic definitions for bus frequencies
i2c: k1: Use generic definitions for bus frequencies
i2c: davinci: Use generic definitions for bus frequencies
i2c: pnx: Use generic definitions for bus frequencies
...
|
|
Replace irq_of_parse_and_map() with platform_get_irq(), which resolves
the interrupt from pdev->dev.of_node directly and returns a positive IRQ
or a negative errno (it never returns 0). Propagate the error on failure
instead of the previous open-coded "IRQ missing or invalid" / -EINVAL
message, so -EPROBE_DEFER is handled correctly. The rtc->irq field is a
signed short, so the negative error code is preserved.
np is still used by of_property_read_u32() for "st,lpc-mode", so it is
not removed.
Built for ARM (multi_v7_defconfig + CONFIG_RTC_DRV_ST_LPC) with LLVM=1;
drivers/rtc/rtc-st-lpc.o compiles cleanly.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Link: https://patch.msgid.link/20260714002259.1392655-1-rosenp@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Use devm_device_init_wakeup() so we can avoid having to explicitly teardown
of module removal.
Link: https://patch.msgid.link/20260625130202.1621692-2-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Since the driver allocates the IRQ using devm_request_irq(), this means the
IRQ is going to be automatically unregistered by devres after
mv_rtc_remove() returns.
However, mv_rtc_remove() explicitly disables the hardware clock before
devres teardown happens so the interrupt handler may run while the clock is
disabled leading to a possible bus hang when accessing registers.
Link: https://patch.msgid.link/20260625130202.1621692-1-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The driver has a match table for the i2c bus wired into its driver
structure, but the table is not exported with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE() entry so module alias information
is generated for automatic module loading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the driver registration structure, and the missing module alias
publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704152528.53258-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704121734.54941-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio updates from Bartosz Golaszewski:
"GPIO core:
- extend the gpio-regmap abstraction layer with more features
allowing users to override configuration setting, translate
register values and masks and enable/disable interrupts
- extend GPIO kunit tests with suites verifying probe ordering by
software node devlink support and software node hogs
- shrink GPIO kunit initialization code
- coding style updates (remove commas from sentinels where
applicable)
- with all users now converted treewide to using real firmware node
links for software node GPIO lookup: remove the deprecated
label-matching mechanism from from GPIO core
- drop redundant return value check of nonseekable_open() in
gpiolib-cdev
- use IRQ trigger helpers where applicable
Driver updates:
- refactor error paths and logging in gpio-nomadik
- use more modern interfaces for getting resources in gpio-rockchip,
gpio-bt8xx and gpio-pca9570
- add missing MODULE_DEVICE_TABLE() to gpio-sifive and gpio-vf610
- drop unused FILONOFF macro from gpio-rcar
- extend build coverage of ioport GPIO drivers with COMPILE_TEST=y
- only enable the gpio-rtd driver by default with ARCH_REALTEK=y to
avoid bloating the build
- refactor coding style in several drivers
- use correct endianess translation in gpio-pcf85x
- add wake-up interrupt support to gpio-mvebu
- apply initial value in direction output setter in gpio-by-pinctrl
Misc:
- replace linux/gpio.h inclusions treewide with linux/gpio/legacy.h
which now exports all the deprecated APIs
- select GPIOLIB_LEGACY in Kconfig where required treewide
- use software nodes for gpio-keys in MFD drivers
Devicetree bindings:
- describe the realtek rtd1625 GPIO controller
- document new models for gpio-pca95xx and gpio-cadence
- document new property in gpio-rockchip"
* tag 'gpio-updates-for-v7.3-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (61 commits)
gpio: gpio-by-pinctrl: Apply initial value in direction output wrapper
dt-bindings: gpio: rockchip,gpio-bank: Add rockchip,grf property
gpio: Use IRQ trigger mask helpers
gpio: allow COMPILE_TEST for IOPORT drivers
gpio: realtek: Add driver for Realtek DHC RTD1625 SoC
gpio: regmap: Add IRQ enable/disable helpers
gpio: regmap: Add set_config callback
gpio: regmap: Add value_xlate callback
gpio: regmap: Add gpio_regmap_operation to extend reg_mask_xlate callback
gpio: regmap: Order kernel-doc descriptions with the actual appearance
gpio: regmap: Apply default resource callbacks for regmap IRQ chip
gpio: regmap: Provide default IRQ resource request and release callbacks
Revert "gpio: realtek: Add driver for Realtek DHC RTD1625 SoC"
gpib: gpio: replace linux/gpio.h inclusion
Input: matrix_keyboard - replace linux/gpio.h inclusion
phy: replace linux/gpio.h inclusions
pcmcia: replace linux/gpio.h inclusions
ASoC: replace linux/gpio.h inclusions
mfd: replace linux/gpio.h inclusions
sh: replace linux/gpio.h inclusions
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing updates from Bartosz Golaszewski:
"This a very tiny pull for v7.3 from the power sequencing tree. It only
contains a handful of updates to the pwrseq-pcie-m2 driver:
- add support for new devices to pwrseq-pcie-m2
- make device matching more fine-grained for cases where the same
combo chips are wired differently on the M.2 card (and - for
instance - don't require serial device creation because they expose
BT over USB) in pwrseq-pcie-m2"
* tag 'pwrseq-updates-for-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: pcie-m2: Match WCN6855 and WCN7851 UART BT variants by subdevice ID
power: sequencing: pcie-m2: Add QCA2066 (QCNFA765) BT serdev ID
power: sequencing: pcie-m2: Add PCI ID for NXP 88W9098 and AW693 Bluetooth
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux
Pull pwm updates from Uwe Kleine-König:
"A bunch of cleanups - in C and Rust - and a devicetree and driver
extension for a new SoC variant.
Thanks to Biju Das, Francis Laniel, Guru Das Srinagesh, Markus
Elfring, Mikko Perttunen, Thierry Reding, and Yi-Wei Wang for their
changes and further Alexandre Courbot, Benno Lossin, Chen Wang, Geert
Uytterhoeven, Jon Hunter, Laurent Pinchart, Michal Wilczynski, Mikko
Perttunen, and Rob Herring for valuable review feedback"
* tag 'pwm/for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
pwm: th1520: use vertical import style
rust: pwm: replace `core::mem::zeroed` with `pin_init::zeroed`
pwm: rzg2l-gpt: Drop unused rzg2l_gpt_chip parameter from rzg2l_gpt_calculate_prescale()
pwm: Use seq_putc() calls in pwm_dbg_show()
pwm: tegra: Add support for Tegra264
pwm: tegra: Parametrize duty and scale field widths
pwm: tegra: Modify read/write accessors for multi-register channel
pwm: tegra: Avoid hard-coded max clock frequency
pwm: tegra: Prefix driver-local macros and functions
dt-bindings: pwm: Document Tegra264 controller
pwm: lpss-pci: Unify coding style of pci_device_id array
pwm: Unify coding style of of_device_id arrays
pwm: Unify coding style of acpi_device_id arrays
pwm: Use named initializers for arrays of acpi_device_id
pwm: pca9685: Drop unused assignment of acpi_device_id driver data
pwm: pxa: Depend on OF and simplify accordingly
pwm: Use named initializers for platform_device_id arrays
pwm: mc33xs2410: Initialize spi_device_id arrays using member names
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- A new driver and device tree binding for Imagis ISA1200 haptic motor
controller
- Improvements to input core opening, closing and inhibiting devices,
ensuring devices are fully ready before delivering events, deferring
handler start() until the device is opened, resyncing state on
uninhibit, and rejecting inhibit requests during unregistration
- Updates to cap11xx capacitive touch driver to support Microchip
CAP1114, optional hardware reset GPIO handling, and per-chip LED
constraints
- Fixes for MELFAS MMS114 touchscreen driver hardening incoming data
parsing, endianness fixes for I2C packet layout, Y-resolution
configuration, and refactoring to use chip variant descriptors
- Updates for psmouse driver resolving a potential UAF during protocol
disconnect, cleaning up PNP ID matching, and making use of guard()
- Fix for FocalTech PS/2 protocol to prevent coordinate underflow and
cursor jumps at boundaries
- A change to Synaptics driver to enable InterTouch (SMBus) mode on
Dell Inspiron 3521
- Refactoring of PA-RISC keyboard support in gscps2 to supply keymaps
via software node device properties, removing architecture-specific
tables from the generic atkbd driver
- Updates to Samsung keypad driver to keep interrupts disabled while
device is closed, along with wakeup logic cleanups and use of
pm_runtime_active guards
- Updates to NXP i.MX SNVS power key driver to report press events
during resume to avoid lost events, and error handling cleanups
- Updated TCA8418 keypad driver enabling overflow mode per hardware
errata
- Conversion of ROHM BD718x7 and BD71828 PMIC drivers to instantiate
gpio-keys child devices using software nodes instead of platform data
(coming from MFD immutable branch)
- Updates to Synaptics RMI4 driver to use touchscreen dimensions from
platform data when specified
- Firmware update speed optimization for IC Type 0x19 in ELAN I2C
driver
- A fix to Azoteq IQS5xx driver to validate firmware record spans
against programmable map size
- Update to Samsung SUR40 contact count based on PixelSense
specification
- A number of updates to device tree bindings, including TI TPS65217
power button schema conversion and new compatibles for FocalTech
FT3D81 and Synaptics S3706B
- Other assorted driver cleanups, style fixes, and conversions to
modern string and cleanup helpers
* tag 'input-for-v7.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (61 commits)
Input: rmi4 - use platform data instead of query, when available
Input: elan_i2c - sort include statements
Input: elan_i2c - optimize update speed for IC Type 0x19.
Input: elan_i2c - use device-id/acpi.h for ACPI IDs
Input: reject inhibit and uninhibit requests on unregistering devices
Input: defer handler's start() until device is opened
Input: call handler->start() when uninhibiting device
Input: clear inhibited flag before re-opening device on uninhibit
Input: ensure device is ready before delivering events
Input: gscps2 - supply PA-RISC keyboard keymap via device property
Input: synaptics_i2c - return 0 explicitly on success
Input: rmi_smbus - remove conditional return with no effect
Input: pmic8xxx-keypad - remove conditional return with no effect
Input: focaltech - use signed coordinates to prevent underflow
Input: psmouse - use guard() for resource management
Input: psmouse - modernize PNP ID parsing
Input: psmouse - clean up locking around disable_work_sync()
Input: psmouse - fix use-after-free during protocol disconnect
Input: samsung-keypad - use pm_runtime_active guard
Input: samsung-keypad - keep interrupt disabled while closed
...
|
|
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Matthias Brugger <mbrugger@suse.com>
Reviewed-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
Link: https://patch.msgid.link/20260704122003.70108-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome platform firmware updates from Tzung-Bi Shih:
"Fixes:
- Don't map no-map memory regions for CBMEM entries
- Check bound of coreboot table entries
Cleanups:
- Fix typo in docs"
* tag 'chrome-platform-firmware-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
firmware: coreboot: Validate table bounds
firmware: coreboot: Skip no-map CBMEM entries
docs: ABI: testing: Fix typo
|
|
devm_clk_get_optional() returns NULL when the optional clock is absent,
but returns an ERR_PTR when the clock provider lookup fails. Probe
currently keeps the ERR_PTR and then passes it to clk_get_rate().
Return the lookup error instead. A truly absent optional clock still
reaches the existing calibration fallback through clk_get_rate(NULL).
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Fixes: 07dcc6f9c762 ("rtc: zynqmp: Add calibration set and get support")
Reviewed-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260624055524.38522-1-pengpeng@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Symbolic permissions S_IRUGO and S_IWUSR are deprecated in favor of
octal permissions. Replace S_IRUGO|S_IWUSR with 0644 and S_IRUGO
with 0444.
Signed-off-by: Jack Lee <skunkolee@gmail.com>
Link: https://patch.msgid.link/20260612223534.77412-1-skunkolee@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Reproducer:
1. server: systemctl start ksmbd
2. client: mount with `posix` option
mount -t cifs -o posix //${server_ip}/export /mnt
3. client: touch /mnt/file1 /mnt/file2
4. client: C program: int fd = open("/mnt/file2", O_RDONLY);
5. client: C program: rename("/mnt/file1", "/mnt/file2");
6. client: C program: struct stat stbuf; fstat(fd, &stbuf);
stbuf.st_nlink is 1, should be 0
This patch fixes xfstests generic/035 when mounted with `posix` option.
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
Commit 110fee6b9bb5 ("smb: client: fix missing timestamp updates with
O_TRUNC") introduced cifs_file_set_size(), which calls netfs_resize_file()
and cifs_setsize() on success. cifs_setsize() calls i_size_write(),
updating i_size to the new value. The subsequent blocks in both
cifs_setattr_unix() and cifs_setattr_nounix():
if ((attrs->ia_valid & ATTR_SIZE) &&
attrs->ia_size != i_size_read(inode)) {
truncate_setsize(inode, attrs->ia_size);
netfs_resize_file(&cifsInode->netfs, attrs->ia_size, true);
fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size);
}
are therefore unreachable on the success path: attrs->ia_size ==
i_size_read(inode) always holds after cifs_file_set_size() succeeds.
On the failure path, execution jumps to out/cifs_setattr_exit before
reaching these blocks.
truncate_setsize() and netfs_resize_file() are redundant with what
cifs_file_set_size() already did; fscache_resize_cookie() was moved there
by commit fa724e235cfd ("cifs: add fscache_resize_cookie() to
cifs_setsize()"). Remove both dead blocks.
Fixes: 110fee6b9bb5 ("smb: client: fix missing timestamp updates with O_TRUNC")
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Huiwen He <hehuiwen@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
cifs_remap_file_range() acquires i_rwsem on both inodes via
lock_two_nondirectories() before calling smb2_duplicate_extents().
cifs_setsize() (called inside smb2_duplicate_extents() when the clone
extends the file) therefore already runs under the lock, meaning the
fscache_resize_cookie() added to cifs_setsize() by commit fa724e235cfd
("cifs: add fscache_resize_cookie() to cifs_setsize()") is correctly
serialised for this path without further changes.
That same commit made the caller-side block:
if (rc == 0 && new_size > i_size) {
truncate_setsize(target_inode, new_size);
fscache_resize_cookie(cifs_inode_cookie(target_inode), new_size);
}
redundant: smb2_duplicate_extents() already performs the full size update
via cifs_setsize() when the operation extends the file. Remove the
now-dead block.
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Huiwen He <hehuiwen@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
i_rwsem
cifs_setsize() calls fscache_resize_cookie() without holding i_rwsem.
When the fscache cookie is active (FSCACHE_COOKIE_IS_CACHING is set),
fscache_resize_cookie() performs a real resize that requires i_rwsem
held exclusively. If another file descriptor has the same inode open,
fscache_use_cookie() was already called from that cifs_open(), making
the cookie active. In that case, calling cifs_setsize() from
cifs_do_truncate() (invoked from cifs_open() without i_rwsem) races
against concurrent fscache I/O.
Strip fscache_resize_cookie() from cifs_setsize(), making it a pure
size/page-cache helper. Add cifs_resize_file_locked() for callers
that already hold i_rwsem: it calls netfs_resize_file() and
cifs_setsize(), then temporarily activates the cookie with
fscache_use_cookie() to perform the resize under the lock, then
deactivates it with cifs_fscache_unuse_inode_cookie(). Using
fscache_use_cookie() before the resize ensures correctness whether or
not another fd already holds the cookie active.
Switch cifs_file_set_size(), smb2_duplicate_extents(), and both size-
extension branches of smb3_simple_falloc() to the new wrapper; those
paths already hold i_rwsem via VFS setattr, lock_two_nondirectories(),
or cifs_fallocate() respectively. cifs_do_truncate() continues to
call cifs_setsize() followed by cifs_invalidate_cache(), since it runs
without i_rwsem.
Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()")
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it
cannot use cifs_resize_file_locked() to perform a proper fscache cookie
resize. Instead, add cifs_invalidate_cache() after cifs_setsize().
cifs_invalidate_cache() calls fscache_invalidate(), which works without
holding i_rwsem: it unconditionally increments inval_counter and sets
FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not
served once the cookie is later activated by fscache_use_cookie().
Truncation to zero leaves no valid cached data, making invalidation the
correct semantic here.
Fixes: fa724e235cfd ("cifs: add fscache_resize_cookie() to cifs_setsize()")
Cc: stable@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
When free_tgts() frees all structures in ce->tlist, ce->tgthint
is left pointing to one of the freed cache_dfs_tgt structures.
If ce->tgthint is not reset before it is used later, it results
in a use-after-free.
Set ce->tgthint to NULL in free_tgts() after the elements are
freed to reflect that no elements remain.
Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines")
Cc: stable@vger.kernel.org # depends on: smb: client: harden DFS cache against invalid target hints
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
Currently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is
NULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always
valid.
In preparation for clearing ce->tgthint in free_tgts(), harden callers
of get_tgt_name() against ERR_PTR results and harden
dfs_cache_noreq_update_tgthint() against NULL pointer dereferences.
Cc: stable@vger.kernel.org
Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
extensions
When a file has the setuid or setgid bit set and is written to, the VFS
strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID
together with an ATTR_MODE carrying the already-cleared mode.
Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped
ATTR_MODE in that case:
/* skip mode change if it's just for clearing setuid/setgid */
if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
attrs->ia_valid &= ~ATTR_MODE;
This is fine for the default mount, where the mode is only emulated via
the DOS read-only attribute and cannot represent the setuid/setgid bits
anyway. However, with the "cifsacl" or "modefromsid" mount options the
mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with
the SMB3.1.1 POSIX extensions the mode is sent to the server directly,
and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent
via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means
the cleared mode is never pushed to the server, so the setuid/setgid bit
survives the write.
This is a security issue: on local filesystems the setuid bit is stripped
when a file is written, but over these cifs.ko mounts the bit persists on
the server, potentially allowing an unexpected privilege escalation on
subsequent execution.
Fix this in two places:
1. cifs_setattr_nounix(): only take the "skip mode change" shortcut
when the mode is emulated via the DOS read-only attribute (i.e.
neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are
in effect), so that the cleared mode is propagated to the server
in the ACL / POSIX cases.
2. cifs_setattr_unix(): this function is only called when Unix
extensions are in effect, so the mode is always stored on the
server. Remove the shortcut entirely so that the cleared mode is
always pushed.
Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
smb2_async_readv() and smb2_async_writev() end with the same
send-error block: if the error is replayable and smb2_should_replay()
agrees, tell netfs to retry the subrequest. The write path also sets
wdata->replay. The read path does not set rdata->replay.
smb2_should_replay() is not a pure predicate. It consumes the retry
budget and computes the exponential back-off, doubling cur_sleep up to
CIFS_MAX_SLEEP. That back-off is only applied where the replay flag is
tested at the top of the reissued request:
if (rdata->replay) {
/* Back-off before retry */
if (rdata->cur_sleep)
msleep(rdata->cur_sleep);
smb2_set_replay(server, &rqst);
}
So on the read path the back-off is recomputed on every send-error
retry and then discarded, and SMB2_FLAGS_REPLAY_OPERATION is not set
on the reissued request.
netfs does not pace the retry either. netfs_reissue_read() calls
->issue_read() directly, and fs/netfs/read_retry.c contains no delay
of its own, so read send-error retries reissue immediately while the
equivalent write retries back off.
The read response callback already sets rdata->replay under the same
conditions, so the read path does use the replay mechanism. Only this
send-error path omits it.
Where the back-off belongs was settled while the commit below was
under review. David Howells asked whether netfslib should be doing the
back-off [1], and objected to sleeping inside the response callback
because that runs in the cifsd thread and would stall the socket [2].
The sleep was therefore taken out of smb2_should_replay() and moved to
just before the replay in smb2_async_readv() and smb2_async_writev()
[3]. Setting the flag here preserves that arrangement: the sleep still
happens at the top of the reissued request, not in a callback.
Set rdata->replay here, matching smb2_async_writev().
Fixes: 2c1238a7477a ("cifs: make retry logic in read/write path consistent with other paths")
Link: https://lore.kernel.org/all/1652858.1769038134@warthog.procyon.org.uk/ [1]
Link: https://lore.kernel.org/all/1653031.1769038583@warthog.procyon.org.uk/ [2]
Link: https://lore.kernel.org/all/CANT5p=pXP3+CywpmK-on2uTvxO3S=31_B85_UDR7RoK1dQVtMA@mail.gmail.com/ [3]
Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-5
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
smb2_new_read_req() allocates the request buffer with
smb2_plain_req_init() but only publishes it to the caller with
*buf = req at the very end of the function. Two error returns sit in
between:
rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,
(void **) &req, total_len);
if (rc)
return rc;
if (server == NULL)
return -ECONNABORTED;
[...]
rdata->mr = smbd_register_mr(server->smbd_conn,
&rdata->subreq.io_iter,
true, need_invalidate);
if (!rdata->mr)
return -EAGAIN;
On either of them the buffer is neither released nor handed back, so
it is leaked. The caller cannot clean up after it: smb2_async_readv()
does 'goto out' on a non-zero return, which skips the
cifs_small_buf_release(buf) at async_readv_out, and buf has not been
assigned at that point in any case.
The write path has never had this problem. smb2_async_writev()
registers the memory region inline and jumps to its release label
instead of returning:
wdata->mr = smbd_register_mr(...);
if (!wdata->mr) {
rc = -EAGAIN;
goto async_writev_out;
}
Commit b7972092199f ("cifs: smbd: Retry on memory registration
failure") changed both sides from -ENOBUFS to -EAGAIN in a single
patch, which puts the two shapes next to each other.
Only the -EAGAIN return is reachable in practice, because
smb2_plain_req_init() calls smb2_reconnect() first and that already
fails with -EIO when server is NULL, before anything is allocated.
Both returns are given the same treatment here rather than leaving
one of them correct only by accident.
Because -EAGAIN is a replayable error, the failure also reaches the
retry block at the end of smb2_async_readv(), which marks the
subrequest NETFS_SREQ_NEED_RETRY, so a failing registration can be
retried rather than ending the I/O, and every attempt that reaches it
leaks another buffer. smb2_should_replay() short-circuits on
tcon->retry, so on a hard mount the attempt count is not bounded by
the retrans setting.
Only the asynchronous read path is affected. The synchronous
SMB2_read() caller passes rdata == NULL and the memory registration
block is guarded on rdata.
The memory registration failure path was pointed out by the Sashiko
AI reviewer while it was reviewing an unrelated patch to
smb2_async_readv().
Fixes: bd3dcc6a22a9 ("CIFS: SMBD: Upper layer performs SMB read via RDMA write through memory registration")
Link: https://sashiko.dev/#/patchset/20260729192002.876156-1-clusk%40northecho.dev
Link: https://lore.kernel.org/all/20260729192002.876156-1-clusk@northecho.dev/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Christopher Lusk <clusk@northecho.dev>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
Some SMB servers return STATUS_OBJECT_NAME_NOT_FOUND or
STATUS_DELETE_PENDING when creating an O_TMPFILE.
The SMB client maps them to ENOENT.
The ENOENT error is supposed to be returned when the path
(a target directory in this case) does not exist, while a
lack of support of O_TMPFILE by the target file system should
be indicated by EOPNOTSUPP.
Reported-by: Mikhail Stefantsev <mikhail@mstefan99.com>
Fixes: 3e7d63037a2b ("smb: client: add support for O_TMPFILE")
Closes: https://lore.kernel.org/linux-cifs/75fb5359-b268-492d-8d4a-504d1af60f2a@app.fastmail.com/
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux
Pull chrome platform updates from Tzung-Bi Shih:
"New:
- Add post_power_on_delay_ms for Hana in of_hw_prober
Improvements:
- Use dumb trackpad prober for Spherion in of_hw_prober
Fixes:
- Check bound of firmware-reported data in cros_ec_sensorhub and
cros_ec_typec
- Fix memory overread in cros_ec_sensorhub
- Fix resource leak in cros_ec_debugfs
- Clamp payload length for LIGHTBAR_CMD_SET_PROGRAM_EX in
cros_ec_lightbar
Cleanups:
- Drop unused platform_device_id driver data
- Remove redundant log"
* tag 'chrome-platform-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
platform/chrome: of_hw_prober: Add delay for hana trackpads
platform/chrome: lightbar: Limit payload to max packet size
platform/chrome: cros_ec_debugfs: Unregister panic notifier
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
platform/chrome: cros_ec: Remove redundant dev_err()
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
platform/chrome: sensorhub: Fix memory overread in ring handler
platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
platform/chrome: of_hw_prober: Use dumb trackpad prober for Spherion
platform/chrome: Drop unused assignment of platform_device_id driver data
platform/chrome: sensorhub: Bound the EC-reported sensor number
|
|
When pending disconnecting queues exceed the backlog limit, the
connect path only drops the device reference and leaks the newly
allocated queue and its IB resources.
Fixes: badc53620fe8 ("nvme: target: rdma: fix ndev refcount leak on queue connect")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
Currently NVMe fault injection applies to every command routed through
nvme_should_fail(), which makes it hard to target a specific command
type when reproducing an issue in error-handling paths.
Add an "opcode" debugfs attribute alongside the existing "status" and
"dont_retry" knobs. It defaults to 0xffff, meaning "match any opcode"
and preserving the previous behavior. When set to a valid opcode
(<= 0xff), fault injection is only considered for commands whose opcode
matches.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
nvme_query_fdp_info() is called per-path and therefore prone to races.
It populates head->nr_plids/head->plids for fdp registration.
But nothing protects that pair from concurrent access - two paths scanning
the same namespace can race to populate it.
Avoid the race by moving this initialization work to nvme_alloc_ns_head()
which is called once per shared namespace.
Fixes: 30b5f20bb2dd ("nvme: register fdp parameters with the block layer")
Reported-by: Hari Mishal <harimishal1@gmail.com>
Link: https://lore.kernel.org/linux-nvme/20260725135111.14041-2-harimishal1@gmail.com/
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
so that it becomes possible to submit non-admin commands.
This is a prep patch with no functional changes.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
On -EIO, the RDMA queue_rq path reports a host path error and then
still cleans up the command and unmaps the SQE DMA. The path error
helper completes the request, so that is double cleanup and DMA unmap
after the request is already complete.
Unmap the SQE first, then report the host path error. Skip the outer
command cleanup on that path.
Fixes: 62eca39722fd ("nvme-rdma: handle nvme_rdma_post_send failures better")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
nvme_query_zone_info() returns either a negative errno or a positive
NVMe status code, but nvme_update_ns_info_block() only tests for the
negative case:
ret = nvme_query_zone_info(ns, lbaf, &zi);
if (ret < 0)
goto out;
If the device fails the Identify Namespace (I/O Command Set specific)
command, or the Identify Controller command issued by
nvme_set_max_append(), the positive status falls through and setup
continues with the zero-initialized zone info. nvme_update_zone_info()
then marks the queue zoned with chunk_sectors and ns->head->zsze set to
zero.
blk_validate_zoned_limits() does not check chunk_sectors, so the limits
commit succeeds. blk_revalidate_disk_zones() does reject the zero zone
size, but by then the limits are live and nothing rolls them back, so
I/O keeps being submitted to a zoned queue with a zero zone size and
disk_zone_no() shifts by ilog2(0):
nvme0n1: Invalid non power of two zone size (0)
UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16
shift exponent -1 is negative
disk_zone_no include/linux/blkdev.h:747 [inline]
bio_straddles_zones include/linux/blkdev.h:1058 [inline]
blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline]
blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605
blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196
submit_bh_wbc+0x575/0x740 fs/buffer.c:2824
__block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933
Any device, firmware or NVMe-oF target that fails this one command
reaches this.
Skip the zoned limits update in that case, and log which of the two
things happened: during a revalidation the queue keeps the zone
geometry it was last validated with, and on a first scan the namespace
is registered without zoned limits, so that it is still available as a
handle for admin commands. Neither of the paths in
nvme_query_zone_info() that return a positive status logs anything, so
the failure would otherwise be silent.
zi.zone_size is an exact indicator: every path that returns a positive
status returns before it is assigned, and after that the only failure
left is -ENODEV, which the caller already handles.
Found by FuzzNvme.
Fixes: c85c9ab926a5 ("nvme: split nvme_update_zone_info")
Cc: stable@vger.kernel.org
Cc: Weidong Zhu <weizhu@fiu.edu>
Suggested-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Chao Shi <coshi036@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
p1_rtc_read_time() called if (!regmap_test_bits(regmap, RTC_CTRL, RTC_EN))
to check if the RTC was enabled.
regmap_test_bits() returns 1 if the bit is set, 0 if not set, and a
negative error code (e.g. -EIO) if reading the control register fails.
Using !regmap_test_bits(...) evaluates a negative error code as boolean
false, causing I2C/regmap read failures to be ignored and incorrectly
proceeding to read time registers from a failing device.
Fix this by capturing the return value of regmap_test_bits() and returning
the error code if negative, or -EINVAL if the RTC is disabled.
Fixes: a6de182daa2b ("rtc: spacemit: support the SpacemiT P1 RTC")
Reviewed-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Surendra Singh Chouhan <kr494167@gmail.com>
Link: https://patch.msgid.link/20260724135803.81223-1-kr494167@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
nvme_tcp_handle_c2h_data() finds the request by command id and checks
that it has a payload, but it does not check that the command asked for
data to be read. A controller that answers a write command with C2HData
therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits
WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that
into -EFAULT and resets the controller.
No data is copied, so this is not memory corruption. What a controller
gets is a kernel warning it can raise at will, which is fatal on a host
booted with panic_on_warn.
The send path already knows the direction - it consults rq_data_dir()
when it builds a command - and nvme_tcp_handle_r2t() checks the length
and the offset of the request it names. The C2HData path does not check
the direction at all.
Reject a C2HData PDU whose command is not a read. Rejecting it fails
the command and resets the controller, as the neighbouring check in this
function does; what goes away is the warning.
[ 6.885580] ------------[ cut here ]------------
[ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71
[ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
[ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work
[ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330
[ 6.903739] Call Trace:
[ 6.904085] <TASK>
[ 6.909254] __skb_datagram_iter+0x433/0x820
[ 6.911026] skb_copy_datagram_iter+0x37/0x120
[ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320
[ 6.913378] __tcp_read_sock+0x1ab/0x810
[ 6.915788] nvme_tcp_try_recv+0x152/0x1e0
[ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0
[ 6.926906] </TASK>
[ 6.927226] ---[ end trace 0000000000000000 ]---
[ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data
[ 6.928709] nvme nvme0: receive failed: -14
Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Cc: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
|
|
Andrey Golovko <andrey.golovko@gmail.com> says:
v1 was a single patch that powered the SDCA Function up in the port
PRE_PREP callback:
https://lore.kernel.org/all/20260813001500.9218-1-andrey.golovko@gmail.com/
Mark asked whether that does the right thing when userspace restarts the
stream with SNDRV_PCM_IOCTL_RESUME instead of preparing it, and pointed
out that a stream can also be suspended while prepared; Vijendar agreed.
The answer to the first question is no, and it is reproducible on this
machine, so v2 adds a patch to fix that path. The second case turns out
to be a wider gap that neither patch closes; it is described at the end.
Measured on an ASUS ProArt PX13 HN7306EAC (AMD ACP7.0, two TAS2783 on
SDW1). A test program plays a 440/660 Hz tone straight to the hw
device, the machine goes through an s2idle cycle, and on -ESTRPIPE the
program calls snd_pcm_resume() only - never snd_pcm_prepare(). The tone
is measured through the internal microphone against the noise floor of
the same run, and the peripheral registers are read out of band.
With v1 alone (broonie/sound for-next + v1):
before suspend after snd_pcm_resume()
DP1 PrepareCtrl 0x1 / 0x2 0x0 / 0x0
PDE23 req / act 0x0 / 0x0 0x3 / 0x3
tone 440 / 660 Hz +65.5 / +75.2 dB -1.7 / +1.8 dB
snd_pcm_resume() returned 0 and the PCM stayed RUNNING, so nothing in
the stack reported a failure - the speakers were simply silent. The
ports were never prepared again, so the PRE_PREP callback v1 relies on
was never reached.
With this series:
before suspend after snd_pcm_resume()
DP1 PrepareCtrl 0x1 / 0x2 0x1 / 0x2
PDE23 req / act 0x0 / 0x0 0x0 / 0x0
tone 440 / 660 Hz +73.7 / +88.3 dB +73.7 / +88.5 dB
ChannelEn also moved to the other bank across the cycle, as it should
when the ports are prepared afresh.
The ordinary path is unaffected. The same test recovering with
snd_pcm_prepare() instead of snd_pcm_resume(), on the same build, gives
+79.8 / +86.9 dB after the cycle with the ports prepared and the bank
switched back.
This also explains the negative test Robin Everaars reported for v1 on
the same board earlier today: playback opened without an error, both
amplifiers stayed attached, and the speakers were silent - which is what
this path looks like from userspace.
The case this series does not cover
===================================
A stream that is suspended while merely PREPARED never sees a trigger at
all: snd_pcm_do_suspend() returns early when the stream is not running,
and snd_pcm_do_resume() returns early unless the suspended state was
RUNNING or DRAINING. Userspace then calls snd_pcm_start(), the ports
are enabled, and the peripheral has lost its port state without anything
in the path noticing. Patch 1 cannot help there - the SoundWire stream
is still SDW_STREAM_PREPARED, so sdw_prepare_stream() is a no-op by
design - and neither can the codec, which has no way to tell the core
that its ports went away.
The bus does know: the peripheral goes UNATTACHED and comes back
uninitialized. Making that invalidate the prepared state of the streams
it takes part in looks like the right place to me, but it is a core
change and I have not written it. Say if it belongs in this series.
Link: https://patch.msgid.link/20260813194000.10412-1-andrey.golovko@gmail.com
|
|
A Data Port cannot complete channel preparation while the SDCA Function
is powered down: the peripheral raises the channel's bit in
DPn_PrepareStatus and never clears it.
tas_sdw_hw_params() takes care of that for a stream that is being set
up, and the retry loop there says so - "ensure power on so that port
prepare succeeds". Port preparation, however, also happens on a stream
that is merely re-prepared, without hw_params() running again. That is
what userspace does after a suspend in which the peripheral lost power:
snd_pcm_prepare() reaches .prepare and sdw_prepare_stream(), the port is
prepared afresh, but PDE23 is still at the PS3 reset default because
nothing wrote it since the device came back.
The result is silence with no error anywhere. The codec sets
simple_ch_prep_sm, so sdw_prep_deprep_slave_port() skips the
NOT_PREPARED poll, and a port that never prepares is indistinguishable
from a healthy one.
Power the Function up in the PRE_PREP callback, immediately before the
PrepareCtrl write it already performs, so that preparation has what it
needs on every path that prepares a port.
Measured on an ASUS ProArt PX13 (AMD ACP7.0, two TAS2783): after s2idle
with ~100 s of S0i3 residency, DPn_PrepareStatus stays at the channel
mask and there is no audio; writing PDE23 PS0 and re-issuing the prepare
clears it within 1 ms and audio returns.
Signed-off-by: Andrey Golovko <andrey.golovko@gmail.com>
Link: https://patch.msgid.link/20260813194000.10412-3-andrey.golovko@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
A peripheral loses its Data Port configuration when the controller is
power-gated during system suspend, so the ports have to be prepared
again before the stream can be enabled. That happens on its own when
userspace calls snd_pcm_prepare() after SNDRV_PCM_STATE_SUSPENDED, but
an application is also allowed to restart the stream with
SNDRV_PCM_IOCTL_RESUME on a card that advertises SNDRV_PCM_INFO_RESUME,
as the AMD ACP platforms do. That path only reaches the trigger
callback, sdw_enable_stream() writes the channels of ports that were
never prepared, and playback silently produces nothing: the PCM keeps
running, no error is reported anywhere, and the speakers stay quiet
until the stream is torn down and set up again.
Prepare the stream on SNDRV_PCM_TRIGGER_RESUME, before enabling it.
The SoundWire core expects exactly this: sdw_prepare_stream() accepts a
disabled stream and then reapplies the bus parameters without
recomputing them, which it documents as the resume case.
Signed-off-by: Andrey Golovko <andrey.golovko@gmail.com>
Link: https://patch.msgid.link/20260813194000.10412-2-andrey.golovko@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Unlike the CRTC degamma path, which is guarded by
amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never
validated before use. __set_dm_plane_degamma() passed the user-supplied
size straight into __is_lut_linear() and, for a non-linear LUT, into
__set_input_tf() -> __drm_lut_to_dc_gamma(), the latter always iterating
MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size.
A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus
trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in
__drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not
match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already
asserts a few lines below (and which the CRTC path enforces).
The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with
AMD_PRIVATE_COLOR defined.
Fixes: 980f8710075a ("drm/amd/display: add plane degamma TF and LUT support")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
__is_lut_linear() computes the expected value of each entry with
expected = i * MAX_DRM_LUT_VALUE / (size - 1);
If it is ever called with a single-entry LUT, size - 1 is zero and the
kernel takes a divide error (#DE). A LUT with fewer than two entries
cannot describe a linear mapping anyway, so return false early instead
of dividing by zero.
Fixes: 086247a4b2fb ("drm/amd/display: Use 4096 lut entries")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
If we end up emitting a VM fence keep pipeline sync
associated with that fence. If not, emit them as
part of the IB fence.
v2: fix need_pipe_sync handling
v3: simplify the function
Cc: David Rosca <david.rosca@amd.com>
Fixes: cb1e657ccac8 ("drm/amdgpu: handle GDS and SPM without a VM fence")
Reviewed-by: David Rosca <david.rosca@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression
6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting
the parser loop far past the end of the message BO. Triggering it
additionally requires a ~4GiB mapping so that msg[1] survives the
earlier "header does not fit in BO" check.
Rewrite the test in division form, which is overflow-free by
construction. Also update the message to reflect that msg is invalid.
Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg")
Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: stable@vger.kernel.org
Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
|
The Apple iMac11,1 (27-inch, Late 2009) uses a Mobility Radeon HD 4850
(RV770/DCE3.1) with a 2560x1440 internal panel on an internal
DisplayPort path. Without this fix the display stays dark under KMS.
This machine suffers from the same issue as iMac10,1 and iMac11,2:
Apple routes the internal display through Link B of the DIG encoder
instead of Link A. Add iMac11,1 to the existing DMI quirk and move
the Apple-specific encoder assignment into its own block, independent
of the DCE version check.
Additionally, the 2560x1440 panel requires RADEON_PLL_USE_FRAC_FB_DIV
and ATOM_ENCODER_CMD_DP_VIDEO_ON, limited to iMac11,1 via dmi_match()
to avoid affecting other boards.
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Gilles Risch <gilles.risch@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
|
