summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-18net: llc: make empty have static storage durationWentao Guan
Make @empty have static storage duration (like net/sysctl_net.c does) to avoid storing a bad pointer, and keep consistent with __register_sysctl_table @table 'should not be free'd after registration'. Note that this is _not_ a bug, since size is 0 the pointer will never get deferenced. Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260616064053.690154-1-guanwentao@uniontech.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18dpaa2-switch: fix VLAN upper check not rejecting bridge joinIoana Ciornei
The blamed commit refactored the prechangeupper event handling but failed to actually return an error in case dpaa2_switch_prevent_bridging_with_8021q_upper() detected a 802.1q upper on a port which tries to join a bridge. Fix this by returning err instead of 0. Fixes: 45035febc495 ("net: dpaa2-switch: refactor prechangeupper sanity checks") Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260616105430.3725910-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18virtio-net: fix len check in receive_big()Xiang Mei
receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. Fixes: 0c716703965f ("virtio-net: fix received length check in big packets") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com> Link: https://patch.msgid.link/20260616042837.2249468-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18Merge branch 'net-sched-act_ct-preserve-tc_skb_cb-across-defragmentation'Jakub Kicinski
Zihan Xi says: ==================== net/sched: act_ct: preserve tc_skb_cb across defragmentation ==================== Link: https://patch.msgid.link/cover.1781358691.git.xizh2024@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18selftests/tc-testing: act_ct: add TDC test for skb cb preservation across defragZihan Xi
Add a tc-testing case that sends IPv4 fragments through act_ct on clsact egress while a root prio qdisc is present on the transmit path. The test verifies that packet processing and qdisc accounting continue to work after conntrack defragmentation, covering tc_skb_cb preservation across defragmentation. Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Link: https://patch.msgid.link/53493549fdbcb2de25788b7894c56baadbc5fede.1781358692.git.xizh2024@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18net/sched: act_ct: preserve tc_skb_cb across defragmentationZihan Xi
tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), matching the pattern used by ovs_ct_handle_fragments(). Fixes: ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") Cc: stable@vger.kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Link: https://patch.msgid.link/510c51217fd7aaf29c6dc298bab8d643fe229b1c.1781358692.git.xizh2024@lzu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-18Merge tag 'media/v7.2-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2: - core: fix subdev sensor ownership - subdev: Allow accessing routes with STREAMS client capability - ctrls: Add validation for HEVC active reference counts and background detection control - common: Add YUV24 format info and has_alpha helper - vb2: Change vb2_read() and vb2_write() return types to ssize_t - i2c: cvs: Add driver of Intel Computer Vision Sensing Controller(CVS) - atmel-isc: remove deprecated driver - cec: Add CEC Latency Indication Protocol (LIP) support - imon: Add iMON VFD HID OEM v1.2 key mappings - AVMatrix: new HWS capture driver - isp4: new AMD capture driver - qcom: - iris: Add hierarchical coding, B-frame, and Long-Term Reference support for encoder - camss: Add SM6350 platform support - venus: Add SM6115 platform support - chips-media: wave5: Add support for Packed YUV422, CBP profile, and background detection - csi2rx: Add multistream support and 32 dma chans - Several cleanups and fixes * tag 'media/v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (394 commits) media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() media: qcom: iris: vdec: allow GEN2 decoding into 10bit format media: qcom: iris: vdec: update find_format to handle 8bit and 10bit formats media: qcom: iris: vdec: update size and stride calculations for 10bit formats media: qcom: iris: gen2: add support for 10bit decoding media: qcom: iris: add QC10C & P010 buffer size calculations media: qcom: iris: add helpers for 8bit and 10bit formats media: qcom: iris: Fix FPS calculation and VPP FW overhead media: qcom: camss: vfe-340: Support for PIX client media: qcom: camss: vfe-340: Proper client handling media: qcom: camss: csid-340: Enable PIX interface routing media: qcom: camss: csid-340: Add port-to-interface mapping media: qcom: camss: csid-340: Switch to generic CSID_CFG/CTRL registers media: iris: Initialize HFI ops after firmware load in core init media: iris: drop struct iris_fmt media: iris: Add platform data for X1P42100 media: iris: Add hardware power on/off ops for X1P42100 media: iris: optimize COMV buffer allocation for VPU3x and VPU4x media: iris: add FPS calculation and VPP FW overhead in frequency formula media: qcom: iris: Simplify COMV size calculation ...
2026-06-18string: Remove strncpy() from the kernelKees Cook
strncpy() has been a persistent source of bugs due to its ambiguous intended usage and frequently counter-intuitive semantics: it may not NUL-terminate the destination, and it unconditionally zero-pads to the full length, which isn't always needed. All former callers have been migrated[1] to: - strscpy() for NUL-terminated destinations - strscpy_pad() for NUL-terminated destinations needing zero-padding - strtomem_pad() for non-NUL-terminated fixed-width fields - memcpy_and_pad() for bounded copies with explicit padding - memcpy() for known-length copies Remove the generic implementation, its declaration, the FORTIFY_SOURCE wrapper, and associated tests. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18Merge tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxlLinus Torvalds
Pull CXL updates from Dave Jiang: "A collection of CXL fixes and changes, including an update to MAINTAINERS to add Ming Li as a CXL subsystem reviewer. There's also a series to introduce devm_cxl_probe_mem() core API in order to pave the way for CXL type2 device drivers to setup and retrieve CXL region resource during probe" * tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (26 commits) cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation cxl/region: Fill first free targets[] slot during auto-discovery cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() tools/testing/cxl: Resolve auto-region decoder targets like real HW cxl: Align interleave decode/encode helpers with their callers cxl/test: Add check after kzalloc() memory in alloc_mock_res() cxl/test: Unregister cxl_acpi in cxl_test_init() error path cxl/test: Zero out LSA backing memory to avoid leaking to user cxl/test: Fix integer overflow in mock LSA bounds checks cxl/test: Verify cmd->size_in before accessing payload cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING cxl/region: Avoid variable shadowing in region attach paths cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses cxl/pci: Fix the incorrect check of pci_read_config_word() return ...
2026-06-18xtensa: Remove arch-specific strncpy() implementationKees Cook
strncpy() has no remaining callers in the kernel[1]. Remove the xtensa-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18x86: Remove arch-specific strncpy() implementationKees Cook
strncpy() has no remaining callers in the kernel[1]. Remove the x86-32-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18powerpc: Remove arch-specific strncpy() implementationKees Cook
strncpy() has no remaining callers in the kernel[1]. Remove the powerpc-specific assembly implementation from both the kernel (arch/powerpc/lib/string.S) and the boot wrapper (arch/powerpc/boot/string.S), along with the __HAVE_ARCH_STRNCPY define and declaration, falling back to the generic version in lib/string.c. The boot wrapper's strncpy had no callers in arch/powerpc/boot/. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18m68k: Remove arch-specific strncpy() implementationKees Cook
strncpy() has no remaining callers in the kernel[1]. Remove the m68k-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18alpha: Remove arch-specific strncpy() implementationKees Cook
strncpy() has no remaining callers in the kernel[1]. Remove the alpha-specific assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. The __stxncpy helper (stxncpy.S/ev6-stxncpy.S) is retained as it is still used by strncat. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org>
2026-06-18Merge tag 'libnvdimm-for-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm/dax updates from Alison Schofield: - Fix a race condition and a couple of static analysis issues in BTT - Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf() - Escalate a dev_dbg to dev_err in a resource conflict message - MAINTAINER file updates * tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: MAINTAINERS: nvdimm: Include maintainer profile MAINTAINERS: Update address for Ira Weiny MAINTAINERS: Add maintainer info for libnvdimm and DAX nvdimm: Use sysfs_emit() for cpumask show callback dax/bus: Upgrade resource conflict message to dev_err() in alloc_dax_region() nvdimm/btt: Free arenas on btt_init() error paths nvdimm/btt: Free arena sub-allocations on discover_arenas() error path nvdimm/btt: Handle preemption in BTT lane acquisition
2026-06-18Merge tag 'pmdomain-v7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Add OF helpers for parsing the power-domains-child-ids property - Extend the power domain DT binding with power-domains-child-ids - Switch to use the dynamic root device pmdomain providers: - arm: Add support for domain hierarchies to SCMI power domains - qcom: Add power domains for the Shikra and Nord SoCs - sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on" * tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: core: fix unused variable warning with !PM_GENERIC_DOMAINS_OF pmdomain: core: fix early domain registration pmdomain: mediatek: mfg: move __packed after struct name to fix kernel-doc pmdomain: qcom: rpmpd: Add Shikra RPM Power Domains pmdomain: qcom: rpmhpd: Add power domains for Nord SoC dt-bindings: power: qcom,rpmpd: document the Shikra RPM Power Domains pmdomain: sunxi: support power domain flags for pck600 pmdomain: core: switch to dynamic root device pmdomain: qcom: Unify user-visible "Qualcomm" name dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoC dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD defines pmdomain: arm_scmi: add support for domain hierarchies pmdomain: core: add support for power-domains-child-ids dt-bindings: power: Add power-domains-child-ids property
2026-06-18smb: client: fix query directory replay double-freeHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix change notify replay double-freeHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix query_info() replay double-freeHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix double-free in SMB2_close() replayHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix double-free in SMB2_ioctl() replayHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix double-free in SMB2_open() replayHenrique Carvalho
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18smb: client: fix double-free in SMB2_flush() replayZhao Zhang
SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifs_send_recv() stores a replacement response, flush_exit will free the stale response pointer a second time. Reinitialize resp_buftype and rsp_iov at the top of the replay loop so cleanup only acts on response state produced by the current attempt. This fixes a double-free without changing replay handling for successful requests. Fixes: 4f1fffa23769 ("cifs: commands that are retried should have replay flag set") Cc: stable@vger.kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Assisted-by: Codex:GPT-5.4 Acked-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Zhao Zhang <zzhan461@ucr.edu> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-06-18docs: kselftest: remove link to obsolete wikiBrett A C Sheffield
Remove the reference to the obsolete kselftest wiki. The kselftest wiki is marked obsolete and is no longer updated. The last edit was in 2019, and the information is outdated, referring readers for support to IRC networks that have not been used for years, and to kernel versions that are no longer supported. If there is any relevant information left in the wiki it needs to be cleaned up and moved into the canonical kselftest documentation here. Link: https://lore.kernel.org/r/20260115172817.7120-1-bacs@librecast.net Signed-off-by: Brett A C Sheffield <bacs@librecast.net> Acked-by: Bagas Sanjaya <bagasdotme@gmail.com> Acked-by: SeongJae Park <sj@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-06-18Merge tag 'pinctrl-v7.2-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Add new generic callbacks to populate per-pin pin controllers creating groups and functions from the device tree building out pinctrl_generic_to_map() and move the Spacemit driver over to use this - Generic board-level pin control driver using the mux framework New pin controller drivers: - Amlogic (meson) A9 SoC - Aspeed AST2700 SoC0 and SoC1 - nVidia Tegra264 and Tegra238 - Qualcomm Nord TLMM, Shikra TLMM, SM6350 LPASS LPI, and IPQ9650 TLMM - Renesas RZ/G3L SoC - UltraRISC DP1000 Improvements: - Handle pull up/pull down properly in the Renesas RZG2L driver - Fix up nVidia Tegra 234 DT bindings - Fix up pin definitions in the Qualcomm Eliza driver - Qualcomm PM8010 GPIO support in the PM8010 - Qualcomm SM6115 EGPIO support in the SM6115 - Switch Qualcomm LPASS LPI drivers to use runtime PM for power management - Clean up the Qualcomm Kconfig business a bit to include the necessary drivers for each subarch - Fix output glitch in the Amlogic (meson) A4 pin controller - Move the Airoha driver from the Mediatek directory to its own directory. It is too different from other Mediatek hardware - A slew of fixes to the Airoha AN7581 and AN7583 drivers" * tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (151 commits) pinctrl: Export pinctrl_get_group_selector() pinctrl: Match DT helper types pinctrl: qcom: Register functions before enabling pinctrl pinctrl: meson: amlogic-a4: use nolock get range pinctrl: ultrarisc: Add UltraRISC DP1000 pinctrl driver dt-bindings: pinctrl: Add UltraRISC DP1000 pinctrl controller pinctrl: qcom: Remove unused macro definitions pinctrl: tegra: PINCTRL_TEGRA264 should depend on ARCH_TEGRA pinctrl: tegra: PINCTRL_TEGRA238 should depend on ARCH_TEGRA pinctrl: tegra238: add missing AON pin groups dt-bindings: pinctrl: tegra238: add missing AON pin groups pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function pinctrl: airoha: an7583: fix phy1_led1 pin function pinctrl: airoha: an7583: add missed gpio22 pin group pinctrl: airoha: an7583: fix gpio21 pin group pinctrl: airoha: fix pwm pin function for an7581 and an7583 pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function pinctrl: airoha: an7583: fix misprint in gpio19 pinconf pinctrl: airoha: an7581: fix misprint in gpio19 pinconf ...
2026-06-18Merge tag 'backlight-next-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Support & Features: - Maxim MAX25014: Add support for the Maxim MAX25014 4-channel automotive grade backlight driver IC Improvements & Fixes: - Maintainers: Add the Congatec Board Controller backlight driver to its corresponding entry - Congatec Board Controller: Remove redundant X86 dependency from the backlight driver - Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is powered off during suspend Cleanups & Refactoring: - Core: Use named initializers for i2c_device_id arrays to improve readability and robustness Device Tree Binding Updates: - Maxim MAX25014: Add device tree bindings for the Maxim MAX25014 backlight controller" * tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: Use named initializers for arrays of i2c_device_data MAINTAINERS: Add cgbc backlight driver backlight: cgbc: Remove redundant X86 dependency backlight: Add max25014atg backlight dt-bindings: backlight: Add max25014 support backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
2026-06-18Merge tag 'leds-next-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Support & Features: - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes flash and RGB LED controllers - Texas Instruments: - LP5812: Add support for the TI LP5812 LED driver - LP5860: Add support for the Texas Instruments LP5860 LED matrix driver via SPI Improvements & Fixes: - Core: - Adjust the brightness sysfs node documentation to clarify that only decimal values are accepted - Fix a race condition in the software blink logic when stopping blinking and setting brightness simultaneously - Introduce the `multi_max_intensity` sysfs attribute for multicolor LEDs to support hardware-based global brightness control - Replace OF-based device lookup with firmware node equivalents to support ACPI and software nodes - Return `ENODATA` when reading brightness from hardware-controlled LEDs - Set the coherent DMA mask to zero for the Samsung PMIC device to suppress unnecessary "DMA mask not set" messages - ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the Makefile that prevented the driver from being built - BlinkM: Fix spelling and comment style issues in the driver - DAC124S085: Declare the SPI command word as `__le16` to ensure correct endianness and pass sparse checks - GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing GPIOs between the LED trigger and other drivers - NXP PCA9532: Fix an issue where the LED would stop blinking when changing brightness to a non-zero value - Qualcomm: Unify the user-visible company name to "Qualcomm" across flash LED config options - Qualcomm LPG: Optimize memory allocation by combining main structure and channels into a single allocation using flexible array members - Texas Instruments - LP5860: Add missing `CONFIG_OF` dependency to prevent build warnings - TPS6131x: Increase the overvoltage protection threshold to 6V to avoid false triggers with 5V input supplies - Userspace LEDs (uLEDs): - Fix a potential buffer overread by using `strnchr()` for name string validation - Return `-EFAULT` on `copy_to_user()` failure to properly handle read errors Cleanups & Refactoring: - Core: - Convert various `i2c_device_id` arrays to use named initializers for improved robustness and readability - Multi-color: Fix incorrect `KernelVersion` and `Date` tags for the `multi_max_intensity` ABI - Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE` declarations next to the ID tables for consistency - LP5812: Fix a sysfs ABI reference in the documentation - ST1202: Remove an unused legacy GPIO header include Device Tree Binding Updates: - Class: Document the keyboard backlight LED class naming conventions, including a new scheme for zoned backlights - Core: Dual-license the common LED bindings header under GPLv2 and BSD-2-Clause - IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter used in Xiaomi Redmi Note 8 - Samsung S2M series: - Document the flash LED device bindings for Samsung S2M series PMICs - Document the pattern behavior for Samsung S2M series PMIC RGB - S2MU005: Add device tree bindings for the S2MU005 PMIC, including its flash and RGB LED sub-devices - TI LM3560: Document the TI LM3559 and LM3560 synchronous boost flash drivers" * tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (30 commits) leds: tps6131x: Increase overvoltage protection threshold to 6V leds: Fix sysfs ABI date leds: Fix CONFIG_OF dependency for LEDS_LP5860_CORE leds: uleds: Fix potential buffer overread leds: Use named initializers for arrays of i2c_device_data leds: uleds: Return -EFAULT on copy_to_user() failure leds: core: Report ENODATA for brightness of hardware controlled LED leds: class: Use firmware nodes for device lookup Documentation: leds: Document pattern behavior of Samsung S2M series PMIC RGB LEDs leds: rgb: Add support for Samsung S2M series PMIC RGB LED device leds: flash: Add support for Samsung S2M series PMIC flash LED device dt-bindings: leds: Document Samsung S2M series PMIC flash LED device leds: core: Fix race condition for software blink leds: Adjust documentation of brightness sysfs node leds: dac124s085: Declare SPI command word as __le16 leds: Introduce the multi_max_intensity sysfs attribute dt-bindings: leds: Document TI LM3560 Synchronous Boost Flash Driver leds: bcm63138/cros_ec: Move MODULE_DEVICE_TABLE next to the table itself leds: Add support for TI LP5860 LED driver chip Documentation: leds: leds-class: Document keyboard backlight LED class naming ...
2026-06-18Merge tag 'mfd-next-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger, MUIC, flash and RGB LED controllers - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip - Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager Improvements & Fixes: - Core: Unify the user-visible company name to "Qualcomm" across various config options - ChromeOS EC: - Delay `dev_set_drvdata()` until the probe process has successfully completed to avoid use-after-free issues - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already defined in Device Tree or ACPI - Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds memory access during firmware loading - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to support board files requesting GPIOs - Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC - Renesas RSMU: Fix page register setup for the 8A3400x family by correctly calculating the page address - Renesas RZ/MTU3: - Make the reset line optional to support newer SoC variants (RZ/T2H, RZ/N2H) - Modernize the driver by using device-managed APIs for reset control and device addition - Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress unnecessary "DMA mask not set" messages - Silicon Motion SM501: Fix a reference leak on failed device registration by properly dropping the platform device reference - Texas Instruments: - TPS65219: Make poweroff handler registration conditional on the "system-power-controller" Device Tree property - TPS6586x: Fix Device Tree node reference counting by manually bumping the refcount for sub-devices - TPS65910: Add return value checking for the dummy I2C transfer used to work around silicon erratum SWCZ010 - TWL4030: Update board-specific checks to use Device Tree compatibles instead of legacy machine IDs Cleanups & Refactoring: - Core: Consistently define `pci_device_id` arrays using named initializers across various Intel and Silicon Motion drivers - Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik - Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro comments - MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()` as returning a boolean status - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity - Silicon Labs Si476x: Fix various spelling mistakes in driver comments - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell tables for each PMIC model - Timberdale: Move GPIO pin definitions into the driver and transition to using a software node for the GPIO cell - Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member Device Tree Binding Updates: - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin controllers - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema - Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU - MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for the MT6359 variant - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks - Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible string due to documentation errors - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC, flash and RGB LEDs) - Spreadtrum SC2731: Include regulator bindings for the SC2730 variant - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the PWM subnode - Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792 variant Removals: - Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX phones" * tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits) dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode mfd: rz-mtu3: Make reset optional mfd: rz-mtu3: Store &pdev->dev in local variable mfd: rz-mtu3: Use local variable for reset mfd: rz-mtu3: Use device-managed APIs dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl mfd: tps6586x: Fix OF node refcount dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings mfd: twl4030-power: Update checks for specific boards to use the DT dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block mfd: qcom_rpm: Add msm8960 QDSS clock resource mfd: si476x-i2c: Fix spelling mistakes in comments mfd: max77620: Convert poweroff support to sys-off API mfd: dt-bindings: mt6397: Add regulator supplies dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359 mfd: cs42l43: Sanity check firmware size mfd: qcom: Unify user-visible "Qualcomm" name mfd: cros_ec: Delay dev_set_drvdata() until probe success ...
2026-06-18Merge tag 'hid-for-linus-2026061601' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: "Core: - semantic cleanup fixes for 'hid_device_id::driver_data' (Pawel Zalewski) Multitouch: - UX improvement fixes for Yoga Book 9 (Dave Carey) Logitech: - fix for high resolution scrolling for Logitech HID++ 2.0 devices (Lauri Saurus) CP2112: - fix for cp2112 firmware-based speed configuration, if available (Danny Kaehn) Wacom: - memory corruption and scheduling while atomic and error fixes and error handling fixes (Jinmo Yang, Myeonghun Pak) New device support: - OneXPlayer (Derek J. Clark) - HORI Wireless Switch Pad (Hector Zelaya) - Rakk Dasig X (Karl Cayme) And other assorted small fixes and device ID additions" * tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits) HID: hidpp: fix potential UAF in hidpp_connect_event() HID: logitech-hidpp: sync wheel multiplier on wheel mode changes HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume HID: uhid: convert to hid_safe_input_report() HID: hid-goodix-spi: validate report size to prevent stack buffer overflow HID: nintendo: add support for HORI Wireless Switch Pad HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts HID: pidff: Use correct effect type in effect update HID: wacom: stop hardware after post-start probe failures HID: core: demote warning to debug level HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2 HID: lenovo: Add support for ThinkPad X13 Folio keyboard HID: cp2112: Configure I2C bus speed from firmware HID: cp2112: Add fwnode support HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() HID: Input: Add battery list cleanup with devm action HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter HID: wacom: use cleanup.h for wacom_wac_queue_flush() buffer management HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert ...
2026-06-18kconfig: add optional warnings for changed input valuesPengpeng Hou
When reading .config input, Kconfig stores user-provided values first and then resolves the final value after applying dependencies, ranges, and other constraints. If the final value differs from the user input, Kconfig already tracks that state internally, but it does not provide a focused diagnostic to show which explicit inputs were adjusted. This is particularly confusing for requested values that get forced down by unmet dependencies or clamped by ranges. Add an opt-in diagnostic controlled by KCONFIG_WARN_CHANGED_INPUT. Emit the warnings from conf_write() and conf_write_defconfig() after value resolution. Print the diagnostic to stderr directly, not through the normal message callback, so it remains visible when conf is run with -s, such as from make -s. Keep the diagnostic out of the conf_message() formatting buffer so long warning lists are not truncated, and mark processed symbols as written before the SYMBOL_WRITE check so duplicate menu nodes cannot emit duplicate warnings. Document the new environment variable and add tests for olddefconfig, savedefconfig, and the silent-conf path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Tested-by: Julian Braha <julianbraha@gmail.com> Link: https://patch.msgid.link/20260611060000.23858-1-pengpeng@iscas.ac.cn Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-18modpost: Ignore Clang LTO suffixes in symbol matchingRong Xu
When building the kernel with Clang ThinLTO enabled, the compiler can mangle static variable names by appending suffixes such as ".llvm.<hash>" to prevent naming collisions across translation units. This name mangling breaks the section mismatch whitelisting in modpost. modpost relies on glob patterns (e.g., "*_ops" or "*_probe") to identify safe references between permanent data and initialization code. Because the LTO suffix modifies the end of the symbol name, legitimately whitelisted structures fail the match, resulting in false positive warnings. For example, a static pernet_operations struct triggers the following: WARNING: modpost: vmlinux: section mismatch in reference: \ ping_v4_net_ops.llvm.5641696707737373282 (section: .data) -> \ ping_v4_proc_init_net (section: .init.text) Fix this by ignoring "*_ops.llvm.*" in "from" symbol names (the same as "*_ops"). Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606111233.kM8oo8Df-lkp@intel.com/ Signed-off-by: Rong Xu <xur@google.com> Link: https://patch.msgid.link/20260617224623.1346309-1-xur@google.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-18spi: rpc-if: Use correct device for hardware reinitialization on resumeQuang Nguyen
rpcif_spi_resume() currently passes the SPI controller device to rpcif_hw_init(), but the function should be called with the RPC interface device. Retrieve the rpcif private data from the SPI controller and pass rpc->dev instead. Also propagate the return value of rpcif_hw_init() so that a failure during resume is properly reported rather than silently ignored. Fixes: ad4728740bd6 ("spi: rpc-if: Add resume support for RZ/G3E") Signed-off-by: Quang Nguyen <quang.nguyen.wx@renesas.com> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260618081932.172168-1-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-18PCI: host-common: Request bus reassignment when not probe-onlyRatheesh Kannoth
pci_host_common_init() is used by several generic ECAM host drivers. After PCI core changes around pci_flags and preserve_config, these hosts no longer opted into full bus number reassignment the way they did before, which broke enumeration of devices on a Marvell CN106XX board. When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so pci_scan_bridge_extend() takes the reassignment path: bus numbers can be assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the flag in probe-only mode so existing assignments are not overridden. Fixes: 7246a4520b4b ("PCI: Use preserve_config in place of pci_flags") Closes: https://lore.kernel.org/all/abkqm_LCd9zAM8cW@rkannoth-OptiPlex-7090/ Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: add problem report link] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org Cc: Vidya Sagar <vidyas@nvidia.com> Link: https://patch.msgid.link/20260414081730.3864372-1-rkannoth@marvell.com
2026-06-18PCI: rockchip: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-8-18255117159@163.com
2026-06-18PCI: plda: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-10-18255117159@163.com
2026-06-18PCI: mediatek: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com
2026-06-18PCI: iproc: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-6-18255117159@163.com
2026-06-18PCI: dwc: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-3-18255117159@163.com
2026-06-18PCI: cadence: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-2-18255117159@163.com
2026-06-18PCI: brcmstb: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-5-18255117159@163.com
2026-06-18PCI: altera: Protect root bus removal with rescan lockHans Zhang
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-4-18255117159@163.com
2026-06-18Merge tag 'ext4_for_linus-7.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: - A major rework of the fast commit mechanism to avoid lock contention and deadlocks. We also export snapshot statistics in /proc/fs/ext4/*/fc_info - Performance optimization for directory hash computation by processing input in 4-byte chunks and removing function pointers, along with new KUnit tests for directory hash - Cleanups in JBD2 to remove special slabs and use kmalloc() instead - Various bug fixes, including: - Early validation of donor superblock in EXT4_IOC_MOVE_EXT to avoid cross-fs deadlock - Fix for a kernel BUG in ext4_write_inline_data_end under data=journal - Fix for a NULL dereference in jbd2_journal_dirty_metadata when handle is aborted - Fix for an underflow in JBD2 fast commit block initialization check - Fix for LOGFLUSH shutdown ordering to ensure ordered data writeback - Miscellaneous fixes for error path return values and KUnit assertions * tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT ext4: fix kernel BUG in ext4_write_inline_data_end ext4: fix ERR_PTR(0) in ext4_mkdir() jbd2: remove special jbd2 slabs ext4: remove mention of PageWriteback ext4: improve str2hashbuf by processing 4-byte chunks and removing function pointers ext4: add Kunit coverage for directory hash computation ext4: fast commit: export snapshot stats in fc_info ext4: fast commit: add lock_updates tracepoint ext4: fast commit: avoid i_data_sem by dropping ext4_map_blocks() in snapshots ext4: fast commit: avoid self-deadlock in inode snapshotting ext4: fast commit: avoid waiting for FC_COMMITTING ext4: lockdep: handle i_data_sem subclassing for special inodes ext4: fast commit: snapshot inode state before writing log jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() ext4: fix fast commit wait/wake bit mapping on 64-bit jbd2: check for aborted handle in jbd2_journal_dirty_metadata() ext4: Use %pe to print PTR_ERR() ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback ext4: replace KUnit tests for memcmp() with KUNIT_ASSERT_MEMEQ()
2026-06-18Merge tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbdLinus Torvalds
Pull smb server updates from Steve French: - Use after free fixes - Out of bounds read fix - Add SMB compression support both at rest and over the wire: support decompression of compressed SMB2 requests, initially allow compressed SMB2 READ responses, and implement get/set compression operations for per-file compression state. - Credentials fixes: for various FSCTLs, setinfo, delete on close and for alternate data streams - Fix access checks and permission checks in DUPLICAT_EXTENTS and SET_ZERO_DATA fsctls, find_file_posix_info, FILE_LINK_INFORMATION and smb2_set_info_sec - Reject non valid session in compound request - Serialize QUERY_DIRECTORY - Prevent path traversal bypass by restricting caseless retry - Path lookup fix - Two minor cleanup fixes * tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbd: (31 commits) ksmbd: fix path resolution in ksmbd_vfs_kern_path_create ksmbd: use opener credentials for FSCTL mutations ksmbd: use opener credentials for ADS I/O ksmbd: require source read access for duplicate extents ksmbd: run set info with opener credentials ksmbd: use opener credentials for delete-on-close ksmbd: serialize QUERY_DIRECTORY requests per file ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION ksmbd: reject non-VALID session in compound request branch ksmbd: compress SMB2 READ responses ksmbd: negotiate and decode SMB2 compression cifs: negotiate chained SMB2 compression capabilities smb: add common SMB2 compression transform helpers smb: move LZ77 compression into common code ksmbd: add per-handle permission check to FILE_LINK_INFORMATION ksmbd: add a permission check for FSCTL_SET_ZERO_DATA ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL smb: server: remove code guarded by nonexistent config option ...
2026-06-18Merge tag 'v7.2-rc-part1-smb3-client-fixes' of ↵Linus Torvalds
git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Three cleanup patches - Fix error return value in smb2_aead_req_alloc - Three compression fixes - Update i_blocks after write (fixes various xfstests) - Fix races in cifsd thread creation - Fix potential out of bounds read parsing security descriptors - Witness protocol fix - Fix umount bug - Mount fix - Fix cached directory entries on unlink/rmdir/rename * tag 'v7.2-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: Use more common code in SMB2_tcon() smb: client: Use more common error handling code in smb3_reconfigure() smb/client: Fix error code in smb2_aead_req_alloc() smb/client: clean up a type issue in cifs_xattr_get() smb/client: allow FS_IOC_SETFLAGS to clear compression smb/client: use writable handle for FS_IOC_SETFLAGS compression smb/client: always return a value for FS_IOC_GETFLAGS smb/client: update i_blocks after contiguous writes smb: client: fix races in cifsd thread creation cifs: validate full SID length in security descriptors smb: client: resolve SWN tcon from live registrations cifs: remove all cifs files before kill super smb: client: fix conflicting option validation for new mount API cifs: invalidate cfid on unlink/rename/rmdir
2026-06-18Merge tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linuxLinus Torvalds
Pull nfsd updates from Chuck Lever: "Jeff Layton wired up netlink upcalls for the auth.unix.ip and auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh caches in NFSD. The new kernel-user API is more extensible and lays the groundwork for retiring the old pipe interface. The default NFS r/w block size rises to 4MB on hosts with at least 16GB of RAM, reducing per-RPC overhead on fast networks. Smaller machines keep their previously computed default, and the value remains tunable through /proc/fs/nfsd/max_block_size. Chuck Lever converted the server's RPCSEC GSS Kerberos code to the kernel's shared crypto/krb5 library. The conversion retires and removes SunRPC's bespoke implementation of Kerberos v5, but keeps RPCSEC GSS-API. Continuing the xdrgen migration that converted the NLMv4 server XDR layer in v7.1, Chuck Lever converted the NLM version 3 server-side XDR layer from hand-written C to xdrgen-generated code. As with the NLMv4 conversion in v7.1, the goals are improved memory safety, lower maintenance burden, and groundwork for generation of Rust code for this layer instead of C. Chuck Lever fixed an issue where lingering NFSv4 state pins a mounted file system after it is unexported. A new netlink-based mechanism can now release NLM locks and NFSv4 state by client address, by filesystem, and by export. Now an administrator can quiesce an export cleanly before unmounting it. The remaining patches are bug fixes, clean-ups, and minor optimizations, including a batch of memory-leak and use-after-free fixes in the ACL, lockd, and TLS handshake paths, many of them reported by Chris Mason. Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.2 NFSD development cycle" * tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (106 commits) svcrdma: wake sq waiters when the transport closes nfsd: reset write verifier on deferred writeback errors nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race sunrpc: wait for in-flight TLS handshake callback when cancel loses race sunrpc: pin svc_xprt across the asynchronous TLS handshake callback nfsd: fix posix_acl leak on SETACL decode failure nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd: check get_user() return when reading princhashlen nfsd: fix inverted cp_ttl check in async copy reaper nfsd: fix dead ACL conflict guard in nfsd4_create NFSD: Fix SECINFO_NO_NAME decode error cleanup sunrpc: harden rq_procinfo lifecycle to prevent double-free SUNRPC: Return an error from xdr_buf_to_bvec() on overflow SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing nfsd: release layout stid on setlease failure lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure lockd: Plug nlm_file leak when nlm_do_fopen() fails Revert "NFSD: Defer sub-object cleanup in export put callbacks" Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers" ...
2026-06-18Merge tag 'fuse-update-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Fix lots of bugs, most from the late 6.x era, but some going back to 2.6.x - Add subsystems (io-uring, passthrough) and respective maintainers (Bernd, Joanne and Amir) - Separate transport and fs layers (Miklos) - Don't block on cat /dev/fuse (Joanne) - Perform some refactoring in fuse-uring (Joanne) - Don't use bounce-buffer for READDIR reply in virtio-fs (Matthew Ochs) - Clean up documentation (Randy) - Improve tracing (Amir) - Extend page cache invalidation after DIO (Cheng Ding) - Invalidate readdir cache on epoch change (Jun Wu) - Misc cleanups * tag 'fuse-update-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (81 commits) fuse-uring: clear ent->fuse_req in commit_fetch error path fuse-uring: use named constants for io-uring iovec indices fuse-uring: refactor setting up copy state for payload copying fuse-uring: use enum types for header copying fuse-uring: refactor io-uring header copying from ring fuse-uring: refactor io-uring header copying to ring fuse-uring: separate next request fetching from sending logic fuse: invalidate readdir cache on epoch bump virtio-fs: avoid double-free on failed queue setup fuse: invalidate page cache after DIO and async DIO writes fuse: set ff->flock only on success fuse: clean up interrupt reading fuse: remove stray newline in fuse_dev_do_read() fuse: use READ_ONCE in fuse_chan_num_background() fuse: dax: Move long delayed work on system_dfl_long_wq fuse: add fuse_request_sent tracepoint fuse: Add SPDX ID lines to some files fuse: use QSTR() instead of QSTR_INIT() in fuse_get_dentry fuse: convert page array allocation to kcalloc() fuse: use current creds for backing files ...
2026-06-18ALSA: emu10k1: Use common error handling code in snd_emu10k1_playback_open()Markus Elfring
Use an additional label so that a bit of exception handling can be better reused at the end of this function implementation. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Link: https://patch.msgid.link/d709474d-62b0-4f7e-9011-a0f716b35383@web.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18ALSA: usb-audio: Add quirk for YAMAHA CDS3000Jean-Louis Colaco
This quirk is identical to the one for the Yamaha Steinberg UR22, here applied to a CD player that also uses the Steinberg USB interface. This quirk is necessary to avoid sporadic "clic" noise when using the DAC of the player. Signed-off-by: Jean-Louis Colaco <jean-louis.colaco@orange.fr> Link: https://patch.msgid.link/20260618113202.8363-1-jean-louis.colaco@orange.fr Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18PCI: iproc: Restore .map_irq() for the platform bus driverMark Tomlinson
Commit b64aa11eb2dd ("PCI: Set bridge map_irq and swizzle_irq to default functions") moved the assignment of default .map_irq() callback to devm_of_pci_bridge_init() and removed the initialization of 'iproc_pcie::map_irq' in platform bus driver. This led to the callback getting assigned the NULL pointer for platform bus driver, thereby breaking the INTx functionality, since 'iproc_pcie::map_irq' overrides the 'pci_host_bridge::map_irq' callback in iproc_pcie_setup(). This issue only affected the iproc platform bus driver as this driver relies on the default callback for non-PAXC controllers. iproc-brcm driver was already providing the custom mapping function, so it was unaffected. Restore the original (and intended) behaviour to use the default map_irq function by removing the local 'iproc_pcie::map_irq' pointer and directly assigning the 'pci_host_bridge::map_irq' callback in iproc-bcma driver. This ensures that the default 'map_irq' callback is used for platform bus driver and only iproc-brcm driver overrides it with a custom one. Fixes: b64aa11eb2dd ("PCI: Set bridge map_irq and swizzle_irq to default functions") Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz> [mani: commit log] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Ray Jui <ray.jui@broadcom.com> Link: https://patch.msgid.link/20260430021628.1343154-1-mark.tomlinson@alliedtelesis.co.nz
2026-06-18Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma updates from Jason Gunthorpe: "Many AI driven bug fixes, and several big driver API cleanups - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw, rtrs, mana, irdma, mlx4. Commonly error path flows, integer arithmetic overflows on unsafe data, out of bounds access, and use after free issues under races. - Second half of the new udata API for drivers focusing on uAPI response - bnxt_re supports more options for QP creation that will allow a dv path in rdma-core - Untangle the module dependencies so drivers don't link to ib_uverbs.ko as was originall intended - Provide a new way to handle umems with a consistent simplified uAPI and update several drivers to use it. This brings dmabuf support to more places and more drivers - Support for mlx5 rate limit and packet pacing for UD and UC - A batch of fixes for the new shared FRMR pools infrastructure" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits) RDMA/irdma: Replace waitqueue and flag with completion RDMA/hns: Fix memory leak of bonding resources RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg docs: infiniband: correct name of option to enable the ib_uverbs module RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled RDMA/bnxt_re: Avoid repeated requests to allocate WC pages RDMA/bnxt_re: Proper rollback if the ioremap fails RDMA/bnxt_re: Add a max slot check for SQ RDMA/bnxt_re: Avoid displaying the kernel pointer RDMA/bnxt_re: Free CQ toggle page after firmware teardown RDMA/bnxt_re: Free SRQ toggle page after firmware teardown RDMA/bnxt_re: Initialize dpi variable to zero ABI: sysfs-class-infiniband: minor cleanup RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one RDMA/mlx5: Fix undefined shift of user RQ WQE size RDMA/mlx5: Remove raw RSS QP restrack tracking RDMA/mlx5: Remove DCT restrack tracking RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles ...
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-18 07:42:26 +0000