summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-09wifi: mt76: fix of_get_mac_address error handlingRosen Penev
Check return value instead of is_valid_ether_addr. The latter is handled by the former. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260427051746.954704-1-rosenp@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09wifi: mt76: mt7925: clean up DMA on probe failureMyeonghun Pak
mt7925_pci_probe() initializes DMA before registering the device. If mt7925_register_device() fails, probe returns through err_free_irq without tearing down DMA state. That leaves the TX NAPI instance enabled and skips the DMA queue cleanup that the normal remove path performs through mt7925e_unregister_device(). Add a dedicated unwind label for failures after mt7925_dma_init() succeeds. Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Link: https://patch.msgid.link/20260426143728.41534-1-pakmyeonghun@bagmyeonghun-ui-MacBookPro.local Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-09net/sched: Update function name in TCQ_F_NOPARENT commentVictor Nogueira
Commit 2ccccf5fb43f ("net_sched: update hierarchical backlog too") renamed qdisc_tree_decrease_qlen() to qdisc_tree_reduce_backlog(), but this comment was missed. Update it. Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20260605212239.2261320-1-victor@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09platform: arm64: qcom-hamoa-ec: Fix indentation in comment tablesShawn Guo
With tab=8 (Linux Kernel coding style), there are a couple of lines misaligned in the comment ASCII tables. Fix indentation for them. Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Link: https://patch.msgid.link/20260608082348.92575-1-shengchao.guo@oss.qualcomm.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8E35)Krishna Chomal
The HP Omen 16-ap0xxx (board ID: 8E35) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_legacy_thermal_params. Testing on board 8E35 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Ahmet Öztürk <sivasli-ahmet@gmx.de> Reported-by: Ahmet Öztürk <sivasli-ahmet@gmx.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221523 Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260608134255.36280-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09drm/virtio: Fix driver removal with disabled KMSDmitry Osipenko
DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uninitialized data on driver removal/unbinding and crashing kernel. Fix it by skipping shutting down atomic core with unavailable KMS. Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Tested-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Reviewed-by: Ryosuke Yasuoka <ryasuoka@redhat.com> Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com
2026-06-09rxrpc: Fix the ACK parser to extract the SACK table for parsingDavid Howells
Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents of the SACK table by copying out the contents of the SACK table into a buffer before attempting to parse AF_RXRPC assumes that it can just call skb_condense() and then validly access the SACK table from skb->data and that it will be a flat buffer - but skb_condense() can silently fail to do anything under some circumstances. Note that whilst rxrpc_input_soft_acks() should be able to parse extended ACKs, the rest of AF_RXRPC doesn't currently support that. Further, there's then no need to call skb_condense() in rxrpc_input_ack(), so don't. Fixes: d57a3a151660 ("rxrpc: Save last ACK's SACK table rather than marking txbufs") Reported-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://lore.kernel.org/r/20260513180907.2061972-1-michael.bommarito@gmail.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Jeffrey Altman <jaltman@auristor.com> cc: Eric Dumazet <edumazet@google.com> cc: "David S. Miller" <davem@davemloft.net> cc: Jakub Kicinski <kuba@kernel.org> cc: Paolo Abeni <pabeni@redhat.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org cc: stable@kernel.org Link: https://patch.msgid.link/105362.1780573560@warthog.procyon.org.uk Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09Merge tag 'imx-soc-updates-for-v7.2' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/arm i.MX Soc Changes for v7.2 - Fix IIM mapping leak in imx31 revision check - Fix CCM node reference leak in imx3 - Make scmi_imx_misc_ctrl_nb variable static in firmware driver * tag 'imx-soc-updates-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: ARM: imx31: Fix IIM mapping leak in revision check ARM: imx3: Fix CCM node reference leak firmware: imx: sm-misc: Make scmi_imx_misc_ctrl_nb variable static Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09ARM: multi_v7_defconfig: Enable dma-buf heapsMaxime Ripard
Now that the system and CMA heaps can be built as modules, enable both as modules in the arm multi_v7_defconfig. Suggested-by: Andrew Davis <afd@ti.com> Signed-off-by: Maxime Ripard <mripard@kernel.org> Link: https://lore.kernel.org/r/20260527084135.842736-1-mripard@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09ARM: configs: Drop duplicated CONFIG_EXT4_FSKrzysztof Kozlowski
Remove redundant, duplicated CONFIG_EXT4_FS to fix warnings like: axm55xx_defconfig:198:warning: override: reassigning to symbol EXT4_FS Fixes: c065b6046b34 ("Use CONFIG_EXT4_FS instead of CONFIG_EXT3_FS in all of the defconfigs") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Richard Cheng <icheng@nvidia.com> Link: https://lore.kernel.org/r/20260603072726.19404-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09r8152: handle the return value of usb_reset_device()Chih Kai Hsu
If usb_reset_device() returns a negative error code, stop the process of probing. Fixes: 10c3271712f5 ("r8152: disable the ECM mode") Signed-off-by: Chih Kai Hsu <hsu.chih.kai@realtek.com> Reviewed-by: Hayes Wang <hayeswang@realtek.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260604092247.27158-450-nic_swsd@realtek.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-09bpf: Validate BTF repeated field counts before expansionPaul Moses
btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands repeatable fields from array elements into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields(). The remaining-capacity check performs the expanded field count calculation in u32. A malformed BTF can wrap that calculation, causing the check to pass even when the expanded field count exceeds the scratch array capacity. The following memcpy() can then write past the end of the array. Use checked addition and multiplication before copying repeated fields and reject impossible counts. Fixes: 797d73ee232d ("bpf: Check the remaining info_cnt before repeating btf fields") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses <p@1g4.org> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260605234301.1109063-1-p@1g4.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-06-09sched/deadline: Use task_on_rq_migrating() helperLiang Luo
Replace the open-coded "p->on_rq == TASK_ON_RQ_MIGRATING" comparisons in enqueue_task_dl() and dequeue_task_dl() with the existing task_on_rq_migrating() helper, consistent with the rest of the scheduler code. No functional change. Signed-off-by: Liang Luo <luoliang@kylinos.cn> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: K Prateek Nayak <kprateek.nayak@amd.com> Link: https://patch.msgid.link/20260608075500.387271-1-luoliang@kylinos.cn
2026-06-09sched/core: Combine separate 'else' and 'if' statementsLiang Luo
The kernel coding style recommends using 'else if' instead of placing 'if' on a separate line after 'else'. This change makes the code consistent with the rest of the kernel codebase. Signed-off-by: Liang Luo <luoliang@kylinos.cn> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260608071842.325159-1-luoliang@kylinos.cn
2026-06-09sched/fair: Fix cpu_util runnable_avg arithmeticHongyan Xia
If we take runnable_avg in max(runnable_avg, util_avg) in cpu_util(), we should then add or subtract task runnable_avg, but the arithmetic below is still with task util_avg. This mixes runnable_avg with util_avg which is incorrect. Fix by always doing arithmetic with runnable_avg and only take max(runnable_avg, util_avg) at the last step. Fixes: 7d0583cf9ec7 ("sched/fair, cpufreq: Introduce 'runnable boosting'") Signed-off-by: Hongyan Xia <hongyan.xia@transsion.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org> Link: https://patch.msgid.link/20260605094318.37931-1-hongyan.xia@transsion.com
2026-06-09rust: sync: completion: Mark inline complete_all and wait_for_completionFabricio Parra
When building the kernel using the llvm-22.1.0-rust-1.93.1-x86_64 toolchain provided by kernel.org with ARCH=x86_64, the following symbols are generated: $ nm vmlinux | grep ' _R'.*Completion | rustfilt ffffffff81827930 T <kernel::sync::completion::Completion>::complete_all ffffffff81827950 T <kernel::sync::completion::Completion>::wait_for_completion These Rust methods are thin wrappers around the C completion helpers `complete_all` and `wait_for_completion`. Mark them `#[inline]` to keep the wrapper pattern consistent with other small Rust helper methods. After applying this patch, the above command will produce no output. Suggested-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Fabricio Parra <a@alice0.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Gary Guo <gary@garyguo.net> Link: https://github.com/Rust-for-Linux/linux/issues/1145 Link: https://patch.msgid.link/20260316151056.287-1-a@alice0.com Link: https://patch.msgid.link/20260605052331.1628-4-boqun@kernel.org
2026-06-09MAINTAINERS: Add RUST [SYNC] entryBoqun Feng
We have two pull requests on Rust synchronization primitives with 10+ patches in a row for recent cycles, so it makes sense to start the effort of handling this area as a group. Luckily for me, Gary Guo and Alice Ryhl agreed to help as co-maintainers, and we also have a talented group of reviewers: Lyude Paul started the SpinLockIrq work [1] and did an amazing job at improving the design and implementation. Daniel Almeida resolved the Lock<T: !Unpin> issue [2] and he did a fair amount of reviews in areas related to synchronization primitives already. Onur Özkan started the ww_mutex work [3] and did an amazing job at consolidating various design requirements and decisions. Of course, this only reflects my own knowledge, and I believe they did way more outside what I'm aware of ;-) Note that having this MAINTAINERS entry is meant to bring more people to help on the synchronization primitives in Rust, which means for patch submissions and design discussion, please still involve the corresponding maintainers (e.g. LOCKING and ATOMIC), scripts/get_maintainers.pl should have this covered. Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Daniel Almeida <daniel.almeida@collabora.com> Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Onur Özkan <work@onurozkan.dev> Acked-by: Gary Guo <gary@garyguo.net> Acked-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/rust-for-linux/20260302232154.861916-1-lyude@redhat.com/ [1] Link: https://lore.kernel.org/all/20250828-lock-t-when-t-is-pinned-v2-0-b067c4b93fd6@collabora.com/ [2] Link: https://lore.kernel.org/rust-for-linux/20260103073554.34855-1-work@onurozkan.dev/ [3] Link: https://patch.msgid.link/20260415232830.8128-1-boqun@kernel.org Link: https://patch.msgid.link/20260605052331.1628-2-boqun@kernel.org
2026-06-09i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()Carlos Song
The LPI2C driver requests DMA channels using dma_request_chan(), but never releases them in lpi2c_imx_remove(), resulting in DMA channel leaks every time the driver is unloaded. Additionally, when lpi2c_dma_init() successfully requests the TX DMA channel but fails to request the RX DMA channel, the probe falls back to PIO mode and completes successfully. Since probe succeeds, the devres framework will not trigger any cleanup, leaving the TX DMA channel and the memory allocated for the dma structure held for the lifetime of the device even though DMA is never used. Switch to devm_dma_request_chan() to let the device core manage DMA channel lifetime automatically. Wrap all allocations within a devres group so that devres_release_group() can release all partially acquired resources when DMA init fails and probe continues in PIO mode. Fixes: a09c8b3f9047 ("i2c: imx-lpi2c: add eDMA mode support for LPI2C") Signed-off-by: Carlos Song <carlos.song@nxp.com> Cc: <stable@vger.kernel.org> # v6.14+ Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20260520093323.2882070-1-carlos.song@oss.nxp.com
2026-06-09ntfs3: cap RESTART_TABLE free-chain walker at rt->usedMichael Bommarito
A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within ~22s on multi-CPU hosts (panic with kernel.softlockup_panic=1). The bug is reachable from desktop USB auto-mount on distributions where udisks2 routes the NTFS signature to the in-tree ntfs3 driver (Arch family and an increasing fraction of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual mount elsewhere. check_rstbl()'s second walker iterates the free-entry singly-linked list headed by rt->first_free with no upper bound on iteration count: for (off = ff; off;) { if (off == RESTART_ENTRY_ALLOCATED) return false; off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off)); if (off > ts - sizeof(__le32)) return false; } The existing guards cover three exits: end-of-list (off == 0), the in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds (off > ts - sizeof(__le32)). None of the three prevents an in-bounds cycle. A crafted on-disk RESTART_TABLE whose free chain contains a self-loop or A->B->A cycle whose offsets satisfy: - in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)] - (off - sizeof(struct RESTART_TABLE)) % rsize == 0 passes all existing guards and spins the mount-time thread forever. Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18 stores 0x18 as its next pointer; mount of the forged image with the in-tree ntfs3 driver never returns. Bound the walker by rt->used. Each entry on a legitimate free chain is unique, and the total slot count is ne = le16_to_cpu (rt->used). A traversal that visits more than ne slots is by construction malformed; reject it as a corrupt RESTART_TABLE. After this patch, mount of the forged image returns with -EINVAL and a log_replay failure message, and mkntfs-produced legitimate images mount cleanly (verified in the same UML harness). Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2026-06-09fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}Michael Bommarito
In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields. The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size <= e->size. Apply the same bound at the two memmove sites. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE. This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (<20260502105008.21827-1-jhapavitra98@gmail.com>) which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Cc: stable@vger.kernel.org Reported-by: Pavitra Jha <jhapavitra98@gmail.com> Closes: https://lore.kernel.org/ntfs3/20260502105008.21827-1-jhapavitra98@gmail.com/ Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2026-06-09platform/x86: msi-ec: Add support for MSI Pulse GL66 12th GenLuis de Carlos
Add the firmware string '1583EMS1.109' to the ALLOWED_FW_10 array. This enables Embedded Controller support, including battery charge thresholds, for the MSI Pulse GL66 12UEK (MS-1583) laptop. Signed-off-by: Luis de Carlos <reskoldo73@gmail.com> Link: https://patch.msgid.link/20260527134750.25263-1-reskoldo73@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk tableGleb Sonichev
The Inspiron N5110 needs the touchpad LED quirk (Vostro V130 quirk) to properly control the touchpad LED. Add its DMI identifier to the existing quirk table, next to the similar Inspiron M5110 entry. Tested on Dell Inspiron N5110. The touchpad LED works correctly with this quirk enabled. Signed-off-by: Gleb Sonichev <sonichev555@gmail.com> Acked-by: Pali Rohár <pali@kernel.org> Link: https://patch.msgid.link/20260525100047.20046-1-sonichev555@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86: hp-wmi: Add support for Omen 16-ap0xxx (8D26)Krishna Chomal
The HP Omen 16-ap0xxx (board ID: 8D26) has the same WMI interface as other Victus S boards, but requires quirks for correctly switching thermal profile. Add the DMI board name to victus_s_thermal_profile_boards[] table and map it to omen_v1_legacy_thermal_params. Testing on board 8D26 confirmed that platform profile is registered successfully and fan RPMs are readable and controllable. Tested-by: Alberto Escaño <alberto_e_88@yahoo.es> Reported-by: Alberto Escaño <alberto_e_88@yahoo.es> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221514 Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com> Link: https://patch.msgid.link/20260525102226.56300-1-krishna.chomal108@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86/intel/pmc: rate-limit LTR scale-factor warningMike Bommarito
convert_ltr_scale() emits an unconditional pr_warn() whenever an LTR row encoded by hardware has a scale-factor field of 6 or 7 (reserved values per the PCIe LTR ECN). The function is called twice per LTR row (snoop + non-snoop) by pmc_core_ltr_show(), which is invoked on every read of /sys/kernel/debug/pmc_core/ltr_show as well as during certain platform driver activity. On a Meteor Lake laptop with an Intel AX210 Wi-Fi card, this produces 4-12 "Invalid LTR scale factor." lines per second in dmesg, with no context to help identify which PMC IP / row carries the bad value. Switch to pr_warn_once() so the warning still flags the spec violation once per boot, and include the offending scale value in the message. Identifying the originating LTR row would require restructuring the caller's loop to perform the validity check itself; that is left as a separate change. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Mike Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260523114517.101305-1-michael.bommarito@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86: hp-wmi: Add thermal support for board 8B2Fyahia ahmed
Added thermal support for board ID 8B2F. Signed-off-by: yahia ahmed <yahia.a.abdrabou@gmail.com> Link: https://patch.msgid.link/20260522203418.28784-1-yahia.a.abdrabou@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86/intel/tpmi: use cleanup helpers in mem_write()ZhaoJinming
In mem_write(), the temporary array returned by parse_int_array_user() must be released on all exit paths. Convert the array variable to use cleanup.h scope-based cleanup so it is freed automatically on return. This also moves the array declaration next to parse_int_array_user() as required by cleanup.h usage guidelines. Fixes: 8e0a2fc68ec3 ("platform/x86/intel/tpmi: Use 32 bit aligned address for debugfs mem write") Cc: stable@vger.kernel.org Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Link: https://patch.msgid.link/20260521130848.2860219-1-zhaojinming@uniontech.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09platform/x86: oxpec: add support for OneXPlayer Super XAlexander Egorov
OneXPlayer Super X identifies itself via DMI as: board vendor: ONE-NETBOOK board name: ONEXPLAYER SUPER X product name: ONEXPLAYER SUPER X Current mainline oxpec does not contain a matching DMI entry for this system, so the in-tree driver is not auto-loaded. The tested Super X fan, PWM, turbo-toggle, and battery charge-control EC layout matches the existing ONEXPLAYER G1 A handling. Add a DMI match for OneXPlayer Super X and reuse the oxp_g1_a board data. Reviewed-by: Derek J Clark <derekjohn.clark@gmail.com> Reviewed-by: Antheas Kapenekakis <lkml@antheas.dev> Signed-off-by: Alexander Egorov <begeebe@gmail.com> Link: https://patch.msgid.link/20260519155124.3240359-1-begeebe@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-06-09Merge tag 'v7.1-rockchip-arm32fixe' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes A change in 7.1-rc improved the general handling for reset controllers using SRCU, but at the same time broke really early users before work- queues are available. So adapt the SMP bringup to keep the core-resets around, instead of aquiring/releasing them on ever SMP action. * tag 'v7.1-rockchip-arm32fixe' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: keep reset control around Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09Merge tag 'riscv-soc-fixes-for-v7.1-rc7' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V soc fixes for v7.1-rc7 Microchip: Fix a resource leak in an unlikely probe failure case. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> * tag 'riscv-soc-fixes-for-v7.1-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: soc: microchip: mpfs-sys-controller: fix resource leak on probe error Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-06-09xfs: mark struct xfs_imap as __packedChristoph Hellwig
This returns 2 bytes of padding at the to struct xfs_inode into which this structure is embedded. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: store an agbno in struct xfs_imapChristoph Hellwig
The xfs_imap structure is embedded into the xfs_inode, which means the size of it directly affects the inode size. Replacing the xfs_daddr_t with an xfs_agbno_t and taking the AG information from other easily available sources allows us to shrink the structure including the typical padding from 16 bytes to 8 bytes. As a side-effect the debugging check in xfs_imap() naturally now converges to a stricter variant that checks that the cluster is located inside a single AG, and not just inside the entire device. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: massage xfs_imap_to_bp into xfs_read_iclusterChristoph Hellwig
xfs_imap_to_bp only uses the im_blkno field from struct xfs_imap, so pass that directly. Rename the function to xfs_read_icluster, which describes the functionality much better and matches other helpers like xfs_read_agf and xfs_read_agi. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: remove im_len field in struct xfs_imapChristoph Hellwig
im_len is always set to the same value for a given file system, which makes it redundant. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: cleanup xfs_imapChristoph Hellwig
Reshuffle the code a bit so that the imap_lookup and filling out of the xfs_imap structure aren't duplicated. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_mapChristoph Hellwig
xfs_trans_read_buf_map asserts bp->b_ops is non-NULL just before calling xfs_buf_reverify which is a no-op if bp->b_ops is set, making the call dead code ever since it as added in commit 1aff5696f3e0 ("xfs: always assign buffer verifiers when one is provided"). Remove the useless call, mark xfs_buf_reverify static and clean up the branch dealing with a buffer attached to the transaction in a bit by deduplicating and keeping together the asserts and removing the bip variable only used once outside of asserts and tracing. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: remove the i_ino field in struct xfs_inodeChristoph Hellwig
Now that the VFS inode has a u64 i_ino field, there is no need to store a copy of the inode number in the xfs_inode structure. Introduce an I_INO() wrapper as a shortcut to the inode number so that we don't have to propagate the VFS inode everywhere. The only non-obvious part is the clearing of i_ino to 0 for RCU freeing the inode. None of this calls into VFS paths, which makes clearing the VFS inode field here just as safe as clearing the old field in the xfs_inode. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: remove xfs_setup_existing_inodeChristoph Hellwig
xfs_setup_existing_inode only has a single caller, fold it into that. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corruptChristoph Hellwig
All xref corruption reports have the xfs_inode structure, so switch the helper to work based on that. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a xchk_ip_set_corrupt helperChristoph Hellwig
Add a smaller wrapper to set a inode corrupted by the xfs_inode pointer. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a xfs_rmap_inode_owner helperChristoph Hellwig
Add a small wrapper for initializing the rmap owner to i_ino. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a xfs_rmap_inode_bmbt_ownerChristoph Hellwig
Add a small wrapper for initializing the bmbt owner to i_ino. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a XFS_INO_TO_FSB helperChristoph Hellwig
Add a shortcut for the common XFS_INO_TO_FSB(mp, ip->i_ino) pattern. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a XFS_INODE_TO_AGINO helperChristoph Hellwig
Add a shortcut for the common XFS_INO_TO_AGINO(mp, ip->i_ino) pattern. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: add a XFS_INODE_TO_AGNO helperChristoph Hellwig
Add a shortcut for the common XFS_INO_TO_AGNO(mp, ip->i_ino) pattern. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: fix unreachable BIGTIME check in dquot flush validationAlexey Nepomnyashih
The dqp->q_id == 0 check inside the XFS_DQTYPE_BIGTIME block is unreachable because root dquots return successfully earlier. Reject root dquots with XFS_DQTYPE_BIGTIME before that early return, preserving the intended validation and removing the unreachable condition. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4ea1ff3b4968 ("xfs: widen ondisk quota expiration timestamps to handle y2038+") Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Allison Henderson <achender@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: fix exchmaps reservation limit checkYingjie Gao
xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the reservation value from before the overhead was added. The computed value is stored back in req->resblks and later passed to xfs_trans_alloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used. Fixes: 966ceafc7a43 ("xfs: create deferred log items for file mapping exchanges") Cc: stable@vger.kernel.org # v6.10 Signed-off-by: Yingjie Gao <gaoyingjie@uniontech.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09xfs: drop the experimental warning for the zoned allocatorChristoph Hellwig
The zoned allocator has been released with 6.15 on May 25, 2025. It has seen constant maintenance and improvements and no major issues, so promote it out of the experimental category. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-06-09drm/i915/edp: Check supported link rates DPCD readNikita Zhandarovich
intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local stack array and then parses the array unconditionally. If the read fails, the array contents are not valid and may result in bogus sink link rates being used. Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, so the existing parser falls back to the default sink rate handling. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4") Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260529145759.1640646-1-n.zhandarovich@fintech.ru Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit bd61c7756b34157e093028225a69383b4b1203cc) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-06-09i2c: eg20t: Consistently define pci_device_ids using named initializersUwe Kleine-König (The Capable Hub)
The .driver_data member of the struct pci_device_id array were initialized by list expressions. This isn't easily readable if you're not into PCI. Using named initializers is more explicit and thus easier to parse. This change doesn't introduce changes to the compiled pci_device_id arrays. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/41316792102ff2860ec019373293cb07d545a0b0.1779481436.git.u.kleine-koenig@baylibre.com
2026-06-09i2c: designware-pcidrv: Consistently define pci_device_ids using named ↵Uwe Kleine-König (The Capable Hub)
initializers The .driver_data member of the struct pci_device_id array were initialized by list expressions. This isn't easily readable if you're not into PCI. Using named initializers is more explicit and thus easier to parse. This change doesn't introduce changes to the compiled pci_device_id array. Tested on x86 and arm64. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/68667c4ab85716b190d8b705813b610e21a386f6.1779481436.git.u.kleine-koenig@baylibre.com