Conversation
commit ae15adeed9f7ec54989175fe3c9e0815186821bc upstream. tegra_vi_channels_alloc() iterates over port nodes and skips those whose reg property cannot be read or whose remote endpoint fails v4l2_fwnode_endpoint_parse(), leaving the negative result of the failed call in ret. If that happens on the last port node, the loop ends with ret still negative and tegra_vi_init() fails the whole VI probe. The same defective port earlier in the ports node is skipped silently, so probing succeeds or fails depending on the order of the port nodes. The CSI equivalent, tegra_csi_channels_alloc(), returns 0 unconditionally after its loop and does not have this problem. Use a separate variable for the per-port checks so that only fatal errors end up in ret. Fixes: 1ebaeb0 ("media: tegra-video: Add support for external sensor capture") Fixes: 2ac4035 ("media: tegra-video: Add support for x8 captures with gang ports") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7f6956b6dcd660a6a67e8eb80bf241ee470ab40d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit d7f48aa7d60c65d3e6d5312c27f17d5525a245fb upstream. isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down. Fixes: a516d36 ("media: staging/ipu7: add IPU7 input system device driver") Cc: stable@vger.kernel.org Signed-off-by: Cong Nguyen <congnt264@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 2a8dd9fd12f3f6b21207cec8f50c92cd428e6b81) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 626147717bea776b61ed3631d2c26283760c4cc4 upstream. During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310 __dma_map_sg_attrs+0x217/0x310 dma_map_sg_attrs+0x4a/0x70 ata_qc_issue+0x9f8/0x1420 __ata_scsi_queuecmd+0x1657/0x1740 ata_scsi_queuecmd+0x79a/0x920 scsi_queue_rq+0x4472/0x4f40 blk_mq_dispatch_rq_list+0x1cca/0x3ee0 __blk_mq_sched_dispatch_requests+0x458/0x630 blk_mq_sched_dispatch_requests+0x15b/0x340 __blk_mq_run_hw_queue+0xe5/0x250 __blk_mq_delay_run_hw_queue+0x138/0x780 blk_mq_run_hw_queue+0x4bb/0x7e0 blk_mq_sched_insert_request+0x2a7/0x4c0 blk_execute_rq+0x497/0x8a0 sg_io+0xbe0/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Uninit was created at: __alloc_pages+0x5c0/0xc80 alloc_pages+0xe0e/0x1050 blk_rq_map_user_iov+0x2b77/0x6100 blk_rq_map_user_io+0x2fa/0x4d0 sg_io+0xad6/0xe20 scsi_ioctl+0x2b36/0x3c60 sr_block_ioctl+0x319/0x440 blkdev_ioctl+0x80f/0xd70 __se_sys_ioctl+0x219/0x420 __x64_sys_ioctl+0x93/0xe0 x64_sys_call+0x1d6c/0x3ad0 do_syscall_64+0x4c/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Bytes 14-15 of 16 are uninitialized Memory access of size 16 starts at ffff88800cbdb000 When processing the last unaligned element of the scatterlist, it is supplemented with missing bytes in the amount of pad_len. These bytes remain uninitialized, which leads to a problem. Extend last_sg->length by pad_len first, then use sg_zero_buffer() to zero those pad_len bytes. sg_zero_buffer() uses sg_miter internally, which correctly handles sg entries spanning multiple pages and padding that crosses a page boundary. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 40b01b9 ("block: update bio according to DMA alignment padding") Cc: stable@vger.kernel.org Signed-off-by: Petr Vaganov <p.vaganov@ideco.ru> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/20260628185229.37957-1-p.vaganov@ideco.ru Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e7143c3f4e5c0a7986733c6f27009274bf6c4264) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 786439ad58763e04b91bc2ec5f590e463939f197 upstream. glink_smem_rx_peek() reads the RX FIFO payload after the caller has determined data is available via glink_smem_rx_avail(), which reads the remote-updated head index. A control dependency between the head read and the subsequent payload read does not order the two loads, so the CPU may speculatively read the FIFO before observing the head update and consume stale data the remote has not yet published. Add rmb() in glink_smem_rx_peek() before the memcpy_fromio() so the availability (head) read is ordered ahead of the FIFO payload read, matching the consumer pattern in Documentation/core-api/circular-buffers.rst. Fixes: caf989c ("rpmsg: glink: Introduce glink smem based transport") Cc: stable@vger.kernel.org Signed-off-by: Chunkai Deng <chunkai.deng@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260618-rpmsg-glink-smem-mb-v1-1-68a026453a69@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit eb57632f9418f34c05394945a931fa3a4a032533) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…hone Pro" commit 5f19535351bf28f28d702f452d11a1216ec2bd28 upstream. This reverts commit 096bd8c. Just as with the Pinebook Pro, there are multiple chipset variants for the Pinephone Pro, and multiple firmware binaries for different distributions. The change causes issues with some of these combinations, and reverting it resolves the issues. See the Closes below for the full report. Similarly with the Pinebook Pro adjustment, the original commit only indicates "further description" and not indicative of fixing any existing issues, so reverting should not kick any back up. Fixes: 096bd8c ("arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro") Cc: Heiko Stuebner <heiko@sntech.de> Cc: Peter Robinson <pbrobinson@gmail.com> Cc: Thorsten Leemhuis <regressions@leemhuis.info> Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/r/20260607225901.64019-1-oklopfer37@gmail.com/ Signed-off-by: Oren Klopfer <oklopfer37@gmail.com> Link: https://patch.msgid.link/20260703201010.67311-1-oklopfer37@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ff23eb4823d82adc01174293fd3e8a1610fe9794) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 8e73ae5c34e4fbbd25a8324e3c0eb1e845d7f01e upstream. IRQ_TYPE_xxx flags are not correct in the context of GPIO flags. These are simple defines so they could be used in DTS but they will not have the same meaning: IRQ_TYPE_LEVEL_LOW = 8 = GPIO_TRANSITORY. Correct the touchscreen irq-gpios to use proper flags, assuming the author of the code wanted similar logical behavior: IRQ_TYPE_LEVEL_LOW => GPIO_ACTIVE_LOW Fixes: e46b455 ("arm64: dts: qcom: sm6115-pro1x: Add Goodix Touchscreen") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260413090527.53000-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6bb9469c34fff08bebfbf2e6d27a916dd963f0d8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 06c8fc3e132ce8659bc9f0877b5c6daaf41aadbd upstream. The l12b and l15b supplies are used by components that are not (fully) described (and some never will be) and must never be disabled. Mark the regulators as always-on to prevent them from being disabled, for example, when consumers probe defer or suspend. Note that these supplies currently have no consumers described in mainline for dell-thena beyond the audio codec (vdd-buck/vdd-rxtx/ vdd-io on wcd938x), which can release them when the codec goes idle. The board-level gpio-fixed regulators that feed the Type-C retimer's VDDIO and other rails are not described with a vin-supply link, so the kernel cannot keep their parent LDOs alive on its own. This mirrors the same change Johan Hovold applied to every other X1E80100 board in a March 2025 series; commit 63169c0 ("arm64: dts: qcom: x1e80100-dell-xps13-9345: mark l12b and l15b always-on") is representative. The dell-thena board file was introduced four months later and did not inherit that change; this patch closes the gap. Fixes: e7733b4 ("arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455") Cc: stable@vger.kernel.org Signed-off-by: Michael Scott <mike.scott@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Acked-by: Val Packett <val@packett.cool> Link: https://lore.kernel.org/r/20260521010935.1333494-4-mike.scott@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit b6b3e4d5973bda6ac97486efdbbda4d6d034261e) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 2a08921edcab6a462fa6ddb02c91b90b5ac92429 upstream. According to the Jedec 5.1 specification, the device is held in reset when RST_n is low, therefore the polarity of the line must be that, as specified in the Device Tree binding (mmc/mmc-pwrseq-emmc.yaml). Due to the wrong polarity, eMMC devices with RST_n_FUNCTION[162] bitfield [1:0] set to 0x1 (the default is 0x0) will be held in reset forever. Cc: stable@vger.kernel.org Fixes: 56198ac ("arm64: dts: rockchip: add px30-pp1516 base dtsi and board variants") Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260612-pp1516-emmc-polarity-v1-1-4816c1c909f7@cherry.de Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit fe455c13bf01e4d40276f94996774ae32f5bc94a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit dfe078755706ed50651ebbe0442843ecd4ae8389 upstream. According to the Jedec 5.1 specification, the device is held in reset when RST_n is low, therefore the polarity of the line must be that, as specified in the Device Tree binding (mmc/mmc-pwrseq-emmc.yaml). Due to the wrong polarity, eMMC devices with RST_n_FUNCTION[162] bitfield [1:0] set to 0x1 (the default is 0x0) will be held in reset forever. Cc: stable@vger.kernel.org Fixes: c484cf9 ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260626-ringneck-emmc-polarity-v1-1-90cefe57b316@cherry.de Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5512c23231206fe5177471db89ec605c51e4097c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 85babf47515e2adf266dcc3be9804e31f752083e upstream. Technically, the reset signal is active low - it's called RST_n after all. But it is ignored completely unless RST_n_FUNCTION=1 (byte 162 in extcsd) is set in the emmc. It is 0 per default. For emmcs that have RST_n_FUNCTION=1 we failed like this: [ 3.074480] mmc1: Failed to initialize a non-removable card With this change they work normally. Cc: stable@vger.kernel.org Fixes: bb510dd ("arm64: dts: rockchip: add px30-cobra base dtsi and board variants") Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de> Tested-by: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260609081728.30616-2-jakobunt@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 650d2d5c0df7e4be6f099430bb596970026070e8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 4f7259ebe1eba4778768a4f5a0bbbe439d10f3f3 upstream. The ES8388 sound card on the rk3399-roc-pc-plus fails to probe because i2s1 cannot claim its MCLK pin: pinctrl: pin gpio4-0 already requested by ff880000.i2s; cannot claim for ff890000.i2s pinctrl: error -EINVAL: pin-128 (ff890000.i2s) pinctrl: error -EINVAL: could not request pin 128 (gpio4-0) from group i2s-8ch-mclk-pin on device rockchip-pinctrl GPIO4_A0 is routed as SCLK_I2S_8CH_OUT and is used by i2s1 as the external MCLK for the ES8388 codec. The board dts already removes GPIO4_A0 from the i2s0_8ch_bus pin group, but i2s0 still claims the same pin through its bclk_off state. Since the i2s driver requests both states, this blocks i2s1 pinctrl setup and leaves the simple-audio-card deferred with a parse error. Override i2s0_8ch_bus_bclk_off as well, matching the existing i2s0_8ch_bus override, so GPIO4_A0 is left for i2s1/ES8388 audio. Cc: stable@vger.kernel.org Fixes: 6d9a7bd ("arm64: dts: rockchip: add support for Firefly ROC-RK3399-PC-PLUS") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260717010736.578419-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8fc4bafabc06586e5e4ce4c3773926cced63a943) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit b4db45b3ec97a9d0d23446084f45e095b2ba2020 upstream. The rk3588s-roc-pc ES8388 codec is connected to the i2s0_8ch audio interface. Use the matching I2S0 MCLK output for the codec clock instead of I2S1. Using the I2S1 MCLK can leave the ALSA PCM running while the codec has no usable master clock for the active audio path, resulting in silent headphone output. Also make the CPU DAI provide bitclock and frame clock. This matches the active Rockchip I2S controller side and avoids relying on the codec to drive the bus clocks. Route the headphone output to LOUT2 and ROUT2, matching the old 5.10 BSP device tree. LOUT1 and ROUT1 are used for the speaker route there, so using them for the headphone widget can leave the headphone jack silent even while the ALSA path is active. The old BSP also used hp-con-gpio on GPIO1_A4. Model that GPIO as a simple audio amplifier so DAPM enables the headphone connection when the headphone path is active. Cc: stable@vger.kernel.org Fixes: 7f95097 ("arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260703025648.180135-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5343399ed72420ae7f9f45dd82ff99739d57ecfe) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 7e4cb63d61a7e0bef20f0d00e831c7fac06e4a1c upstream. Commit 4785aa8 ("cpuidle, ACPI: Evaluate LPI arch_flags for broadcast timer") replaced the generic nonzero check for LPI architectural context loss flags with arch_get_idle_state_flags(). RISC-V does not implement the helper, so it falls back to the stub that returns 0. Consequently, CPUIDLE_FLAG_TIMER_STOP is not set when an LPI state loses the hart timer context, preventing cpuidle from using a broadcast timer for that state. Implement the RISC-V helper and map the hart timer context loss flag to CPUIDLE_FLAG_TIMER_STOP. Fixes: 4785aa8 ("cpuidle, ACPI: Evaluate LPI arch_flags for broadcast timer") Cc: stable@vger.kernel.org Acked-by: Sudeep Holla <sudeep.holla@kernel.org> Reviewed-by: Yixun Lan <dlan@kernel.org> Reviewed-by: Sunil V L <sunilvl@oss.qualcomm.com> Reviewed-by: Huisong Li <lihuisong@huawei.com> Signed-off-by: Peixin Xie <peixin.xie@linux.spacemit.com> Link: https://patch.msgid.link/20260803-riscv-acpi-lpi-timer-v3-1-520fa13732f5@linux.spacemit.com Signed-off-by: Paul Walmsley <pjw@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8f392916a3540506a3377ad421fa9e62c2ff6826) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 34c9cfcde29b938c416924ee6ec3519270bc2238 upstream. A kthread is used to run check_vector_unaligned_access() to optimize boot time, allowing the kernel to continue booting without waiting for the unaligned vector speed probe to finish. However, this asynchronous approach introduces several complications. First, the kthread may not complete before a user reads vDSO data, resulting in incorrect values. This was previously addressed by commit 5d15d2a ("riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot"), which added complex synchronization between the kthread and vDSO reads. Second, it was discovered that the kthread may not finish before vec_check_unaligned_access_speed_all_cpus() (marked with __init) is freed, triggering a page fault. These issues raise the question of whether the kthread is worth the added complexity. A past boot time regression report was actually unrelated to synchronous probing; it was caused by the probe running serially. Since switching to a parallel probe, no further complaints have been made. Furthermore, the unaligned scalar access speed probe takes the same amount of time, runs synchronously, and has caused no issues. Testing shows no noticeable boot time slowdown when running the vector probe synchronously (0.464474s with kthread vs. 0.457991s without). Remove the kthread usage and run the probe synchronously. This simplifies the boot flow and allows for the revert of commit 5d15d2a ("riscv: hwprobe: Fix stale vDSO data for late-initialized keys at boot") Reported-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Closes: https://lore.kernel.org/linux-riscv/20260612-vec_unaligned_drop_init-v1-1-df969210ae34@oss.tenstorrent.com/ Fixes: e7c9d66 ("RISC-V: Report vector unaligned access speed hwprobe") Cc: stable@vger.kernel.org Signed-off-by: Nam Cao <namcao@linutronix.de> Acked-by: Jesse Taube <jtaubepe@redhat.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://patch.msgid.link/1c378963f27c5960e8a57c50b8b444d30954cb54.1781666867.git.namcao@linutronix.de [pjw@kernel.org: updated to apply; adjusted Fixes: tag; fixed my own manual patch application error] Signed-off-by: Paul Walmsley <pjw@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 37797d5013c9e719323e3e23c68cbd1807a6d648) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 22f9efb3ae07f966a1901d929d16df1388cce65c upstream. Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a device does not prevent its driver data from going away. Fixes: 63c13d6 ("remoteproc/mediatek: add SCP support for mt8183") Cc: stable@vger.kernel.org # 5.6 Cc: Erin Lo <erin.lo@mediatek.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20260706065614.389412-1-johan@kernel.org Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c7e32814a6bf20f792d05f0bc9f94f0606311bc6) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit a5edadbae57e2298a56cf7a4e774a027905a331f upstream. vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the page read-only and then upgrade it to writable with mprotect(), after which the guest can corrupt the host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071). Cc: stable@vger.kernel.org Fixes: 2050327 ("ptp: Add support for the AMZNC10C 'vmclock' device") Signed-off-by: Abdifatah Suruur <suruurism@gmail.com> Link: https://patch.msgid.link/20260813174707.14809-1-suruurism@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3f5677d2f817355147337f0453174c7bb0f3b66a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 06aa3d26327f24edd039ff249672fdf6f2ba5695 upstream. Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a86339 ("qede: Add build_skb() support.") accidentally dropped the assignment of tpa_info->buffer.data in qede_tpa_start(). When memory pressure causes an SKB allocation failure in qede_tpa_start(), the driver sets tpa_start_fail = true and attempts to recycle the physical page later in qede_tpa_end() via qede_reuse_page(). However, because buffer.data was left uninitialized (NULL), qede_reuse_page() pushes a "ghost" BD (valid DMA mapping but NULL data pointer) back into the active Rx ring. The next time the hardware uses this ring slot, it passes a NULL page to qede_fill_frag_skb(), causing a kernel panic. Example crash from production system: BUG: unable to handle kernel NULL pointer dereference at 0x8 RIP: qede_fill_frag_skb+0x96/0x430 [qede] Call Trace: qede_rx_int+0xb06/0x1de0 qede_poll+0x2f4/0x6c0 __napi_poll+0x2d/0x130 Fix the root cause by restoring the tpa_info->buffer.data assignment in qede_tpa_start(), ensuring valid pages are correctly tracked and recycled. Additionally, update the stale comment for struct qede_agg_info::buffer to reflect its current usage. Fixes: 8a86339 ("qede: Add build_skb() support.") Cc: stable@vger.kernel.org Signed-off-by: Vaibhav Nagare <vnagare@redhat.com> Link: https://patch.msgid.link/20260818073309.2266072-1-vnagare@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 2a952fb1b20d83e83ca852773e6188511f7d2191) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit a7100601aa1a39f799a566acce10db20eaf4b7f2 upstream. c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device. Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case. This issue was found by an in-house static analysis tool. Fixes: 1c8f1da ("iw_cxgb4: Fix possible circular dependency locking warning") Link: https://patch.msgid.link/r/20260806130128.465460-1-fanwu01@zju.edu.cn Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 85f438382a865a4dc4c50e6b884310bb2b60fc4d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 1d0f877d593438a494ca5b05cc8699150409005a upstream. ionic_fill_lif_cfg() reads eq_count from firmware uncapped, but the eth driver only reserves ionic->neqs_per_lif MSI-X vectors for RDMA event queues. Since ionic_rdma probes via the auxiliary bus before the netdev is brought up, it can exhaust the shared interrupt bitmap, causing ionic_open() to fail with -ENOSPC when allocating rx/tx interrupts. Cap RDMA eq_count to neqs_per_lif, which is populated by ionic_lif_size() at PCI probe before the RDMA aux device registers. Fixes: 8d765af ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter") Cc: stable@vger.kernel.org Signed-off-by: Brett Creeley <brett.creeley@amd.com> Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260805053254.4023262-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a38cd610b24f72c2eb712e276ae30221aaeec74d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820 upstream. ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx->file stable while a uevent is queued. The handler re-reads ctx->file for every dereference: mutex_lock(&ctx->file->mut); /* file A */ list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */ mutex_unlock(&ctx->file->mut); /* file B */ wake_up_interruptible(&ctx->file->poll_wait); /* file B */ A concurrent ucma_migrate_id() reassigns ctx->file while the SET_OPTION caller sleeps in mutex_lock(), so the list_add_tail() lands on file B's event_list while only file A's mutex is held, racing every other user of that list: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report+0x1aa/0x1c0 Read of size 8 at addr ffff888153c6a418 by task poc_corr/486 Call Trace: __list_add_valid_or_report+0x1aa/0x1c0 ucma_event_handler+0x1be/0xc00 ucma_set_ib_path+0x45e/0x710 ucma_set_option+0x32e/0x590 ucma_write+0x1f9/0x330 Allocated by task 505: ucma_write_cm_event+0x1a1/0x660 Freed by task 505: kfree+0x1da/0x4c0 ucma_get_event+0x5d5/0x7e0 The freed object is a ucma_event that another thread dequeued from file B's list under file B's mutex. File A's mut is left held on top of that, wedging its next writer in uninterruptible sleep. This path needs a bound and address-resolved cm_id, so it requires an RDMA device to be present. Take the handler lock around the call. Fixes: 09e328e ("RDMA/ucma: Fix the locking of ctx->file") Link: https://patch.msgid.link/r/2823D190-92D5-4714-8769-4FB643C64FF3@doyensec.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 28ac2dd416482d1c763c4af5d61af465b387fb50) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit f4cc21c6a8e9d392871477f9fd98d68e5ad80272 upstream.
ctx->file may only be changed under the handler lock and the xa_lock, which
is what stops uevents being queued for a ctx while ucma_migrate_id() moves
it to another file. The CM core takes that lock before invoking
ucma_event_handler(), but the write() paths that queue uevents themselves
do not.
ucma_write_cm_event() re-reads ctx->file for each of its four dereferences,
so ucma_migrate_id() can swap it mid-sequence:
mutex_lock(&ctx->file->mut); /* file A */
list_add_tail(&uevent->list, &ctx->file->event_list); /* file B */
mutex_unlock(&ctx->file->mut); /* file B */
wake_up_interruptible(&ctx->file->poll_wait); /* file B */
The window is the mutex_lock() itself: the writer sleeps in it while the
migration reassigns ctx->file. The list_add_tail() then runs on file B's
event_list holding only file A's mutex:
list_add corruption. prev->next should be next (ffff888101320f30),
but was ffff88814a08c418. (prev=ffff88814a075c18).
kernel BUG at lib/list_debug.c:32!
Call Trace:
ucma_write_cm_event+0x36e/0x5e0
and file A's mut is left held forever, wedging its next writer in D state.
The uevent is also stranded on a list ucma_cleanup_ctx_events() will not
walk, so it outlives its context. /dev/infiniband/rdma_cm is 0666 and no
RDMA device is involved, so an unprivileged user reaches all of this.
Take the handler lock, as ucma_cleanup_mc_events() does; ctx->cm_id is
pinned by the ucma_get_ctx() reference.
Fixes: a3c9d0f ("RDMA/ucma: Support write an event into a CM")
Link: https://patch.msgid.link/r/60544A67-EFD6-4D5D-974C-D983445F1070@doyensec.com
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4f8bb11dd2ff365e7cff1c9964ab4607292d364e)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 011199f46f44a9fd93a9e5ab5d7fd1328d80e9bf upstream. The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it. Cc: stable@vger.kernel.org Fixes: 5b2e450 ("IB/core: Add UVERBS_METHOD_REG_MR on the MR object") Reported-by: Jacob Moroni <jmoroni@google.com> Closes: https://lore.kernel.org/all/CAHYDg1TOGxRGZrS69d4Y--Shj_DZv0nJuM73iHUBwBM70g_t3Q@mail.gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 71d5c41ac583df09a7c32199bef7d42de7267d07) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…aving dangling of_node pointer commit f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c upstream. In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node. The function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Remove the of_node_put(np) call to let the device hold the reference. Cc: stable@vger.kernel.org Fixes: bc40733 ("regulator: as3722: add regulator driver for AMS AS3722") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260626160150.54291-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 95342d26f9c6b68a46ab57fa48428a3c4a423dd7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…wnership transferred to rdata commit 7c8cc25d8d86f9eb3979255935cfdc7d062ad746 upstream. In max8998_pmic_dt_parse_pdata(), of_get_child_by_name() acquires a reference on reg_np which is then stored in rdata->reg_node, transferring ownership to the regulator data array. The subsequent of_node_put(reg_np) at the end of the function releases the last matched regulator node's reference, leaving rdata->reg_node as a dangling pointer for the last entry. Remove the spurious of_node_put(reg_np) call. Cc: stable@vger.kernel.org Fixes: 156f252 ("drivers: regulator: add Maxim 8998 driver") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260626160326.54457-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 20e5fbb8c1a4c0096ebe42a73d927f0146453223) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 05dfeb2d0ccf87a7b92cd149a393b8423a26a04e upstream. As per the REFGEN IP team, this block supplies the reference current to the PHYs in the SoC. So, correct the regulator type to REGULATOR_CURRENT to match with the HW behavior. Fixes: 7cbfbe2 ("regulator: Introduce Qualcomm REFGEN regulator driver") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Link: https://patch.msgid.link/20260617-ipq9650_refgen-v4-1-c505ea6c6661@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1c3036a81800560b98908cf8267a61ec41a9a238) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit e743527c5bfdceda1095bc0a9e596e2aebb6a9c3 upstream. ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again. However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory. Use bpage->order for the allocation to prevent this race. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260813131152.3589632-6-vdonnefort@google.com Fixes: bce761d ("ring-buffer: Read and write to ring buffers with custom sub buffer size") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 2dc510957fe8fd098ab3c3147ebdf34d00cd2734) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 234b1a72e9706fe20c08c96f4374ec8e83b934cb upstream. When sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. Use the correct order for cpu_buffer->free_page. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260813131152.3589632-2-vdonnefort@google.com Fixes: f9b94da ("ring-buffer: Set new size of the ring buffer sub page") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260806211306.3704194-1-vdonnefort%40google.com # patch 3 Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8c1ecdcdea738efe0494af908f12c0ae3a97fffa) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 24974bd0da1b47fd56c975533ead50abf754e74d upstream. Because, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, hold cpu_buffer->lock to prevent races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page(). Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260813131152.3589632-3-vdonnefort@google.com Fixes: 8e7b58c ("ring-buffer: Just update the subbuffers when changing their allocation order") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260810125633.3344684-1-vdonnefort%40google.com # patch 3 Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit cb258d651d747a7f7063d40f145418bee562ceaf upstream. device_prepare() blocks runtime PM for a device with runtime PM disabled before invoking its system-sleep ->prepare() callback. For a device that has never enabled runtime PM, this changes dev->power.last_status from RPM_INVALID to RPM_BLOCKED. If the callback returns an error, dpm_prepare() does not move the device to dpm_prepared_list. Consequently, the recovery path through dpm_complete() never calls device_complete() for the failing device. The error path drops the runtime PM usage reference, but does not clear RPM_BLOCKED. A later legitimate pm_runtime_enable() then reports: Attempt to enable runtime PM when it is blocked before clearing the stale state. Call pm_runtime_unblock() on the prepare error path before dropping the runtime PM reference, matching the cleanup performed by device_complete(). The issue was reproduced with a platform test device whose ->prepare() callback returns -EIO while runtime PM has never been enabled. Before the fix, last_status remained RPM_BLOCKED after the failed suspend and the first pm_runtime_enable() produced the warning above. With the fix, last_status is restored to RPM_INVALID and the warning is absent. Fixes: 3e5eee1 ("PM: Block enabling of runtime PM during system suspend") Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Shibo Zhu <3499129952@qq.com> Link: https://patch.msgid.link/tencent_C5AC0A02FC01F700E764F8C2E3ECE4F41009@qq.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit bc6fdd425fdeb70715e98391273707ec3836baad) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit f574296be7f46eb60beca851240b526df232f480 upstream. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op. Fixes: 382f458 ("orangefs: rewrite readdir to fix several bugs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao <gyf161023@gmail.com> Signed-off-by: Mike Marshall <hubcap@omnibond.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f796f38a324e89547738f4b70cc33be5be2bc6da) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…copy commit 44b5adfe49499f53002737f5fe81d608c08122fc upstream. mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected. Fixes: e57b790 ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260625-b4-disp-16f99062-v1-1-aee52ecf61b9@proton.me Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5fdaf7016d7684ef756a229fd5d96b4a140eeb40) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives the teardown and its timer fires afterwards, trying to queue onto the workqueue that is already gone: workqueue: cannot queue mt7925_mlo_pm_work [mt7925_common] on wq phy0 WARNING: kernel/workqueue.c:2283 at __queue_work+0x59/0xa0, CPU#1: swapper/1/0 call_timer_fn+0x2a/0x140 __run_timers+0x203/0x330 run_timer_softirq+0x86/0xf0 mt7921 already has its own stop callback, so add one for mt7925 that cancels the work before calling mt792x_stop(). mt7925_ops backs both the PCIe and USB drivers, so this covers both. Fixes: 276a568 ("wifi: mt76: mt7925: update the power-saving flow") Cc: stable@vger.kernel.org Tested-by: Traockl <281473483+Traockl@users.noreply.github.com> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca> Link: https://patch.msgid.link/20260627202946.25598-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau <nbd@nbd.name> Conflicts: drivers/net/wireless/mediatek/mt76/mt7925/main.c Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit deaa2e3656937fbbe312f0ee2616c756c6e2511f upstream. mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames (MT_TXD7_MAC_TXD, set in mt7996_mac_write_txwi_80211()), but are otherwise FW-TXP devices. On tx free mt76_connac_txp_skb_unmap() therefore decodes the per-frame txp as a struct mt76_connac_fw_txp. For a MAC-TXP the fw_txp.nbuf byte aliases the AddBA TID word (MT_TXP1_TID_ADDBA), which is always zero, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. buf[1].skip_unmap is set unconditionally, so the generic DMA-ring cleanup skips it as well. Each AddBA req therefore leaks one TX DMA mapping, roughly one per (re)association. With WED enabled these mappings are bounced through the WED swiotlb pool, so under continuous client reconnect churn the pool is exhausted after ~1-2 days, after which DMA mapping fails for WED, the WiFi MCU and other on-SoC consumers. Keep the deferred (token release) unmap that the design relies on, and add an mt7996-specific txp unmap that inspects MT_TXD7_MAC_TXD and unmaps buf[1] from the MAC-TXP layout for those frames, delegating to mt76_connac_txp_skb_unmap() otherwise. Cc: stable@vger.kernel.org Fixes: cb6ebbd ("wifi: mt76: mt7996: support writing MAC TXD for AddBA Request") Link: https://patch.msgid.link/20260722082610.2699628-13-nbd@nbd.name Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 01f2e0da8548f82d704b65b513026cfedc5f8962) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f upstream. The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy. Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware. Fixes: 98686cd ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Cc: stable@vger.kernel.org Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com> Link: https://patch.msgid.link/20260713115412.67095-1-acharyalaxman8848@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 03b81f015dbb29807ce1ec6d45537d658abdac69) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 728836ebca239810f164262b10211ef59182f811 upstream. virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. The current order does not account for dependencies between those items: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock. The remove path can then stop the queues and flush rx_work before send_pkt_work queues it. Although the later send_pkt_work flush waits for that producer to finish, nothing waits for the newly queued rx_work, so kfree(vsock) can race with it. KASAN reported: BUG: KASAN: slab-use-after-free in virtio_transport_rx_work+0x487/0x4b0 Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtio_transport_rx_work+0x487/0x4b0 process_one_work+0x688/0x1120 worker_thread+0x45b/0xd10 Allocated by task 1: virtio_vsock_probe+0xef/0x6b0 Freed by task 84: kfree+0x131/0x3c0 virtio_vsock_remove+0xd1/0x100 Flush the works in producer-to-consumer order. virtio_vsock_vqs_del() has already disabled the queue callbacks and cleared the run flags, so after tx_work and send_pkt_work are drained, no source remains that can queue rx_work after its flush. Fixes: 0ea9e1d ("VSOCK: Introduce virtio_transport.ko") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com> Link: https://patch.msgid.link/20260822164556.3750959-1-nicoyip.dev@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 165a330a68b5f299d8735f0194c314cb2e571269) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 169ae5e65e5aaf213b6a578f6478a9fd2e523606 upstream. w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. The downstream slave puts a length byte in buf[0]. The driver then reads that many bytes into buf[1] with w1_f19_i2c_read(). buf[0] is controlled by the device and can be 0 to 255. w1_f19_i2c_read() only rejects a zero count. The caller buffer is I2C_SMBUS_BLOCK_MAX + 2, so 34 bytes. A length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core does check buf[0] against I2C_SMBUS_BLOCK_MAX. That check runs after master_xfer returns. By then the write is already done. i2c-algo-bit rejects an oversize length before it copies, and returns -EPROTO. Reject a length above I2C_SMBUS_BLOCK_MAX at both RECV_LEN sites, the same way i2c-algo-bit does. Fixes: ebc4768 ("add w1_ds28e17 driver for the DS28E17 Onewire to I2C master bridge") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Reviewed-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260629121043.199487-1-maoyixie.tju@gmail.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ae0c79a8527044e54d81fd5a3b49ce6177633758) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 789763523fb43cdc328de5cb5dcd19240ccf90d8 upstream. XArray operations that allocate xa_nodes, such as xas_nomem() and xas_alloc(), add __GFP_ACCOUNT when the array has XA_FLAGS_ACCOUNT set. This charges the allocated memory and avoids the workingset convergence issue described by commit 7b78564 ("mm: fix page cache convergence regression"). xas_split_alloc() does not add _GFP_ACCOUNT when XA_FLAGS_ACCOUNT is present. Fix it. Link: https://lore.kernel.org/20260804-add-gfp_account-to-xas_split_alloc-v3-2-38cb3ff325c5@nvidia.com Fixes: 6b24ca4 ("mm: Use multi-index entries in the page cache") Signed-off-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: William Kucharski <william.kucharski@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f49e55b1c8fe1029476ee762ec3a11c6f51410c8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 72e67c118642634c25465db0c8bcfa54c4ce086c upstream. The size of a sequential zone backing file records the amount of data written and is used to restore the zone state. A backing file whose size is equal to the zone capacity is restored as a full zone, while a file larger than the zone capacity is rejected as invalid. However, zloop_finish_zone() currently truncates the backing file to the zone size. For devices with a reduced zone capacity, finishing a zone therefore creates a backing file larger than the zone capacity. After the device is removed and later re-added, that zone file is rejected instead of being restored as a full zone. Truncate finished sequential zones to the zone capacity, matching the persistent representation accepted by zloop_update_seq_zone() for a full zone. Suggested-by: Damien Le Moal <dlemoal@kernel.org> Fixes: eb0570c ("block: new zoned loop block device driver") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/B39E5FD81D1A07F4+20260804023403.939767-1-raoxu@uniontech.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c3c7e87c76b42e640ef1d60c37b81b0e9f5ffd1d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 705c4ed0643366963547b2616d53165f2519c81f upstream. i2c_nuvoton_wait_for_stat() enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the function returns without balancing the enable_irq() call. Disable the IRQ before leaving the failed wait path. Also preserve an interrupted wait's original error code instead of converting it to -ETIMEDOUT inside the helper. Cc: stable@vger.kernel.org # v5.10+ Fixes: 4c336e4 ("tpm: Add support for the Nuvoton NPCT501 I2C TPM") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20260626091653.54929-1-mhun512@gmail.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit cde2d927c29e82380851f209222256c607969a1f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 7170ca01623b399c97f2ae9d3e228badc1f25ea3 upstream. cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong. Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl. Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled. Cc: stable@vger.kernel.org Fixes: e054bcb ("sysctl: move cad_pid into kernel/pid.c") Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Alexey Gladkov <legion@kernel.org> Reviewed-by: Bradley Morgan <include@grrlz.net> Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Signed-off-by: Joel Granados <joel.granados@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e8527de7fea191fda704792a56081f9009aeec37) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit de508ece1d37cdbbbfa52f074954310f9b066b13 upstream. If a machine has multiple graphic cards, detect the graphic card which is used to display firmware messages and use that one as the default graphic card for sticon and fbcon. On parisc machines the default graphic card used for BCH (boot console handler, aka BIOS menu) is stored in the stable storage (equivalent to CMOS storage on x86) or in the console path in page zero. Extract that path and store it as default STI path for later comparism. Take care that the graphic card can be a GSC or a PCI card which use different path strings. Increase max string size for default_sti_path to 32 chars as the print_pa_hwpath() function formats a hardware path using unbounded sprintf calls for up to 6 bus converter components and 1 module component (e.g., 255/255/...), which can produce a string up to 28 bytes long. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 236c8ecaafc63c9551f7def9be02fe86c7c1b5ed) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit d19cdc167e696714509e87d3f7ae765b6e164589 upstream. send_signal_locked() rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it. Link: https://lore.kernel.org/86a8857d58d43ee26a8b365b837fd24830343494.1782159692.git.include@grrlz.net Fixes: 7a0cf09 ("signal: Correct namespace fixups of si_pid and si_uid") Signed-off-by: Bradley Morgan <include@grrlz.net> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Adrian Huang <adrianhuang0701@gmail.com> Cc: Aleksandr Nogikh <nogikh@google.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Marco Elver <elver@google.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a246da20c8e4ae4319511c698b9f26ad0ad1769f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit fedc88e38ce979a720cd2de042578cb5df3dc8de upstream. When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race. Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ed64aa505875a3b4defd504ee8e59e1949246a62) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 1f58a5335cdd14b3fb5f2a5d3763dee1f5cba1d3 upstream. parse() hands nla_strscpy() len as dstsize, and nla_strscpy() copies at most dstsize - 1 bytes. When the attr payload comes in without a trailing NUL, srclen == len >= dstsize and the last character of the cpumask string gets cut off. Register "0-15" and you are silently listening on "0-1", exit data for the rest never shows up. The bug only bites when the sender doesn't NUL terminate the payload; senders that include the NUL were always fine (srclen gets decremented for the trailing NUL, so srclen < dstsize). Thats probably why this survived 20 years. And the policy is NLA_STRING, not NLA_NUL_STRING, so a payload without the trailing NUL is legit input here. Skip the kmalloc/nla_strscpy dance entirely and use nla_strdup(), which already allocates srclen + 1 and terminates. The nla_len() bounds checks stay as they were. Link: https://lore.kernel.org/EC49FE41-7F5F-41E0-A07A-ABEB8ECA514D@grrlz.net Fixes: f9fd891 ("[PATCH] per-task delay accounting taskstats interface: control exit data through cpumasks") Signed-off-by: Bradley Morgan <include@grrlz.net> Reported-by: Oleg Deomi <oleg.deomi@gmail.com> Closes: https://lore.kernel.org/CAByWkfZ6b1=3H9pwkz-dDQOs9cZaF-HYQ6b9Yb0=Hq2r1Vv_Pw@mail.gmail.com Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Balbir Singh <bsingharora@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6067c39c2cec1ad87c43fa20c0a6636380b67d62) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…ex() commit 4b61084b11bcecce86d03804ff30f8d7b465593c upstream. If the auxiliary clock is disabled during tk_get_aux_ts64() but is enabled before tks->clock_valid is checked, then uninitialized stackdata will be used in the calculations and indirectly leaked to userspace. The same race window also exists after this change and also for the core timekeeper. But in these cases the only effect would be incorrect adjustments and this is userspace's responsibility to avoid this. Fixes: 4eca49d ("timekeeping: Prepare do_adtimex() for auxiliary clocks") Signed-off-by: Thomas Weißschuh (Schneider Electric) <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260731-timekeeping-aux-adjtimex-return-v1-1-b7fea4692886@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit fecf1e37775269ad38c172b468ad4ecc3968aa63) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit c793bbfc4a0a9f5a66978fc91559e9681748dbeb upstream. When timers are migrated away from an offline CPU the debugobjects state gets corrupted. The timer is accounted as inactive on deletion, but the enqueue on the alive CPU lacks the activation call. That used to work, but got broken when the trace point and the debug objects call got separated. That change missed to fixup migrate_timer_list(). Add the missing debug_timer_activate() invocation to fix it. Fixes: dc1e7dc ("timer: Move trace point to get proper index") Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/87bjb0l7ha.ffs@fw13 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit b7eff3f621ef24624f946e35fe7deb6a36398576) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit a5a5ed23b1340ff0f32a14a7ca8585f7c4e9b2e2 upstream. In udf_do_extend_file() the total extent length is rounded up to a block boundary with: iinfo->i_lenExtents = (iinfo->i_lenExtents + sb->s_blocksize - 1) & ~(sb->s_blocksize - 1); i_lenExtents is a __u64, but sb->s_blocksize is unsigned long. On 32-bit kernels unsigned long is 32-bit, so ~(sb->s_blocksize - 1) is a 32-bit value (e.g. 0xfffff800 for a 2 KiB block) that is zero-extended in the AND, clearing the upper 32 bits of i_lenExtents. For UDF files whose total extent length exceeds 4 GiB this truncates i_lenExtents when the file is extended, corrupting the tracked extent length. Cast the block size to 64-bit before forming the mask. 64-bit kernels are unaffected. Fixes: 48d6d8f ("udf: cache struct udf_inode_info") Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Link: https://patch.msgid.link/20260722082425.213311-1-zhanxusheng@xiaomi.com Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 2d6150e5e6aa641e02e0072ac937b09bdc1e73f8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 98df164036bed307a16e7c124ad023c2c13c4b76 upstream.
run_vmtests.sh runs on-fault-limit as the nobody user via "sudo -u nobody
./on-fault-limit", guarded by a check that nobody can access the binary
("sudo -u nobody ls ./on-fault-limit").
The guard resolves the relative path from the inherited working directory,
which only requires search permission on the test directory itself.
Classic sudo passes the relative path through to execve() the same way, so
the two agree. However, sudo-rs (the default sudo implementation since
Ubuntu 25.10) canonicalizes the command to an absolute path before
executing it, which requires search permission on every ancestor
directory. When the kernel tree lives under a private home directory
(mode 0750, the Ubuntu default for new users since 21.04), the guard
passes but the execution fails with "command not found", and the test is
reported as a false FAIL:
# running sudo -u nobody ./on-fault-limit
sudo: './on-fault-limit': command not found
# [FAIL]
Wrap the command in "sh -c" so that sudo only resolves the shell binary,
and the relative path is resolved by nobody's shell from the inherited
working directory, matching what the guard checks. This is the only "sudo
-u nobody" invocation in the script; uid, cwd, rlimits (including
RLIMIT_MEMLOCK, which this test exercises) and the exit status are
unchanged through sh.
Verified on Ubuntu 26.04 (sudo-rs 0.2.13): the test now runs and passes
instead of failing. Verified on Ubuntu 24.04 (sudo 1.9.15p5): behavior is
unchanged.
Link: https://lore.kernel.org/20260713092700.464376-1-injaeryou@gmail.com
Fixes: 5d2146a ("selftests/mm: skip mlock tests if nobody user can't read it")
Signed-off-by: Injae Ryou <injaeryou@gmail.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit e91d66e5ff6610185f79dcded36d1f1fa45826e5)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 9a3f43b30373c61477d0d3ab52946c05f9492bf9 upstream.
Commit 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported
sensor number") evaluated the `sensor_num` against the bounds limit even
for timestamp events. A timestamp event typically has a `sensor_num` of
0xff [1], causing the driver to flag it as invalid and skip to the next
event.
As a result, we'd see a flooding of "Invalid sensor number 255 from EC"
warning logs and these timestamp events were being dropped.
Move the bounds-check into cros_ec_sensor_ring_process_event() and
evaluate it only after standalone timestamp events have already been
processed and returned early.
[1] https://crrev.com/219ca6ef82ba266da788b673ee4ad50bd3ea1285/common/motion_sense_fifo.c#427
Fixes: 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported sensor number")
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Link: https://lore.kernel.org/r/20260715024454.4127571-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6a259dd313043fb99b63f57e9baa9db956b5909d)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit aa62204 ] PMD 'non-swap' swap entries are currently used for PMD-level migration entries and device private entries. To add to the confusion in this terminology we use is_swap_pmd() in an inconsistent way similar to how is_swap_pte() was being used - sometimes adopting the convention that !pmd_none(), !pmd_present() implies PMD 'swap' entry, sometimes not. This patch handles the low-hanging fruit of cases where we can simply substitute other predicates for is_swap_pmd(). No functional change intended. Link: https://lkml.kernel.org/r/8a1704b36a009c18032d5bea4cb68e71448fbbe5.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Vlastimil Babka <vbabka@suse.cz> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Alistair Popple <apopple@nvidia.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Baoquan He <bhe@redhat.com> Cc: Barry Song <baohua@kernel.org> Cc: Byungchul Park <byungchul@sk.com> Cc: Chengming Zhou <chengming.zhou@linux.dev> Cc: Chris Li <chrisl@kernel.org> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Claudio Imbrenda <imbrenda@linux.ibm.com> Cc: David Hildenbrand <david@redhat.com> Cc: Dev Jain <dev.jain@arm.com> Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Cc: Gregory Price <gourry@gourry.net> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: "Huang, Ying" <ying.huang@linux.alibaba.com> Cc: Hugh Dickins <hughd@google.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Janosch Frank <frankja@linux.ibm.com> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Joshua Hahn <joshua.hahnjy@gmail.com> Cc: Kairui Song <kasong@tencent.com> Cc: Kemeng Shi <shikemeng@huaweicloud.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Mathew Brost <matthew.brost@intel.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Nhat Pham <nphamcs@gmail.com> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pasha Tatashin <pasha.tatashin@soleen.com> Cc: Peter Xu <peterx@redhat.com> Cc: Rakie Kim <rakie.kim@sk.com> Cc: Rik van Riel <riel@surriel.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: SeongJae Park <sj@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Wei Xu <weixugc@google.com> Cc: xu xin <xu.xin16@zte.com.cn> Cc: Yuanchu Xie <yuanchu@google.com> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Stable-dep-of: f5407e9b697c ("mm/rmap: use huge_ptep_get() in try_to_unmap_one()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 381a0a524e967a8bb887372af64433e442e846ad) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit f5407e9b697c940e78b27ff63c6e14d8d171adc3 ] Patch series "Fix incorrect access of hugetlb pte entries", v3. There are various places which use ptep_get() to get the pte entry corresponding to a hugetlb folio. Some arches (like s390) have special handling to compute the pteval, so they provide huge_ptep_get(). Use this helper consistently. Additionally, some code paths may provide huge_ptep_get with an unaligned address. This is a problem on arm64 (I checked other arches and it looks fine for them), which is fixed in patch 1. The fix is made to be backport-friendly: the cleaner fix would be to perhaps pass the hstate to huge_ptep_get() - that is wider churn and we can do that later. This patch (of 5): try_to_unmap_one() handles hugetlb folios when memory failure needs to replace a poisoned hugetlb mapping with a hwpoison entry. In that case page_vma_mapped_walk() returns the pte pointer to the hugetlb folio in pvmw.pte, but the code reads it with ptep_get(). On arches which provide their own huge_ptep_get() to dereference a huge pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present() etc to misbehave. It is not clear whether this has a trivially visible effect to userspace. Just use huge_ptep_get() for dereferencing a huge pte pointer. Link: https://lore.kernel.org/20260703114202.365553-1-dev.jain@arm.com Link: https://lore.kernel.org/20260703114202.365553-3-dev.jain@arm.com Fixes: c7ab0d2 ("mm: convert try_to_unmap_one() to use page_vma_mapped_walk()") Signed-off-by: Dev Jain <dev.jain@arm.com> Reported-by: David Hildenbrand <david@kernel.org> Reviewed-by: Muchun Song <muchun.song@linux.dev> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Alistair Popple <apopple@nvidia.com> Cc: Andi Kleen <ak@linux.intel.com> Cc: Anshuman Khandual <anshuman.khandual@arm.com> Cc: Byungchul Park <byungchul@sk.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Gregory Price <gourry@gourry.net> Cc: Harry Yoo <harry@kernel.org> Cc: "Huang, Ying" <ying.huang@linux.alibaba.com> Cc: Jann Horn <jannh@google.com> Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Joshua Hahn <joshua.hahnjy@gmail.com> Cc: Jun'ichi "Nick" Nomura <j-nomura@ce.jp.nec.com> Cc: Kiryl Shutsemau <kas@kernel.org> Cc: Lance Yang <lance.yang@linux.dev> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Rakie Kim <rakie.kim@sk.com> Cc: Ralph Campbell <rcampbell@nvidia.com> Cc: Rik van Riel <riel@surriel.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Will Deacon <will@kernel.org> Cc: Zi Yan <ziy@nvidia.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8e30f5427f3458d5aca8f063f52e62ee24a81925) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260904045747.813364717@linuxfoundation.org Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Wentao Guan <guanwentao@uniontech.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Miguel Ojeda <ojeda@kernel.org> Link: https://lore.kernel.org/r/20260905115635.269562615@linuxfoundation.org Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7cfc41f8e80f11ffa8382ed1a505154ceffb79c7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
🔵 Needs a closer look
The update spans more than 300 architecture, core-kernel, filesystem, networking, and driver files and includes unresolved minor cleanup findings.
Pull request overview
Updates the Deepin Linux 6.18.y kernel baseline from 6.18.49 to 6.18.50, integrating broad upstream stability, security, lifecycle, bounds-checking, and hardware-support fixes.
Changes:
- Applies upstream fixes across memory management, networking, filesystems, security, and architecture code.
- Improves driver cleanup, synchronization, validation, and device compatibility.
- Updates kernel version, tooling checks, tests, and documentation.
File summaries
| File | Description |
|---|---|
Makefile |
Bumps sublevel to 6.18.50. |
tools/testing/selftests/mm/run_vmtests.sh |
Adjusts unprivileged mlock test invocation. |
tools/include/linux/compiler.h |
Defines the const-function attribute. |
scripts/rust_is_available.sh |
Detects incompatible bindgen/libclang combinations. |
scripts/rust_is_available_bindgen_libclang_22.h |
Adds bindgen compatibility probe. |
rust/kernel/time.rs |
Fixes overflow-safe microsecond rounding. |
rust/kernel/list.rs |
Corrects list example documentation. |
sound/usb/6fire/comm.c |
Validates received MIDI message lengths. |
sound/soc/amd/yc/acp6x-mach.c |
Adds MSI Thin A15 audio quirk. |
sound/pci/pcxhr/pcxhr.c |
Initializes locks before IRQ registration. |
sound/hda/core/ext/stream.c |
Uses masked register update for reset. |
sound/drivers/virmidi.c |
Validates platform card index. |
sound/drivers/serial-u16550.c |
Validates platform card index. |
sound/drivers/portman2x4.c |
Handles negative card indices. |
sound/drivers/mts64.c |
Handles negative card indices. |
sound/drivers/mpu401/mpu401.c |
Validates platform card index. |
sound/drivers/aloop.c |
Validates platform card index. |
sound/core/ump_convert.c |
Initializes the second UMP word. |
security/smack/smack_lsm.c |
Uses task-safe label lookup. |
security/landlock/errata/abi-1.h |
Documents whiteout creation erratum. |
security/keys/trusted-keys/trusted_tpm1.c |
Reorders trusted-key teardown. |
security/apparmor/include/label.h |
Adds vector terminator capacity. |
security/apparmor/include/cred.h |
Defers stale credential replacement. |
net/vmw_vsock/virtio_transport.c |
Reorders work flushing during removal. |
net/sunrpc/xprtsock.c |
Handles TLS cancellation races. |
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c |
Rejects empty write chunks. |
net/sunrpc/xprtrdma/svc_rdma_pcl.c |
Publishes fully initialized chunks. |
net/sunrpc/xdr.c |
Prevents buffer-length underflow. |
net/sunrpc/sunrpc_syms.c |
Initializes the GSS proxy lock. |
net/sunrpc/cache.c |
Safely restarts the cache cleaner. |
net/sunrpc/auth_gss/gss_rpc_xdr.c |
Rejects duplicate credentials. |
net/sunrpc/auth_gss/gss_rpc_upcall.h |
Removes obsolete initializer declaration. |
net/sunrpc/auth_gss/gss_rpc_upcall.c |
Removes obsolete client initialization. |
net/sunrpc/auth_gss/auth_gss.c |
Hardens wrapped-response bounds checks. |
net/smc/smc.h |
Replaces connection bitfields with bytes. |
net/smc/smc_wr.c |
Corrects spillover-buffer documentation. |
net/smc/smc_tx.h |
Handles absent send buffers. |
net/smc/smc_rx.c |
Avoids access after connection teardown. |
net/smc/af_smc.c |
Guards send-buffer queue queries. |
net/sctp/sm_sideeffect.c |
Discards chunks after association deletion. |
net/sctp/inqueue.c |
Drops chunks for dead transports. |
net/sched/sch_generic.c |
Initializes watchdog timestamp correctly. |
net/openvswitch/conntrack.c |
Releases connlabel state on failure. |
net/mptcp/syncookies.c |
Restores the local address identifier. |
net/mpls/af_mpls.c |
Refreshes header pointers after pulls. |
net/iucv/af_iucv.c |
Restricts socket lookup to the receiving device. |
net/ipv6/sit.c |
Limits tunnel headroom. |
net/ipv6/seg6_local.c |
Resets IPv6 control-block state. |
net/ipv6/route.c |
Uses RCU-safe exception traversal. |
net/ipv6/ip6_input.c |
Orphans forwarded multicast packets. |
net/ipv6/ip6_gre.c |
Corrects GRE tunnel headroom accounting. |
net/ipv4/ipmr.c |
Orphans non-local multicast packets. |
net/ipv4/ipip.c |
Drops packets when metadata allocation fails. |
net/ipv4/ip_tunnel.c |
Limits tunnel headroom. |
net/core/xdp.c |
Corrects XDP frame sizing and headroom. |
net/core/skbuff.c |
Avoids clearing shared zerocopy state. |
net/ceph/osdmap.c |
Validates decoded CRUSH bucket IDs. |
net/bluetooth/rfcomm/core.c |
Serializes security confirmation handling. |
net/bluetooth/iso.c |
Handles concurrently closed listeners. |
net/bluetooth/hci_sync.c |
Clears stale command-pending state. |
net/bluetooth/hci_event.c |
Preserves advertising state after failures. |
net/bluetooth/hci_core.c |
Retains the sent command skb safely. |
net/bluetooth/hci_conn.c |
Limits advertising restart by role. |
net/bluetooth/eir.c |
Corrects service-data iteration bounds. |
mm/zswap.c |
Fixes shrink-worker retry behavior. |
mm/zsmalloc.c |
Centralizes handle-aware class lookup. |
mm/swapfile.c |
Rate-limits invalid swap-entry errors. |
mm/page_table_check.c |
Safely checks non-present PMDs. |
mm/mm_init.c |
Corrects deferred PFN completion tracking. |
mm/migrate.c |
Reports Tasks RCU quiescent states. |
mm/mempolicy.c |
Unifies VMA policy lookup and release. |
mm/kasan/quarantine.c |
Drains quarantine lists for all possible CPUs. |
mm/internal.h |
Refactors compaction capture state. |
mm/huge_memory.c |
Handles empty PMDs before swap conversion. |
lib/xarray.c |
Accounts split allocations to memory cgroups. |
lib/ucs2_string.c |
Prevents one-past-limit reads. |
kernel/trace/trace.c |
Serializes ring-buffer resizing and improves errors. |
kernel/trace/trace_events.c |
Handles event test-thread creation failure. |
kernel/trace/trace_events_user.c |
Protects the parent user-event context. |
kernel/trace/trace_events_hist.c |
Removes histogram variables during cleanup. |
kernel/time/timer.c |
Reactivates migrated timers in debug tracking. |
kernel/time/timekeeping.c |
Handles unavailable auxiliary clocks. |
kernel/time/itimer.c |
Initializes legacy timer padding. |
kernel/taskstats.c |
Uses safe netlink string duplication. |
kernel/signal.c |
Avoids mutating caller-owned signal information. |
kernel/params.c |
Preserves old parameters on allocation failure. |
kernel/bpf/stackmap.c |
Pins execution during callchain access. |
kernel/auditfilter.c |
Corrects audit-tree reference release. |
io_uring/query.c |
Bounds query structure clearing. |
include/uapi/linux/landlock.h |
Documents whiteout access semantics. |
include/net/sctp/structs.h |
Corrects stream-reset field documentation. |
include/linux/usb/tcpci.h |
Adds receive frame-type mask. |
include/linux/swapops.h |
Adds soft-leaf helpers and safe PMD checks. |
include/linux/sunrpc/svc_rdma_pcl.h |
Makes segment iteration zero-safe. |
include/linux/netdevice.h |
Moves statistics type into the hot cache group. |
include/linux/mm_types.h |
Adds the soft-leaf entry type. |
include/linux/list.h |
Forces initdata-safe list helper inlining. |
include/linux/hugetlb.h |
Declares huge PTE accessor for stub builds. |
include/linux/dm-io.h |
Extends DM I/O unsupported-operation reporting. |
include/linux/compaction.h |
Updates compaction capture API. |
fs/udf/partition.c |
Fixes VAT upper-bound validation. |
fs/udf/inode.c |
Prevents extent-length mask truncation. |
fs/ubifs/auth.c |
Corrects signature-length validation. |
fs/tracefs/event_inode.c |
Initializes eventfs lists centrally. |
fs/smb/client/smb2file.c |
Prevents aligned-length overflow. |
fs/smb/client/smb1ops.c |
Corrects WSL device xattr length. |
fs/smb/client/inode.c |
Clears released connection state. |
fs/smb/client/file.c |
Invalidates cache after truncation. |
fs/smb/client/cifsfs.c |
Handles zero-length clone ranges safely. |
fs/orangefs/orangefs-debugfs.c |
Trims leading configuration whitespace. |
fs/orangefs/devorangefs-req.c |
Clears freed trailer pointer. |
fs/ocfs2/xattr.c |
Always runs deferred deallocations. |
fs/ocfs2/dlm/dlmrecovery.c |
Validates migration message sizing. |
fs/ocfs2/dlm/dlmmaster.c |
Validates migration lock names. |
fs/ocfs2/dir.c |
Prevents directory-position mask truncation. |
fs/ocfs2/cluster/nodemanager.h |
Declares unlocked dependency helper. |
fs/ocfs2/cluster/nodemanager.c |
Adds unlocked configfs dependency helper. |
fs/ntfs3/frecord.c |
Zeroes partially decompressed frame tails. |
fs/nsfs.c |
Tightens namespace visibility checks. |
fs/notify/fanotify/fanotify.h |
Stores permission ranges by value. |
fs/notify/fanotify/fanotify.c |
Copies range positions into events. |
fs/notify/fanotify/fanotify_user.c |
Emits copied range positions. |
fs/nilfs2/direct.c |
Propagates delete deformation intent. |
fs/nilfs2/bmap.h |
Extends block-map delete callback. |
fs/nilfs2/bmap.c |
Passes normal-delete semantics. |
fs/nfsd/state.h |
Adds RCU session lifetime support. |
fs/nfsd/nfssvc.c |
Corrects ACL version negotiation. |
fs/nfsd/nfsproc.c |
Acquires write access before setattr preparation. |
fs/nfsd/nfscache.c |
Fixes cache initialization and prune limits. |
fs/nfsd/nfs4layouts.c |
Safely obtains layout files. |
fs/nfsd/nfs3acl.c |
Honors requested ACL masks. |
fs/nfsd/localio.c |
Protects cached local-file lookup with RCU. |
fs/nfs/pnfs.c |
Fixes busy comparison and segment cleanup. |
fs/nfs_common/nfslocalio.c |
Cleans failed local-file publication. |
fs/netfs/write_retry.c |
Serializes write retry-list updates. |
fs/netfs/read_retry.c |
Serializes read retry-list updates. |
fs/lockd/clntproc.c |
Handles lock-owner allocation failure. |
fs/fuse/dev.c |
Waits for aborted requests to finish. |
fs/fat/misc.c |
Rolls back failed FAT chain updates. |
fs/ecryptfs/super.c |
Reports filename-encryption mount options. |
fs/ecryptfs/miscdev.c |
Bounds packet-length inspection. |
fs/ecryptfs/ecryptfs_kernel.h |
Adds packet-buffer size parameter. |
fs/ecryptfs/crypto.c |
Supplies packet parsing bounds. |
fs/ceph/xattr.c |
Validates xattr value length. |
fs/ceph/mds_client.c |
Bounds capability path decoding. |
fs/ceph/addr.c |
Releases failed write-buffer claims. |
fs/buffer.c |
Avoids unnecessary buffer traversal. |
fs/btrfs/direct-io.c |
Corrects extent-map ownership on failure. |
fs/backing-file.c |
Uses the user-visible backing path. |
drivers/w1/slaves/w1_ds28e17.c |
Validates SMBus block lengths. |
drivers/video/fbdev/uvesafb.c |
Removes connector callback after init failure. |
drivers/video/fbdev/pvr2fb.c |
Corrects userspace pointer annotation. |
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c |
Initializes mutex before registration. |
drivers/usb/typec/ucsi/ucsi.c |
Uses the standard UCSI timeout. |
drivers/usb/typec/altmodes/thunderbolt.c |
Cancels work before teardown. |
drivers/usb/phy/phy-fsl-usb.h |
Corrects internal timer linkage. |
drivers/usb/gadget/udc/snps_udc_plat.c |
Preserves extcon probe errors. |
drivers/usb/gadget/function/uvc_video.c |
Uses the initialized UVC object for logging. |
drivers/usb/gadget/function/f_uvc.c |
Clears freed control pointers. |
drivers/usb/gadget/function/f_midi2.c |
Removes configfs default groups. |
drivers/usb/gadget/function/f_fs.c |
Avoids sleeping while holding the setup mutex. |
drivers/usb/dwc3/gadget.c |
Cancels endpoint delayed work. |
drivers/staging/media/ipu7/ipu7-isys.c |
Cleans notifier state on probe failure. |
drivers/staging/greybus/hid.c |
Returns transferred report length. |
drivers/scsi/scsi_lib.c |
Zeroes DMA padding bytes. |
drivers/s390/block/dasd.c |
Propagates ESE read failures. |
drivers/s390/block/dasd_erp.c |
Preserves processed-byte accounting. |
drivers/rpmsg/qcom_glink_smem.c |
Orders FIFO publication and payload reads. |
drivers/remoteproc/mtk_scp.c |
Releases uninitialized SCP device references. |
drivers/regulator/qcom-refgen-regulator.c |
Corrects regulator classification. |
drivers/regulator/max8998.c |
Fixes device-tree node ownership. |
drivers/regulator/as3722-regulator.c |
Fixes device-tree node ownership. |
drivers/rapidio/devices/rio_mport_cdev.c |
Prevents stale mapping reuse. |
drivers/ptp/ptp_vmclock.c |
Restricts writable remapping. |
drivers/power/supply/ucs1002_power.c |
Adds managed delayed-work cancellation. |
drivers/power/supply/twl4030_charger.c |
Adds managed work cancellation. |
drivers/power/supply/lp8788-charger.c |
Cancels work after IRQ teardown. |
drivers/power/supply/lp8727_charger.c |
Reorders IRQ and work teardown. |
drivers/power/supply/bq25890_charger.c |
Manages secondary charger references. |
drivers/platform/x86/lenovo/ymc.c |
Masks high WMI event bits. |
drivers/platform/x86/lenovo/wmi-helpers.c |
Always frees ACPI output objects. |
drivers/platform/x86/intel/ishtp_eclite.c |
Releases ACPI device on probe failure. |
drivers/platform/x86/hp/hp-bioscfg/string-attributes.c |
Bounds string package parsing. |
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c |
Sends validated key lengths. |
drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c |
Removes sensitive debug dumping. |
drivers/platform/x86/amd/pmc/pmc.c |
Cleans debugfs and ACPI registration failures. |
drivers/platform/chrome/cros_ec_sensorhub_ring.c |
Validates sensor event identifiers. |
drivers/phy/rockchip/phy-rockchip-samsung-dcphy.c |
Corrects regmap maximum register. |
drivers/pci/msi/msi.c |
Enables memory decoding during MSI-X restore. |
drivers/pci/controller/pci-hyperv.c |
Adds hierarchical IRQ retrigger support. |
drivers/pci/controller/dwc/pci-meson.c |
Requests reset GPIO asserted. |
drivers/of/base.c |
Continues child iteration through secondary nodes. |
drivers/nvme/host/pci.c |
Disables controller after IRQ setup failure. |
drivers/nvme/host/fc.c |
Corrects failed queue cleanup bounds. |
drivers/nvme/host/core.c |
Zeroes the discard page. |
drivers/nvdimm/label.c |
Prevents label-size multiplication overflow. |
drivers/net/wireless/realtek/rtw88/tx.c |
Frees skb after HCI transmit failure. |
drivers/net/wireless/realtek/rtw88/pci.c |
Cleans PCI resources after NAPI failure. |
drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c |
Bounds TID array access. |
drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c |
Cleans shared data on initialization failure. |
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |
Initializes EEPROM state. |
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |
Initializes EEPROM state. |
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |
Validates fallback EEPROM size. |
drivers/net/wireless/mediatek/mt76/mt7925/usb.c |
Cancels MLO PM work during suspend. |
drivers/net/wireless/mediatek/mt76/mt7925/pci.c |
Cancels MLO PM work during teardown. |
drivers/net/wireless/mediatek/mt76/mt7925/mac.c |
Cancels MLO PM work during reset. |
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c |
Bounds firmware-provided EEPROM offsets. |
drivers/net/wireless/mediatek/mt76/mt7615/main.c |
Cancels work before taking the mutex. |
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c |
Detaches timed-out command buffers. |
drivers/net/wireless/intel/iwlwifi/dvm/main.c |
Corrects EEPROM cleanup ordering. |
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c |
Fixes control-buffer ownership. |
drivers/net/wireless/ath/ath6kl/cfg80211.c |
Prevents association length underflow. |
drivers/net/usb/qmi_wwan.c |
Adds Telit FE990D50 support. |
drivers/net/thunderbolt/main.c |
Cleans failed connection resources. |
drivers/net/phy/phylink.c |
Handles error-valued PCS pointers. |
drivers/net/ovpn/ovpnpriv.h |
Exposes the OVPN workqueue. |
drivers/net/ipa/ipa_modem.c |
Waits for runtime resume before queue wake. |
drivers/net/ethernet/renesas/ravb.h |
Adds IRQ and PHC tracking fields. |
drivers/net/ethernet/qlogic/qede/qede.h |
Corrects aggregation-buffer documentation. |
drivers/net/ethernet/qlogic/qede/qede_fp.c |
Preserves aggregation buffer data pointer. |
drivers/net/ethernet/nvidia/forcedeth.c |
Fixes register save/restore bounds. |
drivers/net/ethernet/broadcom/bnxt/bnxt.c |
Uses common transmit-drop cleanup. |
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c |
Clears freed firmware pointers. |
drivers/net/dsa/realtek/rtl83xx.c |
Uses sleepable GPIO setters. |
drivers/misc/nsm.c |
Clamps response length. |
drivers/mfd/sm501.c |
Frees device state on removal. |
drivers/mfd/cgbc-core.c |
Removes children before session release. |
drivers/media/test-drivers/vicodec/vicodec-core.c |
Corrects FWHT component count. |
drivers/media/cec/platform/stm32/stm32-cec.c |
Bounds received CEC messages. |
drivers/md/raid10.c |
Corrects degraded-array detection. |
drivers/md/md.c |
Validates bad-block shift values. |
drivers/md/dm-verity-target.c |
Adapts to extended DM I/O API. |
drivers/md/dm-switch.c |
Publishes table entries atomically. |
drivers/md/dm-stats.c |
Handles partial per-CPU allocation. |
drivers/md/dm-snap-persistent.c |
Adapts snapshot I/O calls. |
drivers/md/dm-pcache/dm_pcache.c |
Parses GC percentage into its actual type. |
drivers/md/dm-pcache/cache.h |
Validates on-media key counts. |
drivers/md/dm-pcache/cache_segment.c |
Restricts allocation to initialized segments. |
drivers/md/dm-log.c |
Adapts log I/O calls. |
drivers/md/dm-log-userspace-base.c |
Reserves constructor-string terminator space. |
drivers/md/dm-era-target.c |
Releases failed snapshot clone blocks. |
drivers/iommu/msm_iommu.c |
Cleans failed IOMMU registration. |
drivers/iommu/iommufd/ioas.c |
Releases locks and references after xarray failure. |
drivers/iommu/iommufd/device.c |
Avoids locking internal access objects. |
drivers/iommu/iommu.c |
Fully releases failed mock devices. |
drivers/iommu/iommu-sva.c |
Publishes SVA handle state under lock. |
drivers/iommu/intel/iommu.h |
Exposes the tboot no-force setting. |
drivers/iommu/intel/iommu.c |
Honors explicit IOMMU disable requests. |
drivers/iommu/intel/dmar.c |
Centralizes mandatory DMAR detection. |
drivers/iommu/amd/ppr.c |
Releases PCI device references. |
drivers/interconnect/core.c |
Correctly releases failed paths. |
drivers/infiniband/hw/ionic/ionic_lif_cfg.c |
Uses configured event-queue count. |
drivers/infiniband/hw/cxgb4/device.c |
Cancels registration work during removal. |
drivers/infiniband/core/uverbs_std_types_mr.c |
Passes driver udata for MR registration. |
drivers/i3c/master/svc-i3c-master.c |
Bounds and flushes oversized IBI payloads. |
drivers/i3c/master.c |
Fixes device lifetime during unregister. |
drivers/i2c/busses/i2c-mxs.c |
Uses managed DMA channel allocation. |
drivers/hwmon/max6621.c |
Corrects signed temperature conversion. |
drivers/hsi/controllers/omap_ssi_core.c |
Configures a 32-bit DMA mask. |
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-protocol.h |
Extends GET_REPORT with buffer size. |
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c |
Passes GET_REPORT buffer length. |
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h |
Tracks report-buffer capacity. |
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c |
Allocates header-inclusive report buffers. |
drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c |
Disables autosuspend during removal. |
drivers/hid/hid-universal-pidff.c |
Stops hardware after initialization failure. |
drivers/hid/hid-sony.c |
Prevents timer-driven URB resubmission. |
drivers/hid/hid-sensor-custom.c |
Rolls back partially created sysfs groups. |
drivers/hid/hid-roccat.c |
Frees circular-buffer allocations. |
drivers/hid/hid-picolcd_debugfs.c |
Bounds EEPROM response copying. |
drivers/hid/hid-mcp2221.c |
Validates HID response lengths and stops I/O. |
drivers/gpu/drm/nouveau/nouveau_gem.c |
Serializes VMA lookup with BO reservation. |
drivers/gpu/drm/amd/display/dc/dc_types.h |
Adds second-tile disable quirk. |
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c |
Avoids logging through null service objects. |
drivers/fpga/altera-cvp.c |
Safely copies trailing configuration bytes. |
drivers/cxl/pmem.c |
Formats serial IDs as unsigned decimal. |
drivers/cxl/pci.c |
Removes redundant work cancellation. |
drivers/cxl/cxl.h |
Enlarges decimal serial storage. |
drivers/cxl/core/ras.c |
Removes redundant work cancellation. |
drivers/cxl/core/pmem.c |
Aligns key IDs with sysfs serial formatting. |
drivers/cxl/core/features.c |
Validates firmware RPC input size. |
drivers/crypto/allwinner/sun8i-ss/Makefile |
Stops building unsupported PRNG code. |
drivers/crypto/allwinner/sun8i-ce/Makefile |
Stops building unsupported PRNG code. |
drivers/crypto/allwinner/Kconfig |
Removes unsupported PRNG options. |
drivers/clocksource/timer-sun4i.c |
Corrects minimum clock-event delta. |
drivers/clocksource/timer-nxp-pit.c |
Cleans per-CPU state after hotplug failure. |
drivers/char/tpm/tpm_i2c_nuvoton.c |
Disables IRQ after interrupted waits. |
drivers/char/ipmi/ipmb_dev_int.c |
Validates IPMB message lengths. |
drivers/char/hw_random/stm32-rng.c |
Uses managed runtime PM. |
drivers/cdx/cdx.c |
Publishes resource attributes only after creation. |
drivers/bluetooth/hci_serdev.c |
Propagates controller setup errors. |
drivers/bluetooth/hci_ldisc.c |
Propagates controller setup errors. |
drivers/bluetooth/hci_intel.c |
Disables autosuspend before PM teardown. |
drivers/bluetooth/hci_h5.c |
Disables autosuspend before PM teardown. |
drivers/bluetooth/hci_bcm4377.c |
Adds malformed advertising PHY quirk. |
drivers/bluetooth/hci_bcm.c |
Disables autosuspend before PM teardown. |
drivers/bluetooth/btrtl.c |
Removes the RTL8761B extended-scan quirk. |
drivers/block/zram/backend_deflate.c |
Validates deflate window bits. |
drivers/block/zloop.c |
Finishes zones at usable capacity. |
drivers/base/property.c |
Fixes secondary firmware-node iteration. |
drivers/base/power/main.c |
Unblocks runtime PM after prepare failure. |
drivers/base/arch_numa.c |
Bounds node-to-CPU mask initialization. |
drivers/acpi/apei/erst.c |
Corrects ERST timeout units. |
Documentation/admin-guide/blockdev/zoned_loop.rst |
Documents zone-capacity behavior. |
Documentation/ABI/testing/sysfs-bus-nvdimm |
Documents decimal CXL identifiers. |
block/genhd.c |
Marks queues dying with dead disks. |
arch/x86/net/bpf_jit_comp.c |
Corrects per-CPU address instruction encoding. |
arch/x86/include/asm/barrier.h |
Uses the correct feature for sfence. |
arch/x86/events/intel/uncore.c |
Documents NUMA dependency. |
arch/x86/coco/tdx/tdx.c |
Corrects emulated port-I/O register masking. |
arch/riscv/include/asm/acpi.h |
Maps ACPI timer-loss idle flags. |
arch/powerpc/platforms/powermac/low_i2c.c |
Retains device-tree node references. |
arch/powerpc/kernel/pci-common.c |
Corrects legacy PCI write values. |
arch/arm64/kernel/compat_alignment.c |
Prevents register-count truncation. |
arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts |
Adds I2S clock-off pin state. |
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi |
Corrects eMMC reset polarity. |
arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi |
Corrects eMMC reset polarity. |
arch/arm64/boot/dts/rockchip/px30-cobra.dtsi |
Corrects eMMC reset polarity. |
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi |
Keeps required regulators enabled. |
arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts |
Corrects touchscreen GPIO polarity flags. |
arch/arm/Kconfig |
Disables eBPF JIT for ARMv3. |
arch/alpha/kernel/traps.c |
Passes arithmetic exception summary to emulation. |
arch/alpha/kernel/pci-sysfs.c |
Corrects legacy port-write argument order. |
arch/alpha/include/uapi/asm/fpu.h |
Corrects denormal trap handling. |
Review details
- Files reviewed: 300/501 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if (IS_ERR_OR_NULL(fwnode)) | ||
| /* | ||
| * If this function is in a loop and the previous iteration returned | ||
| * an child from fwnode->secondary, then we need to use the secondary |
Comment on lines
+374
to
+378
| /* | ||
| * Restrict the read-only mapping so it cannot be upgraded to | ||
| * writable later with mprotect(). | ||
| */ | ||
| vm_flags_clear(vma, VM_MAYWRITE); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.