At allocation time for L2 pointers SID should be checked.
Also, there is a missing equal for the SID checks.
Bug: 443053939
Change-Id: I63aaf0438640c0cb173f12405b9c67b3a9656c61
Signed-off-by: Mostafa Saleh <smostafa@google.com>
(cherry picked from commit 0668e45a43398a07c3aa2ae08903097657efd87e)
Signed-off-by: Lee Jones <joneslee@google.com>
During attach, if error happens after taking the ref of the SMMUv3, it
must be put back.
Also, add an assertion during free domain that there are no dangling
SMMU refs.
Bug: 357781595
Change-Id: Ic717c5b2a958e58e00e188b68dda754c38014b76
Signed-off-by: Mostafa Saleh <smostafa@google.com>
The driver takes a reference on the smmu for each attached device,
we should do the same at detach, which is ignored at the moment for
pasids.
Bug: 357781595
Change-Id: I93380fad288c7fe06c462d7568dc1f4f53ecb640
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Check before clearing CD entries as they might not be attached.
Bug: 357781595
Change-Id: I54d26657d38ae4447038adbbdc386c9c4e4f32f4
Signed-off-by: Mostafa Saleh <smostafa@google.com>
GKI (arm64) relevant 35 out of 230 changes, affecting 67 files +612/-427
ec9be081c5 Revert "mmc: sdhci: Disable SD card clock before changing parameters" [1 file, +2/-7]
0698a2eb7d Bluetooth: HCI: Set extended advertising data synchronously [2 files, +130/-113]
3672fe9d1e Bluetooth: hci_sync: revert some mesh modifications [1 file, +4/-12]
44bb1e13b4 Bluetooth: MGMT: set_mesh: update LE scan interval and window [1 file, +22/-0]
a99f80c88a Bluetooth: MGMT: mesh_send: check instances prior disabling advertising [1 file, +2/-1]
5581e694d3 usb: typec: altmodes/displayport: do not index invalid pin_assignments [2 files, +2/-1]
b1abc5ab47 scsi: sd: Fix VPD page 0xb7 length check [1 file, +1/-1]
381c1c1219 Bluetooth: Prevent unintended pause by checking if advertising is active [1 file, +4/-0]
f0fee863a7 nvme: Fix incorrect cdw15 value in passthru error logging [1 file, +1/-1]
50c86c0945 netfs: Fix i_size updating [2 files, +8/-2]
a553afd91f net/sched: Always pass notifications when child class becomes empty [1 file, +5/-14]
d78f79a2c1 spinlock: extend guard with spinlock_bh variants [1 file, +13/-0]
0cc4721a71 sched/fair: Rename h_nr_running into h_nr_queued [5 files, +53/-53]
a2562bdd35 sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE [1 file, +11/-2]
5833026221 f2fs: decrease spare area for pinned files for zoned devices [3 files, +5/-2]
8912b139a8 f2fs: zone: fix to calculate first_zoned_segno correctly [4 files, +69/-20]
c5474a7b04 bpf: use common instruction history across all states [2 files, +63/-63]
4265682c29 bpf: Do not include stack ptr register in precision backtracking bookkeeping [2 files, +24/-6]
e0fefe9bc0 netfs: Fix oops in write-retry from mis-resetting the subreq iterator [1 file, +3/-2]
acf9ab15ec selinux: change security_compute_sid to return the ssid or tsid on match [1 file, +11/-5]
42c5a4b47d rcu: Return early if callback is not specified [1 file, +4/-0]
e036efbe58 add a string-to-qstr constructor [10 files, +13/-23]
f94c422157 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass [3 files, +21/-13]
8caccd2eac usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed [1 file, +4/-1]
9f75893189 Revert "usb: xhci: Implement xhci_handshake_check_state() helper" [3 files, +3/-30]
fbebc2254a usb: xhci: quirk for data loss in ISOC transfers [3 files, +30/-0]
195597e0be xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS [1 file, +2/-1]
dbdd2a2320 Input: xpad - support Acer NGR 200 Controller [1 file, +2/-0]
3b1407caac usb: dwc3: Abort suspend on soft disconnect failure [2 files, +16/-15]
7cb8750160 usb: acpi: fix device link removal [3 files, +8/-1]
c745744a82 dma-buf: fix timeout handling in dma_resv_wait_timeout v2 [1 file, +7/-5]
ccdc472b4d Logitech C-270 even more broken [1 file, +2/-1]
c782f98eef usb: typec: displayport: Fix potential deadlock [1 file, +1/-2]
ead91de35d mm/vmalloc: fix data race in show_numa_info() [1 file, +35/-28]
4c443046d8 mm: userfaultfd: fix race of userfaultfd_move and swap cache [1 file, +31/-2]
Changes in 6.12.37
rtc: pcf2127: add missing semicolon after statement
rtc: pcf2127: fix SPI command byte for PCF2131
rtc: cmos: use spin_lock_irqsave in cmos_interrupt
virtio-net: xsk: rx: fix the frame's length check
virtio-net: ensure the received length does not exceed allocated size
s390/pci: Fix stale function handles in error handling
s390/pci: Do not try re-enabling load/store if device is disabled
net: txgbe: request MISC IRQ in ndo_open
vsock/vmci: Clear the vmci transport packet properly when initializing it
net: libwx: fix the incorrect display of the queue number
mmc: sdhci: Add a helper function for dump register in dynamic debug mode
Revert "mmc: sdhci: Disable SD card clock before changing parameters"
mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
Bluetooth: HCI: Set extended advertising data synchronously
Bluetooth: hci_sync: revert some mesh modifications
Bluetooth: MGMT: set_mesh: update LE scan interval and window
Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
usb: typec: altmodes/displayport: do not index invalid pin_assignments
mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
mtk-sd: Prevent memory corruption from DMA map failure
mtk-sd: reset host->mrq on prepare_data() error
drm/v3d: Disable interrupts before resetting the GPU
firmware: arm_ffa: Fix memory leak by freeing notifier callback node
firmware: arm_ffa: Move memory allocation outside the mutex locking
firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context
arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
scsi: sd: Fix VPD page 0xb7 length check
scsi: ufs: core: Fix spelling of a sysfs attribute name
RDMA/mlx5: Fix HW counters query for non-representor devices
RDMA/mlx5: Fix CC counters query for MPV
RDMA/mlx5: Fix vport loopback for MPV device
platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
Bluetooth: Prevent unintended pause by checking if advertising is active
btrfs: fix missing error handling when searching for inode refs during log replay
btrfs: fix iteration of extrefs during log replay
btrfs: return a btrfs_inode from btrfs_iget_logging()
btrfs: return a btrfs_inode from read_one_inode()
btrfs: fix invalid inode pointer dereferences during log replay
btrfs: fix inode lookup error handling during log replay
btrfs: record new subvolume in parent dir earlier to avoid dir logging races
btrfs: propagate last_unlink_trans earlier when doing a rmdir
btrfs: use btrfs_record_snapshot_destroy() during rmdir
ethernet: atl1: Add missing DMA mapping error checks and count errors
dpaa2-eth: fix xdp_rxq_info leak
drm/exynos: fimd: Guard display clock control with runtime PM calls
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
drm/i915/selftests: Change mock_request() to return error pointers
nvme: Fix incorrect cdw15 value in passthru error logging
nvmet: fix memory leak of bio integrity
platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
platform/x86: hp-bioscfg: Directly use firmware_attributes_class
platform/x86: hp-bioscfg: Fix class device unregistration
platform/x86: firmware_attributes_class: Move include linux/device/class.h
platform/x86: firmware_attributes_class: Simplify API
platform/x86: think-lmi: Directly use firmware_attributes_class
platform/x86: think-lmi: Fix class device unregistration
platform/x86: dell-sysman: Directly use firmware_attributes_class
platform/x86: dell-wmi-sysman: Fix class device unregistration
platform/mellanox: mlxreg-lc: Fix logic error in power state check
drm/bridge: aux-hpd-bridge: fix assignment of the of_node
smb: client: fix warning when reconnecting channel
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
drm/i915/gt: Fix timeline left held on VMA alloc error
drm/i915/gsc: mei interrupt top half should be in irq disabled context
idpf: return 0 size for RSS key if not supported
idpf: convert control queue mutex to a spinlock
igc: disable L1.2 PCI-E link substate to avoid performance issue
smb: client: set missing retry flag in smb2_writev_callback()
smb: client: set missing retry flag in cifs_readv_callback()
smb: client: set missing retry flag in cifs_writev_callback()
netfs: Fix i_size updating
lib: test_objagg: Set error message in check_expect_hints_stats()
amd-xgbe: align CL37 AN sequence as per databook
enic: fix incorrect MTU comparison in enic_change_mtu()
rose: fix dangling neighbour pointers in rose_rt_device_down()
nui: Fix dma_mapping_error() check
net/sched: Always pass notifications when child class becomes empty
amd-xgbe: do not double read link status
smb: client: fix race condition in negotiate timeout by using more precise timing
arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma
crypto: iaa - Remove dst_null support
crypto: iaa - Do not clobber req->base.data
spinlock: extend guard with spinlock_bh variants
crypto: zynqmp-sha - Add locking
kunit: qemu_configs: sparc: use Zilog console
kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
gfs2: Initialize gl_no_formal_ino earlier
gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
gfs2: Rename dinode_demise to evict_behavior
gfs2: Prevent inode creation race
gfs2: Decode missing glock flags in tracepoints
gfs2: Add GLF_PENDING_REPLY flag
gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
gfs2: Move gfs2_dinode_dealloc
gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
gfs2: deallocate inodes in gfs2_create_inode
btrfs: prepare btrfs_page_mkwrite() for large folios
btrfs: fix wrong start offset for delalloc space release during mmap write
sched/fair: Rename h_nr_running into h_nr_queued
sched/fair: Add new cfs_rq.h_nr_runnable
sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE
gfs2: Move gfs2_trans_add_databufs
gfs2: Don't start unnecessary transactions during log flush
ASoC: tas2764: Extend driver to SN012776
ASoC: tas2764: Reinit cache on part reset
ACPI: thermal: Fix stale comment regarding trip points
ACPI: thermal: Execute _SCP before reading trip points
bonding: Mark active offloaded xfrm_states
wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path
wifi: ath12k: Handle error cases during extended skb allocation
wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug
iommu: ipmmu-vmsa: avoid Wformat-security warning
f2fs: decrease spare area for pinned files for zoned devices
f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
f2fs: zone: fix to calculate first_zoned_segno correctly
scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
hisi_acc_vfio_pci: bugfix cache write-back issue
hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
bpf: use common instruction history across all states
bpf: Do not include stack ptr register in precision backtracking bookkeeping
arm64: dts: qcom: sm8650: change labels to lower-case
arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs
arm64: dts: renesas: Factor out White Hawk Single board support
arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description
arm64: dts: qcom: sm8650: add the missing l2 cache node
ubsan: integer-overflow: depend on BROKEN to keep this out of CI
remoteproc: k3: Call of_node_put(rmem_np) only once in three functions
remoteproc: k3-r5: Add devm action to release reserved memory
remoteproc: k3-r5: Use devm_kcalloc() helper
remoteproc: k3-r5: Use devm_ioremap_wc() helper
remoteproc: k3-r5: Use devm_rproc_add() helper
remoteproc: k3-r5: Refactor sequential core power up/down operations
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe()
drm/xe: Fix DSB buffer coherency
drm/xe: Move DSB l2 flush to a more sensible place
drm/xe: add interface to request physical alignment for buffer objects
drm/xe: Allow bo mapping on multiple ggtts
drm/xe: move DPT l2 flush to a more sensible place
drm/xe: Replace double space with single space after comma
drm/xe/guc: Dead CT helper
drm/xe/guc: Explicitly exit CT safe mode on unwind
selinux: change security_compute_sid to return the ssid or tsid on match
drm/simpledrm: Do not upcast in release helpers
drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
drm/amdgpu/mes: add missing locking in helper functions
sched_ext: Make scx_group_set_weight() always update tg->scx.weight
scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
drm/msm: Fix a fence leak in submit error path
drm/msm: Fix another leak in the submit error path
ALSA: sb: Don't allow changing the DMA mode during operations
ALSA: sb: Force to disable DMAs once when DMA mode is changed
ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
ata: pata_cs5536: fix build on 32-bit UML
ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
genirq/irq_sim: Initialize work context pointers properly
powerpc: Fix struct termio related ioctl macros
ASoC: amd: yc: update quirk data for HP Victus
regulator: fan53555: add enable_time support and soft-start times
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
aoe: defer rexmit timer downdev work to workqueue
wifi: mac80211: drop invalid source address OCB frames
wifi: ath6kl: remove WARN on bad firmware input
ACPICA: Refuse to evaluate a method if arguments are missing
mtd: spinand: fix memory leak of ECC engine conf
rcu: Return early if callback is not specified
add a string-to-qstr constructor
module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
RDMA/mlx5: Fix cache entry update on dereg error
IB/mlx5: Fix potential deadlock in MR deregistration
drm/xe/bmg: Update Wa_22019338487
drm/xe: Allow dropping kunit dependency as built-in
NFSv4/flexfiles: Fix handling of NFS level errors in I/O
usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
usb: xhci: quirk for data loss in ISOC transfers
xhci: dbctty: disable ECHO flag by default
xhci: dbc: Flush queued requests before stopping dbc
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
Input: xpad - support Acer NGR 200 Controller
Input: iqs7222 - explicitly define number of external channels
usb: cdnsp: do not disable slot for disabled slot
usb: cdnsp: Fix issue with CV Bad Descriptor test
usb: dwc3: Abort suspend on soft disconnect failure
usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
usb: acpi: fix device link removal
smb: client: fix readdir returning wrong type with POSIX extensions
cifs: all initializations for tcon should happen in tcon_info_alloc
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
i2c/designware: Fix an initialization issue
Logitech C-270 even more broken
optee: ffa: fix sleep in atomic context
iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
riscv: cpu_ops_sbi: Use static array for boot_data
platform/x86: think-lmi: Create ksets consecutively
platform/x86: think-lmi: Fix kobject cleanup
platform/x86: think-lmi: Fix sysfs group cleanup
usb: typec: displayport: Fix potential deadlock
powerpc/kernel: Fix ppc_save_regs inclusion in build
mm/vmalloc: fix data race in show_numa_info()
mm: userfaultfd: fix race of userfaultfd_move and swap cache
x86/bugs: Rename MDS machinery to something more generic
x86/bugs: Add a Transient Scheduler Attacks mitigation
KVM: SVM: Advertise TSA CPUID bits to guests
x86/microcode/AMD: Add TSA microcode SHAs
x86/process: Move the buffer clearing before MONITOR
Linux 6.12.37
Change-Id: If1d8d0f83e11df1540bebaf0fb136fe340f25dcb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 87 out of 414 changes, affecting 112 files +738/-352
bdb71ee651 configfs: Do not override creating attribute file failure in populate_attrs() [1 file, +1/-1]
ba789be63d io_uring: account drain memory to cgroup [1 file, +1/-1]
c58b577cf7 io_uring/kbuf: account ring io_buffer_list memory [1 file, +1/-1]
f78b38af35 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() [1 file, +3/-2]
2429bb9fad media: v4l2-dev: fix error handling in __video_register_device() [1 file, +7/-7]
5d8b057ed7 media: videobuf2: use sgtable-based scatterlist wrappers [1 file, +2/-2]
b52dc88361 media: uvcvideo: Return the number of processed controls [1 file, +10/-1]
6d2b12e7c5 media: uvcvideo: Send control events for partial succeeds [1 file, +9/-3]
aac91ae06c media: uvcvideo: Fix deferred probing error [1 file, +19/-8]
86d9837e46 arm64/mm: Close theoretical race where stale TLB entry remains valid [1 file, +5/-4]
5538af3843 block: use plug request list tail for one-shot backmerge attempt [1 file, +13/-13]
943801c380 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion [1 file, +1/-0]
1c71f3cf5f cgroup,freezer: fix incomplete freezing when attaching tasks [1 file, +1/-2]
a0890b7805 bus: firewall: Fix missing static inline annotations for stubs [1 file, +9/-6]
5766da2237 ext4: inline: fix len overflow in ext4_prepare_inline_data [1 file, +1/-1]
796632e6f8 ext4: fix calculation of credits for extent tree modification [1 file, +6/-5]
4b36399711 ext4: ensure i_size is smaller than maxbytes [1 file, +2/-1]
be5f3061a6 ext4: only dirty folios when data journaling regular files [1 file, +6/-1]
a0b1c91ada Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() [1 file, +2/-0]
fed611bd8c f2fs: fix to do sanity check on ino and xnid [1 file, +6/-0]
aaa644e7ff f2fs: prevent kernel warning due to negative i_nlink from corrupted image [1 file, +9/-0]
ee1b421c46 f2fs: fix to do sanity check on sit_bitmap_size [1 file, +8/-0]
f16a797dce watchdog: fix watchdog may detect false positive of softlockup [1 file, +27/-14]
02137179ff mm: fix ratelimit_pages update error in dirty_ratio_handler() [1 file, +1/-1]
462eee6d42 firmware: arm_scmi: Ensure that the message-id supports fastchannel [2 files, +45/-33]
e3cf1ef571 dm-verity: fix a memory leak if some arguments are specified multiple times [3 files, +24/-5]
f2986bccf2 dm: lock limits when reading them [1 file, +7/-1]
ec5f0b4412 ovl: Fix nested backing file paths [1 file, +2/-2]
92776ca0cc remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() [1 file, +2/-3]
f4ef928ca5 remoteproc: core: Release rproc->clean_table after rproc_attach() fails [1 file, +1/-0]
68e58f5791 PCI: dwc: ep: Correct PBA offset in .set_msix() callback [1 file, +3/-2]
b20701d594 PCI: Add ACS quirk for Loongson PCIe [1 file, +23/-0]
be0cf75cbd PCI: Fix lock symmetry in pci_slot_unlock() [1 file, +2/-1]
7b45d2401d clocksource: Fix the CPUs' choice in the watchdog per CPU verification [1 file, +1/-1]
c05aba32a9 ACPICA: Avoid sequence overread in call to strncmp() [1 file, +1/-1]
66613b13cd ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case [1 file, +8/-1]
33cd650d38 pmdomain: core: Reset genpd->states to avoid freeing invalid data [1 file, +3/-1]
f34e0c1556 platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() [1 file, +1/-0]
c519f81e9c gpiolib: of: Add polarity quirk for s5m8767 [1 file, +9/-0]
1f152ae557 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() [1 file, +1/-1]
6c1151d53c tipc: use kfree_sensitive() for aead cleanup [1 file, +1/-1]
b0e647442c f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx [2 files, +15/-13]
2d834477bb bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() [1 file, +2/-1]
77ff6aec7c cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs [1 file, +35/-1]
0a8446058c tcp: always seek for minimal rtt in tcp_rcv_rtt_update() [1 file, +8/-14]
f97085d365 tcp: remove zero TCP TS samples for autotuning [1 file, +5/-5]
89b20c406e tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows [1 file, +3/-3]
84c156a351 tcp: add receive queue awareness in tcp_rcv_space_adjust() [2 files, +5/-3]
3a9e74d158 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT [1 file, +4/-0]
5eb9c50e0c net: page_pool: Don't recycle into cache on PREEMPT_RT [1 file, +4/-0]
8b0741b167 xfrm: validate assignment of maximal possible SEQ number [1 file, +42/-10]
8fdf2f79eb bpf: Pass the same orig_call value to trampoline functions [1 file, +1/-1]
f0023d7a2a f2fs: fix to bail out in get_new_segment() [2 files, +6/-1]
448dc45eea bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index [1 file, +2/-2]
78f768e36c net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions [1 file, +69/-8]
4b3383110b software node: Correct a OOB check in software_node_get_reference_args() [1 file, +1/-1]
b7129ef57d sock: Correct error checking condition for (assign|release)_proto_idx() [1 file, +2/-2]
a58f0a0e99 f2fs: fix to set atomic write status more clear [3 files, +12/-2]
b8b4b8bb34 bpf, sockmap: Fix data lost during EAGAIN retries [1 file, +2/-1]
7c41f73b64 fs/xattr.c: fix simple_xattr_list() [1 file, +1/-0]
2e10dc9c2a io_uring/kbuf: don't truncate end buffer for multiple buffer peeks [1 file, +4/-1]
1a4254ab06 io_uring: fix task leak issue in io_wq_create() [1 file, +3/-1]
4220cc0b98 nvme: always punt polled uring_cmd end_io work to task_work [1 file, +7/-14]
f9b97d466e net_sched: sch_sfq: reject invalid perturb period [1 file, +8/-2]
2a3ad42a57 net: clear the dst when changing skb protocol [1 file, +13/-6]
510a29d776 mm: close theoretical race where stale TLB entries could linger [1 file, +2/-0]
57ec081869 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() [3 files, +9/-2]
3d828519bd atm: Revert atm_account_tx() if copy_from_iter_full() fails. [3 files, +8/-1]
47f34289d1 arm64: Restrict pagetable teardown to avoid false warning [1 file, +2/-1]
9cf5b2a3b7 mm/hugetlb: unshare page tables during VMA split, not before [5 files, +57/-16]
dc5f0aef9e net: Fix checksum update for ILA adj-transport [4 files, +7/-7]
2516299184 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE [3 files, +7/-2]
50189d9c5e erofs: remove unused trace event erofs_destroy_inode [1 file, +0/-18]
348e541fef ipv6: remove leftover ip6 cookie initializer [1 file, +0/-2]
3c44ebad5a ipv6: replace ipcm6_init calls with ipcm6_init_sk [4 files, +3/-29]
6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure [1 file, +1/-4]
8873080b88 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() [1 file, +2/-1]
ac462a75fd net: netmem: fix skb_ensure_writable with unreadable skbs [1 file, +0/-3]
61b39e189d ptp: allow reading of currently dialed frequency to succeed on free-running clocks [1 file, +2/-1]
397c1faf8f tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior [1 file, +25/-12]
0d3d91c350 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer [1 file, +2/-2]
31d50dfe9c tcp: fix passive TFO socket having invalid NAPI ID [1 file, +3/-0]
0f8df5d6f2 ublk: santizize the arguments from userspace when adding a device [1 file, +3/-0]
456019adaa perf: Fix sample vs do_exit() [2 files, +16/-8]
7335c33d62 perf: Fix cgroup state vs ERROR [1 file, +30/-21]
fd199366bf perf/core: Fix WARN in perf_cgroup_switch() [1 file, +20/-2]
22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [1 file, +1/-1]
Changes in 6.12.35
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
s390/pci: Remove redundant bus removal and disable from zpci_release_device()
s390/pci: Prevent self deletion in disable_slot()
s390/pci: Allow re-add of a reserved but not yet removed device
s390/pci: Serialize device addition and removal
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
iommu/vt-d: Restore context entry setup order for aliased devices
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
ACPI: battery: negate current when discharging
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
iommu/amd: Allow matching ACPI HID devices without matching UIDs
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
net/mlx5: HWS, Fix IP version decision
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
net/mlx5: HWS, Harden IP version definer checks
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
Input: sparcspkr - avoid unannotated fall-through
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
wifi: cfg80211: init wiphy_work before allocating rfkill fails
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
ALSA: hda/realtek: Add quirk for Asus GU605C
iio: accel: fxls8962af: Fix temperature calculation
mm/hugetlb: unshare page tables during VMA split, not before
drm/amdgpu: read back register after written for VCN v4.0.5
kbuild: rust: add rustc-min-version support function
rust: compile libcore with edition 2024 for 1.87+
net: Fix checksum update for ILA adj-transport
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: remove leftover ip6 cookie initializer
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
eth: bnxt: fix out-of-range access of vnic_info array
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe: Wire up device shutdown handler
drm/xe/gt: Update handling of xe_force_wake_get return
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
serial: sh-sci: Increment the runtime usage counter for the earlycon device
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
Linux 6.12.35
Change-Id: Ida57d269272a624bedb979bfad0b3c5e7df7e846
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 62e062a29ad5133f67c20b333ba0a952a99161ae upstream.
When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.
Cc: <stable@vger.kernel.org>
Fixes: 25c2325575 ("iommu/rockchip: Add missing set_platform_dma_ops callback")
Signed-off-by: Simon Xue <xxm@rock-chips.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20250623020018.584802-1-xxm@rock-chips.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 33647d0be323f9e2f27cd1e86de5cfd965cec654 ]
iommu_device_sysfs_add() requires a constant format string, otherwise
a W=1 build produces a warning:
drivers/iommu/ipmmu-vmsa.c:1093:62: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security]
1093 | ret = iommu_device_sysfs_add(&mmu->iommu, &pdev->dev, NULL, dev_name(&pdev->dev));
| ^~~~~~~~~~~~~~~~~~~~
drivers/iommu/ipmmu-vmsa.c:1093:62: note: treat the string as an argument to avoid this
1093 | ret = iommu_device_sysfs_add(&mmu->iommu, &pdev->dev, NULL, dev_name(&pdev->dev));
| ^
| "%s",
This was an old bug but I saw it now because the code was changed as part
of commit d9d3cede4167 ("iommu/ipmmu-vmsa: Register in a sensible order").
Fixes: 7af9a5fdb9 ("iommu/ipmmu-vmsa: Use iommu_device_sysfs_add()/remove()")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20250423164006.2661372-1-arnd@kernel.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
The `__iommu_add_sg` function currently assumes that a scatter-gather
entry will always map to a single page size. However, a single
scatter-gather entry can span multiple IOMMU page sizes if there is
a larger page size mapping. This can lead to issues with deferred
scatter-gather mappings.
This patch modifies `__iommu_add_sg` to iteratively call
`ops->add_deferred_map_sg` for each IOMMU page-sized chunk within a
scatter-gather entry, ensuring that all parts of the entry are
correctly handled for deferred mappings.
Fixes: 1a608d2b0d ("BACKPORT: FROMLIST: drivers/iommu: Add deferred map_sg operations")
Change-Id: I2d2edbd5fa3d37c0b1e4a9976824b77a9ef39676
Signed-off-by: Ryan Huang <tzukui@google.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Probably due to a typo, iommu_map_sg() previously returned EINVAL
instead of -EINVAL under certain conditions.
Fixes: 1a608d2b0d ("BACKPORT: FROMLIST: drivers/iommu: Add deferred map_sg operations")
Change-Id: I1458104f6d9c570443014afffa115df98080d9d8
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Steps on the way to 6.12.34
Resolves merge conflicts in:
kernel/sched/core.c
net/netfilter/xt_mark.c
Change-Id: I6df5e27c2a5bfa8b077b1f2814ad98b2a3dc0877
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
As at the moment we don't support page table coalescing, it is possible
to call free_leaf while mapping a THP for a guest.
This should do nothing as the identity mapped page table doesn't
do any tracking of pages in the vmemmap.
Bug: 421734292
Change-Id: I436b9839643f8a4a76035bd2fa1e273d64456690
Signed-off-by: Mostafa Saleh <smostafa@google.com>
This reverts commit 53f42776e4 which is
commit 1f7df3a691740a7736bbc99dc4ed536120eb4746 upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I6cc1f1a93d322e461655a8ce36e090d235de7646
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.31
Resolves merge conflicts in:
kernel/sched/fair.c
Change-Id: I545f90ce44822f1a0f940be224258533b6581077
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Steps on the way to 6.12.31
Resolves merge conflicts in:
drivers/media/usb/uvc/uvc_ctrl.c
Change-Id: I663a7a27e554e5a9d426532ff17f7dffc9619d22
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 51c33f333bbf7bdb6aa2a327e3a3e4bbb2591511 ]
A BIOS upgrade has changed the IVRS DTE UID for a device that no
longer matches the UID in the SSDT. In this case there is only
one ACPI device on the system with that _HID but the _UID mismatch.
IVRS:
```
Subtable Type : F0 [Device Entry: ACPI HID Named Device]
Device ID : 0060
Data Setting (decoded below) : 40
INITPass : 0
EIntPass : 0
NMIPass : 0
Reserved : 0
System MGMT : 0
LINT0 Pass : 1
LINT1 Pass : 0
ACPI HID : "MSFT0201"
ACPI CID : 0000000000000000
UID Format : 02
UID Length : 09
UID : "\_SB.MHSP"
```
SSDT:
```
Device (MHSP)
{
Name (_ADR, Zero) // _ADR: Address
Name (_HID, "MSFT0201") // _HID: Hardware ID
Name (_UID, One) // _UID: Unique ID
```
To handle this case; while enumerating ACPI devices in
get_acpihid_device_id() count the number of matching ACPI devices with
a matching _HID. If there is exactly one _HID match then accept it even
if the UID doesn't match. Other operating systems allow this, but the
current IVRS spec leaves some ambiguity whether to allow or disallow it.
This should be clarified in future revisions of the spec. Output
'Firmware Bug' for this case to encourage it to be solved in the BIOS.
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Link: https://lore.kernel.org/r/20250512173129.1274275-1-superm1@kernel.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit e586e22974d2b7acbef3c6c3e01b2d5ce69efe33 ]
On a 32 bit system calling:
iommu_map(0, 0x40000000)
When using the AMD V1 page table type with a domain->pgsize of 0xfffff000
causes iommu_pgsize() to miscalculate a result of:
size=0x40000000 count=2
count should be 1. This completely corrupts the mapping process.
This is because the final test to adjust the pagesize malfunctions when
the addition overflows. Use check_add_overflow() to prevent this.
Fixes: b1d99dc5f9 ("iommu: Hook up '->unmap_pages' driver callback")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/0-v1-3ad28fc2e3a3+163327-iommu_overflow_pgsize_jgg@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
There are some problems with the maple tree usage at the moment:
- pviommu_domain_find() uses mas_find() which must be locked.
- pviommu_domain_remove_map() had a similar problem, but also it explicitly
calls find and erase/insert non-atomically, so convert all of those to the
unlocked version and use the tree lock on them.
- All allocations from unmap must be atomic
Bug: 357781595
Bug: 348382247
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reported-by: Aashish Sharma <shraash@google.com>
Change-Id: Ida8cfcfe3dc34ba7574d06eb1970602ab160173c
kvm_arm_smmu_domain_finalize() always sets a domain's smmu field, even
if the function fails. If the function fails and the caller attempts
to free the domain, the kvm_arm_smmu_domain_free() function will be
called. The will domain's smmu field is not NULL, so the logic will
call into the hypervisor to free the domain, and free the domain
ID back to the IDA.
However, it's possible that the domain was not even allocated to begin
with in the hypervisor, or the domain ID was not allocated either,
hence why kvm_arm_smmu_domain_finalize() failed in the first place.
Change kvm_arm_smmu_domain_finalize() to only set the smmu field
if it succeeded to allocate all resources required. That way, the
free() callback has meaningful objects to free.
Bug: 423086309
Change-Id: Ib22bbf15b2f3649fc42d7788a17b8e25b8bd2777
[isaacmanjarres: Resolve trivial merge conflicts from differences
between 6.6 and 6.12.]
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
When we write more than a single command to the command queue, we need
to wrap around when we hit the end of the command queue. Otherwise,
we'll write to memory locations that are past the end of the command
queue.
Bug: 421785718
Fixes: dd32b792c1 ("BACKPORT: FROMLIST: iommu/arm-smmu-v3-kvm: Support command queue batching")
Change-Id: Ia6246e3e0fc6185b2373664e90c119051d1c55fc
Signed-off-by: Daniel Mentz <danielmentz@google.com>
[ Upstream commit 1f7df3a691740a7736bbc99dc4ed536120eb4746 ]
The IOMMU translation for MSI message addresses has been a 2-step process,
separated in time:
1) iommu_dma_prepare_msi(): A cookie pointer containing the IOVA address
is stored in the MSI descriptor when an MSI interrupt is allocated.
2) iommu_dma_compose_msi_msg(): this cookie pointer is used to compute a
translated message address.
This has an inherent lifetime problem for the pointer stored in the cookie
that must remain valid between the two steps. However, there is no locking
at the irq layer that helps protect the lifetime. Today, this works under
the assumption that the iommu domain is not changed while MSI interrupts
being programmed. This is true for normal DMA API users within the kernel,
as the iommu domain is attached before the driver is probed and cannot be
changed while a driver is attached.
Classic VFIO type1 also prevented changing the iommu domain while VFIO was
running as it does not support changing the "container" after starting up.
However, iommufd has improved this so that the iommu domain can be changed
during VFIO operation. This potentially allows userspace to directly race
VFIO_DEVICE_ATTACH_IOMMUFD_PT (which calls iommu_attach_group()) and
VFIO_DEVICE_SET_IRQS (which calls into iommu_dma_compose_msi_msg()).
This potentially causes both the cookie pointer and the unlocked call to
iommu_get_domain_for_dev() on the MSI translation path to become UAFs.
Fix the MSI cookie UAF by removing the cookie pointer. The translated IOVA
address is already known during iommu_dma_prepare_msi() and cannot change.
Thus, it can simply be stored as an integer in the MSI descriptor.
The other UAF related to iommu_get_domain_for_dev() will be addressed in
patch "iommu: Make iommu_dma_prepare_msi() into a generic operation" by
using the IOMMU group mutex.
Link: https://patch.msgid.link/r/a4f2cd76b9dc1833ee6c1cf325cba57def22231c.1740014950.git.nicolinc@nvidia.com
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3832862eb9c4dfa0e80b2522bfaedbc8a43de97d ]
At the moment, if of_iommu_configure() allocates dev->iommu itself via
iommu_fwspec_init(), then suffers a DT parsing failure, it cleans up the
fwspec but leaves the empty dev_iommu hanging around. So far this is
benign (if a tiny bit wasteful), but we'd like to be able to reason
about dev->iommu having a consistent and unambiguous lifecycle. Thus
make sure that the of_iommu cleanup undoes precisely whatever it did.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/d219663a3f23001f23d520a883ac622d70b4e642.1740753261.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
GKI (arm64) relevant 33 out of 166 changes, affecting 52 files +454/-363
0aaae77be5 ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() [1 file, +7/-0]
fdf0ae5e9e ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset [1 file, +2/-1]
38d9ca7405 binder: fix offset calculation in debug log [1 file, +1/-1]
f1dfc94584 drm/fdinfo: Protect against driver unbind [1 file, +6/-0]
090c8714ef arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays [1 file, +2/-0]
eb9b72e4fe mm/memblock: pass size instead of end to memblock_set_node() [1 file, +1/-1]
9c4ddea497 mm/memblock: repeat setting reserved region nid if array is doubled [1 file, +10/-0]
0988dd0263 tracing: Do not take trace_event_sem in print_event_fields() [1 file, +2/-2]
f451082572 dm-bufio: don't schedule in atomic context [1 file, +8/-1]
510aea4ef0 dm: always update the array size in realloc_argv on success [1 file, +3/-2]
2e303d0107 iommu: Fix two issues in iommu_copy_struct_from_user() [1 file, +4/-4]
573b047229 cpufreq: Avoid using inconsistent policy->min and policy->max [1 file, +25/-7]
962d88304c cpufreq: Fix setting policy limits when frequency tables are used [4 files, +73/-41]
1f27a3e93b tracing: Fix oob write in trace_seq_to_buffer() [1 file, +3/-2]
220395054c ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties [1 file, +13/-19]
29a4a29112 ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence [1 file, +4/-1]
65d3c57061 xsk: Fix race condition in AF_XDP generic RX path [4 files, +6/-6]
fe81c26d2d Bluetooth: hci_conn: Remove alloc from critical section [1 file, +10/-18]
eb8b860e87 Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver [6 files, +95/-107]
620810ac1f Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync [7 files, +88/-109]
432572d536 Bluetooth: L2CAP: copy RX timestamp to new fragments [1 file, +3/-0]
6b1355860d scsi: ufs: core: Remove redundant query_complete trace [1 file, +0/-2]
5ad0b1b554 nvme-pci: fix queue unquiesce check on slot_reset [1 file, +1/-1]
6effe1c0fa net: ipv6: fix UDPv6 GSO segmentation with NAT [1 file, +60/-1]
c0dba059b1 net: use sock_gen_put() when sk_state is TCP_TIME_WAIT [2 files, +2/-2]
e10ec6e32b blk-mq: create correct map for fallback case [1 file, +1/-2]
dab2a13059 mm, slab: clean up slab->obj_exts always [1 file, +7/-20]
0a188c0e19 sch_htb: make htb_qlen_notify() idempotent [1 file, +2/-0]
969d8beaa2 firmware: arm_scmi: Balance device refcount when destroying devices [1 file, +3/-0]
3b41b5efae kernel: param: rename locate_module_kobject [1 file, +3/-3]
69113bf740 kernel: globalize lookup_or_create_module_kobject() [2 files, +3/-1]
e1eea69858 drivers: base: handle module_kobject creation [1 file, +5/-8]
db62809197 dm: fix copying after src array boundaries [1 file, +1/-1]
Changes in 6.12.28
Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x
Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x
Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
Bluetooth: btusb: Add new VID/PID for WCN785x
Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x
Revert "rndis_host: Flag RNDIS modems as WWAN devices"
ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
binder: fix offset calculation in debug log
btrfs: adjust subpage bit start based on sectorsize
btrfs: fix COW handling in run_delalloc_nocow()
cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
drm/fdinfo: Protect against driver unbind
drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
EDAC/altera: Test the correct error reg offset
EDAC/altera: Set DDR and SDMMC interrupt mask before registration
i2c: imx-lpi2c: Fix clock count when probe defers
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
parisc: Fix double SIGFPE crash
perf/x86/intel: Only check the group flag for X86 leader
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
mm/memblock: pass size instead of end to memblock_set_node()
mm/memblock: repeat setting reserved region nid if array is doubled
mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
spi: tegra114: Don't fail set_cs_timing when delays are zero
tracing: Do not take trace_event_sem in print_event_fields()
wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
x86/boot/sev: Support memory acceptance in the EFI stub under SVSM
dm-bufio: don't schedule in atomic context
dm-integrity: fix a warning on invalid table line
dm: always update the array size in realloc_argv on success
drm/amdgpu: Fix offset for HDP remap in nbio v7.11
drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids
iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
iommu: Fix two issues in iommu_copy_struct_from_user()
platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles
platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug
ksmbd: fix use-after-free in ksmbd_session_rpc_open
ksmbd: fix use-after-free in kerberos authentication
ksmbd: fix use-after-free in session logoff
smb: client: fix zero length for mkdir POSIX create context
cpufreq: Avoid using inconsistent policy->min and policy->max
cpufreq: Fix setting policy limits when frequency tables are used
tracing: Fix oob write in trace_seq_to_buffer()
drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF
ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties
ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB
ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
book3s64/radix : Align section vmemmap start address to PAGE_SIZE
pinctrl: imx: Return NULL if no group is matched and found
powerpc/boot: Check for ld-option support
ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init()
ALSA: hda/realtek - Enable speaker for HP platform
drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions'
wifi: iwlwifi: don't warn if the NIC is gone in resume
wifi: iwlwifi: fix the check for the SCRATCH register upon resume
wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
powerpc/boot: Fix dash warning
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
xsk: Fix race condition in AF_XDP generic RX path
net/mlx5e: Use custom tunnel header for vxlan gbp
net/mlx5: E-Switch, Initialize MAC Address for Default GID
net/mlx5e: TC, Continue the attr process even if encap entry is invalid
net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover
net/mlx5: E-switch, Fix error handling for enabling roce
accel/ivpu: Correct DCT interrupt handling
ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot
Bluetooth: hci_conn: Remove alloc from critical section
Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver
Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
Bluetooth: btintel_pcie: Avoid redundant buffer allocation
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths
Bluetooth: L2CAP: copy RX timestamp to new fragments
net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
octeon_ep_vf: Resolve netdevice usage count issue
bnxt_en: improve TX timestamping FIFO configuration
rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation
net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised
net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array
pds_core: make pdsc_auxbus_dev_del() void
pds_core: specify auxiliary_device to be created
pds_core: remove write-after-free of client_id
net_sched: drr: Fix double list add in class with netem as child qdisc
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
net_sched: ets: Fix double list add in class with netem as child qdisc
net_sched: qfq: Fix double list add in class with netem as child qdisc
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
idpf: fix offloads support for encapsulated packets
scsi: ufs: core: Remove redundant query_complete trace
ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
nvme-pci: fix queue unquiesce check on slot_reset
drm/tests: shmem: Fix memleak
drm/mipi-dbi: Fix blanking for non-16 bit formats
net: dlink: Correct endianness handling of led_mode
net: mdio: mux-meson-gxl: set reversed bit when using internal phy
idpf: fix potential memory leak on kcalloc() failure
idpf: protect shutdown from reset
igc: fix lock order in igc_ptp_reset
net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
net: dsa: felix: fix broken taprio gate states after clock jump
net: ipv6: fix UDPv6 GSO segmentation with NAT
ALSA: hda/realtek: Fix built-mic regression on other ASUS models
bnxt_en: Fix error handling path in bnxt_init_chip()
bnxt_en: Fix ethtool selftest output in one of the failure cases
bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings()
bnxt_en: Fix coredump logic to free allocated buffer
bnxt_en: Fix out-of-bound memcpy() during ethtool -w
bnxt_en: Fix ethtool -d byte order for 32-bit values
nvme-tcp: fix premature queue removal and I/O failover
nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
bnxt_en: fix module unload sequence
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
net: lan743x: Fix memleak issue when GSO enabled
net: fec: ERR007885 Workaround for conventional TX
octeon_ep: Fix host hang issue during device reboot
net: hns3: store rx VLAN tag offload state for VF
net: hns3: fix an interrupt residual problem
net: hns3: fixed debugfs tm_qset size
net: hns3: defer calling ptp_clock_register()
net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
net: vertexcom: mse102x: Fix LEN_MASK
net: vertexcom: mse102x: Add range check for CMD_RTS
net: vertexcom: mse102x: Fix RX error handling
blk-mq: create correct map for fallback case
mm, slab: clean up slab->obj_exts always
bcachefs: Remove incorrect __counted_by annotation
net: Fix the devmem sock opts and msgs for parisc
accel/ivpu: Make DB_ID and JOB_ID allocations incremental
accel/ivpu: Use xa_alloc_cyclic() instead of custom function
accel/ivpu: Fix a typo
accel/ivpu: Update VPU FW API headers
accel/ivpu: Abort all jobs after command queue unregister
accel/ivpu: Fix locking order in ivpu_job_submit
accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW
sch_htb: make htb_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
sch_ets: make est_qlen_notify() idempotent
drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
firmware: arm_scmi: Balance device refcount when destroying devices
firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
arm64: dts: imx95: Correct the range of PCIe app-reg region
ARM: dts: opos6ul: add ksz8081 phy properties
arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs
Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
kernel: param: rename locate_module_kobject
kernel: globalize lookup_or_create_module_kobject()
drivers: base: handle module_kobject creation
drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
drm/amd/display: Fix slab-use-after-free in hdcp
dm: fix copying after src array boundaries
Linux 6.12.28
Change-Id: I79f3d50a10acfe53f329b4b5a4af502f488c61f3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 69 out of 278 changes, affecting 88 files +585/-290
0b603e7759 tracing: Add __print_dynamic_array() helper [3 files, +15/-1]
0312735402 tracing: Verify event formats that have "%*p.." [2 files, +13/-2]
1c9798bf81 mm/vmscan: don't try to reclaim hwpoison folio [1 file, +7/-0]
db3b3964af PM: EM: use kfree_rcu() to simplify the code [1 file, +1/-9]
9d5752b853 PM: EM: Address RCU-related sparse warnings [2 files, +26/-25]
3e12e8c273 block: remove the write_hint field from struct request [4 files, +13/-12]
ed7535b141 block: remove the ioprio field from struct request [4 files, +11/-15]
2afa5ea7c4 block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone [1 file, +1/-0]
46d3575209 PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends [1 file, +6/-12]
35ba7b2d4d PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads [2 files, +5/-0]
16c8aa5de1 dma/contiguous: avoid warning about unused size_bytes [1 file, +1/-2]
7ccfadfb25 cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() [1 file, +8/-2]
28fbd7b13b cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() [1 file, +10/-3]
7d002f5914 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() [1 file, +5/-7]
5d92e582d1 cgroup/cpuset-v1: Add missing support for cpuset_v2_mode [1 file, +29/-0]
29daa63f2c scsi: core: Clear flags for scsi_cmnd that did not complete [1 file, +5/-1]
eeab661803 scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer() [1 file, +2/-0]
41143e7105 net: phy: leds: fix memory leak [1 file, +13/-10]
0ceef62a32 tipc: fix NULL pointer dereference in tipc_mon_reinit_self() [1 file, +2/-1]
a61afd5482 fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() [1 file, +36/-33]
7f24ea6a46 block: never reduce ra_pages in blk_apply_bdi_limits [1 file, +7/-1]
3decda1a3c splice: remove duplicate noinline from pipe_clear_nowait [1 file, +1/-1]
30c0d6e778 virtio_console: fix missing byte order handling for cols and rows [1 file, +4/-3]
c2a6b4d78c net: selftests: initialize TCP header and skb payload with zero [1 file, +13/-5]
3939d6f29d irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() [1 file, +1/-1]
7a8a6b627f io_uring: fix 'sync' handling of io_fallback_tw() [1 file, +7/-6]
1f439fe4d8 scsi: Improve CDL control [1 file, +24/-12]
3670dee376 char: misc: register chrdev region with all possible minors [1 file, +1/-1]
ea0d806b94 USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe [2 files, +7/-0]
1777714865 xhci: Limit time spent with xHC interrupts disabled during bus resume [3 files, +20/-16]
bce3055b08 usb: xhci: Fix invalid pointer dereference in Etron workaround [1 file, +1/-1]
52a7c9d930 usb: dwc3: gadget: check that event count does not exceed event buffer length [1 file, +6/-0]
9924ee1bcd usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive [1 file, +3/-0]
d85b7af3bd usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive [1 file, +3/-0]
3e52ae347e USB: VLI disk crashes if LPM is used [1 file, +3/-0]
0486de3c1b crypto: null - Use spin lock instead of mutex [1 file, +26/-13]
7758e308ae bpf: Fix kmemleak warning for percpu hashmap [1 file, +3/-3]
c5c833f637 bpf: Fix deadlock between rcu_tasks_trace and event_mutex. [1 file, +4/-3]
4139072087 clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() [1 file, +4/-0]
4131411f42 bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage [1 file, +6/-5]
b817d2bfd6 bpf: Reject attaching fexit/fmod_ret to __noreturn functions [1 file, +32/-0]
2ecae00138 usb: dwc3: gadget: Refactor loop to avoid NULL endpoints [1 file, +18/-4]
cbfa55bda1 usb: xhci: Complete 'error mid TD' transfers when handling Missed Service [1 file, +5/-1]
16a7a8e6c4 usb: xhci: Fix isochronous Ring Underrun/Overrun event handling [1 file, +14/-6]
635be13606 xhci: Handle spurious events on Etron host isoc enpoints [2 files, +27/-13]
9ff59cb815 usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running [1 file, +7/-4]
0485bdf88f objtool, panic: Disable SMAP in __stack_chk_fail() [2 files, +10/-1]
c548f95688 9p/net: fix improper handling of bogus negative read/write replies [1 file, +16/-14]
18296b5951 9p/trans_fd: mark concurrent read and writes to p9_conn->err [1 file, +10/-7]
3568fd9e44 io_uring: always do atomic put from iowq [2 files, +8/-1]
90dc6c1e3b perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init [1 file, +3/-3]
24ede35eb2 nvme: requeue namespace scan on missed AENs [1 file, +4/-0]
b9c89c97d7 nvme: re-read ANA log page after ns scan completes [1 file, +5/-0]
ee5521176a nvme: multipath: fix return value of nvme_available_path [1 file, +1/-1]
5e58b93a12 gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment [1 file, +3/-3]
9f8eeac3a6 timekeeping: Add a lockdep override in tick_freeze() [1 file, +22/-0]
b14d986413 iommu: Clear iommu-dma ops on cleanup [1 file, +3/-0]
b626bc3c1d ext4: make block validity check resistent to sb bh corruption [2 files, +6/-6]
2ef6eea2ef netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS [1 file, +4/-0]
d53b2d49a8 iomap: skip unnecessary ifs_block_is_uptodate check [1 file, +1/-1]
bfc66c4c28 Revert "drivers: core: synchronize really_probe() and dev_uevent()" [1 file, +0/-3]
de7c24febd usb: typec: class: Fix NULL pointer access [2 files, +14/-2]
45314999f9 ext4: goto right label 'out_mmap_sem' in ext4_setattr() [1 file, +1/-1]
40966fc993 usb: typec: class: Invalidate USB device pointers on partner unregistration [1 file, +6/-2]
4833d0a92b iommu: Handle race with default domain setup [1 file, +5/-0]
1042d22942 nvme: fixup scan failure for non-ANA multipath controllers [1 file, +1/-1]
1b7647efad usb: xhci: Fix Short Packet handling rework ignoring errors [1 file, +1/-1]
ab5281d21e usb: typec: class: Unlocked on error in typec_register_partner() [1 file, +1/-0]
6b9ebcbd31 mq-deadline: don't call req_get_ioprio from the I/O completion handler [1 file, +4/-9]
Changes in 6.12.26
module: sign with sha512 instead of sha1 by default
tracing: Add __print_dynamic_array() helper
tracing: Verify event formats that have "%*p.."
mm/vmscan: don't try to reclaim hwpoison folio
soc: qcom: ice: introduce devm_of_qcom_ice_get
mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
PM: EM: use kfree_rcu() to simplify the code
PM: EM: Address RCU-related sparse warnings
media: i2c: imx214: Use subdev active state
media: i2c: imx214: Simplify with dev_err_probe()
media: i2c: imx214: Convert to CCI register access helpers
media: i2c: imx214: Replace register addresses with macros
media: i2c: imx214: Check number of lanes from device tree
media: i2c: imx214: Fix link frequency validation
media: ov08x40: Move ov08x40_identify_module() function up
media: ov08x40: Add missing ov08x40_identify_module() call on stream-start
block: remove the write_hint field from struct request
block: remove the ioprio field from struct request
block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone
net: dsa: mv88e6xxx: fix VTU methods for 6320 family
iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
iio: adc: ad7768-1: Fix conversion result sign
arm64: dts: ti: Refactor J784s4 SoC files to a common file
arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix serdes_ln_ctrl reg-masks
of: resolver: Simplify of_resolve_phandles() using __free()
of: resolver: Fix device node refcount leakage in of_resolve_phandles()
scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
PCI/MSI: Convert pci_msi_ignore_mask to per MSI domain flag
PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends
PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
accel/ivpu: Add auto selection logic for job scheduler
accel/ivpu: Fix the NPU's DPU frequency calculation
ksmbd: use __GFP_RETRY_MAYFAIL
ksmbd: add netdev-up/down event debug print
ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
ksmbd: fix use-after-free in __smb2_lease_break_noti()
scsi: ufs: exynos: Remove empty drv_init method
scsi: ufs: exynos: Remove superfluous function parameter
scsi: ufs: exynos: Add gs101_ufs_drv_init() hook and enable WriteBooster
scsi: ufs: exynos: Move UFS shareability value to drvdata
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
drm/xe/bmg: Add one additional PCI ID
drm/amd/display: Fix unnecessary cast warnings from checkpatch
drm/amd/display/dml2: use vzalloc rather than kzalloc
lib/Kconfig.ubsan: Remove 'default UBSAN' from UBSAN_INTEGER_WRAP
ceph: Fix incorrect flush end position calculation
cpufreq: sun50i: prevent out-of-bounds access
dma/contiguous: avoid warning about unused size_bytes
cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
cpufreq: cppc: Fix invalid return value in .get() callback
cpufreq: Do not enable by default during compile testing
cpufreq: fix compile-test defaults
btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
vhost-scsi: Add better resource allocation failure handling
vhost-scsi: Fix vhost_scsi_send_bad_target()
vhost-scsi: Fix vhost_scsi_send_status()
net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
net/mlx5: Move ttc allocation after switch case to prevent leaks
scsi: core: Clear flags for scsi_cmnd that did not complete
scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
net: lwtunnel: disable BHs when required
net: phy: leds: fix memory leak
tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
net_sched: hfsc: Fix a UAF vulnerability in class handling
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
pds_core: Prevent possible adminq overflow/stuck condition
pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
pds_core: Remove unnecessary check in pds_client_adminq_cmd()
pds_core: make wait_context part of q_info
block: never reduce ra_pages in blk_apply_bdi_limits
iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
riscv: Replace function-like macro by static inline function
riscv: uprobes: Add missing fence.i after building the XOL buffer
splice: remove duplicate noinline from pipe_clear_nowait
bpf: Add namespace to BPF internal symbols
perf/x86: Fix non-sampling (counting) events on certain x86 platforms
LoongArch: Select ARCH_USE_MEMTEST
LoongArch: Make regs_irqs_disabled() more clear
LoongArch: Make do_xyz() exception handlers more robust
KVM: SVM: Disable AVIC on SNP-enabled system without HvInUseWrAllowed feature
netfilter: fib: avoid lookup if socket is available
virtio_console: fix missing byte order handling for cols and rows
sched_ext: Use kvzalloc for large exit_dump allocation
crypto: atmel-sha204a - Set hwrng quality to lowest possible
xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
net: selftests: initialize TCP header and skb payload with zero
net: phy: microchip: force IRQ polling mode for lan88xx
scsi: mpi3mr: Fix pending I/O counter
rust: firmware: Use `ffi::c_char` type in `FwFunc`
drm: panel: jd9365da: fix reset signal polarity in unprepare
drm/amd/display: Fix gpu reset in multidisplay config
drm/amd/display: Force full update in gpu reset
x86/insn: Fix CTEST instruction decoding
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
LoongArch: Handle fp, lsx, lasx and lbt assembly symbols
LoongArch: Return NULL from huge_pte_offset() for invalid PMD
LoongArch: Remove a bogus reference to ZONE_DMA
LoongArch: KVM: Fully clear some CSRs when VM reboot
LoongArch: KVM: Fix PMU pass-through issue if VM exits to host finally
io_uring: fix 'sync' handling of io_fallback_tw()
KVM: SVM: Allocate IR data using atomic allocation
cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
mcb: fix a double free bug in chameleon_parse_gdd()
ata: libata-scsi: Improve CDL control
ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
ata: libata-scsi: Fix ata_msense_control_ata_feature()
USB: storage: quirk for ADATA Portable HDD CH94
scsi: Improve CDL control
mei: me: add panther lake H DID
mei: vsc: Fix fortify-panic caused by invalid counted_by() use
KVM: x86: Explicitly treat routing entry type changes as changes
KVM: x86: Reset IRTE to host control if *new* route isn't postable
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
char: misc: register chrdev region with all possible minors
misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration
misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
firmware: stratix10-svc: Add of_platform_default_populate()
tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
serial: msm: Configure correct working mode before starting earlycon
serial: sifive: lock port in startup()/shutdown() callbacks
USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
USB: serial: option: add Sierra Wireless EM9291
USB: serial: simple: add OWON HDS200 series oscilloscope support
xhci: Limit time spent with xHC interrupts disabled during bus resume
usb: xhci: Fix invalid pointer dereference in Etron workaround
usb: cdns3: Fix deadlock when using NCM gadget
usb: chipidea: ci_hdrc_imx: fix usbmisc handling
usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
usb: dwc3: gadget: check that event count does not exceed event buffer length
usb: dwc3: xilinx: Prevent spike in reset signal
usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
USB: VLI disk crashes if LPM is used
USB: wdm: handle IO errors in wdm_wwan_port_start
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
USB: wdm: add annotation
selftests/bpf: Fix stdout race condition in traffic monitor
pinctrl: renesas: rza2: Fix potential NULL pointer dereference
pinctrl: mcp23s08: Get rid of spurious level interrupts
MIPS: cm: Detect CM quirks from device tree
crypto: ccp - Add support for PCI device 0x1134
crypto: lib/Kconfig - Fix lib built-in failure when arch is modular
crypto: null - Use spin lock instead of mutex
bpf: Fix kmemleak warning for percpu hashmap
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
parisc: PDT: Fix missing prototype warning
s390/sclp: Add check for get_zeroed_page()
s390/tty: Fix a potential memory leak bug
bpf: bpftool: Setting error code in do_loader()
bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage
bpf: Reject attaching fexit/fmod_ret to __noreturn functions
mailbox: pcc: Fix the possible race in updation of chan_in_use flag
mailbox: pcc: Always clear the platform ack interrupt first
usb: host: max3421-hcd: Add missing spi_device_id table
fs/ntfs3: Keep write operations atomic
fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
usb: xhci: Complete 'error mid TD' transfers when handling Missed Service
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
xhci: Handle spurious events on Etron host isoc enpoints
i3c: master: svc: Add support for Nuvoton npcm845 i3c
dmaengine: dmatest: Fix dmatest waiting less when interrupted
usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
phy: rockchip: usbdp: Avoid call hpd_event_trigger in dp_phy_init
usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
thunderbolt: Scan retimers after device router has been enumerated
um: work around sched_yield not yielding in time-travel mode
objtool: Silence more KCOV warnings
objtool, panic: Disable SMAP in __stack_chk_fail()
objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()
objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc()
objtool, lkdtm: Obfuscate the do_nothing() pointer
qibfs: fix _another_ leak
ntb: reduce stack usage in idt_scan_mws
ntb_hw_amd: Add NTB PCI ID for new gen CPU
9p/net: fix improper handling of bogus negative read/write replies
9p/trans_fd: mark concurrent read and writes to p9_conn->err
rtc: pcf85063: do a SW reset if POR failed
io_uring: always do atomic put from iowq
kbuild: add dependency from vmlinux to sorttable
sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
KVM: s390: Don't use %pK through tracepoints
KVM: s390: Don't use %pK through debug printing
cgroup/cpuset: Don't allow creation of local partition over a remote one
selftests: ublk: fix test_stripe_04
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
xen: Change xen-acpi-processor dom0 dependency
nvme: requeue namespace scan on missed AENs
ACPI: EC: Set ec_no_wakeup for Lenovo Go S
ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
drm/amdgpu: Increase KIQ invalidate_tlbs timeout
drm/xe/xe3lpg: Apply Wa_14022293748, Wa_22019794406
nvme: re-read ANA log page after ns scan completes
nvme: multipath: fix return value of nvme_available_path
objtool: Stop UNRET validation on UD2
gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
x86/xen: disable CPU idle and frequency drivers for PVH dom0
selftests/mincore: Allow read-ahead pages to reach the end of the file
x86/bugs: Use SBPB in write_ibpb() if applicable
x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
x86/bugs: Don't fill RSB on context switch with eIBRS
nvmet-fc: take tgtport reference only once
nvmet-fc: put ref when assoc->del_work is already scheduled
cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode
timekeeping: Add a lockdep override in tick_freeze()
cifs: Fix querying of WSL CHR and BLK reparse points over SMB1
iommu: Clear iommu-dma ops on cleanup
ext4: make block validity check resistent to sb bh corruption
scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init()
scsi: ufs: exynos: Enable PRDT pre-fetching with UFSHCD_CAP_CRYPTO
scsi: ufs: exynos: Move phy calls to .exit() callback
scsi: ufs: exynos: gs101: Put UFS device in reset on .suspend()
scsi: pm80xx: Set phy_attached to zero when device is gone
ASoC: fsl_asrc_dma: get codec or cpu dai from backend
x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
iomap: skip unnecessary ifs_block_is_uptodate check
riscv: Provide all alternative macros all the time
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
spi: tegra210-quad: add rate limiting and simplify timeout error message
ubsan: Fix panic from test_ubsan_out_of_bounds
x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores
md/raid1: Add check for missing source disk in process_checks()
drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4
drm/amdgpu: Use the right function for hdp flush
spi: spi-imx: Add check for spi_imx_setupxfer()
Revert "drivers: core: synchronize really_probe() and dev_uevent()"
driver core: introduce device_set_driver() helper
driver core: fix potential NULL pointer dereference in dev_uevent()
xfs: do not check NEEDSREPAIR if ro,norecovery mount.
xfs: Do not allow norecovery mount with quotacheck
xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
xfs: flush inodegc before swapon
selftests/bpf: fix bpf_map_redirect call for cpu map test
selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
selftests/bpf: check program redirect in xdp_cpumap_attach
selftests/bpf: Adjust data size to have ETH_HLEN
usb: typec: class: Fix NULL pointer access
vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
comedi: jr3_pci: Fix synchronous deletion of timer
ext4: goto right label 'out_mmap_sem' in ext4_setattr()
usb: typec: class: Invalidate USB device pointers on partner unregistration
Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family"
net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
net: dsa: mv88e6xxx: enable PVT for 6321 switch
net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
net: dsa: mv88e6xxx: enable STU methods for 6320 family
iommu: Handle race with default domain setup
crypto: lib/Kconfig - Hide arch options from user
media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
MIPS: cm: Fix warning if MIPS_CM is disabled
nvme: fixup scan failure for non-ANA multipath controllers
usb: xhci: Fix Short Packet handling rework ignoring errors
objtool: Ignore end-of-section jumps for KCOV/GCOV
objtool: Silence more KCOV warnings, part 2
usb: typec: class: Unlocked on error in typec_register_partner()
crypto: Kconfig - Select LIB generic option
arm64: dts: ti: k3-j784s4-j742s2-main-common: Correct the GICD size
mq-deadline: don't call req_get_ioprio from the I/O completion handler
Linux 6.12.26
Change-Id: Iff5be8c388b8b915652fafb787156a4653f060aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
struct kvm_cpu_context pulls in a lot of KVM-internal types into the KMI
(struct kvm, struct kvm_vcpu, ...). None of these should be needed by
modules, so let's remove it from the KMI.
Bug: 357781595
Change-Id: I2302a9354721e5ef504a6c3e67d9bd4f17582ac8
Signed-off-by: Quentin Perret <qperret@google.com>
Introduce new DMA APIs to perform DMA linkage of buffers
in layers higher than DMA.
In proposed API, the callers will perform the following steps.
In map path:
if (dma_can_use_iova(...))
dma_iova_alloc()
for (page in range)
dma_iova_link_next(...)
dma_iova_sync(...)
else
/* Fallback to legacy map pages */
for (all pages)
dma_map_page(...)
In unmap path:
if (dma_can_use_iova(...))
dma_iova_destroy()
else
for (all pages)
dma_unmap_page(...)
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit 433a76207dcf5facc0183acb790f6e8398585258
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
[Daniel: Adopted to the absence of commit 6aa63a4ec947 ("iommu: Sort out domain
user data")]
Bug: 416098329
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: Ibf9e394630a8d14e2017bee9d2902a0daef4da89
Split the iommu logic from iommu_dma_map_page into a separate helper.
This not only keeps the code neatly separated, but will also allow for
reuse in another caller.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit ed18a46262be4397cdc24382fb331c68846fef6e
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
Bug: 416098329
[Daniel: Adopted to commit ed5035757c ("BACKPORT: FROMLIST: PCI: Rename
pci_dev->untrusted to pci_dev->requires_dma_protection")]
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: I0ece9ce844ebcbab5ee6c6c6b0e99dea6255a77b
The existing .map_pages() callback provides both allocating of IOVA
and linking DMA pages. That combination works great for most of the
callers who use it in control paths, but is less effective in fast
paths where there may be multiple calls to map_page().
These advanced callers already manage their data in some sort of
database and can perform IOVA allocation in advance, leaving range
linkage operation to be in fast path.
Provide an interface to allocate/deallocate IOVA and next patch
link/unlink DMA ranges to that specific IOVA.
In the new API a DMA mapping transaction is identified by a
struct dma_iova_state, which holds some recomputed information
for the transaction which does not change for each page being
mapped, so add a check if IOVA can be used for the specific
transaction.
The API is exported from dma-iommu as it is the only implementation
supported, the namespace is clearly different from iommu_* functions
which are not allowed to be used. This code layout allows us to save
function call per API call used in datapath as well as a lot of boilerplate
code.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit 393cf700e6242032fbad51b248111ab6740ce8ad
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
Bug: 416098329
[Daniel: Adopted to absence of commit 6aa63a4ec947 ("iommu: Sort out domain
user data")]
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: If1db370d0d2913e4391de8fc603901a375860687
For the upcoming IOVA-based DMA API we want to batch the
ops->iotlb_sync_map() call after mapping multiple IOVAs from
dma-iommu without having a scatterlist. Improve the API.
Add a wrapper for the map_sync as iommu_sync_map() so that callers
don't need to poke into the methods directly.
Formalize __iommu_map() into iommu_map_nosync() which requires the
caller to call iommu_sync_map() after all maps are completed.
Refactor the existing sanity checks from all the different layers
into iommu_map_nosync().
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Will Deacon <will@kernel.org>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit 5c87cffe2d3853cfae61e9373ee98a0409839178
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
Bug: 416098329
[Daniel: Adopted to commit 1a608d2b0d ("BACKPORT: FROMLIST: drivers/iommu:
Add deferred map_sg operations")]
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: Iefa5c86c91bc5b89113a68798898a3b5c6896edc
To support the upcoming non-scatterlist mapping helpers, we need to go
back to have them called outside of the DMA API. Thus move them out of
dma-map-ops.h, which is only for DMA API implementations to pci-p2pdma.h,
which is for driver use.
Note that the core helper is still not exported as the mapping is
expected to be done only by very highlevel subsystem code at least for
now.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit ca2c2e4a78c619bcf1c1df29fee5981035f3fcbc
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
[Daniel: Adopted to absence of commit 82ba975e4c43 ("mm: allow compound zone
device pages")]
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Bug: 416098329
Change-Id: I9a9289e2d84fac6e4dbcbdd2a047c9fee585fe39
The current scheme with a single helper to determine the P2P status
and map a scatterlist segment force users to always use the map_sg
helper to DMA map, which we're trying to get away from because they
are very cache inefficient.
Refactor the code so that there is a single helper that checks the P2P
state for a page, including the result that it is not a P2P page to
simplify the callers, and a second one to perform the address translation
for a bus mapped P2P transfer that does not depend on the scatterlist
structure.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
(cherry picked from commit a25e7962db0d79882c9d32fd2a67a02e79129c0e
https://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux.git)
Bug: 416098329
[Daniel: Adopted to absence of commit 82ba975e4c43 ("mm: allow compound zone
device pages")]
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: Ia2b610da45d0beb76744d9182ab8665b5e7dd072
GKI (arm64) relevant 98 out of 394 changes, affecting 131 files +1443/-762
40bc55e4fc cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() [1 file, +3/-3]
9701dcbf5f cgroup/cpuset: Fix error handling in remote_partition_disable() [1 file, +20/-9]
2dbd1b1660 cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" [1 file, +14/-25]
6b145f8b22 cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation [1 file, +33/-16]
1b06f00eda cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set [1 file, +19/-20]
cdb6e724e7 cgroup/cpuset: Fix race between newly created partition and dying one [4 files, +25/-4]
179ef2f810 gpiolib: of: Fix the choice for Ingenic NAND quirk [1 file, +2/-0]
cb8372e54f ublk: refactor recovery configuration flag helpers [1 file, +42/-20]
caa5c8a235 ublk: fix handling recovery & reissue in ublk_abort_queue() [1 file, +26/-4]
7c5957f790 tipc: fix memory leak in tipc_link_xmit [1 file, +1/-0]
4d55144b12 codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() [2 files, +3/-8]
b2f3c3d57a tc: Ensure we have enough buffer space when sending filter netlink notifications [1 file, +45/-21]
a065b99605 net: ethtool: Don't call .cleanup_data when prepare_data fails [1 file, +5/-3]
70449ca406 net_sched: sch_sfq: use a temporary work area for validating configuration [1 file, +44/-12]
f86293adce net_sched: sch_sfq: move the limit validation [1 file, +6/-4]
6d98cd6342 net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() [1 file, +13/-13]
a6ed6f8ec8 net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY [1 file, +29/-2]
cc16f7402a ipv6: Align behavior across nexthops during path selection [1 file, +4/-4]
c61feda373 perf/core: Add aux_pause, aux_resume, aux_start_paused [4 files, +110/-5]
7ef5aa081f perf/core: Simplify the perf_event_alloc() error path [2 files, +78/-76]
fa1827fa96 perf: Fix hang while freeing sigtrap event [2 files, +18/-47]
52535688c2 fs: consistently deref the files table with rcu_dereference_raw() [1 file, +17/-9]
67e85cfa95 umount: Allow superblock owners to force umount [1 file, +2/-1]
1b3ebfb15d perf: arm_pmu: Don't disable counter in armpmu_add() [1 file, +3/-5]
11ae4fec1f PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() [1 file, +3/-3]
ead1fc9f93 Flush console log from kernel_power_off() [3 files, +8/-3]
cb58e90920 arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD [1 file, +2/-0]
3c057a4904 media: uvcvideo: Add quirk for Actions UVC05 [1 file, +9/-0]
cb1c6cb110 ALSA: usb-audio: Fix CME quirk for UF series keyboards [1 file, +74/-6]
a6bf0fd322 net: page_pool: don't cast mp param to devmem [1 file, +1/-1]
c6e50cb8bf f2fs: don't retry IO for corrupted data scenario [1 file, +4/-0]
de94d0ca9e net: usb: asix_devices: add FiberGecko DeviceID [1 file, +17/-0]
7204335d19 page_pool: avoid infinite loop to schedule delayed worker [1 file, +7/-1]
ecc4613316 f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() [1 file, +8/-1]
5f815757e6 ext4: protect ext4_release_dquot against freezing [1 file, +17/-0]
aa39d45071 Revert "f2fs: rebuild nat_bits during umount" [3 files, +59/-95]
eb59cc31b6 ext4: ignore xattrs past end [1 file, +10/-1]
a8a8076210 cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk [3 files, +19/-0]
299d7d27af net: vlan: don't propagate flags on open [1 file, +4/-27]
40c70ff44b tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER [1 file, +3/-1]
6b7a32fa9b Bluetooth: hci_uart: fix race during initialization [1 file, +2/-1]
fe6f1f349d Bluetooth: hci_qca: use the power sequencer for wcn6750 [1 file, +1/-1]
feed98579d Bluetooth: qca: simplify WCN399x NVM loading [1 file, +6/-7]
035e1bffc0 Bluetooth: Add quirk for broken READ_VOICE_SETTING [3 files, +15/-0]
09246dfb5c Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE [2 files, +10/-1]
044c1b3528 drm: allow encoder mode_set even when connectors change for crtc [1 file, +1/-1]
df33b535f0 drm: panel-orientation-quirks: Add support for AYANEO 2S [1 file, +2/-2]
6fe4ed94ee drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB [1 file, +18/-0]
5dd6fdb889 drm: panel-orientation-quirks: Add quirk for AYA NEO Slide [1 file, +6/-0]
a64e097426 drm: panel-orientation-quirks: Add new quirk for GPD Win 2 [1 file, +6/-0]
ba5a998f84 drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel) [1 file, +12/-0]
f04612890c drm/debugfs: fix printk format for bridge index [1 file, +1/-1]
b22cb42a5e drm/bridge: panel: forbid initializing a panel with unknown connector type [1 file, +4/-1]
1c38108a49 drivers: base: devres: Allow to release group on device release [1 file, +7/-0]
8feefd106a PCI: Enable Configuration RRS SV early [1 file, +5/-3]
73d2b96250 PCI: Check BAR index for validity [4 files, +57/-10]
9a6be23eb0 tracing: probe-events: Add comments about entry data storing code [1 file, +28/-0]
7b9bdd7059 erofs: set error to bio if file-backed IO fails [1 file, +2/-0]
806908d5d9 bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags [1 file, +44/-36]
dd3edffae8 ext4: don't treat fhandle lookup of ea_inode as FS corruption [1 file, +48/-20]
2ff58c5b26 arm64: cputype: Add MIDR_CORTEX_A76AE [1 file, +2/-0]
4af2858435 arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list [1 file, +1/-0]
3b0f2526c8 arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB [2 files, +102/-102]
20c105f587 arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list [1 file, +3/-0]
c322789613 KVM: arm64: Tear down vGIC on failed vCPU creation [1 file, +5/-1]
baea1762cd media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() [1 file, +2/-2]
0828d6e9ad io_uring/net: fix accept multishot handling [1 file, +2/-0]
b7c6d081c1 io_uring/net: fix io_req_post_cqe abuse by send bundle [3 files, +6/-2]
3e0356857e io_uring/kbuf: reject zero sized provided buffers [1 file, +2/-0]
16d9067f00 ext4: fix off-by-one error in do_split [1 file, +1/-1]
a1dde7457d f2fs: fix to avoid atomicity corruption of atomic file [2 files, +5/-3]
e6bba32857 i3c: Add NULL pointer check in i3c_master_queue_ibi() [1 file, +3/-0]
9eaec071f1 jbd2: remove wrong sb->s_sequence check [1 file, +0/-1]
eec737e17e arm64: mops: Do not dereference src reg for a set operation [1 file, +2/-2]
1dd288783d arm64: mm: Correct the update of max_pfn [1 file, +2/-1]
5f7f6abd92 net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. [2 files, +43/-2]
53dc6b00c0 mm/rmap: reject hugetlb folios in folio_make_device_exclusive() [1 file, +1/-1]
83b6b5061e mm: make page_mapped_in_vma() hugetlb walk aware [1 file, +9/-4]
6dd8d9440f mm: fix lazy mmu docs and usage [1 file, +8/-6]
2532df0a9b mm/mremap: correctly handle partial mremap() of VMA starting at 0 [1 file, +5/-5]
cc98577f91 mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock [1 file, +1/-1]
14936034de mm/userfaultfd: fix release hang over concurrent GUP [1 file, +25/-26]
65b259e3e0 mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper [3 files, +8/-4]
9e7c37fadb sctp: detect and prevent references to a freed transport in sendmsg [3 files, +18/-9]
474b3194c8 tracing: Do not add length to print format in synthetic events [1 file, +0/-1]
74f01c2ca8 dm-verity: fix prefetch-vs-suspend race [1 file, +8/-0]
fae0a8796c KVM: Allow building irqbypass.ko as as module when kvm.ko is a module [3 files, +7/-7]
dc83eccc93 of/irq: Fix device node refcount leakage in API of_irq_parse_one() [1 file, +27/-32]
3540164c75 of/irq: Fix device node refcount leakage in API of_irq_parse_raw() [1 file, +8/-0]
29cb94963c of/irq: Fix device node refcount leakages in of_irq_count() [1 file, +3/-1]
d0f25a9977 of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() [1 file, +5/-1]
712d84459a of/irq: Fix device node refcount leakages in of_irq_init() [1 file, +3/-0]
d69ad6e1a5 PCI: Fix reference leak in pci_alloc_child_bus() [1 file, +4/-1]
9707d0c932 PCI: Fix reference leak in pci_register_host_bridge() [1 file, +7/-2]
869202291a PCI: Fix wrong length of devres array [1 file, +1/-1]
92ca7270fe ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio() [1 file, +3/-2]
9ca4fe3574 arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists [1 file, +14/-1]
281782d2c6 Bluetooth: hci_uart: Fix another race during initialization [2 files, +15/-6]
Changes in 6.12.24
ASoC: Intel: adl: add 2xrt1316 audio configuration
cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask()
cgroup/cpuset: Fix error handling in remote_partition_disable()
cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()"
cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation
cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set
cgroup/cpuset: Fix race between newly created partition and dying one
gpiolib: of: Fix the choice for Ingenic NAND quirk
selftests/futex: futex_waitv wouldblock test should fail
ublk: refactor recovery configuration flag helpers
ublk: fix handling recovery & reissue in ublk_abort_queue()
drm/i915: Disable RPG during live selftest
x86/acpi: Don't limit CPUs to 1 for Xen PV guests due to disabled ACPI
drm/xe/hw_engine: define sysfs_ops on all directories
ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
tipc: fix memory leak in tipc_link_xmit
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
net: tls: explicitly disallow disconnect
octeontx2-pf: qos: fix VF root node parent queue index
tc: Ensure we have enough buffer space when sending filter netlink notifications
net: ethtool: Don't call .cleanup_data when prepare_data fails
drm/tests: modeset: Fix drm_display_mode memory leak
drm/tests: helpers: Create kunit helper to destroy a drm_display_mode
drm/tests: cmdline: Fix drm_display_mode memory leak
drm/tests: modes: Fix drm_display_mode memory leak
drm/tests: probe-helper: Fix drm_display_mode memory leak
net: libwx: handle page_pool_dev_alloc_pages error
ata: sata_sx4: Add error handling in pdc20621_i2c_read()
drm/i915/huc: Fix fence not released on early probe errors
nvmet-fcloop: swap list_add_tail arguments
net_sched: sch_sfq: use a temporary work area for validating configuration
net_sched: sch_sfq: move the limit validation
smb: client: fix UAF in decryption with multichannel
net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
ipv6: Align behavior across nexthops during path selection
net: ppp: Add bound checking for skb data on ppp_sync_txmung
nft_set_pipapo: fix incorrect avx2 match of 5th field octet
iommu/exynos: Fix suspend/resume with IDENTITY domain
iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
perf/core: Add aux_pause, aux_resume, aux_start_paused
perf/core: Simplify the perf_event_alloc() error path
perf: Fix hang while freeing sigtrap event
fs: consistently deref the files table with rcu_dereference_raw()
umount: Allow superblock owners to force umount
pm: cpupower: bench: Prevent NULL dereference on malloc failure
x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2
x86/ia32: Leave NULL selector values 0~3 unchanged
x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
perf: arm_pmu: Don't disable counter in armpmu_add()
perf/dwc_pcie: fix some unreleased resources
PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
Flush console log from kernel_power_off()
arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
xen/mcelog: Add __nonstring annotations for unterminated strings
zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault
platform/chrome: cros_ec_lpc: Match on Framework ACPI device
ASoC: SOF: topology: Use krealloc_array() to replace krealloc()
HID: pidff: Convert infinite length from Linux API to PID standard
HID: pidff: Do not send effect envelope if it's empty
HID: pidff: Add MISSING_DELAY quirk and its detection
HID: pidff: Add MISSING_PBO quirk and its detection
HID: pidff: Add PERMISSIVE_CONTROL quirk
HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
HID: pidff: Add FIX_WHEEL_DIRECTION quirk
HID: Add hid-universal-pidff driver and supported device ids
HID: pidff: Add PERIODIC_SINE_ONLY quirk
HID: pidff: Fix null pointer dereference in pidff_find_fields
ASoC: amd: ps: use macro for ACP6.3 pci revision id
ALSA: hda: intel: Fix Optimus when GPU has no sound
ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
ASoC: fsl_audmix: register card device depends on 'dais' property
media: uvcvideo: Add quirk for Actions UVC05
media: s5p-mfc: Corrected NV12M/NV21M plane-sizes
mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
ALSA: usb-audio: Fix CME quirk for UF series keyboards
ASoC: amd: Add DMI quirk for ACP6X mic support
ASoC: amd: yc: update quirk data for new Lenovo model
platform/x86: x86-android-tablets: Add select POWER_SUPPLY to Kconfig
wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
wifi: ath11k: fix memory leak in ath11k_xxx_remove()
wifi: ath12k: fix memory leak in ath12k_pci_remove()
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
ata: libata-core: Add 'external' to the libata.force kernel parameter
scsi: mpi3mr: Avoid reply queue full condition
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
net: page_pool: don't cast mp param to devmem
f2fs: don't retry IO for corrupted data scenario
wifi: mac80211: add strict mode disabling workarounds
wifi: mac80211: ensure sdata->work is canceled before initialized.
scsi: target: spc: Fix RSOC parameter data header size
net: usb: asix_devices: add FiberGecko DeviceID
page_pool: avoid infinite loop to schedule delayed worker
can: flexcan: Add quirk to handle separate interrupt lines for mailboxes
can: flexcan: add NXP S32G2/S32G3 SoC support
jfs: Fix uninit-value access of imap allocated in the diMount() function
fs/jfs: cast inactags to s64 to prevent potential overflow
fs/jfs: Prevent integer overflow in AG size calculation
jfs: Prevent copying of nlink with value 0 from disk inode
jfs: add sanity check for agwidth in dbMount
ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
net: sfp: add quirk for 2.5G OEM BX SFP
wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module
ahci: add PCI ID for Marvell 88SE9215 SATA Controller
ext4: protect ext4_release_dquot against freezing
Revert "f2fs: rebuild nat_bits during umount"
ext4: ignore xattrs past end
cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
scsi: st: Fix array overflow in st_setup()
ahci: Marvell 88SE9215 controllers prefer DMA for ATAPI
btrfs: harden block_group::bg_list against list_del() races
wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
net: vlan: don't propagate flags on open
tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
Bluetooth: btintel_pcie: Add device id of Whale Peak
Bluetooth: hci_uart: fix race during initialization
Bluetooth: btusb: Add 2 HWIDs for MT7922
Bluetooth: hci_qca: use the power sequencer for wcn6750
Bluetooth: qca: simplify WCN399x NVM loading
Bluetooth: Add quirk for broken READ_VOICE_SETTING
Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
drm: allow encoder mode_set even when connectors change for crtc
drm/xe/bmg: Add new PCI IDs
drm/xe/vf: Don't try to trigger a full GT reset if VF
drm/amd/display: Update Cursor request mode to the beginning prefetch always
drm/amdgpu: Unlocked unmap only clear page table leaves
drm: panel-orientation-quirks: Add support for AYANEO 2S
drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
drm: panel-orientation-quirks: Add new quirk for GPD Win 2
drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
drm/debugfs: fix printk format for bridge index
drm/bridge: panel: forbid initializing a panel with unknown connector type
drm/amd/display: stop DML2 from removing pipes based on planes
drivers: base: devres: Allow to release group on device release
drm/amdkfd: clamp queue size to minimum
drm/amdkfd: Fix mode1 reset crash issue
drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
drm/amdkfd: debugfs hang_hws skip GPU with MES
drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds
drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
PCI: Add Rockchip Vendor ID
drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()
PCI: Enable Configuration RRS SV early
drm/amdgpu: Fix the race condition for draining retry fault
PCI: Check BAR index for validity
PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
drm/amdgpu: grab an additional reference on the gang fence v2
fbdev: omapfb: Add 'plane' value check
tracing: probe-events: Add comments about entry data storing code
ktest: Fix Test Failures Due to Missing LOG_FILE Directories
tpm, tpm_tis: Workaround failed command reception on Infineon devices
tpm: End any active auth session before shutdown
pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
pwm: rcar: Improve register calculation
pwm: fsl-ftm: Handle clk_get_rate() returning 0
erofs: set error to bio if file-backed IO fails
bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
ext4: don't treat fhandle lookup of ea_inode as FS corruption
s390/pci: Fix s390_mmio_read/write syscall page fault handling
HID: pidff: Clamp PERIODIC effect period to device's logical range
HID: pidff: Stop all effects before enabling actuators
HID: pidff: Completely rework and fix pidff_reset function
HID: pidff: Simplify pidff_upload_effect function
HID: pidff: Define values used in pidff_find_special_fields
HID: pidff: Rescale time values to match field units
HID: pidff: Factor out code for setting gain
HID: pidff: Move all hid-pidff definitions to a dedicated header
HID: pidff: Simplify pidff_rescale_signed
HID: pidff: Use macros instead of hardcoded min/max values for shorts
HID: pidff: Factor out pool report fetch and remove excess declaration
HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
HID: hid-universal-pidff: Add Asetek wheelbases support
HID: pidff: Comment and code style update
HID: pidff: Support device error response from PID_BLOCK_LOAD
HID: pidff: Remove redundant call to pidff_find_special_keys
HID: pidff: Rename two functions to align them with naming convention
HID: pidff: Clamp effect playback LOOP_COUNT value
HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff
HID: pidff: Fix 90 degrees direction name North -> East
HID: pidff: Fix set_device_control()
auxdisplay: hd44780: Fix an API misuse in hd44780.c
dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
media: uapi: rkisp1-config: Fix typo in extensible params example
media: mgb4: Fix CMT registers update logic
media: i2c: adv748x: Fix test pattern selection mask
media: mgb4: Fix switched CMT frequency range "magic values" sets
media: intel/ipu6: set the dev_parent of video device to pdev
media: venus: hfi: add a check to handle OOB in sfr region
media: venus: hfi: add check to handle incorrect queue size
media: vim2m: print device name after registering device
media: siano: Fix error handling in smsdvb_module_init()
media: rockchip: rga: fix rga offset lookup
xenfs/xensyms: respect hypervisor's "next" indication
arm64: cputype: Add MIDR_CORTEX_A76AE
arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
KVM: arm64: Tear down vGIC on failed vCPU creation
spi: cadence-qspi: Fix probe on AM62A LP SK
mtd: rawnand: brcmnand: fix PM resume warning
tpm, tpm_tis: Fix timeout handling when waiting for TPM status
accel/ivpu: Fix PM related deadlocks in MS IOCTLs
media: streamzap: prevent processing IR data on URB failure
media: hi556: Fix memory leak (on error) in hi556_check_hwcfg()
media: visl: Fix ERANGE error when setting enum controls
media: platform: stm32: Add check for clk_enable()
media: imx219: Adjust PLL settings based on the number of MIPI lanes
media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
Revert "media: imx214: Fix the error handling in imx214_probe()"
media: i2c: ccs: Set the device's runtime PM status correctly in remove
media: i2c: ccs: Set the device's runtime PM status correctly in probe
media: i2c: ov7251: Set enable GPIO low in probe
media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
media: nuvoton: Fix reference handling of ece_node
media: nuvoton: Fix reference handling of ece_pdev
media: venus: hfi_parser: add check to avoid out of bound access
media: venus: hfi_parser: refactor hfi packet parsing logic
media: i2c: imx319: Rectify runtime PM handling probe and remove
media: i2c: imx219: Rectify runtime PM handling in probe and remove
media: i2c: imx214: Rectify probe error handling related to runtime PM
media: chips-media: wave5: Fix gray color on screen
media: chips-media: wave5: Avoid race condition in the interrupt handler
media: chips-media: wave5: Fix a hang after seeking
media: chips-media: wave5: Fix timeout while testing 10bit hevc fluster
mptcp: sockopt: fix getting IPV6_V6ONLY
mptcp: sockopt: fix getting freebind & transparent
mtd: Add check for devm_kcalloc()
net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
mtd: Replace kcalloc() with devm_kcalloc()
clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
wifi: mt76: Add check for devm_kstrdup()
wifi: mac80211: fix integer overflow in hwmp_route_info_get()
wifi: mt76: mt7925: ensure wow pattern command align fw format
wifi: mt76: mt7925: fix country count limitation for CLC
wifi: mt76: mt7925: fix the wrong link_idx when a p2p_device is present
wifi: mt76: mt7925: fix the wrong simultaneous cap for MLO
io_uring/net: fix accept multishot handling
io_uring/net: fix io_req_post_cqe abuse by send bundle
io_uring/kbuf: reject zero sized provided buffers
ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()
ASoC: q6apm: add q6apm_get_hw_pointer helper
ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx
accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()
accel/ivpu: Fix deadlock in ivpu_ms_cleanup()
bus: mhi: host: Fix race between unprepare and queue_buf
ext4: fix off-by-one error in do_split
f2fs: fix to avoid atomicity corruption of atomic file
vdpa/mlx5: Fix oversized null mkey longer than 32bit
udf: Fix inode_getblk() return value
tpm: do not start chip while suspended
svcrdma: do not unregister device for listeners
soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
smb311 client: fix missing tcon check when mounting with linux/posix extensions
ima: limit the number of open-writers integrity violations
ima: limit the number of ToMToU integrity violations
i3c: master: svc: Use readsb helper for reading MDB
i3c: Add NULL pointer check in i3c_master_queue_ibi()
jbd2: remove wrong sb->s_sequence check
kbuild: exclude .rodata.(cst|str)* when building ranges
leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs
mfd: ene-kb3930: Fix a potential NULL pointer dereference
mailbox: tegra-hsp: Define dimensioning masks in SoC data
locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
mptcp: fix NULL pointer in can_accept_new_subflow
mptcp: only inc MPJoinAckHMacFailure for HMAC failures
mtd: inftlcore: Add error check for inftl_read_oob()
mtd: rawnand: Add status chack in r852_ready()
arm64: mops: Do not dereference src reg for a set operation
arm64: tegra: Remove the Orin NX/Nano suspend key
arm64: mm: Correct the update of max_pfn
arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
arm64: dts: exynos: gs101: disable pinctrl_gsacore node
backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers
btrfs: tests: fix chunk map leak after failure to add it to the tree
btrfs: zoned: fix zone activation with missing devices
btrfs: zoned: fix zone finishing with missing devices
iommufd: Fix uninitialized rc in iommufd_access_rw()
iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
iommu/vt-d: Put IRTE back into posted MSI mode if vCPU posting is disabled
iommu/vt-d: Don't clobber posted vCPU IRTE when host IRQ affinity changes
iommu/vt-d: Fix possible circular locking dependency
iommu/vt-d: Wire up irq_ack() to irq_move_irq() for posted MSIs
sparc/mm: disable preemption in lazy mmu mode
sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
mm/damon/ops: have damon_get_folio return folio even for tail pages
mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
mm: make page_mapped_in_vma() hugetlb walk aware
mm: fix lazy mmu docs and usage
mm/mremap: correctly handle partial mremap() of VMA starting at 0
mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
mm/userfaultfd: fix release hang over concurrent GUP
mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
mm/hugetlb: move hugetlb_sysctl_init() to the __init section
mm/hwpoison: introduce folio_contain_hwpoisoned_page() helper
sctp: detect and prevent references to a freed transport in sendmsg
x86/xen: fix balloon target initialization for PVH dom0
tracing: fprobe events: Fix possible UAF on modules
tracing: Do not add length to print format in synthetic events
thermal/drivers/rockchip: Add missing rk3328 mapping entry
CIFS: Propagate min offload along with other parameters from primary to secondary channels.
cifs: avoid NULL pointer dereference in dbg call
cifs: fix integer overflow in match_server()
cifs: Ensure that all non-client-specific reparse points are processed by the server
clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks
clk: qcom: gdsc: Release pm subdomains in reverse add order
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
crypto: ccp - Fix check for the primary ASP device
crypto: ccp - Fix uAPI definitions of PSP errors
dlm: fix error if inactive rsb is not hashed
dlm: fix error if active rsb is not hashed
dm-ebs: fix prefetch-vs-suspend race
dm-integrity: set ti->error on memory allocation failure
dm-integrity: fix non-constant-time tag verification
dm-verity: fix prefetch-vs-suspend race
dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
ftrace: Add cond_resched() to ftrace_graph_set_hash()
ftrace: Properly merge notrace hashes
gpio: tegra186: fix resource handling in ACPI probe path
gpio: zynq: Fix wakeup source leaks on device unbind
gve: handle overflow when reporting TX consumed descriptors
KVM: Allow building irqbypass.ko as as module when kvm.ko is a module
KVM: PPC: Enable CAP_SPAPR_TCE_VFIO on pSeries KVM guests
KVM: x86: Explicitly zero-initialize on-stack CPUID unions
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
landlock: Move code to ease future backports
landlock: Add the errata interface
landlock: Add erratum for TCP fix
landlock: Always allow signals between threads of the same process
landlock: Prepare to add second errata
selftests/landlock: Split signal_scoping_threads tests
selftests/landlock: Add a new test for setuid()
misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
net: mana: Switch to page pool for jumbo frames
ntb: use 64-bit arithmetic for the MSI doorbell mask
of/irq: Fix device node refcount leakage in API of_irq_parse_one()
of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
of/irq: Fix device node refcount leakages in of_irq_count()
of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
of/irq: Fix device node refcount leakages in of_irq_init()
PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4
PCI: pciehp: Avoid unnecessary device replacement check
PCI: Fix reference leak in pci_alloc_child_bus()
PCI: Fix reference leak in pci_register_host_bridge()
PCI: Fix wrong length of devres array
phy: freescale: imx8m-pcie: assert phy reset and perst in power off
pinctrl: qcom: Clear latched interrupt status when changing IRQ type
pinctrl: samsung: add support for eint_fltcon_offset
ring-buffer: Use flush_kernel_vmap_range() over flush_dcache_folio()
s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
s390: Fix linker error when -no-pie option is unavailable
sched_ext: create_dsq: Return -EEXIST on duplicate request
selftests: mptcp: close fd_in before returning in main_loop
selftests: mptcp: fix incorrect fd checks in main_loop
thermal/drivers/mediatek/lvts: Disable monitor mode during suspend
thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold
arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
iommufd: Make attach_handle generic than fault specific
iommufd: Fail replace if device has not been attached
x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT
ACPI: platform-profile: Fix CFI violation when accessing sysfs files
NFSD: fix decoding in nfs4_xdr_dec_cb_getattr
NFSD: Fix CB_GETATTR status fix
nfsd: don't ignore the return code of svc_proc_register()
x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
libbpf: Prevent compiler warnings/errors
kbuild: Add '-fno-builtin-wcslen'
media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline
Bluetooth: hci_uart: Fix another race during initialization
s390/cpumf: Fix double free on error in cpumf_pmu_event_init()
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
Linux 6.12.24
Change-Id: I272e8aac67399f2eb57ca25e05cded24172d2d76
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 2c8a7c66c90832432496616a9a3c07293f1364f3 upstream.
On the Lenovo ThinkPad X201, when Intel VT-d is enabled in the BIOS, the
kernel boots with errors related to DMAR, the graphical interface appeared
quite choppy, and the system resets erratically within a minute after it
booted:
DMAR: DRHD: handling fault status reg 3
DMAR: [DMA Write NO_PASID] Request device [00:02.0] fault addr 0xb97ff000
[fault reason 0x05] PTE Write access is not set
Upon comparing boot logs with VT-d on/off, I found that the Intel Calpella
quirk (`quirk_calpella_no_shadow_gtt()') correctly applied the igfx IOMMU
disable/quirk correctly:
pci 0000:00:00.0: DMAR: BIOS has allocated no shadow GTT; disabling IOMMU
for graphics
Whereas with VT-d on, it went into the "else" branch, which then
triggered the DMAR handling fault above:
... else if (!disable_igfx_iommu) {
/* we have to ensure the gfx device is idle before we flush */
pci_info(dev, "Disabling batched IOTLB flush on Ironlake\n");
iommu_set_dma_strict();
}
Now, this is not exactly scientific, but moving 0x0044 to quirk_iommu_igfx
seems to have fixed the aforementioned issue. Running a few `git blame'
runs on the function, I have found that the quirk was originally
introduced as a fix specific to ThinkPad X201:
commit 9eecabcb9a ("intel-iommu: Abort IOMMU setup for igfx if BIOS gave
no shadow GTT space")
Which was later revised twice to the "else" branch we saw above:
- 2011: commit 6fbcfb3e46 ("intel-iommu: Workaround IOTLB hang on
Ironlake GPU")
- 2024: commit ba00196ca4 ("iommu/vt-d: Decouple igfx_off from graphic
identity mapping")
I'm uncertain whether further testings on this particular laptops were
done in 2011 and (honestly I'm not sure) 2024, but I would be happy to do
some distro-specific testing if that's what would be required to verify
this patch.
P.S., I also see IDs 0x0040, 0x0062, and 0x006a listed under the same
`quirk_calpella_no_shadow_gtt()' quirk, but I'm not sure how similar these
chipsets are (if they share the same issue with VT-d or even, indeed, if
this issue is specific to a bug in the Lenovo BIOS). With regards to
0x0062, it seems to be a Centrino wireless card, but not a chipset?
I have also listed a couple (distro and kernel) bug reports below as
references (some of them are from 7-8 years ago!), as they seem to be
similar issue found on different Westmere/Ironlake, Haswell, and Broadwell
hardware setups.
Cc: stable@vger.kernel.org
Fixes: 6fbcfb3e46 ("intel-iommu: Workaround IOTLB hang on Ironlake GPU")
Fixes: ba00196ca4 ("iommu/vt-d: Decouple igfx_off from graphic identity mapping")
Link: https://groups.google.com/g/qubes-users/c/4NP4goUds2c?pli=1
Link: https://bugs.archlinux.org/task/65362
Link: https://bbs.archlinux.org/viewtopic.php?id=230323
Reported-by: Wenhao Sun <weiguangtwk@outlook.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=197029
Signed-off-by: Mingcong Bai <jeffbai@aosc.io>
Link: https://lore.kernel.org/r/20250415133330.12528-1-jeffbai@aosc.io
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 12f78021973ae422564b234136c702a305932d73 upstream.
UBSan caught a bug with IOMMU SVA domains, where the reported exponent
value in __arm_smmu_tlb_inv_range() was >= 64.
__arm_smmu_tlb_inv_range() uses the domain's pgsize_bitmap to compute
the number of pages to invalidate and the invalidation range. Currently
arm_smmu_sva_domain_alloc() does not setup the iommu domain's
pgsize_bitmap. This leads to __ffs() on the value returning 64 and that
leads to undefined behaviour w.r.t. shift operations
Fix this by initializing the iommu_domain's pgsize_bitmap to PAGE_SIZE.
Effectively the code needs to use the smallest page size for
invalidation
Cc: stable@vger.kernel.org
Fixes: eb6c97647b ("iommu/arm-smmu-v3: Avoid constructing invalid range commands")
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Balbir Singh <balbirs@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>
Cc: Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20250412002354.3071449-1-balbirs@nvidia.com
Signed-off-by: Will Deacon <will@kernel.org>
commit b00d24997a11c10d3e420614f0873b83ce358a34 upstream.
ASPEED VGA card has two built-in devices:
0008:06:00.0 PCI bridge: ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge (rev 06)
0008:07:00.0 VGA compatible controller: ASPEED Technology, Inc. ASPEED Graphics Family (rev 52)
Its toplogy looks like this:
+-[0008:00]---00.0-[01-09]--+-00.0-[02-09]--+-00.0-[03]----00.0 Sandisk Corp Device 5017
| +-01.0-[04]--
| +-02.0-[05]----00.0 NVIDIA Corporation Device
| +-03.0-[06-07]----00.0-[07]----00.0 ASPEED Technology, Inc. ASPEED Graphics Family
| +-04.0-[08]----00.0 Renesas Technology Corp. uPD720201 USB 3.0 Host Controller
| \-05.0-[09]----00.0 Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller
\-00.1 PMC-Sierra Inc. Device 4028
The IORT logic populaties two identical IDs into the fwspec->ids array via
DMA aliasing in iort_pci_iommu_init() called by pci_for_each_dma_alias().
Though the SMMU driver had been able to handle this situation since commit
563b5cbe33 ("iommu/arm-smmu-v3: Cope with duplicated Stream IDs"), that
got broken by the later commit cdf315f907 ("iommu/arm-smmu-v3: Maintain
a SID->device structure"), which ended up with allocating separate streams
with the same stuffing.
On a kernel prior to v6.15-rc1, there has been an overlooked warning:
pci 0008:07:00.0: vgaarb: setting as boot VGA device
pci 0008:07:00.0: vgaarb: bridge control possible
pci 0008:07:00.0: vgaarb: VGA device added: decodes=io+mem,owns=none,locks=none
pcieport 0008:06:00.0: Adding to iommu group 14
ast 0008:07:00.0: stream 67328 already in tree <===== WARNING
ast 0008:07:00.0: enabling device (0002 -> 0003)
ast 0008:07:00.0: Using default configuration
ast 0008:07:00.0: AST 2600 detected
ast 0008:07:00.0: [drm] Using analog VGA
ast 0008:07:00.0: [drm] dram MCLK=396 Mhz type=1 bus_width=16
[drm] Initialized ast 0.1.0 for 0008:07:00.0 on minor 0
ast 0008:07:00.0: [drm] fb0: astdrmfb frame buffer device
With v6.15-rc, since the commit bcb81ac6ae3c ("iommu: Get DT/ACPI parsing
into the proper probe path"), the error returned with the warning is moved
to the SMMU device probe flow:
arm_smmu_probe_device+0x15c/0x4c0
__iommu_probe_device+0x150/0x4f8
probe_iommu_group+0x44/0x80
bus_for_each_dev+0x7c/0x100
bus_iommu_probe+0x48/0x1a8
iommu_device_register+0xb8/0x178
arm_smmu_device_probe+0x1350/0x1db0
which then fails the entire SMMU driver probe:
pci 0008:06:00.0: Adding to iommu group 21
pci 0008:07:00.0: stream 67328 already in tree
arm-smmu-v3 arm-smmu-v3.9.auto: Failed to register iommu
arm-smmu-v3 arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22
Since SMMU driver had been already expecting a potential duplicated Stream
ID in arm_smmu_install_ste_for_dev(), change the arm_smmu_insert_master()
routine to ignore a duplicated ID from the fwspec->sids array as well.
Note: this has been failing the iommu_device_probe() since 2021, although a
recent iommu commit in v6.15-rc1 that moves iommu_device_probe() started to
fail the SMMU driver probe. Since nobody has cared about DMA Alias support,
leave that as it was but fix the fundamental iommu_device_probe() breakage.
Fixes: cdf315f907 ("iommu/arm-smmu-v3: Maintain a SID->device structure")
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://lore.kernel.org/r/20250415185620.504299-1-nicolinc@nvidia.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream.
There is a string parsing logic error which can lead to an overflow of hid
or uid buffers. Comparing ACPIID_LEN against a total string length doesn't
take into account the lengths of individual hid and uid buffers so the
check is insufficient in some cases. For example if the length of hid
string is 4 and the length of the uid string is 260, the length of str
will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer
which size is 256.
The same applies to the hid string with length 13 and uid string with
length 250.
Check the length of hid and uid strings separately to prevent
buffer overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: ca3bf5d47c ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Paklov <Pavel.Paklov@cyberprotect.ru>
Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect.ru
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Mostafa Saleh
Greg Kroah-Hartman
Simon Xue
Arnd Bergmann
Ryan Huang
Daniel Mentz
Sean Christopherson
Mario Limonciello
Lu Baolu
Rolf Eike Beer
Jason Gunthorpe
Isaac J. Manjarres
Yi Liu
Vasant Hegde
Robin Murphy
Quentin Perret
Leon Romanovsky
Christoph Hellwig
Mingcong Bai
Balbir Singh
Nicolin Chen
Pavel Paklov