Linux 6.18.27
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.18.27 kernel.
All users of the 6.18 kernel series must upgrade.
The updated 6.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.18.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml | 70 ++ Documentation/scheduler/sched-ext.rst | 12 Makefile | 3 arch/arm/mm/flush.c | 4 arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi | 5 arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 20 arch/arm64/crypto/aes-modes.S | 4 arch/arm64/include/asm/mmu.h | 2 arch/arm64/mm/init.c | 9 arch/arm64/mm/mmu.c | 92 ++- arch/loongarch/kernel/cpu-probe.c | 7 arch/loongarch/kernel/syscall.c | 3 arch/loongarch/kvm/vcpu.c | 2 arch/parisc/Kconfig | 3 arch/parisc/include/asm/checksum.h | 89 --- arch/parisc/kernel/syscalls/syscall.tbl | 2 arch/parisc/lib/Makefile | 2 arch/parisc/lib/checksum.c | 99 --- arch/um/drivers/cow_user.c | 8 arch/x86/Kconfig | 1 arch/x86/kernel/shstk.c | 44 - arch/x86/kvm/hyperv.h | 8 arch/x86/kvm/svm/hyperv.h | 9 arch/x86/kvm/svm/nested.c | 195 ++++--- arch/x86/kvm/svm/svm.c | 139 ++++- arch/x86/kvm/svm/svm.h | 11 arch/x86/kvm/x86.c | 65 +- arch/x86/mm/pti.c | 5 block/bio-integrity.c | 6 block/bio.c | 6 block/blk-zoned.c | 12 block/blk.h | 19 certs/extract-cert.c | 6 crypto/acompress.c | 8 crypto/algif_aead.c | 10 crypto/authencesn.c | 5 crypto/pcrypt.c | 7 drivers/base/core.c | 39 + drivers/base/dd.c | 20 drivers/block/rbd.c | 6 drivers/block/zram/zram_drv.c | 3 drivers/bus/imx-weim.c | 2 drivers/bus/mhi/host/pci_generic.c | 2 drivers/char/ipmi/ipmi_ssif.c | 42 - drivers/char/tpm/tpm-chip.c | 2 drivers/char/tpm/tpm2-cmd.c | 6 drivers/char/tpm/tpm2-sessions.c | 5 drivers/char/tpm/tpm_tis_core.c | 11 drivers/crypto/atmel-aes.c | 2 drivers/crypto/atmel-ecc.c | 1 drivers/crypto/atmel-i2c.c | 4 drivers/crypto/atmel-sha204a.c | 37 - drivers/crypto/atmel-tdes.c | 8 drivers/crypto/ccree/cc_hash.c | 1 drivers/crypto/hisilicon/sec/sec_algs.c | 2 drivers/crypto/intel/qat/qat_6xxx/adf_drv.c | 4 drivers/crypto/nx/nx-842.c | 10 drivers/crypto/nx/nx-842.h | 4 drivers/crypto/talitos.c | 254 ++++++---- drivers/edac/versalnet_edac.c | 6 drivers/firmware/google/framebuffer-coreboot.c | 12 drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 6 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 52 +- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 9 drivers/gpu/drm/nouveau/nouveau_drm.c | 2 drivers/gpu/drm/nouveau/nouveau_gem.c | 2 drivers/gpu/drm/tiny/arcpgu.c | 3 drivers/greybus/gb-beagleplay.c | 112 +++- drivers/hid/hid-apple.c | 2 drivers/hwmon/isl28022.c | 5 drivers/hwmon/powerz.c | 11 drivers/hwmon/pt5161l.c | 4 drivers/i2c/i2c-core-of.c | 2 drivers/iio/adc/ad7768-1.c | 16 drivers/iio/adc/ti-ads7950.c | 11 drivers/iio/frequency/admv1013.c | 90 +-- drivers/infiniband/core/addr.c | 3 drivers/infiniband/hw/mana/qp.c | 15 drivers/infiniband/sw/rxe/rxe_recv.c | 3 drivers/input/touchscreen/edt-ft5x06.c | 3 drivers/leds/rgb/leds-qcom-lpg.c | 7 drivers/md/dm-raid1.c | 6 drivers/md/md-llbitmap.c | 11 drivers/md/raid10.c | 4 drivers/md/raid5-cache.c | 48 + drivers/md/raid5.c | 8 drivers/media/i2c/imx219.c | 3 drivers/media/platform/amphion/vpu_v4l2.c | 9 drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 drivers/media/rc/igorplugusb.c | 16 drivers/media/rc/ttusbir.c | 13 drivers/mfd/mfd-core.c | 12 drivers/mfd/stpmic1.c | 20 drivers/misc/ibmasm/ibmasmfs.c | 7 drivers/misc/ibmasm/lowlevel.c | 12 drivers/misc/ibmasm/remote.c | 5 drivers/misc/mei/bus-fixup.c | 6 drivers/misc/mei/hw-me-regs.h | 163 +++--- drivers/misc/mei/hw-me.h | 6 drivers/misc/mei/pci-me.c | 209 ++++---- drivers/mmc/core/block.c | 12 drivers/mmc/core/queue.h | 3 drivers/mmc/host/sdhci-of-dwcmshc.c | 19 drivers/mtd/devices/docg3.c | 3 drivers/mtd/nand/spi/winbond.c | 4 drivers/mtd/spi-nor/sst.c | 13 drivers/net/can/usb/ucan.c | 2 drivers/net/ethernet/micrel/ks8851.h | 6 drivers/net/ethernet/micrel/ks8851_common.c | 69 +- drivers/net/ethernet/micrel/ks8851_par.c | 15 drivers/net/ethernet/micrel/ks8851_spi.c | 11 drivers/net/ethernet/microsoft/mana/mana_en.c | 11 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c | 2 drivers/net/gtp.c | 2 drivers/net/netconsole.c | 2 drivers/net/phy/mdio_bus_provider.c | 4 drivers/net/wireless/marvell/mwifiex/init.c | 2 drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 51 +- drivers/net/wireless/realtek/rtl8xxxu/core.c | 28 - drivers/net/wireless/realtek/rtw88/pci.c | 3 drivers/nvme/host/core.c | 2 drivers/nvme/host/pci.c | 2 drivers/of/base.c | 2 drivers/of/dynamic.c | 2 drivers/of/platform.c | 2 drivers/of/unittest.c | 4 drivers/pci/controller/cadence/pcie-cadence.h | 56 -- drivers/pci/controller/dwc/pci-imx6.c | 1 drivers/pci/endpoint/functions/pci-epf-mhi.c | 4 drivers/pci/endpoint/functions/pci-epf-ntb.c | 56 -- drivers/phy/qualcomm/phy-qcom-m31-eusb2.c | 4 drivers/power/supply/axp288_charger.c | 19 drivers/pwm/pwm-imx-tpm.c | 9 drivers/remoteproc/xlnx_r5_remoteproc.c | 20 drivers/reset/reset-rzv2h-usb2phy.c | 64 -- drivers/rtc/rtc-ntxec.c | 2 drivers/scsi/sd.c | 1 drivers/spi/spi-ch341.c | 36 - drivers/spi/spi-imx.c | 4 drivers/spi/spi.c | 63 +- drivers/thermal/thermal_core.c | 7 drivers/usb/chipidea/core.c | 45 - drivers/usb/chipidea/otg.c | 7 drivers/usb/host/xhci.c | 1 drivers/vfio/cdx/intr.c | 13 drivers/vfio/cdx/main.c | 19 drivers/vfio/cdx/private.h | 3 drivers/vfio/pci/virtio/common.h | 2 drivers/vfio/pci/virtio/migrate.c | 33 - fs/afs/file.c | 12 fs/ceph/dir.c | 6 fs/erofs/dir.c | 28 - fs/ext2/inode.c | 14 fs/ext4/xattr.c | 6 fs/file_table.c | 22 fs/jbd2/revoke.c | 8 fs/nfs/internal.h | 2 fs/nfs/nfs4client.c | 4 fs/nfs/nfs4proc.c | 3 fs/notify/inotify/inotify_user.c | 1 fs/ntfs3/run.c | 18 fs/ocfs2/aops.c | 74 +- fs/userfaultfd.c | 2 fs/xfs/xfs_buf.c | 1 fs/xfs/xfs_sysfs.c | 7 fs/xfs/xfs_zone_alloc.h | 4 fs/xfs/xfs_zone_gc.c | 17 include/linux/alloc_tag.h | 2 include/linux/damon.h | 1 include/linux/device.h | 45 + include/linux/fwnode.h | 44 + include/linux/hugetlb_inline.h | 4 include/linux/pgalloc_tag.h | 2 include/linux/randomize_kstack.h | 26 - include/linux/sched.h | 4 include/linux/tpm_eventlog.h | 9 include/linux/usb.h | 3 include/net/mana/mana.h | 1 include/net/mctp.h | 3 include/trace/events/rxrpc.h | 6 init/main.c | 1 io_uring/poll.c | 6 io_uring/register.c | 36 + io_uring/timeout.c | 4 kernel/fork.c | 2 kernel/locking/rtmutex.c | 13 kernel/sched/core.c | 2 kernel/sched/rt.c | 2 kernel/sched/sched.h | 2 kernel/taskstats.c | 1 kernel/trace/fprobe.c | 21 kernel/trace/ring_buffer.c | 13 lib/alloc_tag.c | 109 ++++ lib/test_hmm.c | 86 +-- lib/ts_kmp.c | 18 mm/damon/core.c | 60 +- mm/damon/stat.c | 5 mm/filemap.c | 3 mm/hugetlb.c | 3 mm/internal.h | 11 mm/mempolicy.c | 23 mm/migrate.c | 17 mm/mlock.c | 10 mm/page_alloc.c | 15 mm/slub.c | 29 - mm/truncate.c | 6 mm/vma.c | 4 mm/vmalloc.c | 3 mm/zsmalloc.c | 1 net/bluetooth/hci_event.c | 18 net/bridge/br_arp_nd_proxy.c | 8 net/bridge/br_fdb.c | 28 - net/caif/cfsrvl.c | 14 net/ceph/auth.c | 2 net/ipv4/icmp.c | 5 net/ipv4/inet_connection_sock.c | 3 net/ipv6/exthdrs.c | 9 net/ipv6/rpl_iptunnel.c | 9 net/ipv6/seg6_iptunnel.c | 12 net/mctp/route.c | 8 net/netfilter/nft_bitwise.c | 3 net/qrtr/ns.c | 86 ++- net/rds/rdma.c | 4 net/rxrpc/ar-internal.h | 1 net/rxrpc/call_event.c | 20 net/rxrpc/conn_event.c | 43 + net/rxrpc/io_thread.c | 24 net/rxrpc/rxgk_app.c | 3 net/rxrpc/rxgk_common.h | 1 net/rxrpc/rxkad.c | 112 +--- net/rxrpc/skbuff.c | 9 net/smc/smc_clc.c | 4 net/strparser/strparser.c | 8 rust/kernel/dma.rs | 3 scripts/check-uapi.sh | 7 security/apparmor/lsm.c | 16 security/landlock/cred.c | 6 sound/aoa/soundbus/i2sbus/core.c | 12 sound/aoa/soundbus/i2sbus/pcm.c | 71 +- sound/core/control.c | 4 sound/core/misc.c | 13 sound/core/seq/oss/seq_oss_rw.c | 6 sound/drivers/aloop.c | 43 + sound/drivers/pcmtest.c | 19 sound/hda/codecs/realtek/alc269.c | 1 sound/pci/ctxfi/ctatc.c | 3 sound/soc/intel/avs/path.c | 2 sound/usb/6fire/control.c | 10 sound/usb/caiaq/control.c | 52 +- sound/usb/caiaq/device.c | 35 - sound/usb/caiaq/input.c | 2 sound/usb/endpoint.c | 6 sound/usb/format.c | 2 sound/usb/mixer.c | 7 sound/usb/mixer_quirks.c | 12 tools/accounting/getdelays.c | 41 + tools/accounting/procacct.c | 40 + tools/perf/arch/loongarch/annotate/instructions.c | 1 tools/perf/util/disasm.c | 1 tools/testing/ktest/ktest.pl | 2 tools/testing/selftests/kvm/x86/msrs_test.c | 2 tools/testing/selftests/landlock/audit.h | 107 +++- tools/testing/selftests/landlock/audit_test.c | 124 ++++ tools/testing/selftests/landlock/net_test.c | 2 tools/testing/selftests/landlock/ptrace_test.c | 1 tools/testing/selftests/landlock/scoped_abstract_unix_test.c | 1 tools/testing/selftests/mqueue/setting | 1 tools/testing/selftests/mqueue/settings | 1 tools/testing/selftests/vfio/lib/vfio_pci_device.c | 4 tools/testing/vma/vma_internal.h | 7 274 files changed, 3262 insertions(+), 1875 deletions(-)
Aditya Garg (1):
HID: apple: ensure the keyboard backlight is off if suspending
Aksh Garg (1):
PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
Alex Williamson (2):
vfio/virtio: Convert list_lock from spinlock to mutex vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
Alexander Usyskin (2):
mei: me: use PCI_DEVICE_DATA macro
mei: me: add nova lake point H DID
Alistair Popple (1):
lib: test_hmm: evict device pages on file close to avoid use-after-free
Amir Goldstein (1):
fs: prepare for adding LSM blob to backing_file
Andrea Mayer (2):
seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
Andrea Righi (1):
sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle
Anshuman Khandual (1):
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
Anthony Yznaga (1):
mm: prevent droppable mappings from being locked
Antoniu Miclaus (2):
iio: frequency: admv1013: add dev variable
iio: frequency: admv1013: fix NULL pointer dereference on str
Ao Zhou (1):
net: rds: fix MR cleanup on copy error
Arjan van de Ven (1):
drm/amdgpu: fix zero-size GDS range init on RDNA4
Arnd Bergmann (2):
tpm: avoid -Wunused-but-set-variable
check-uapi: link into shared objects
Ben Levinsky (1):
remoteproc: xlnx: Only access buffer information if IPI is buffered
Bin Liu (1):
mmc: block: use single block write in retry
Brahmajit Das (1):
ASoC: Intel: avs: replace strcmp with sysfs_streq
Breno Leitao (1):
netconsole: avoid out-of-bounds access on empty string in trim_newline()
Brian Mak (1):
mfd: core: Preserve OF node when ACPI handle is present
Brian Ruley (1):
ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()
Cengiz Can (1):
apparmor: use target task's context in apparmor_getprocattr()
Chen Ni (1):
media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe()
Chen Zhao (1):
IB/core: Fix zero dmac race in neighbor resolution
Chia-Ming Chang (2):
md/raid5: fix soft lockup in retry_aligned_read()
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
Corey Minyard (3):
ipmi:ssif: Clean up kthread on errors
ipmi:ssif: Remove unnecessary indention
ipmi:ssif: NULL thread on error
Cássio Gabriel (10):
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
ALSA: usb-audio: Avoid false E-MU sample-rate notifications
ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
ALSA: aoa: i2sbus: clear stale prepared state
ALSA: aoa: i2sbus: fix OF node lifetime handling
ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
ALSA: caiaq: Fix control_put() result and cache rollback
ALSA: 6fire: Fix input volume change detection
ALSA: pcmtest: Fix resource leaks in module init error paths
ALSA: aloop: Fix peer runtime UAF during format-change stop
Damien Le Moal (1):
block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work()
Daniel Hodges (2):
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
Danilo Krummrich (1):
rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs
Dave Hansen (1):
x86/cpu: Disable FRED when PTI is forced on
David (Ming Qiang) Wu (1):
amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
David Carlier (2):
drm/nouveau: fix nvkm_device leak on aperture removal failure
gtp: disable BH before calling udp_tunnel_xmit_skb()
David Howells (8):
rxrpc: Fix potential UAF after skb_unshare() failure
rxrpc: Fix memory leaks in rxkad_verify_response()
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
rxrpc: Fix rxkad crypto unalignment handling
rxrpc: Fix error handling in rxgk_extract_token()
rxrpc: Fix re-decryption of RESPONSE packets
rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
rxgk: Fix potential integer overflow in length check
David Lechner (1):
iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
Dawei Feng (1):
rbd: fix null-ptr-deref when device_add_disk() fails
Deepanshu Kartikey (2):
ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
ALSA: caiaq: fix usb_dev refcount leak on probe failure
Denis M. Karpov (1):
userfaultfd: allow registration of ranges below mmap_min_addr
Dmitry Torokhov (1):
Input: edt-ft5x06 - fix use-after-free in debugfs teardown
Douglas Anderson (3):
driver core: Don't let a device probe until it's ready device property: Make modifications of fwnode "flags" thread safe driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
Douya Le (1):
crypto: algif_aead - snapshot IV for async AEAD requests
Elson Serrao (1):
phy: qcom: m31-eusb2: clear PLL_EN during init
Eric Biggers (1):
crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
Fan Wu (1):
media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
Fedor Pchelkin (1):
wifi: rtw88: check for PCI upstream bridge existence
Felix Gu (1):
EDAC/versalnet: Fix device_node leak in mc_probe()
Francesco Dolcini (1):
arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
Gao Xiang (1):
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Giovanni Cabiddu (2):
crypto: qat - fix IRQ cleanup on 6xxx probe failure
crypto: acomp - fix wrong pointer stored by acomp_save_req()
Greg Kroah-Hartman (5):
LoongArch: Add spectre boundry for syscall dispatch table drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
leds: qcom-lpg: Check for array overflow when selecting the high resolution
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows Linux 6.18.27
Guangshuo Li (1):
ALSA: pcmtest: fix reference leak on failed device registration
Gunnar Kudrjavets (3):
tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
tpm: Fix auth session leak in tpm2_get_random() error path
tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
Gustavo A. R. Silva (1):
crypto: nx - Fix packed layout in struct nx842_crypto_header
Hans Holmberg (1):
xfs: start gc on zonegc_low_space attribute updates
Hao Ge (1):
mm/alloc_tag: clear codetag for pages allocated before page_ext initialization
Haoxiang Li (2):
xfs: fix a resource leak in xfs_alloc_buftarg()
crypto: ccree - fix a memory leak in cc_mac_digest()
Harin Lee (1):
ALSA: ctxfi: Add fallback to default RSR for S/PDIF
Harry Yoo (Oracle) (2):
mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP mm/slab: return NULL early from kmalloc_nolock() in NMI on UP
Helge Deller (2):
parisc: _llseek syscall is only available for 32-bit userspace
parisc: Drop ip_fast_csum() inline assembly implementation
Heming Zhao (1):
ocfs2: split transactions in dio completion to avoid credit exhaustion
Herbert Xu (1):
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
Huacai Chen (1):
LoongArch: Show CPU vulnerabilites correctly
Jackie Liu (2):
mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start()
Jacqueline Wong (2):
tpm: tpm_tis: add error logging for data transfer
tpm: tpm_tis: stop transmit if retries are exhausted
James Kim (1):
mtd: docg3: fix use-after-free in docg3_release()
Jens Axboe (2):
io_uring/register: fix ring resizing with mixed/large SQEs/CQEs io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
Jiawen Wu (2):
net: txgbe: fix RTNL assertion warning when remove module
net: txgbe: fix firmware version check
Johan Hovold (5):
spi: imx: fix use-after-free on unbind
spi: ch341: fix memory leaks on probe failures
spi: fix resource leaks on device setup failure
rtc: ntxec: fix OF node reference imbalance
can: ucan: fix devres lifetime
Jonathan Santos (2):
iio: adc: ad7768-1: fix one-shot mode data acquisition
iio: adc: ad7768-1: remove switch to one-shot mode
Joseph Salisbury (1):
sched: Use u64 for bandwidth ratio calculations
Josh Hunt (1):
md/raid10: fix deadlock with check operation and nowait requests
Josh Law (1):
lib/ts_kmp: fix integer overflow in pattern length calculation
Junrui Luo (2):
md/raid5: validate payload size before accessing journal metadata dm mirror: fix integer overflow in create_dirty_log()
Kai Ma (1):
netfilter: reject zero shift in nft_bitwise
Keenan Dong (1):
rtmutex: Use waiter::task instead of current in remove_waiter()
Kevin Brodsky (1):
arm64: mm: Simplify check in arch_kfence_init_pool()
Kevin Cheng (2):
KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
Koichiro Den (1):
PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
Krzysztof Kozlowski (1):
power: supply: axp288_charger: Do not cancel work before initializing it
Long Li (1):
RDMA/mana_ib: Disable RX steering on RSS QP destroy
Longxuan Yu (1):
io_uring/poll: fix signed comparison in io_poll_get_ownership()
Lorenzo Stoakes (Oracle) (1):
fs: afs: revert mmap_prepare() change
Luca Ceresoli (1):
drm/arcpgu: fix device node leak
Luxiao Xu (1):
net: strparser: fix skb_head leak in strp_abort_strp()
Manish Honap (1):
vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set()
Manivannan Sadhasivam (5):
net: qrtr: ns: Fix use-after-free in driver remove()
net: qrtr: ns: Free the node during ctrl_cmd_bye()
net: qrtr: ns: Limit the maximum server registration per node
net: qrtr: ns: Limit the maximum number of lookups
net: qrtr: ns: Limit the total number of nodes
Marco Elver (2):
slub: fix data loss and overflow in krealloc()
vmalloc: fix buffer overflow in vrealloc_node_align()
Marek Vasut (3):
mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
net: ks8851: Reinstate disabling of BHs around IRQ handler
net: ks8851: Avoid excess softirq scheduling
Masami Hiramatsu (Google) (2):
tracing/fprobe: Reject registration of a registered fprobe before init
ring-buffer: Do not double count the reader_page
Matthew Wilcox (Oracle) (1):
mm: call ->free_folio() directly in folio_unmap_invalidate()
Max Kellermann (1):
ceph: only d_add() negative dentries when they are unhashed
Michael Bommarito (1):
um: drivers: call kernel_strrchr() explicitly in cow_user.c
Michal Pecio (1):
usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
Mickaël Salaün (5):
landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() selftests/landlock: Drain stale audit records on init selftests/landlock: Fix format warning for __u64 in net_test selftests/landlock: Fix snprintf truncation checks in audit helpers selftests/landlock: Skip stale records in audit_match_record()
Miguel Ojeda (1):
kbuild: rust: allow clippy::uninlined_format_args
Ming Qian (1):
media: amphion: Fix race between m2m job_abort and device_run
Miquel Raynal (1):
mtd: spinand: winbond: Declare the QE bit on W25NxxJW
Naman Jain (1):
block: relax pgmap check in bio_add_page for compatible zone device pages
Nathan Chancellor (1):
extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
Oliver Neukum (2):
media: rc: ttusbir: respect DMA coherency rules
media: rc: igorplugusb: heed coherency rules
Paul Louvel (2):
crypto: talitos - fix SEC1 32k ahash request limitation
crypto: talitos - rename first/last to first_desc/last_desc
Pavel Begunkov (1):
io_uring/timeout: check unused sqe fields
Pengpeng Hou (1):
greybus: gb-beagleplay: bound bootloader receive buffering
Prasanna Kumar T S M (2):
vfio/cdx: Fix NULL pointer dereference in interrupt trigger path EDAC/versalnet: Fix memory leak in remove and probe error paths
Qiang Yu (1):
bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
Rafael J. Wysocki (1):
thermal: core: Fix thermal zone governor cleanup issues
Raphael Zimmer (1):
libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
Richard Zhu (1):
PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX
Rick Edgecombe (1):
x86/shstk: Prevent deadlock during shstk sigreturn
Robert Beckett (2):
nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
Robert Marko (1):
arm64: dts: marvell: uDPU: add ethernet aliases
Ronak Raheja (1):
phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE
Rong Bao (1):
perf annotate: Use jump__delete when freeing LoongArch jumps
Rong Zhang (1):
Revert "ALSA: usb: Increase volume range that triggers a warning"
Ruide Cao (1):
ipv4: icmp: validate reply type before using icmp_pointers
Ruijie Li (1):
net/smc: avoid early lgr access in smc_clc_wait_msg
Ryan Roberts (2):
randomize_kstack: Maintain kstack_offset per task
arm64: mm: Fix rodata=full block mapping support for realm guests
Sanjaikumar V S (1):
mtd: spi-nor: sst: Fix write enable before AAI sequence
Sanman Pradhan (3):
hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
Sean Christopherson (5):
KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs
KVM: x86: Defer non-architectural deliver of exception payload to userspace read
KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
KVM: nSVM: Always intercept VMMCALL when L2 is active
Sean Wang (2):
wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
SeongJae Park (3):
mm/damon/core: fix damon_call() vs kdamond_fn() exit race mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bp mm/damon/core: use time_in_range_open() for damos quota window start
Sergey Senozhatsky (1):
zram: do not forget to endio for partial discard requests
Shawn Lin (1):
mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
Shigeru Yoshida (1):
mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
Shuvam Pandey (1):
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
Simon Liebold (1):
selftests/mqueue: Fix incorrectly named file
Sohei Koyama (1):
ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
Spencer Payton (1):
ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx
Steven Rostedt (1):
ktest: Fix the month in the name of the failure directory
Swamil Jain (1):
dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints
Takashi Iwai (5):
ALSA: usb-audio: Evaluate packsize caps at the right place
ALSA: core: Fix potential data race at fasync handling
ALSA: caiaq: Handle probe errors properly
ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
ALSA: caiaq: Don't abort when no input device is available
Tao Cui (1):
LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()
Thomas Fourier (1):
crypto: hisilicon - Fix dma_unmap_single() direction
Thomas Zimmermann (2):
firmware: google: framebuffer: Do not mark framebuffer as busy
firmware: google: framebuffer: Do not unregister platform device
Thorsten Blum (11):
crypto: atmel-sha204a - Fix OTP sysfs read and error handling
ALSA: aoa: Skip devices with no codecs in i2sbus_resume() mm/hugetlb: fix early boot crash on parameters without '=' separator
crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
crypto: atmel-ecc - Release client on allocation failure
crypto: atmel-tdes - fix DMA sync direction
crypto: atmel-sha204a - Fix error codes in OTP reads
crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
crypto: nx - fix context leak in nx842_crypto_free_ctx
Tiezhu Yang (1):
drm/amd: Fix set but not used warnings
Tobias Gaertner (2):
ntfs3: add buffer boundary checks to run_unpack()
ntfs3: fix integer overflow in run_unpack() volume boundary check
Tommaso Merciai (1):
reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime
Tushar Sariya (1):
NFSv4.1: Apply session size limits on clone path
Tyllis Xu (3):
misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
ibmasm: fix OOB reads in command_file_write due to missing size checks
ibmasm: fix heap over-read in ibmasm_send_i2o_message()
Uladzislau Rezki (Sony) (1):
mm/vmalloc: take vmap_purge_lock in shrinker
Usama Arif (1):
mm: migrate: requeue destination folio on deferred split queue
Vasiliy Kovalev (1):
ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
Viorel Suman (OSS) (1):
pwm: imx-tpm: Count the number of enabled channels in probe
Weigang He (1):
greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
Wentao Liang (2):
of: unittest: fix use-after-free in of_unittest_changeset()
of: unittest: fix use-after-free in testdrv_probe()
Xu Yang (2):
usb: chipidea: otg: not wait vbus drop if use role_switch
usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
Yang Xiuwei (1):
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
Yi Cong (1):
wifi: rtl8xxxu: fix potential use of uninitialized value
Yiyang Chen (2):
tools/accounting: handle truncated taskstats netlink messages
taskstats: set version in TGID exit notifications
Yosry Ahmed (20):
KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
KVM: SVM: Switch svm_copy_lbrs() to a macro
KVM: SVM: Add missing save/restore handling of LBR MSRs
KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper
KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper
KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT
KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE
KVM: nSVM: Add missing consistency check for nCR3 validity
Yu Kuai (2):
md/md-llbitmap: skip reading rdevs that are not in_sync md/md-llbitmap: raise barrier before state machine transition
Yuan Zhaoming (1):
net: mctp: fix don't require received header reserved bits to be zero
Yucheng Lu (1):
crypto: authencesn - reject short ahash digests during instance creation
Zhang Yi (1):
jbd2: fix deadlock in jbd2_journal_cancel_revoke()
Zhengchuan Liang (2):
net: caif: clear client service pointer on teardown
net: bridge: use a stable FDB dst snapshot in RCU readers
Zhenzhong Wu (1):
tcp: call sk_data_ready() after listener migration
Ziqing Chen (1):
ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
hkbinbin (1):
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
Greg Kroah-Hartman
maintainerDocumentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml +52 -18
@@ -36,34 +36,50 @@ properties: reg: description: Addresses to each DSS memory region described in the SoC's TRM. - items: - - description: common DSS register area - - description: VIDL1 light video plane - - description: VID video plane - - description: OVR1 overlay manager for vp1 - - description: OVR2 overlay manager for vp2 - - description: VP1 video port 1 - - description: VP2 video port 2 - - description: common1 DSS register area + oneOf: + - items: + - description: common DSS register area + - description: VIDL1 light video plane + - description: VID video plane + - description: OVR1 overlay manager for vp1 + - description: OVR2 overlay manager for vp2 + - description: VP1 video port 1 + - description: VP2 video port 2 + - description: common1 DSS register area + - items: + - description: common DSS register area + - description: VIDL1 light video plane + - description: OVR1 overlay manager for vp1 + - description: VP1 video port 1 + - description: common1 DSS register area reg-names: - items: - - const: common - - const: vidl1 - - const: vid - - const: ovr1 - - const: ovr2 - - const: vp1 - - const: vp2 - - const: common1 + oneOf: + - items: + - const: common + - const: vidl1 + - const: vid + - const: ovr1 + - const: ovr2 + - const: vp1 + - const: vp2 + - const: common1 + - items: + - const: common + - const: vidl1 + - const: ovr1 + - const: vp1 + - const: common1 clocks: + minItems: 2 items: - description: fck DSS functional clock - description: vp1 Video Port 1 pixel clock - description: vp2 Video Port 2 pixel clock clock-names: + minItems: 2 items: - const: fck - const: vp1
@@ -180,6 +196,24 @@ allOf: ports: properties: port@1: false + reg: + maxItems: 5 + reg-names: + maxItems: 5 + clocks: + maxItems: 2 + clock-names: + maxItems: 2 + else: + properties: + reg: + minItems: 8 + reg-names: + minItems: 8 + clocks: + minItems: 3 + clock-names: + minItems: 3 - if: properties:
Documentation/scheduler/sched-ext.rst +7 -5
@@ -321,13 +321,15 @@ by a sched_ext scheduler: ops.dispatch(); /* Task is moved to a local DSQ */ } ops.running(); /* Task starts running on its assigned CPU */ - while (task->scx.slice > 0 && task is runnable) - ops.tick(); /* Called every 1/HZ seconds */ - ops.stopping(); /* Task stops running (time slice expires or wait) */ - /* Task's CPU becomes available */ + while task_is_runnable(p) { + while (task->scx.slice > 0 && task_is_runnable(p)) + ops.tick(); /* Called every 1/HZ seconds */ + + ops.dispatch(); /* task->scx.slice can be refilled */ + } - ops.dispatch(); /* task->scx.slice can be refilled */ + ops.stopping(); /* Task stops running (time slice expires or wait) */ } ops.quiescent(); /* Task releases its assigned CPU (wait) */
Makefile +2 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 18 -SUBLEVEL = 26 +SUBLEVEL = 27 EXTRAVERSION = NAME = Baby Opossum Posse
@@ -492,6 +492,7 @@ export rust_common_flags := --edition=2021 \ -Wclippy::ptr_cast_constness \ -Wclippy::ref_as_ptr \ -Wclippy::undocumented_unsafe_blocks \ + -Aclippy::uninlined_format_args \ -Wclippy::unnecessary_safety_comment \ -Wclippy::unnecessary_safety_doc \ -Wrustdoc::missing_crate_level_docs \
arch/arm/mm/flush.c +3 -1
@@ -304,8 +304,10 @@ void __sync_icache_dcache(pte_t pteval)else mapping =NULL ; -if (!test_and_set_bit (PG_dcache_clean, &folio->flags.f)) +if (!test_bit (PG_dcache_clean, &folio->flags.f)) {__flush_dcache_folio (mapping, folio); +set_bit (PG_dcache_clean, &folio->flags.f); + }if (pte_exec (pteval))__flush_icache_all ();
arch/arm64/boot/dts/marvell/armada-3720-uDPU.dtsi +5 -0
@@ -15,6 +15,11 @@ #include "armada-372x.dtsi" / { + aliases { + ethernet0 = ð0; + ethernet1 = ð1; + }; + chosen { stdout-path = "serial0:115200n8"; };
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +10 -10
@@ -572,16 +572,16 @@ AM62X_IOPAD(0x15c, PIN_INPUT, 0) /* (AB22) MDIO0_MDIO */ /* ETH_1_MDIO, SODIMM /* On-module eMMC */ pinctrl_sdhci0: main-mmc0-default-pins { pinctrl-single,pins = < - AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */ - AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */ - AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */ - AM62X_IOPAD(0x210, PIN_INPUT, 0) /* (AA1) MMC0_DAT1 */ - AM62X_IOPAD(0x20c, PIN_INPUT, 0) /* (AA3) MMC0_DAT2 */ - AM62X_IOPAD(0x208, PIN_INPUT, 0) /* (Y4) MMC0_DAT3 */ - AM62X_IOPAD(0x204, PIN_INPUT, 0) /* (AB2) MMC0_DAT4 */ - AM62X_IOPAD(0x200, PIN_INPUT, 0) /* (AC1) MMC0_DAT5 */ - AM62X_IOPAD(0x1fc, PIN_INPUT, 0) /* (AD2) MMC0_DAT6 */ - AM62X_IOPAD(0x1f8, PIN_INPUT, 0) /* (AC2) MMC0_DAT7 */ + AM62X_IOPAD(0x220, PIN_INPUT, 0) /* (Y3) MMC0_CMD */ + AM62X_IOPAD(0x218, PIN_INPUT, 0) /* (AB1) MMC0_CLK */ + AM62X_IOPAD(0x214, PIN_INPUT, 0) /* (AA2) MMC0_DAT0 */ + AM62X_IOPAD(0x210, PIN_INPUT_PULLUP, 0) /* (AA1) MMC0_DAT1 */ + AM62X_IOPAD(0x20c, PIN_INPUT_PULLUP, 0) /* (AA3) MMC0_DAT2 */ + AM62X_IOPAD(0x208, PIN_INPUT_PULLUP, 0) /* (Y4) MMC0_DAT3 */ + AM62X_IOPAD(0x204, PIN_INPUT_PULLUP, 0) /* (AB2) MMC0_DAT4 */ + AM62X_IOPAD(0x200, PIN_INPUT_PULLUP, 0) /* (AC1) MMC0_DAT5 */ + AM62X_IOPAD(0x1fc, PIN_INPUT_PULLUP, 0) /* (AD2) MMC0_DAT6 */ + AM62X_IOPAD(0x1f8, PIN_INPUT_PULLUP, 0) /* (AC2) MMC0_DAT7 */ >; };
arch/arm64/crypto/aes-modes.S +2 -2
@@ -838,7 +838,7 @@ AES_FUNC_START(aes_mac_update) encrypt_block v0, w2, x1, x7, w8 eor v0.16b, v0.16b, v4.16b cmp w3, wzr - csinv x5, x6, xzr, eq + csinv w5, w6, wzr, eq cbz w5, .Lmacout encrypt_block v0, w2, x1, x7, w8 st1 {v0.16b}, [x4] /* return dg */
@@ -852,7 +852,7 @@ AES_FUNC_START(aes_mac_update) eor v0.16b, v0.16b, v1.16b /* ..and xor with dg */ subs w3, w3, #1 - csinv x5, x6, xzr, eq + csinv w5, w6, wzr, eq cbz w5, .Lmacout .Lmacenc:
arch/arm64/include/asm/mmu.h +2 -0
@@ -112,5 +112,7 @@ void kpti_install_ng_mappings(void);static inline void kpti_install_ng_mappings (void ) {}#endif +extern bool page_alloc_available; +#endif /* !__ASSEMBLY__ */ #endif
arch/arm64/mm/init.c +8 -1
@@ -357,7 +357,6 @@ void __init arch_mm_preinit(void) }swiotlb_init (swiotlb, flags); -swiotlb_update_mem_attributes ();/* * Check boundaries twice: Some fundamental inconsistencies can be
@@ -384,6 +383,14 @@ void __init arch_mm_preinit(void) } } +bool page_alloc_available__ro_after_init ; + +void __init mem_init (void ) +{ + page_alloc_available = true; +swiotlb_update_mem_attributes (); +} +void free_initmem (void ) {void *lm_init_begin =lm_alias (__init_begin);
arch/arm64/mm/mmu.c +57 -35
156 lines not on this page · raw message
arch/loongarch/kernel/cpu-probe.c +7 -0
@@ -7,6 +7,7 @@#include <linux/init.h> #include <linux/kernel.h> #include <linux/ptrace.h> +#include <linux/cpu.h> #include <linux/smp.h> #include <linux/stddef.h> #include <linux/export.h>
@@ -387,3 +388,9 @@ void cpu_probe(void)cpu_report (); } + +ssize_t cpu_show_spectre_v1 (struct device *dev, +struct device_attribute *attr,char *buf) +{ +return sysfs_emit (buf,"Mitigation: __user pointer sanitization\n" ); +}
arch/loongarch/kernel/syscall.c +2 -1
@@ -9,6 +9,7 @@#include <linux/entry-common.h> #include <linux/errno.h> #include <linux/linkage.h> +#include <linux/nospec.h> #include <linux/objtool.h> #include <linux/randomize_kstack.h> #include <linux/syscalls.h>
@@ -61,7 +62,7 @@ void noinstr __no_stack_protector do_syscall(struct pt_regs *regs)add_random_kstack_offset ();if (nr < NR_syscalls) { - syscall_fn = sys_call_table[nr]; + syscall_fn = sys_call_table[array_index_nospec (nr, NR_syscalls)]; regs->regs[4 ] =syscall_fn (regs->orig_a0, regs->regs[5 ], regs->regs[6 ], regs->regs[7 ], regs->regs[8 ], regs->regs[9 ]); }
arch/loongarch/kvm/vcpu.c +1 -1
@@ -375,7 +375,7 @@ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu) val =gcsr_read (LOONGARCH_CSR_CRMD );preempt_enable (); -return (val &CSR_PRMD_PPLV ) ==PLV_KERN ; +return (val &CSR_CRMD_PLV ) ==PLV_KERN ; }#ifdef CONFIG_GUEST_PERF_EVENTS
arch/parisc/Kconfig +3 -0
@@ -129,6 +129,9 @@ config GENERIC_BUG config GENERIC_BUG_RELATIVE_POINTERS bool +config GENERIC_CSUM + def_bool y + config GENERIC_HWEIGHT bool default y
arch/parisc/include/asm/checksum.h +2 -87
101 lines not on this page · raw message
arch/parisc/kernel/syscalls/syscall.tbl +1 -1
@@ -154,7 +154,7 @@ # 137 was afs_syscall 138 common setfsuid sys_setfsuid 139 common setfsgid sys_setfsgid -140 common _llseek sys_llseek +140 32 _llseek sys_llseek 141 common getdents sys_getdents compat_sys_getdents 142 common _newselect sys_select compat_sys_select 143 common flock sys_flock
arch/parisc/lib/Makefile +1 -1
@@ -3,7 +3,7 @@ # Makefile for parisc-specific library files # -lib-y := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \ +lib-y := lusercopy.o bitops.o io.o memset.o memcpy.o \ ucmpdi2.o delay.o obj-y := iomap.o
arch/parisc/lib/checksum.c deleted +0 -99
99 lines not on this page · raw message
arch/um/drivers/cow_user.c +7 -1
@@ -15,6 +15,12 @@#include "cow.h" #include "cow_sys.h" +/* +* arch/um/Makefile remaps strrchr to kernel_strrchr; call the kernel +* name directly to avoid glibc >= 2.43's C23 strrchr macro. +*/ +char *kernel_strrchr (const char *,int ); +#define PATH_LEN_V1 256/* unsigned time_t works until year 2106 */
@@ -153,7 +159,7 @@ static int absolutize(char *to, int size, char *from) errno);return -1 ; } - slash =strrchr (from,'/' ); + slash =kernel_strrchr (from,'/' );if (slash !=NULL ) { *slash ='\0' ;if (chdir (from)) {
arch/x86/Kconfig +1 -0
@@ -1877,6 +1877,7 @@ config X86_USER_SHADOW_STACK bool "X86 userspace shadow stack" depends on AS_WRUSS depends on X86_64 + depends on PER_VMA_LOCK select ARCH_USES_HIGH_VMA_FLAGS select ARCH_HAS_USER_SHADOW_STACK select X86_CET
arch/x86/kernel/shstk.c +24 -20
69 lines not on this page · raw message
arch/x86/kvm/hyperv.h +0 -8
@@ -305,14 +305,6 @@ static inline bool kvm_hv_has_stimer_pending(struct kvm_vcpu *vcpu) {return false; } -static inline bool kvm_hv_is_tlb_flush_hcall (struct kvm_vcpu *vcpu) -{ -return false; -} -static inline bool guest_hv_cpuid_has_l2_tlb_flush (struct kvm_vcpu *vcpu) -{ -return false; -}static inline int kvm_hv_verify_vp_assist (struct kvm_vcpu *vcpu) {return 0 ;
arch/x86/kvm/svm/hyperv.h +8 -1
@@ -41,10 +41,17 @@ static inline bool nested_svm_l2_tlb_flush_enabled(struct kvm_vcpu *vcpu) return hv_vcpu->vp_assist_page.nested_control.features.directhypercall; } +static inline bool nested_svm_is_l2_tlb_flush_hcall (struct kvm_vcpu *vcpu) +{ +return guest_hv_cpuid_has_l2_tlb_flush (vcpu) && +nested_svm_l2_tlb_flush_enabled (vcpu) && +kvm_hv_is_tlb_flush_hcall (vcpu); +} +void svm_hv_inject_synthetic_vmexit_post_tlb_flush (struct kvm_vcpu *vcpu);#else /* CONFIG_KVM_HYPERV */ static inline void nested_svm_hv_update_vm_vp_ids (struct kvm_vcpu *vcpu) {} -static inline bool nested_svm_l2_tlb_flush_enabled (struct kvm_vcpu *vcpu) +static inline bool nested_svm_is_l2_tlb_flush_hcall (struct kvm_vcpu *vcpu) {return false; }
arch/x86/kvm/svm/nested.c +114 -81
380 lines not on this page · raw message
arch/x86/kvm/svm/svm.c +122 -17
219 lines not on this page · raw message
arch/x86/kvm/svm/svm.h +10 -1
@@ -142,6 +142,7 @@ struct kvm_vmcb_info { };struct vmcb_save_area_cached { +struct vmcb_seg cs;u64 efer;u64 cr4;u64 cr3;
@@ -688,8 +689,16 @@ static inline void *svm_vcpu_alloc_msrpm(void)return svm_alloc_permissions_map (MSRPM_SIZE ,GFP_KERNEL_ACCOUNT ); } +#define svm_copy_lbrs (to, from) \ +do { \ + (to)->dbgctl = (from)->dbgctl; \ + (to)->br_from = (from)->br_from; \ + (to)->br_to = (from)->br_to; \ + (to)->last_excp_from = (from)->last_excp_from; \ + (to)->last_excp_to = (from)->last_excp_to; \ +} while (0) +void svm_vcpu_free_msrpm (void *msrpm); -void svm_copy_lbrs (struct vmcb *to_vmcb,struct vmcb *from_vmcb);void svm_enable_lbrv (struct kvm_vcpu *vcpu);void svm_update_lbrv (struct kvm_vcpu *vcpu);
arch/x86/kvm/x86.c +42 -23
108 lines not on this page · raw message
arch/x86/mm/pti.c +5 -0
@@ -105,6 +105,11 @@ void __init pti_check_boottime_disable(void)pr_debug ("PTI enabled, disabling INVLPGB\n" );setup_clear_cpu_cap (X86_FEATURE_INVLPGB ); } + +if (cpu_feature_enabled (X86_FEATURE_FRED )) { +pr_debug ("PTI enabled, disabling FRED\n" ); +setup_clear_cpu_cap (X86_FEATURE_FRED ); + } }static int __init pti_parse_cmdline (char *arg)
block/bio-integrity.c +3 -3
@@ -128,10 +128,10 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,if (bip->bip_vcnt >0 ) {struct bio_vec *bv = &bip->bip_vec[bip->bip_vcnt -1 ]; -if (!zone_device_pages_have_same_pgmap (bv->bv_page, page)) +if (!zone_device_pages_compatible (bv->bv_page, page))return 0 ; - -if (bvec_try_merge_hw_page (q, bv, page, len, offset)) { +if (zone_device_pages_have_same_pgmap (bv->bv_page, page) && +bvec_try_merge_hw_page (q, bv, page, len, offset)) { bip->bip_iter.bi_size += len;return len; }
block/bio.c +3 -3
@@ -1030,10 +1030,10 @@ int bio_add_page(struct bio *bio, struct page *page,if (bio->bi_vcnt >0 ) {struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt -1 ]; -if (!zone_device_pages_have_same_pgmap (bv->bv_page, page)) +if (!zone_device_pages_compatible (bv->bv_page, page))return 0 ; - -if (bvec_try_merge_page (bv, page, len, offset)) { +if (zone_device_pages_have_same_pgmap (bv->bv_page, page) && +bvec_try_merge_page (bv, page, len, offset)) { bio->bi_iter.bi_size += len;return len; }
block/blk-zoned.c +8 -4
@@ -801,13 +801,17 @@ static void disk_zone_wplug_schedule_bio_work(struct gendisk *disk, struct blk_zone_wplug *zwplug) {/* -* Take a reference on the zone write plug and schedule the submission -* of the next plugged BIO. blk_zone_wplug_bio_work() will release the -* reference we take here. +* Schedule the submission of the next plugged BIO. Taking a reference +* to the zone write plug is required as the bio_work belongs to the +* plug, and thus we must ensure that the write plug does not go away +* while the work is being scheduled but has not run yet. +* blk_zone_wplug_bio_work() will release the reference we take here, +* and we also drop this reference if the work is already scheduled. */ WARN_ON_ONCE (!(zwplug->flags &BLK_ZONE_WPLUG_PLUGGED ));refcount_inc (&zwplug->ref); -queue_work (disk->zone_wplugs_wq, &zwplug->bio_work); +if (!queue_work (disk->zone_wplugs_wq, &zwplug->bio_work)) +disk_put_zone_wplug (zwplug); } static inline void disk_zone_wplug_add_bio(struct gendisk *disk,
block/blk.h +19 -0
@@ -139,6 +139,25 @@ static inline bool biovec_phys_mergeable(struct request_queue *q,return true; } +/* +* Check if two pages from potentially different zone device pgmaps can +* coexist as separate bvec entries in the same bio. +* +* The block DMA iterator (blk_dma_map_iter_start) caches the P2PDMA mapping +* state from the first segment and applies it to all subsequent segments, so +* P2PDMA pages from different pgmaps must not be mixed in the same bio. +* +* Other zone device types (FS_DAX, GENERIC) use the same dma_map_phys() path +* as normal RAM. PRIVATE and COHERENT pages never appear in bios. +*/ +static inline bool zone_device_pages_compatible (const struct page *a, +const struct page *b) +{ +if (is_pci_p2pdma_page (a) ||is_pci_p2pdma_page (b)) +return zone_device_pages_have_same_pgmap (a, b); +return true; +} +static inline bool __bvec_gap_to_prev (const struct queue_limits *lim,struct bio_vec *bprv,unsigned int offset) {
certs/extract-cert.c +5 -1
@@ -43,7 +43,9 @@ void format(void)exit (2 ); } +#ifdef USE_PKCS11_ENGINE static const char *key_pass; +#endif static BIO *wb;static char *cert_dst;static bool verbose;
@@ -135,7 +137,9 @@ int main(int argc, char **argv)if (verbose_env &&strchr (verbose_env,'1' )) verbose = true; - key_pass =getenv ("KBUILD_SIGN_PIN" ); +#ifdef USE_PKCS11_ENGINE + key_pass =getenv ("KBUILD_SIGN_PIN" ); +#endif if (argc !=3 )format ();
crypto/acompress.c +3 -5
@@ -171,15 +171,13 @@ static void acomp_save_req(struct acomp_req *req, crypto_completion_t cplt) state->compl = req->base.complete; state->data = req->base.data; req->base.complete = cplt; - req->base.data = state; + req->base.data = req; }static void acomp_restore_req (struct acomp_req *req) { -struct acomp_req_chain *state = req->base.data; - - req->base.complete = state->compl; - req->base.data = state->data; + req->base.complete = req->chain.compl; + req->base.data = req->chain.data; }static void acomp_reqchain_virt (struct acomp_req *req)
crypto/algif_aead.c +8 -2
@@ -72,8 +72,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,struct af_alg_ctx *ctx = ask->private;struct crypto_aead *tfm = pask->private;unsigned int as =crypto_aead_authsize (tfm); +unsigned int ivsize =crypto_aead_ivsize (tfm);struct af_alg_async_req *areq;struct scatterlist *rsgl_src, *tsgl_src =NULL ; +void *iv;int err =0 ;size_t used =0 ;/* [in] TX bufs to be en/decrypted */ size_t outlen =0 ;/* [out] RX bufs produced by kernel */
@@ -125,10 +127,14 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,/* Allocate cipher request for current operation. */ areq =af_alg_alloc_areq (sk,sizeof (struct af_alg_async_req ) + -crypto_aead_reqsize (tfm)); +crypto_aead_reqsize (tfm) + ivsize);if (IS_ERR (areq))return PTR_ERR (areq); + iv = (u8 *)aead_request_ctx (&areq->cra_u.aead_req) + +crypto_aead_reqsize (tfm); +memcpy (iv, ctx->iv, ivsize); +/* convert iovecs of output buffers into RX SGL */ err =af_alg_get_rsgl (sk, msg, flags, areq, outlen, &usedpages);if (err)
@@ -187,7 +193,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,/* Initialize the crypto operation */ aead_request_set_crypt (&areq->cra_u.aead_req, tsgl_src, - areq->first_rsgl.sgl.sgt.sgl, used, ctx->iv); + areq->first_rsgl.sgl.sgt.sgl, used, iv);aead_request_set_ad (&areq->cra_u.aead_req, ctx->aead_assoclen);aead_request_set_tfm (&areq->cra_u.aead_req, tfm);
crypto/authencesn.c +5 -0
@@ -390,6 +390,11 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, auth =crypto_spawn_ahash_alg (&ctx->auth); auth_base = &auth->base; +if (auth->digestsize >0 && auth->digestsize <4 ) { + err = -EINVAL ; + goto err_free_inst; + } + err =crypto_grab_skcipher (&ctx->enc,aead_crypto_instance (inst),crypto_attr_alg_name (tb[2 ]),0 , mask);if (err)
crypto/pcrypt.c +5 -2
@@ -69,6 +69,9 @@ static void pcrypt_aead_done(void *data, int err)struct pcrypt_request *preq =aead_request_ctx (req);struct padata_priv *padata =pcrypt_request_padata (preq); +if (err == -EINPROGRESS ) +return ; + padata->info = err;padata_do_serial (padata);
@@ -82,7 +85,7 @@ static void pcrypt_aead_enc(struct padata_priv *padata) ret =crypto_aead_encrypt (req); -if (ret == -EINPROGRESS ) +if (ret == -EINPROGRESS || ret == -EBUSY )return ; padata->info = ret;
@@ -133,7 +136,7 @@ static void pcrypt_aead_dec(struct padata_priv *padata) ret =crypto_aead_decrypt (req); -if (ret == -EINPROGRESS ) +if (ret == -EINPROGRESS || ret == -EBUSY )return ; padata->info = ret;
drivers/base/core.c +27 -12
@@ -182,7 +182,7 @@ void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode)if (fwnode->dev)return ; - fwnode->flags |=FWNODE_FLAG_NOT_DEVICE ; +fwnode_set_flag (fwnode,FWNODE_FLAG_NOT_DEVICE );fwnode_links_purge_consumers (fwnode);fwnode_for_each_available_child_node (fwnode, child)
@@ -228,7 +228,7 @@ static void __fw_devlink_pickup_dangling_consumers(struct fwnode_handle *fwnode,if (fwnode->dev && fwnode->dev->bus)return ; - fwnode->flags |=FWNODE_FLAG_NOT_DEVICE ; +fwnode_set_flag (fwnode,FWNODE_FLAG_NOT_DEVICE );__fwnode_links_move_consumers (fwnode, new_sup);fwnode_for_each_available_child_node (fwnode, child)
@@ -1012,7 +1012,7 @@ static void device_links_missing_supplier(struct device *dev)static bool dev_is_best_effort (struct device *dev) {return (fw_devlink_best_effort && dev->can_match) || - (dev->fwnode && (dev->fwnode->flags &FWNODE_FLAG_BEST_EFFORT )); + (dev->fwnode &&fwnode_test_flag (dev->fwnode,FWNODE_FLAG_BEST_EFFORT )); } static struct fwnode_handle *fwnode_links_check_suppliers(
@@ -1723,11 +1723,11 @@ bool fw_devlink_is_strict(void)static void fw_devlink_parse_fwnode (struct fwnode_handle *fwnode) { -if (fwnode->flags &FWNODE_FLAG_LINKS_ADDED ) +if (fwnode_test_flag (fwnode,FWNODE_FLAG_LINKS_ADDED ))return ;fwnode_call_int_op (fwnode, add_links); - fwnode->flags |=FWNODE_FLAG_LINKS_ADDED ; +fwnode_set_flag (fwnode,FWNODE_FLAG_LINKS_ADDED ); }static void fw_devlink_parse_fwtree (struct fwnode_handle *fwnode)
@@ -1885,7 +1885,7 @@ static bool fwnode_init_without_drv(struct fwnode_handle *fwnode)struct device *dev;bool ret; -if (!(fwnode->flags &FWNODE_FLAG_INITIALIZED )) +if (!fwnode_test_flag (fwnode,FWNODE_FLAG_INITIALIZED ))return false; dev =get_dev_from_fwnode (fwnode);
@@ -2001,10 +2001,10 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,* We aren't trying to find all cycles. Just a cycle between con and * sup_handle. */ -if (sup_handle->flags &FWNODE_FLAG_VISITED ) +if (fwnode_test_flag (sup_handle,FWNODE_FLAG_VISITED ))return false; - sup_handle->flags |=FWNODE_FLAG_VISITED ; +fwnode_set_flag (sup_handle,FWNODE_FLAG_VISITED );/* Termination condition. */ if (sup_handle == con_handle) {
@@ -2074,7 +2074,7 @@ static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle, } out: - sup_handle->flags &= ~FWNODE_FLAG_VISITED ; +fwnode_clear_flag (sup_handle,FWNODE_FLAG_VISITED );put_device (sup_dev);put_device (con_dev);put_device (par_dev);
@@ -2127,7 +2127,7 @@ static int fw_devlink_create_devlink(struct device *con,* When such a flag is set, we can't create device links where P is the * supplier of C as that would delay the probe of C. */ -if (sup_handle->flags &FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD && +if (fwnode_test_flag (sup_handle,FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD ) &&fwnode_is_ancestor_of (sup_handle, con->fwnode))return -EINVAL ;
@@ -2150,7 +2150,7 @@ static int fw_devlink_create_devlink(struct device *con,else flags =FW_DEVLINK_FLAGS_PERMISSIVE ; -if (sup_handle->flags &FWNODE_FLAG_NOT_DEVICE ) +if (fwnode_test_flag (sup_handle,FWNODE_FLAG_NOT_DEVICE )) sup_dev =fwnode_get_next_parent_dev (sup_handle);else sup_dev =get_dev_from_fwnode (sup_handle);
@@ -2162,7 +2162,7 @@ static int fw_devlink_create_devlink(struct device *con,* supplier device indefinitely. */ if (sup_dev->links.status ==DL_DEV_NO_DRIVER && - sup_handle->flags &FWNODE_FLAG_INITIALIZED ) { +fwnode_test_flag (sup_handle,FWNODE_FLAG_INITIALIZED )) {dev_dbg (con,"Not linking %pfwf - dev might never probe\n" , sup_handle);
@@ -3688,6 +3688,21 @@ int device_add(struct device *dev)fw_devlink_link_device (dev); } +/* +* The moment the device was linked into the bus's "klist_devices" in +* bus_add_device() then it's possible that probe could have been +* attempted in a different thread via userspace loading a driver +* matching the device. "ready_to_probe" being unset would have +* blocked those attempts. Now that all of the above initialization has +* happened, unblock probe. If probe happens through another thread +* after this point but before bus_probe_device() runs then it's fine. +* bus_probe_device() -> device_initial_probe() -> __device_attach() +* will notice (under device_lock) that the device is already bound. +*/ +device_lock (dev); +dev_set_ready_to_probe (dev); +device_unlock (dev); +bus_probe_device (dev);/*
drivers/base/dd.c +20 -0
@@ -846,6 +846,26 @@ static int __driver_probe_device(const struct device_driver *drv, struct deviceif (dev->driver)return -EBUSY ; +/* +* In device_add(), the "struct device" gets linked into the subsystem's +* list of devices and broadcast to userspace (via uevent) before we're +* quite ready to probe. Those open pathways to driver probe before +* we've finished enough of device_add() to reliably support probe. +* Detect this and tell other pathways to try again later. device_add() +* itself will also try to probe immediately after setting +* "ready_to_probe". +*/ +if (!dev_ready_to_probe (dev)) +return dev_err_probe (dev, -EPROBE_DEFER ,"Device not ready to probe\n" ); + +/* +* Set can_match = true after calling dev_ready_to_probe(), so +* driver_deferred_probe_add() won't actually add the device to the +* deferred probe list when dev_ready_to_probe() returns false. +* +* When dev_ready_to_probe() returns false, it means that device_add() +* will do another probe() attempt for us. +*/ dev->can_match = true;dev_dbg (dev,"bus: '%s': %s: matched device with driver %s\n" , drv->bus->name, __func__, drv->name);
drivers/block/rbd.c +3 -3
@@ -7165,7 +7165,7 @@ static ssize_t do_rbd_add(const char *buf, size_t count) rc =device_add_disk (&rbd_dev->dev, rbd_dev->disk,NULL );if (rc) - goto err_out_cleanup_disk; + goto err_out_device;spin_lock (&rbd_dev_list_lock);list_add_tail (&rbd_dev->node, &rbd_dev_list);
@@ -7179,8 +7179,8 @@ static ssize_t do_rbd_add(const char *buf, size_t count)module_put (THIS_MODULE );return rc; -err_out_cleanup_disk: -rbd_free_disk (rbd_dev); +err_out_device: +device_del (&rbd_dev->dev); err_out_image_lock:rbd_dev_image_unlock (rbd_dev);rbd_dev_device_release (rbd_dev);
drivers/block/zram/zram_drv.c +2 -1
@@ -2308,7 +2308,7 @@ static void zram_bio_discard(struct zram *zram, struct bio *bio)*/ if (offset) {if (n <= (PAGE_SIZE - offset)) -return ; + goto end_bio; n -= (PAGE_SIZE - offset); index++;
@@ -2323,6 +2323,7 @@ static void zram_bio_discard(struct zram *zram, struct bio *bio) n -=PAGE_SIZE ; } +end_bio:bio_endio (bio); }
drivers/bus/imx-weim.c +1 -1
@@ -332,7 +332,7 @@ static int of_weim_notify(struct notifier_block *nb, unsigned long action,* fw_devlink doesn't skip adding consumers to this * device. */ - rd->dn->fwnode.flags &= ~FWNODE_FLAG_NOT_DEVICE ; +fwnode_clear_flag (&rd->dn->fwnode,FWNODE_FLAG_NOT_DEVICE );if (!of_platform_device_create (rd->dn,NULL , &pdev->dev)) { dev_err(&pdev->dev, "Failed to create child device '%pOF'\n",
drivers/bus/mhi/host/pci_generic.c +1 -1
@@ -1380,7 +1380,7 @@ static int mhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err_unregister; } - err =mhi_sync_power_up (mhi_cntrl); + err =mhi_async_power_up (mhi_cntrl);if (err) {dev_err (&pdev->dev,"failed to power up MHI controller\n" ); goto err_unprepare;
drivers/char/ipmi/ipmi_ssif.c +25 -17
67 lines not on this page · raw message
drivers/char/tpm/tpm-chip.c +1 -1
@@ -283,7 +283,7 @@ static void tpm_dev_release(struct device *dev)kfree (chip->work_space.context_buf);kfree (chip->work_space.session_buf);#ifdef CONFIG_TCG_TPM2_HMAC -kfree (chip->auth); +kfree_sensitive (chip->auth);#endif kfree (chip); }
drivers/char/tpm/tpm2-cmd.c +2 -4
@@ -275,10 +275,8 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) NULL, 0);tpm_buf_append_u16 (&buf, num_bytes); err =tpm_buf_fill_hmac_session (chip, &buf); -if (err) { -tpm_buf_destroy (&buf); -return err; - } +if (err) + goto out; err = tpm_transmit_cmd(chip, &buf, offsetof(struct tpm2_get_random_out,
drivers/char/tpm/tpm2-sessions.c +4 -1
@@ -203,8 +203,10 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name) rc =tpm_buf_read_u16 (&buf, &offset); name_size_alg =name_size (&buf.data[offset]); -if (name_size_alg <0 ) +if (name_size_alg <0 ) { +tpm_buf_destroy (&buf);return name_size_alg; + }if (rc != name_size_alg) {tpm_buf_destroy (&buf);
@@ -217,6 +219,7 @@ static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name) }memcpy (name, &buf.data[offset], rc); +tpm_buf_destroy (&buf);return name_size_alg; }#endif /* CONFIG_TCG_TPM2_HMAC */
drivers/char/tpm/tpm_tis_core.c +10 -1
@@ -472,6 +472,8 @@ static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) status =tpm_tis_status (chip);if (!itpm && (status &TPM_STS_DATA_EXPECT ) ==0 ) { rc = -EIO ; +dev_err (&chip->dev,"TPM_STS_DATA_EXPECT should be set. sts = 0x%08x\n" , + status); goto out_err; } }
@@ -492,6 +494,8 @@ static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) status =tpm_tis_status (chip);if (!itpm && (status &TPM_STS_DATA_EXPECT ) !=0 ) { rc = -EIO ; +dev_err (&chip->dev,"TPM_STS_DATA_EXPECT should be unset. sts = 0x%08x\n" , + status); goto out_err; }
@@ -553,11 +557,16 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)break ; else if (rc != -EAGAIN && rc != -EIO)/* Data transfer failed, not recoverable */ -return rc; + goto out_err;usleep_range (priv->timeout_min, priv->timeout_max); } +if (rc == -EAGAIN || rc == -EIO ) { +dev_err (&chip->dev,"Exhausted %d tpm_tis_send_data retries\n" ,TPM_RETRY ); + goto out_err; + } +/* go and do it */ rc =tpm_tis_write8 (priv,TPM_STS (priv->locality),TPM_STS_GO );if (rc <0 )
drivers/crypto/atmel-aes.c +1 -1
@@ -2131,7 +2131,7 @@ static int atmel_aes_buff_init(struct atmel_aes_dev *dd)static void atmel_aes_buff_cleanup (struct atmel_aes_dev *dd) { -free_page ((unsigned long )dd->buf); +free_pages ((unsigned long )dd->buf,ATMEL_AES_BUFFER_ORDER ); }static int atmel_aes_dma_init (struct atmel_aes_dev *dd)
drivers/crypto/atmel-ecc.c +1 -0
@@ -261,6 +261,7 @@ static int atmel_ecdh_init_tfm(struct crypto_kpp *tfm)if (IS_ERR (fallback)) {dev_err (&ctx->client->dev,"Failed to allocate transformation for '%s': %ld\n" , alg,PTR_ERR (fallback)); +atmel_ecc_i2c_client_free (ctx->client);return PTR_ERR (fallback); }
drivers/crypto/atmel-i2c.c +2 -2
@@ -72,8 +72,8 @@ EXPORT_SYMBOL(atmel_i2c_init_read_config_cmd);int atmel_i2c_init_read_otp_cmd (struct atmel_i2c_cmd *cmd,u16 addr) { -if (addr <0 || addr >OTP_ZONE_SIZE ) -return -1 ; +if (addr >=OTP_ZONE_SIZE /4 ) +return -EINVAL ; cmd->word_addr =COMMAND ; cmd->opcode =OPCODE_READ ;
drivers/crypto/atmel-sha204a.c +21 -16
@@ -15,6 +15,7 @@#include <linux/module.h> #include <linux/scatterlist.h> #include <linux/slab.h> +#include <linux/sysfs.h> #include <linux/workqueue.h> #include "atmel-i2c.h"
@@ -95,19 +96,24 @@ static int atmel_sha204a_rng_read(struct hwrng *rng, void *data, size_t max,static int atmel_sha204a_otp_read (struct i2c_client *client,u16 addr,u8 *otp) {struct atmel_i2c_cmd cmd; -int ret =-1 ; +int ret; -if (atmel_i2c_init_read_otp_cmd (&cmd, addr) <0 ) { + ret =atmel_i2c_init_read_otp_cmd (&cmd, addr); +if (ret <0 ) {dev_err (&client->dev,"failed, invalid otp address %04X\n" , addr);return ret; } ret =atmel_i2c_send_receive (client, &cmd); +if (ret <0 ) { +dev_err (&client->dev,"failed to read otp at %04X\n" , addr); +return ret; + }if (cmd.data[0 ] ==0xff ) {dev_err (&client->dev,"failed, device not ready\n" ); -return -EINVAL ; +return -EIO ; }memcpy (otp, cmd.data+1 ,4 );
@@ -120,21 +126,22 @@ static ssize_t otp_show(struct device *dev, {u16 addr;u8 otp[OTP_ZONE_SIZE ]; -char *str = buf;struct i2c_client *client =to_i2c_client (dev); -int i; +ssize_t len =0 ; +int i, ret; -for (addr =0 ; addr <OTP_ZONE_SIZE /4 ; addr++) { -if (atmel_sha204a_otp_read (client, addr, otp + addr *4 ) <0 ) { +for (addr =0 ; addr <OTP_ZONE_SIZE /4 ; addr++) { + ret =atmel_sha204a_otp_read (client, addr, otp + addr *4 ); +if (ret <0 ) {dev_err (dev,"failed to read otp zone\n" ); -break ; +return ret; } } -for (i =0 ; i < addr*2 ; i++) - str +=sprintf (str,"%02X" , otp[i]); - str +=sprintf (str,"\n" ); -return str - buf; +for (i =0 ; i <OTP_ZONE_SIZE ; i++) + len +=sysfs_emit_at (buf, len,"%02X" , otp[i]); + len +=sysfs_emit_at (buf, len,"\n" ); +return len; }static DEVICE_ATTR_RO (otp);
@@ -191,10 +198,8 @@ static void atmel_sha204a_remove(struct i2c_client *client) {struct atmel_i2c_client_priv *i2c_priv =i2c_get_clientdata (client); -if (atomic_read (&i2c_priv->tfm_count)) { -dev_emerg (&client->dev,"Device is busy, will remove it anyhow\n" ); -return ; - } +devm_hwrng_unregister (&client->dev, &i2c_priv->hwrng); +atmel_i2c_flush_queue ();sysfs_remove_group (&client->dev.kobj, &atmel_sha204a_groups);
drivers/crypto/atmel-tdes.c +4 -4
@@ -294,8 +294,8 @@ static int atmel_tdes_crypt_pdc_stop(struct atmel_tdes_dev *dd)dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE );dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); }else { -dma_sync_single_for_device (dd->dev, dd->dma_addr_out, - dd->dma_size,DMA_FROM_DEVICE ); +dma_sync_single_for_cpu (dd->dev, dd->dma_addr_out, + dd->dma_size,DMA_FROM_DEVICE );/* copy data */ count = atmel_tdes_sg_copy(&dd->out_sg, &dd->out_offset,
@@ -619,8 +619,8 @@ static int atmel_tdes_crypt_dma_stop(struct atmel_tdes_dev *dd)dma_unmap_sg (dd->dev, dd->out_sg,1 ,DMA_FROM_DEVICE );dma_unmap_sg (dd->dev, dd->in_sg,1 ,DMA_TO_DEVICE ); }else { -dma_sync_single_for_device (dd->dev, dd->dma_addr_out, - dd->dma_size,DMA_FROM_DEVICE ); +dma_sync_single_for_cpu (dd->dev, dd->dma_addr_out, + dd->dma_size,DMA_FROM_DEVICE );/* copy data */ count = atmel_tdes_sg_copy(&dd->out_sg, &dd->out_offset,
drivers/crypto/ccree/cc_hash.c +1 -0
@@ -1448,6 +1448,7 @@ static int cc_mac_digest(struct ahash_request *req)if (cc_map_hash_request_final (ctx->drvdata, state, req->src, req->nbytes,1 , flags)) {dev_err (dev,"map_ahash_request_final() failed\n" ); +cc_unmap_result (dev, state, digestsize, req->result);cc_unmap_req (dev, state, ctx);return -ENOMEM ; }
drivers/crypto/hisilicon/sec/sec_algs.c +1 -1
@@ -844,7 +844,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,if (crypto_skcipher_ivsize (atfm))dma_unmap_single (info->dev, sec_req->dma_iv,crypto_skcipher_ivsize (atfm), -DMA_BIDIRECTIONAL ); +DMA_TO_DEVICE ); err_unmap_out_sg:if (split) sec_unmap_sg_on_err(skreq->dst, steps, splits_out,
drivers/crypto/intel/qat/qat_6xxx/adf_drv.c +3 -1
@@ -182,8 +182,10 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)return ret; ret =adf_dev_up (accel_dev, true); -if (ret) +if (ret) { +adf_dev_down (accel_dev);return ret; + } ret =devm_add_action_or_reset (dev, adf_device_down, accel_dev);if (ret)
drivers/crypto/nx/nx-842.c +4 -6
@@ -115,10 +115,7 @@ void *nx842_crypto_alloc_ctx(struct nx842_driver *driver) ctx->sbounce = (u8 *)__get_free_pages (GFP_KERNEL ,BOUNCE_BUFFER_ORDER ); ctx->dbounce = (u8 *)__get_free_pages (GFP_KERNEL ,BOUNCE_BUFFER_ORDER );if (!ctx->wmem || !ctx->sbounce || !ctx->dbounce) { -kfree (ctx->wmem); -free_page ((unsigned long )ctx->sbounce); -free_page ((unsigned long )ctx->dbounce); -kfree (ctx); +nx842_crypto_free_ctx (ctx);return ERR_PTR (-ENOMEM ); }
@@ -131,8 +128,9 @@ void nx842_crypto_free_ctx(void *p)struct nx842_crypto_ctx *ctx = p;kfree (ctx->wmem); -free_page ((unsigned long )ctx->sbounce); -free_page ((unsigned long )ctx->dbounce); +free_pages ((unsigned long )ctx->sbounce,BOUNCE_BUFFER_ORDER ); +free_pages ((unsigned long )ctx->dbounce,BOUNCE_BUFFER_ORDER ); +kfree (ctx); }EXPORT_SYMBOL_GPL (nx842_crypto_free_ctx);
drivers/crypto/nx/nx-842.h +2 -2
@@ -159,7 +159,7 @@ struct nx842_crypto_header_group {struct nx842_crypto_header {/* New members MUST be added within the struct_group() macro below. */ - struct_group_tagged(nx842_crypto_header_hdr, hdr, + __struct_group(nx842_crypto_header_hdr, hdr, __packed, __be16 magic; /* NX842_CRYPTO_MAGIC */__be16 ignore;/* decompressed end bytes to ignore */ u8 groups;/* total groups in this header */
@@ -167,7 +167,7 @@ struct nx842_crypto_header {struct nx842_crypto_header_group group[]; } __packed;static_assert (offsetof(struct nx842_crypto_header , group) ==sizeof (struct nx842_crypto_header_hdr ), -"struct member likely outside of struct_group_tagged()" ); +"struct member likely outside of __struct_group()" );#define NX842_CRYPTO_GROUP_MAX (0x20)
drivers/crypto/talitos.c +166 -88
421 lines not on this page · raw message
drivers/edac/versalnet_edac.c +4 -2
@@ -868,12 +868,12 @@ static void remove_versalnet(struct mc_priv *priv)static int mc_probe (struct platform_device *pdev) { -struct device_node *r5_core_node;struct mc_priv *priv;struct rproc *rp;int rc; - r5_core_node =of_parse_phandle (pdev->dev.of_node,"amd,rproc" ,0 ); + struct device_node *r5_core_node __free(device_node) = +of_parse_phandle (pdev->dev.of_node,"amd,rproc" ,0 );if (!r5_core_node) {dev_err (&pdev->dev,"amd,rproc: invalid phandle\n" );return -EINVAL ;
@@ -917,6 +917,7 @@ static int mc_probe(struct platform_device *pdev) err_init:cdx_mcdi_finish (priv->mcdi); +kfree (priv->mcdi); err_unreg:unregister_rpmsg_driver (&amd_rpmsg_driver);
@@ -938,6 +939,7 @@ static void mc_remove(struct platform_device *pdev)remove_versalnet (priv);rproc_shutdown (priv->mcdi->r5_rproc);cdx_mcdi_finish (priv->mcdi); +kfree (priv->mcdi); }static const struct of_device_id amd_edac_match[] = {
drivers/firmware/google/framebuffer-coreboot.c +1 -11
@@ -67,7 +67,7 @@ static int framebuffer_probe(struct coreboot_device *dev)return -ENODEV ;memset (&res,0 ,sizeof (res)); - res.flags =IORESOURCE_MEM |IORESOURCE_BUSY ; + res.flags =IORESOURCE_MEM ; res.name ="Coreboot Framebuffer" ; res.start = fb->physical_address; length =PAGE_ALIGN (fb->y_resolution * fb->bytes_per_line);
@@ -81,19 +81,10 @@ static int framebuffer_probe(struct coreboot_device *dev) sizeof(pdata));if (IS_ERR (pdev))pr_warn ("coreboot: could not register framebuffer\n" ); -else -dev_set_drvdata (&dev->dev, pdev);return PTR_ERR_OR_ZERO (pdev); } -static void framebuffer_remove (struct coreboot_device *dev) -{ -struct platform_device *pdev =dev_get_drvdata (&dev->dev); - -platform_device_unregister (pdev); -} -static const struct coreboot_device_id framebuffer_ids[] = { { .tag =CB_TAG_FRAMEBUFFER }, {/* sentinel */ }
@@ -102,7 +93,6 @@ MODULE_DEVICE_TABLE(coreboot, framebuffer_ids);static struct coreboot_driver framebuffer_driver = { .probe = framebuffer_probe, - .remove = framebuffer_remove, .drv = { .name ="framebuffer" , },
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c +1 -3
@@ -302,7 +302,6 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset, int pages) {unsigned t; -unsigned p;int i, j;u64 page_base;/* Starting from VEGA10, system bit must be 0 to mean invalid. */
@@ -316,8 +315,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,return ; t = offset /AMDGPU_GPU_PAGE_SIZE ; - p = t /AMDGPU_GPU_PAGES_IN_CPU_PAGE ; -for (i =0 ; i < pages; i++, p++) { +for (i =0 ; i < pages; i++) { page_base = adev->dummy_page_addr;if (!adev->gart.ptr)continue ;
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +3 -0
@@ -75,6 +75,9 @@ static int amdgpu_ttm_init_on_chip(struct amdgpu_device *adev, unsigned int type, uint64_t size_in_page) { +if (!size_in_page) +return 0 ; +return ttm_range_man_init (&adev->mman.bdev, type, false, size_in_page); }
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +4 -2
@@ -100,7 +100,8 @@ #define SOC15_DPG_MODE_OFFSET(ip, inst_idx, reg) \ ({ \ - uint32_t internal_reg_offset, addr; \ + /* To avoid a -Wunused-but-set-variable warning. */ \ + uint32_t internal_reg_offset __maybe_unused, addr; \ bool video_range, video1_range, aon_range, aon1_range; \ \ addr = (adev->reg_offset[ip##_HWIP][inst_idx][reg##_BASE_IDX] + reg); \
@@ -161,7 +162,8 @@ #define SOC24_DPG_MODE_OFFSET(ip, inst_idx, reg) \ ({ \ - uint32_t internal_reg_offset, addr; \ + /* To avoid a -Wunused-but-set-variable warning. */ \ + uint32_t internal_reg_offset __maybe_unused, addr; \ bool video_range, video1_range, aon_range, aon1_range; \ \ addr = (adev->reg_offset[ip##_HWIP][inst_idx][reg##_BASE_IDX] + reg); \
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +46 -6
76 lines not on this page · raw message
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +3 -6
@@ -442,7 +442,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, struint i =0 , k =0 ;int ramp_up_num_steps =1 ;// TODO: Ramp is currently disabled. Reenable it. uint8_t visual_confirm_enabled; -int pipe_idx =0 ;struct dc_stream_status *stream_status =NULL ;if (dc ==NULL )
@@ -457,7 +456,7 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru cmd.fw_assisted_mclk_switch.config_data.visual_confirm_enabled = visual_confirm_enabled;if (should_manage_pstate) { -for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { +for (i =0 ; i < dc->res_pool->pipe_count; i++) {struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];if (!pipe->stream)
@@ -472,7 +471,6 @@ bool dc_dmub_srv_p_state_delegate(struct dc *dc, bool should_manage_pstate, stru cmd.fw_assisted_mclk_switch.config_data.vactive_stretch_margin_us = dc->debug.fpo_vactive_margin_us;break ; } - pipe_idx++; } }
@@ -872,7 +870,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc, bool enable) {uint8_t cmd_pipe_index =0 ; -uint32_t i, pipe_idx; +uint32_t i;uint8_t subvp_count =0 ;union dmub_rb_cmd cmd;struct pipe_ctx *subvp_pipes[2 ];
@@ -899,7 +897,7 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,if (enable) {// For each pipe that is a "main" SUBVP pipe, fill in pipe data for DMUB SUBVP cmd -for (i =0 , pipe_idx =0 ; i < dc->res_pool->pipe_count; i++) { +for (i =0 ; i < dc->res_pool->pipe_count; i++) {struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; pipe_mall_type =dc_state_get_pipe_subvp_type (context, pipe);
@@ -922,7 +920,6 @@ void dc_dmub_setup_subvp_dmub_command(struct dc *dc,populate_subvp_cmd_vblank_pipe_info (dc, context, &cmd, pipe, cmd_pipe_index++); } - pipe_idx++; }if (subvp_count ==2 ) {update_subvp_prefetch_end_to_mall_start (dc, context, &cmd, subvp_pipes);
drivers/gpu/drm/nouveau/nouveau_drm.c +1 -1
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,/* Remove conflicting drivers (vesafb, efifb etc). */ ret =aperture_remove_conflicting_pci_devices (pdev, driver_pci.name);if (ret) -return ret; + goto fail_nvkm;pci_set_master (pdev);
drivers/gpu/drm/nouveau/nouveau_gem.c +1 -1
@@ -686,7 +686,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, } nvbo = (void *)(unsigned long )bo[r->reloc_bo_index].user_priv; -if (unlikely (r->reloc_bo_offset +4 > +if (unlikely ((u64 )r->reloc_bo_offset +4 > nvbo->bo.base.size)) {NV_PRINTK (err, cli,"reloc outside of bo\n" ); ret = -EINVAL ;
drivers/gpu/drm/tiny/arcpgu.c +2 -1
@@ -250,7 +250,8 @@ DEFINE_DRM_GEM_DMA_FOPS(arcpgu_drm_ops);static int arcpgu_load (struct arcpgu_drm_private *arcpgu) {struct platform_device *pdev =to_platform_device (arcpgu->drm.dev); -struct device_node *encoder_node =NULL , *endpoint_node =NULL ; + struct device_node *encoder_node __free(device_node) = NULL; +struct device_node *endpoint_node =NULL ;struct drm_connector *connector =NULL ;struct drm_device *drm = &arcpgu->drm;int ret;
drivers/greybus/gb-beagleplay.c +96 -16
132 lines not on this page · raw message
drivers/iio/frequency/admv1013.c +50 -40
90 lines not on this page · raw message
drivers/md/raid5-cache.c +33 -15
48 lines not on this page · raw message
drivers/media/platform/amphion/vpu_v4l2.c +3 -6
Lines of this file are not shown. View the raw message.
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +1 -0
Lines of this file are not shown. View the raw message.
drivers/misc/mei/hw-me-regs.h +82 -81
163 lines not on this page · raw message
drivers/misc/mei/pci-me.c +105 -104
209 lines not on this page · raw message
drivers/net/ethernet/micrel/ks8851_common.c +30 -39
69 lines not on this page · raw message
drivers/net/ethernet/micrel/ks8851_par.c +6 -9
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/micrel/ks8851_spi.c +4 -7
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/microsoft/mana/mana_en.c +10 -1
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c +2 -0
Lines of this file are not shown. View the raw message.
drivers/net/wireless/marvell/mwifiex/init.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt792x_regs.h +4 -0
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt792x_usb.c +43 -8
51 lines not on this page · raw message
drivers/net/wireless/realtek/rtl8xxxu/core.c +8 -20
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw88/pci.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/pci/controller/cadence/pcie-cadence.h +25 -31
56 lines not on this page · raw message
drivers/pci/endpoint/functions/pci-epf-mhi.c +4 -0
Lines of this file are not shown. View the raw message.
drivers/pci/endpoint/functions/pci-epf-ntb.c +2 -54
56 lines not on this page · raw message
drivers/phy/qualcomm/phy-qcom-m31-eusb2.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/remoteproc/xlnx_r5_remoteproc.c +11 -9
Lines of this file are not shown. View the raw message.
drivers/reset/reset-rzv2h-usb2phy.c +18 -46
64 lines not on this page · raw message
drivers/spi/spi.c +38 -25
63 lines not on this page · raw message
drivers/usb/chipidea/core.c +23 -22
45 lines not on this page · raw message
fs/ocfs2/aops.c +45 -29
74 lines not on this page · raw message
include/linux/device.h +45 -0
45 lines not on this page · raw message
include/linux/fwnode.h +33 -11
44 lines not on this page · raw message
lib/alloc_tag.c +109 -0
109 lines not on this page · raw message
lib/test_hmm.c +49 -37
86 lines not on this page · raw message
mm/damon/core.c +28 -32
60 lines not on this page · raw message
net/qrtr/ns.c +76 -10
86 lines not on this page · raw message
net/rxrpc/conn_event.c +30 -13
43 lines not on this page · raw message
net/rxrpc/rxkad.c +49 -63
112 lines not on this page · raw message
sound/aoa/soundbus/i2sbus/pcm.c +49 -22
71 lines not on this page · raw message
sound/drivers/aloop.c +30 -13
43 lines not on this page · raw message
sound/usb/caiaq/control.c +36 -16
52 lines not on this page · raw message
tools/accounting/getdelays.c +37 -4
41 lines not on this page · raw message
tools/perf/arch/loongarch/annotate/instructions.c +1 -0
Lines of this file are not shown. View the raw message.
tools/testing/selftests/kvm/x86/msrs_test.c +1 -1
Lines of this file are not shown. View the raw message.
tools/testing/selftests/landlock/audit.h +84 -23
107 lines not on this page · raw message
tools/testing/selftests/landlock/audit_test.c +103 -21
124 lines not on this page · raw message
tools/testing/selftests/landlock/net_test.c +1 -1
Lines of this file are not shown. View the raw message.
tools/testing/selftests/landlock/ptrace_test.c +0 -1
Lines of this file are not shown. View the raw message.
tools/testing/selftests/landlock/scoped_abstract_unix_test.c +0 -1
Lines of this file are not shown. View the raw message.
tools/testing/selftests/mqueue/setting deleted +0 -1
Lines of this file are not shown. View the raw message.
tools/testing/selftests/mqueue/settings new file +1 -0
Lines of this file are not shown. View the raw message.
tools/testing/selftests/vfio/lib/vfio_pci_device.c +3 -1
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.