Linux 6.12.109
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.12.109 kernel.
All users of the 6.12 kernel series must upgrade.
The updated 6.12.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/testing/sysfs-bus-nvdimm | 3 Makefile | 2 arch/alpha/include/uapi/asm/fpu.h | 8 arch/alpha/kernel/pci-sysfs.c | 6 arch/alpha/kernel/sys_marvel.c | 25 - arch/alpha/kernel/traps.c | 6 arch/alpha/math-emu/math.c | 88 +++- arch/arm/Kconfig | 2 arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts | 2 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 12 arch/arm64/kernel/compat_alignment.c | 4 arch/openrisc/kernel/entry.S | 43 +- arch/powerpc/platforms/powermac/low_i2c.c | 2 arch/powerpc/platforms/pseries/iommu.c | 23 - arch/riscv/include/asm/acpi.h | 19 arch/s390/kernel/perf_cpum_cf.c | 215 ++++++---- arch/x86/coco/tdx/tdx.c | 10 arch/x86/events/intel/uncore.c | 1 arch/x86/events/intel/uncore_snbep.c | 13 arch/x86/include/asm/insn-eval.h | 36 + arch/x86/include/asm/sev.h | 2 arch/x86/kvm/emulate.c | 26 - arch/x86/net/bpf_jit_comp.c | 2 arch/x86/virt/svm/sev.c | 21 block/blk-sysfs.c | 3 block/genhd.c | 1 drivers/acpi/apei/erst.c | 2 drivers/acpi/apei/ghes.c | 2 drivers/acpi/pfr_update.c | 45 +- drivers/ata/libata-scsi.c | 28 - drivers/auxdisplay/charlcd.c | 21 drivers/base/arch_numa.c | 12 drivers/base/property.c | 19 drivers/bluetooth/btusb.c | 6 drivers/bluetooth/hci_bcm.c | 1 drivers/bluetooth/hci_bcm4377.c | 1 drivers/bluetooth/hci_h5.c | 4 drivers/bluetooth/hci_intel.c | 1 drivers/bluetooth/hci_ldisc.c | 2 drivers/bluetooth/hci_serdev.c | 2 drivers/cdx/cdx.c | 7 drivers/char/ipmi/ipmb_dev_int.c | 5 drivers/char/ipmi/ipmi_msghandler.c | 1 drivers/char/tpm/tpm_i2c_nuvoton.c | 6 drivers/clocksource/timer-sun4i.c | 2 drivers/crypto/allwinner/Kconfig | 16 drivers/crypto/allwinner/sun8i-ce/Makefile | 1 drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 57 -- drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c | 159 ------- drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h | 29 - drivers/crypto/allwinner/sun8i-ss/Makefile | 1 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 39 - drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 177 -------- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 23 - drivers/cxl/core/pmem.c | 10 drivers/cxl/cxl.h | 3 drivers/cxl/pmem.c | 2 drivers/fpga/altera-cvp.c | 10 drivers/fpga/stratix10-soc.c | 21 drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 2 drivers/gpu/drm/nouveau/nouveau_gem.c | 11 drivers/hid/hid-mcp2221.c | 9 drivers/hid/hid-picolcd_debugfs.c | 9 drivers/hid/hid-roccat.c | 13 drivers/hid/hid-sensor-custom.c | 9 drivers/hid/hid-sensor-hub.c | 42 + drivers/hsi/controllers/omap_ssi_core.c | 6 drivers/hwmon/max6621.c | 8 drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 15 drivers/hwtracing/ptt/hisi_ptt.c | 20 drivers/i3c/master.c | 9 drivers/i3c/master/svc-i3c-master.c | 10 drivers/infiniband/core/ucma.c | 5 drivers/infiniband/hw/cxgb4/device.c | 6 drivers/interconnect/core.c | 7 drivers/iommu/amd/init.c | 36 + drivers/iommu/amd/ppr.c | 3 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +- drivers/iommu/intel/dmar.c | 15 drivers/iommu/intel/iommu.c | 8 drivers/iommu/intel/iommu.h | 2 drivers/iommu/iommu-sva.c | 2 drivers/mailbox/qcom-ipcc.c | 17 drivers/md/dm-era-target.c | 5 drivers/md/dm-log-userspace-base.c | 1 drivers/md/dm-stats.c | 6 drivers/md/dm-switch.c | 2 drivers/md/md.c | 15 drivers/md/persistent-data/dm-array.c | 53 ++ drivers/md/raid10.c | 2 drivers/media/cec/platform/stm32/stm32-cec.c | 3 drivers/media/test-drivers/vicodec/vicodec-core.c | 4 drivers/media/v4l2-core/v4l2-dev.c | 14 drivers/mfd/sm501.c | 2 drivers/misc/nsm.c | 2 drivers/mmc/host/via-sdmmc.c | 8 drivers/net/dsa/realtek/rtl83xx.c | 4 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 3 drivers/net/ethernet/nvidia/forcedeth.c | 4 drivers/net/ethernet/qlogic/qede/qede.h | 8 drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 drivers/net/ethernet/renesas/ravb.h | 3 drivers/net/ethernet/renesas/ravb_main.c | 9 drivers/net/ethernet/renesas/ravb_ptp.c | 44 +- drivers/net/ipa/ipa_modem.c | 18 drivers/net/ntb_netdev.c | 11 drivers/net/slip/slip.c | 11 drivers/net/thunderbolt/main.c | 12 drivers/net/tun.c | 21 drivers/net/usb/qmi_wwan.c | 1 drivers/net/wireless/ath/ath11k/mac.c | 28 - drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 16 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 drivers/net/wireless/realtek/rtl8xxxu/core.c | 19 drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c | 12 drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c | 3 drivers/net/wireless/realtek/rtw88/pci.c | 4 drivers/net/wireless/realtek/rtw88/tx.c | 1 drivers/ntb/ntb_transport.c | 38 - drivers/nvdimm/label.c | 2 drivers/nvme/host/core.c | 2 drivers/nvme/host/fc.c | 2 drivers/nvme/host/pci.c | 1 drivers/nvme/host/tcp.c | 45 ++ drivers/of/base.c | 2 drivers/pci/controller/dwc/pci-meson.c | 2 drivers/pci/controller/pci-hyperv.c | 1 drivers/pci/controller/plda/pcie-plda-host.c | 52 +- drivers/pci/msi/msi.c | 10 drivers/pci/pci-sysfs.c | 4 drivers/pci/proc.c | 16 drivers/pci/quirks.c | 6 drivers/platform/chrome/cros_ec_sensorhub_ring.c | 19 drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 18 drivers/platform/x86/hp/hp-bioscfg/bioscfg.h | 8 drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c | 15 drivers/platform/x86/hp/hp-bioscfg/int-attributes.c | 6 drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c | 14 drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c | 14 drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 4 drivers/platform/x86/hp/hp-bioscfg/string-attributes.c | 6 drivers/platform/x86/intel/ishtp_eclite.c | 5 drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 77 +++ drivers/power/supply/bq24257_charger.c | 16 drivers/power/supply/bq256xx_charger.c | 29 - drivers/power/supply/bq25890_charger.c | 12 drivers/power/supply/charger-manager.c | 54 +- drivers/power/supply/cros_usbpd-charger.c | 17 drivers/power/supply/lp8727_charger.c | 4 drivers/power/supply/lp8788-charger.c | 2 drivers/power/supply/max17040_battery.c | 32 + drivers/power/supply/qcom_battmgr.c | 2 drivers/power/supply/rt9455_charger.c | 21 drivers/power/supply/twl4030_charger.c | 12 drivers/power/supply/ucs1002_power.c | 6 drivers/rapidio/devices/rio_mport_cdev.c | 10 drivers/regulator/as3722-regulator.c | 1 drivers/regulator/max8998.c | 1 drivers/regulator/qcom-refgen-regulator.c | 4 drivers/remoteproc/mtk_scp.c | 9 drivers/rpmsg/qcom_glink_smem.c | 7 drivers/s390/block/dasd.c | 6 drivers/s390/block/dasd_eckd.c | 40 + drivers/s390/block/dasd_erp.c | 3 drivers/scsi/scsi_lib.c | 2 drivers/staging/greybus/hid.c | 2 drivers/staging/media/tegra-video/vi.c | 9 drivers/staging/media/tegra-video/vip.c | 10 drivers/tty/serial/imx.c | 20 drivers/usb/dwc2/gadget.c | 11 drivers/usb/gadget/function/f_fs.c | 14 drivers/usb/gadget/function/f_midi2.c | 2 drivers/usb/gadget/function/f_tcm.c | 23 - drivers/usb/gadget/function/f_uvc.c | 7 drivers/usb/gadget/function/u_audio.c | 24 - drivers/usb/gadget/udc/at91_udc.c | 20 drivers/usb/gadget/udc/snps_udc_plat.c | 5 drivers/usb/phy/phy-fsl-usb.c | 52 +- drivers/usb/phy/phy-fsl-usb.h | 6 drivers/usb/typec/tcpm/tcpci.c | 12 drivers/usb/typec/ucsi/ucsi.c | 3 drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 drivers/video/fbdev/pvr2fb.c | 4 drivers/video/fbdev/ssd1307fb.c | 72 +++ drivers/video/fbdev/uvesafb.c | 2 drivers/video/sticore.c | 22 - drivers/w1/slaves/w1_ds28e17.c | 8 fs/backing-file.c | 2 fs/btrfs/relocation.c | 31 + fs/ceph/caps.c | 11 fs/ceph/dir.c | 10 fs/ceph/export.c | 26 - fs/ceph/mds_client.c | 8 fs/ceph/mdsmap.c | 11 fs/ceph/xattr.c | 1 fs/ecryptfs/crypto.c | 2 fs/ecryptfs/ecryptfs_kernel.h | 3 fs/ecryptfs/keystore.c | 45 +- fs/ecryptfs/messaging.c | 11 fs/ecryptfs/miscdev.c | 5 fs/ecryptfs/super.c | 7 fs/efivarfs/super.c | 30 + fs/f2fs/compress.c | 1 fs/f2fs/data.c | 10 fs/fat/misc.c | 4 fs/jbd2/checkpoint.c | 28 - fs/lockd/clntproc.c | 3 fs/lockd/svcsubs.c | 55 +- fs/nfs/pnfs.c | 3 fs/nfsd/filecache.c | 15 fs/nfsd/flexfilelayoutxdr.c | 20 fs/nfsd/nfs2acl.c | 52 +- fs/nfsd/nfs3acl.c | 17 fs/nfsd/nfs3proc.c | 40 + fs/nfsd/nfs4layouts.c | 12 fs/nfsd/nfs4proc.c | 51 +- fs/nfsd/nfs4state.c | 211 +++++++-- fs/nfsd/nfs4xdr.c | 22 - fs/nfsd/nfscache.c | 6 fs/nfsd/nfsctl.c | 11 fs/nfsd/nfsfh.c | 12 fs/nfsd/nfsproc.c | 7 fs/nfsd/nfssvc.c | 4 fs/nfsd/nfsxdr.c | 32 + fs/nfsd/trace.h | 4 fs/nfsd/vfs.c | 34 - fs/nilfs2/bmap.c | 2 fs/nilfs2/bmap.h | 2 fs/nilfs2/btree.c | 39 + fs/nilfs2/direct.c | 4 fs/ntfs3/frecord.c | 9 fs/ntfs3/fslog.c | 34 + fs/ocfs2/cluster/heartbeat.c | 148 +++++- fs/ocfs2/cluster/nodemanager.c | 6 fs/ocfs2/cluster/nodemanager.h | 1 fs/ocfs2/dir.c | 2 fs/ocfs2/dlm/dlmmaster.c | 6 fs/ocfs2/dlm/dlmrecovery.c | 9 fs/ocfs2/refcounttree.c | 47 +- fs/ocfs2/xattr.c | 5 fs/orangefs/devorangefs-req.c | 1 fs/orangefs/orangefs-debugfs.c | 1 fs/proc/task_mmu.c | 15 fs/smb/client/cifsfs.c | 15 fs/smb/client/dfs_cache.c | 33 + fs/smb/client/smb1ops.c | 2 fs/smb/client/smb2file.c | 5 fs/tracefs/event_inode.c | 7 fs/ubifs/auth.c | 2 fs/udf/inode.c | 2 fs/udf/partition.c | 2 include/linux/amd-iommu.h | 4 include/linux/hugetlb.h | 2 include/linux/list.h | 15 include/linux/mm_types.h | 3 include/linux/sunrpc/svc_rdma_pcl.h | 2 include/linux/swapops.h | 12 include/linux/usb/tcpci.h | 1 include/net/ip_tunnels.h | 11 include/net/sctp/structs.h | 2 kernel/auditfilter.c | 6 kernel/bpf/bloom_filter.c | 19 kernel/bpf/stackmap.c | 3 kernel/params.c | 14 kernel/sched/cpufreq_schedutil.c | 15 kernel/signal.c | 4 kernel/taskstats.c | 3 kernel/time/itimer.c | 2 kernel/time/timer.c | 1 kernel/trace/ring_buffer.c | 166 ++++--- kernel/trace/trace.c | 6 kernel/trace/trace_events.c | 2 kernel/trace/trace_events_hist.c | 4 kernel/trace/trace_events_user.c | 3 lib/ucs2_string.c | 2 lib/xarray.c | 3 mm/huge_memory.c | 4 mm/kasan/quarantine.c | 7 mm/kmemleak.c | 51 +- mm/memcontrol.c | 6 mm/memory.c | 49 +- mm/mempolicy.c | 21 mm/migrate.c | 2 mm/page_table_check.c | 12 mm/rmap.c | 60 ++ mm/vmscan.c | 2 mm/zsmalloc.c | 11 mm/zswap.c | 13 net/bluetooth/eir.c | 3 net/bluetooth/hci_conn.c | 3 net/bluetooth/hci_core.c | 2 net/bluetooth/hci_event.c | 7 net/bluetooth/hci_sync.c | 2 net/bluetooth/iso.c | 8 net/bluetooth/rfcomm/core.c | 8 net/ceph/osd_client.c | 30 + net/ceph/osdmap.c | 2 net/core/skbuff.c | 5 net/core/xdp.c | 4 net/ipv4/ip_tunnel.c | 2 net/ipv4/ipip.c | 2 net/ipv6/ip6_gre.c | 14 net/ipv6/ip6_tunnel.c | 22 - net/ipv6/route.c | 2 net/ipv6/seg6_local.c | 9 net/ipv6/sit.c | 2 net/iucv/af_iucv.c | 2 net/l2tp/l2tp_netlink.c | 16 net/mpls/af_mpls.c | 2 net/mptcp/syncookies.c | 1 net/openvswitch/conntrack.c | 8 net/openvswitch/datapath.c | 48 +- net/sched/sch_generic.c | 2 net/sctp/inqueue.c | 7 net/sctp/sm_sideeffect.c | 4 net/sctp/stream.c | 48 +- net/smc/af_smc.c | 3 net/smc/smc_core.c | 27 - net/smc/smc_rx.c | 11 net/smc/smc_tx.h | 6 net/sunrpc/auth_gss/auth_gss.c | 6 net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 net/sunrpc/auth_gss/gss_rpc_xdr.c | 6 net/sunrpc/auth_gss/svcauth_gss.c | 8 net/sunrpc/cache.c | 7 net/sunrpc/sunrpc_syms.c | 1 net/sunrpc/svc.c | 74 +++ net/sunrpc/xdr.c | 2 net/sunrpc/xprtrdma/ib_client.c | 24 + net/sunrpc/xprtrdma/svc_rdma_rw.c | 47 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 47 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 44 +- net/sunrpc/xprtsock.c | 12 net/vmw_vsock/virtio_transport.c | 2 scripts/rust_is_available.sh | 14 scripts/rust_is_available_bindgen_libclang_22.h | 5 scripts/rust_is_available_test.py | 30 + security/apparmor/include/cred.h | 6 security/apparmor/include/label.h | 6 security/apparmor/include/task.h | 15 security/apparmor/task.c | 27 + security/smack/smack_lsm.c | 2 sound/core/ump_convert.c | 1 sound/drivers/aloop.c | 6 sound/drivers/mpu401/mpu401.c | 6 sound/drivers/mts64.c | 6 sound/drivers/portman2x4.c | 6 sound/drivers/serial-u16550.c | 6 sound/drivers/virmidi.c | 6 sound/pci/pcxhr/pcxhr.c | 14 sound/soc/amd/yc/acp6x-mach.c | 7 sound/usb/6fire/comm.c | 9 sound/usb/bcd2000/bcd2000.c | 11 tools/include/linux/compiler.h | 2 tools/testing/selftests/kvm/x86_64/sev_migrate_tests.c | 2 370 files changed, 3741 insertions(+), 1867 deletions(-)
Abdun Nihaal (4):
mfd: sm501: Fix potential memory leaks during remove
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Abdurrahman Hussain (1):
of: fix out-of-bounds read in of_alias_scan() stem parser
Adrian Hunter (1):
i3c: master: Fix info leak and UAF in device unregister path
Ahmad Fatoum (1):
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
Aleksandr Khromov (1):
slip: fix use-after-free in sl_sync()
Alexandra Winter (1):
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Ali Ahmet Memis (1):
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Ali Tariq (2):
PCI: plda: Fix use-after-free of event IRQs during teardown
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
Alison Schofield (1):
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Anirudh Prasad (1):
ACPI: pfr_update: fix stack buffer overflow in query_capability()
Anton Danilov (1):
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
Anup Vishwakarma (1):
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
Ard Biesheuvel (1):
efivarfs: Rate limit statfs() handler
Ashish Kalra (1):
x86/sev: Fix broken SNP support with KVM module built-in
Asim Viladi Oglu Manizada (1):
net: tun: bound receive headroom
Baokun Li (1):
fs: fix user path of nested backing files
Bartosz Golaszewski (1):
powerpc/powermac: fix OF node refcount
Baul Lee (2):
ALSA: 6fire: bound the MIDI event length from the device
ALSA: bcd2000: clear the URB pointers on disconnect
Bradley Morgan (2):
signal: avoid shared siginfo namespace rewrites
taskstats: fix cpumask parsing cutting off the last character
Breno Leitao (4):
mm/kmemleak: avoid soft lockup when scanning task stacks mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
net: fix spurious TX timeout after dev_activate()
Bryam Vargas (10):
misc: nsm: bound the device-reported response length
dm array: validate array block headers on read
dm array: reject an array block whose value size is not the caller's libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
ocfs2: bound namelen in dlm_migrate_request_handler
ocfs2: validate lengths in dlm_mig_lockres_handler
power: supply: cros_usbpd-charger: bound the EC-reported port count platform/chrome: sensorhub: Bound the EC-reported sensor number net/smc: do not dereference an unset send buffer on the SMC-D teardown path net/smc: unregister the connection before draining the rx tasklet
Chao Yu (1):
f2fs: fix potential deadloop in prepare_compress_overwrite()
Chengfeng Ye (2):
Bluetooth: RFCOMM: serialize security confirmation handling vsock/virtio: flush works in dependency order
Chris Mason (16):
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
nfsd: release path refs on follow_down() error
nfsd: size fh_verify server sockaddr slot by xpt_locallen
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfsd: gate nfs3 setacl by argp->mask
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
SUNRPC: svcauth_gss: enforce krb5 token minimum length
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
SUNRPC: harden gss_unwrap_resp_priv length checks
sunrpc: init gssp_lock before publishing proc entry
SUNRPC: reject duplicate CREDS_VALUE options
svcrdma: Fix offset arithmetic in read_chunk_range
svcrdma: Fix pcl_for_each_segment for empty chunks
svcrdma: Fix unmatched rn_unregister on failed accept
Christoph Zwerschke (2):
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christopher Tolang (1):
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
Chuck Lever (13):
NFSD: check truncate permission under inode lock
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
NFSD: Fix off-by-one in DRC bucket pruning limit
nfsd: Reset write verifier when async COPY writeback fails
nfsd: sample writeback error cursor before async COPY loop
nfsd: gate nfs2 setacl by argp->mask
NFSD: Prevent lock owner use-after-free during client teardown
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
SUNRPC: Check svc pool percpu counter allocation
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
svcrdma: Reject connection when transport allocation fails
svcrdma: Reject inline replies that overflow the pull-up buffer
svcrdma: Validate Read chunk positions before reconstruction
Chunkai Deng (1):
rpmsg: glink: smem: order FIFO read after availability check
Coly Li (1):
md: do overflow check for sb->bblog_shift in super_1_load()
Cong Nguyen (2):
hwmon: (max6621) fix negative temperature offset and crit readings
hwmon: (max6621) fix temperature clamp range
Daisuke Matsuda (1):
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Daniel Borkmann (1):
bpf: Disable preemption in __bpf_get_stack
Dave Airlie (1):
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
David Lee (1):
udf: reject VAT indexes equal to the entry count
Dawei Feng (1):
wifi: rtw88: pci: fix resource leak on failed NAPI setup
Deepanshu Kartikey (2):
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
eventfs: Initialize ei->children and ei->list in init_ei()
Dev Jain (1):
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
Dmitry Antipov (1):
ocfs2: always run deallocs on copy-on-write completion
Doruk Tan Ozturk (1):
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
Eric Biggers (2):
crypto: sun8i-ce - Remove crypto_rng interface
crypto: sun8i-ss - Remove crypto_rng interface
Ethan Nelson-Moore (1):
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
Ewan D. Milne (1):
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Fabio Estevam (2):
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Fabio Porcedda (1):
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Fan Wu (11):
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed RDMA/cxgb4: Cancel reg_work before freeing device on remove
power: supply: bq24257: fix use-after-free on remove
power: supply: bq256xx: drain usb_work before freeing the charger
power: supply: charger-manager: register regulators before exposing sysfs
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
power: supply: lp8788-charger: fix use-after-free on remove
power: supply: rt9455: quiesce delayed work before teardown
power: supply: ucs1002: fix use-after-free on remove
mmc: via-sdmmc: stop card-detect handling on probe failure
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
Fan Ye (2):
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
net: thunderbolt: Mark the connection down when bringing it up fails
Farhan Ali (1):
PCI/MSI: Enable memory decoding before restoring MSI-X messages
Felix Yan (1):
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
Florian Fuchs (1):
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Francesco Lavra (1):
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Frank Sorenson (3):
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
smb: client: fix ALIGN() overflow in symlink_data() error context loop
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
Fredric Cover (2):
smb: client: clear ce->tgthint in free_tgts()
smb: client: harden DFS cache against invalid target hints
Gao Shiyuan (1):
iommu/amd: remove return value of amd_iommu_detect
Gaurav Batra (1):
powerpc/pseries/iommu: switch to Default DMA window during kdump
Gongwei Li (1):
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Greg Kroah-Hartman (1):
Linux 6.12.109
Guanghui Yang (1):
btrfs: drop recovered reloc root refs on recovery failure
Guangshuo Li (3):
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guopeng Zhang (1):
mm: memcg: stop reclaim when a limit update is superseded
HanQuan (1):
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Hang Nan (1):
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Hans Verkuil (1):
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
Hao Jia (1):
mm/zswap: fix global shrinker when memory cgroup is disabled
Hao-Qun Huang (3):
staging: greybus: hid: fix SET_REPORT return value
staging: media: tegra-video: fix of_node_put() on VIP parse errors
staging: media: tegra-video: vi: fix probe failure on skipped last port
Haotian Zhang (1):
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Haoxiang Li (1):
HID: sensor: custom: Fix field sysfs group cleanup on failure
Harshit Varu (1):
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Helge Deller (1):
sticon/parisc: Detect default STI graphics card for console output
Hidayath Khan (2):
net/smc: fix socket refcount leak in smc_switch_conns() net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Hongyan Xu (1):
auxdisplay: charlcd: cancel backlight work on registration failure
Huang Wei (1):
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
Hui Su (5):
tracing: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix use-after-free with same-name named triggers
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
cpufreq: schedutil: Fix rate limit overflow
kasan: fix cache shrink race with CPU hotplug
HyeongJun An (6):
Bluetooth: eir: Fix OOB read in eir_get_service_data()
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
power: supply: qcom_battmgr: terminate the strings from firmware platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer platform/x86: ISST: Validate level in perf mask ioctls platform/x86: ISST: Validate socket ID in clos_assoc ioctl
Hyunwoo Kim (3):
apparmor: fix out-of-bounds write when null terminating a label vec
sctp: stop processing a packet once its association is deleted
sctp: drop a chunk if its transport was removed
Ibrahim Abdelkader (1):
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
Ibrahim Hashimov (3):
ubifs: fix out-of-bounds read in signature length check
HID: picolcd: clamp eeprom debugfs read to bytes actually received
ocfs2: validate rl_used against rl_count in refcount block validator
Ilya Krutskih (1):
dm raid1: reserve space for NUL-terminator in build_constructor_string()
Ilya Maximets (1):
net: openvswitch: fix flow mask use-after-free on flow deletion
Ivaylo Dimitrov (1):
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
James Kim (1):
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Jameson Thies (1):
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Jann Horn (2):
apparmor: fix cred UAF caused by begin_current_label_crit_section()
smack: fix cred UAF in smack_file_send_sigiotask()
Jeff Layton (23):
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
nfsd: validate symlink target length in NFSv4 CREATE
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
nfsd: add filehandle match check to nfsd4_delegreturn()
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
nfsd: check client ownership when cancelling a copy-notify stateid
nfsd: clear opcnt on compound arg release to prevent OOB read
nfsd: defer vfree of compound ops to fix rpc_status UAF
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
nfsd: fix nfsd_file leak on inter-server COPY setup failure
nfsd: fix reply size estimate for GET_DIR_DELEGATION
nfsd: fix version mismatch loops in nfsd_acl_init_request()
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
nfsd: initialize copy-notify stateid before publishing it
nfsd: initialize DRC hash table before registering shrinker
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
nfsd: revoke copy-notify stateids before dropping their reference
sunrpc: route to a populated pool in svc_pool_for_cpu()
SUNRPC: always drain cache_cleaner before destroying a cache_detail
Jeffin Philip (1):
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Jiacheng Yu (1):
params: fix charp corruption on allocation failure
Jiangshan Yi (3):
HID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: validate report size in mcp2221_raw_event()
bnx2x: fix double free in bnx2x_init_firmware() error path
Jianing Li (3):
power: supply: max17040: propagate register read errors
power: supply: max17040: drop incorrect I2C functionality check
power: supply: max17040: synchronize work cancellation on suspend
Johan Hovold (2):
USB: phy: fsl-usb: fix missing static keywords
remoteproc: scp: Fix device reference leak on failed lookup
Johannes Weiner (1):
mm: mempolicy: fix automatic numa balancing for shmem
Jordan R Abrahams-Whitehead (1):
include/linux/list.h: mark list_add and __list_add as __always_inline
Jorijn van der Graaf (1):
net: ipa: fix stalled modem TX queue after runtime resume
Joseph Qi (3):
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Joshua Crofts (1):
usb: gadget: midi2: remove default configfs groups on teardown
Joy H.J. Lee (1):
tools/compiler: match glibc 2.42 definition of __attribute_const__
Jun Yang (2):
sctp: distinguish sequence zero from wildcard in reconf lookup
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Junrui Luo (2):
media: vicodec: fix out-of-bounds write in FWHT encoder NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Jérémy Jean (7):
timers/itimer: Zero-init old itimerval before copy to userspace tracing/user_events: Clear copied tracing state before fork duplication
libceph: reject buckets with mismatched CRUSH ids
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
audit: avoid dropping live tree ref on fsnotify rule autoremove
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
SUNRPC: wait for in-flight client TLS handshake callback
Karl Mehltretter (2):
serial: imx: serialize imx_uart_ports[] lifetime
arm64: compat: Fix decrementing LDM/STM alignment emulation
Kathiravan Thirumoorthy (1):
regulator: qcom-refgen: correct the regulator type to CURRENT
Kevin Tian (2):
iommu/vt-d: Fix no_iommu to disable platform opt-in iommu/vt-d: Force requesting ACS when tboot is enabled
Kiryl Shutsemau (Meta) (3):
x86/tdx: Fix off-by-one in port I/O handling x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix zero-extension for 32-bit port I/O
Koichiro Den (5):
NTB: ntb_transport: Recycle TX entries before client callbacks
NTB: ntb_transport: Fail TX enqueue when the QP link is down
NTB: ntb_transport: Reject oversized TX buffers
net: ntb_netdev: Avoid double-accounting netif_rx() drops
net: ntb_netdev: Count packets dropped on RX refill failure
Konstantin Komarov (1):
fs/ntfs3: bound page_lcns[] index by the log record
Krzysztof Kozlowski (1):
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
Krzysztof Wilczyński (5):
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses PCI/proc: Avoid spurious runtime PM wakeup on config space accesses PCI/proc: Use file_ns_capable() when checking config space read access PCI/proc: Warn on writes to kernel-exclusive config space regions
Kuan-Wei Chiu (2):
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Longlong Xia (1):
zsmalloc: account for handle size in class lookup
Lorenzo Stoakes (1):
mm: avoid unnecessary use of is_swap_pmd()
Lorenzo Stoakes (ARM) (1):
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Ma Ke (2):
power: supply: bq25890: Fix power_supply reference leak platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
Maoyi Xie (3):
power: supply: twl4030_charger: cancel workers via devm
i3c: master: svc: bound IBI payload to the requested max_payload_len
w1: ds28e17: reject an oversize length on an I2C block read
Marek Czernohous (1):
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Mario Limonciello (1):
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
Matt Turner (4):
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
alpha: don't leak hardware-fabricated FP exception bits to user space
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
alpha: marvel: Fix lock ordering in init_io7_irqs()
Max Kellermann (3):
ceph: do not repeat ceph_trim_dentries() if no progress possible
jbd2: bound shrinker scans by examined checkpoint buffers
jbd2: check need_resched() when skipping busy checkpoint buffers
Michael Bommarito (7):
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
libceph: validate OSD extent maps before cursor advance
ceph: bound copied dentry name length in NFS export get_name
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
ceph: bound num_export_targets array for mds info v2/v3
ceph: bound xattr value length in __build_xattrs()
lockd: pin next file across nlm_inspect_file lock-drop
Michael Chan (1):
bnxt_en: Mask the bd_cnt field in the TX BD properly
Miguel Ojeda (1):
rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
Mike Snitzer (1):
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Mikulas Patocka (1):
dm-stats: fix a crash if allocation of per-cpu data fails
Ming Lei (1):
block: mark GFP_NOIO around sysfs ->store()
Mohamad Raizudeen (1):
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Muhammad Bilal (10):
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS platform/x86: hp-bioscfg: advance elem past consumed array elements platform/x86: hp-bioscfg: bound ordered-list parsing by the package count platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() platform/x86: hp-bioscfg: fix heap OOB read on empty password write platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed platform/x86: hp-bioscfg: pass validated element count to package parsers platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
Myeonghun Pak (4):
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
fbdev: uvesafb: unregister connector callback on init failure
nvme-pci: disable controller on admin queue IRQ setup failure
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Naman Jain (1):
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Nathan Chancellor (1):
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Neill Kapron (1):
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Niklas Cassel (1):
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Nirmoy Das (1):
ACPI: APEI: Fix ERST timeout unit conversion
Norbert Szetei (3):
RDMA/ucma: Lock the handler in ucma_set_ib_path()
openvswitch: only skb_tx_error() a packet we are about to drop
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Peixin Xie (1):
riscv: acpi: Handle LPI architectural context loss flags
Pengpeng Hou (1):
eCryptfs: bound the packet-length peek to the user buffer
Petr Vaganov (1):
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Prasanna Kumar T S M (1):
cdx: Fix double free when sysfs file creation fails
Qing Ming (1):
mpls: reload header after pskb_may_pull()
Quentin Schulz (1):
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
Robbie Ko (2):
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Ronald Claveau (1):
PCI: meson: Fix GPIO state while requesting PERST#
Runyu Xiao (4):
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Ruoyu Wang (1):
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ryusuke Konishi (1):
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Samuel Page (1):
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Sanman Pradhan (1):
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
Sean Christopherson (1):
KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test
Seiji Nishikawa (1):
ipmi: si: Fix NULL pointer dereference after failed registration
Shameer Kolothum (1):
iommu/arm-smmu-v3: Manage teardown with devm
Shuai Xue (2):
iommu/amd: Put PCI device after handling PPR faults iommu/sva: Set handle->dev before the SVA handle is visible
Shuangpeng Bai (1):
lockd: fix NULL dereference on lockowner allocation failure
Sonali Pradhan (1):
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Srinivas Pandruvada (7):
platform/x86: ISST: Add a NULL check for sst_inst[] platform/x86: ISST: Just allow 2 bits for SST feature enable platform/x86: ISST: Use PP level enable mask platform/x86: ISST: Validate logical CPU id and clos id platform/x86: ISST: Validate parameter for core power state platform/x86: ISST: Validate parameter for frequency and priority platform/x86: ISST: Return error during profile addition
Srinivasan Shanmugam (1):
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
Stanislaw Gruszka (1):
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Stefan Haberland (3):
s390/dasd: Do not complete a failed ESE read as successful s390/dasd: Guard sysfs discipline callbacks against unallocated private data s390/dasd: Propagate partial completion length across ERP recovery
Takashi Iwai (6):
ALSA: aloop: Check card index validity at probe
ALSA: mpu401: Check card index validity at probe
ALSA: mts64: Check card index validity at probe
ALSA: portman2x4: Check card index validity at probe
ALSA: serial-u16550: Check card index validity at probe
ALSA: virmidi: Check card index validity at probe
TanZheng (1):
ACPI: APEI: GHES: fix ARM section length accounting after header
Thomas Gleixner (1):
timer: Keep debugobjects state consistent in migrate_timer_list()
Thomas Richter (1):
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
Tien Sung Ang (1):
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Tim Harvey (1):
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
Tim Menninger (1):
pNFS: Fix EBUSY check in pnfs_layout_need_return
Tzung-Bi Shih (1):
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Vaibhav Nagare (1):
qede: Fix NULL pointer dereference in TPA fragment processing
Valentin Kindschi (2):
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Vincent Donnefort (4):
tracing: Fix logged instance name on creation failure
ring-buffer: Free cpu_buffer::free_page with subbuf_order
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
ring-buffer: Fix subbuf resize race with ring buffer readers
Vincent Mailhol (1):
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Vineet Gupta (1):
bpf, x86: Fix per-CPU address resolution into an extended register
Weigang He (1):
media: cec: stm32: prevent out-of-bounds write on RX overflow
Weiming Shi (2):
sctp: fix NULL deref on untransmitted RECONF completion
xdp: fix zero-copy frame layout
WenTao Liang (2):
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
Xiang Mei (1):
fs/ntfs3: validate dirty page table on log replay
Xin Chen (1):
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Xingrui Li (1):
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Xiubo Li (1):
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Xu Rao (1):
HID: roccat: free buffered reports when destroying device
Xu Yang (2):
device property: fix infinite loop in fwnode_for_each_child_node()
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
Xuanqiang Luo (2):
net: ravb: avoid dereferencing an invalid PTP clock
net: ravb: serialize PTP clock teardown
Yang Erkun (1):
md: make rdev_addable usable for rcu mode
Yehyeong Lee (4):
nvme: zero the discard fallback page
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme-tcp: reject a read that transferred too few bytes
Yemu Lu (1):
fat: restore original value when fat_ent_write failed
Yichong Chen (6):
ecryptfs: fix tag 11 packet exact-fit size check
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs: pass packet set buffer size to parser
ecryptfs: reject too-small tag 70 packets
ecryptfs: release message context on send failure
ecryptfs: show filename encryption options
Yifei Gao (1):
orangefs: fix double-free of trailer_buf on readdir copy failure
Yousef Alhouseen (1):
ipmi: ipmb: validate write message length
Yun Zhou (1):
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Yunye Zhao (1):
md/raid10: fix still_degraded being inverted in raid10_sync_request()
Yuyang Huang (1):
ipv6: use RCU iterator to dump route exceptions
Zhan Xusheng (2):
ocfs2: fix readdir position truncation on 32-bit kernels
udf: Fix i_lenExtents truncation on 32-bit kernels
Zhenghang Xiao (1):
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
Zhiling Zou (5):
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
ip6_gre: fix hardware header length for NBMA tunnels
orangefs: skip leading spaces before parsing client debug masks
net: cap advertised IP tunnel headroom
seg6: reset IP6CB after IPv6 decapsulation
Zi Yan (1):
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
Zide Chen (1):
perf/x86/intel/uncore: Fix die ID init and look up bugs
Zihan Xi (1):
net: l2tp: do not propagate multicast notification errors
Zilin Guan (2):
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
wifi: ath11k: fix memory leaks in beacon template setup
liyouhong (1):
dm-era: fix shadowed superblock leak on take-snap failure
胡连勤 (1):
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Greg Kroah-Hartman
maintainerDocumentation/ABI/testing/sysfs-bus-nvdimm +2 -1
@@ -48,7 +48,8 @@ What: /sys/bus/nd/devices/nmemX/cxl/id Date: November 2022 KernelVersion: 6.2 Contact: Dave Jiang <[email protected]> -Description: (RO) Show the id (serial) of the device. This is CXL specific. +Description: (RO) Show the id (serial) of the device, formatted as an + unsigned 64-bit decimal value. This is CXL specific. What: /sys/bus/nd/devices/nmemX/cxl/provider Date: November 2022
Makefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 12 -SUBLEVEL = 108 +SUBLEVEL = 109 EXTRAVERSION = NAME = Baby Opossum Posse
arch/alpha/include/uapi/asm/fpu.h +6 -2
@@ -101,7 +101,12 @@ ieee_swcr_to_fpcr(unsigned long sw) | IEEE_TRAP_ENABLE_OVF)) << 48; fp |= (~sw & (IEEE_TRAP_ENABLE_UNF |IEEE_TRAP_ENABLE_INE )) <<57 ; fp |= (sw &IEEE_MAP_UMZ ?FPCR_UNDZ |FPCR_UNFD :0 ); - fp |= (~sw &IEEE_TRAP_ENABLE_DNO ) <<41 ; +/* +* Disable denormal operand traps only when denormal inputs are to be +* flushed to zero. Otherwise they must keep trapping, so that /S +* instructions reach the kernel emulation handler. +*/ + fp |= (sw &IEEE_MAP_DMZ ?FPCR_DNOD :0 );return fp; }
@@ -116,7 +121,6 @@ ieee_fpcr_to_swcr(unsigned long fp) | IEEE_TRAP_ENABLE_OVF); sw |= (~fp >>57 ) & (IEEE_TRAP_ENABLE_UNF |IEEE_TRAP_ENABLE_INE ); sw |= (fp >>47 ) &IEEE_MAP_UMZ ; - sw |= (~fp >>41 ) &IEEE_TRAP_ENABLE_DNO ;return sw; }
arch/alpha/kernel/pci-sysfs.c +3 -3
@@ -364,17 +364,17 @@ int pci_legacy_write(struct pci_bus *bus, loff_t port, u32 val, size_t size)switch (size) {case 1 : -outb (port, val); +outb (val, port);return 1 ;case 2 :if (port &1 )return -EINVAL ; -outw (port, val); +outw (val, port);return 2 ;case 4 :if (port &3 )return -EINVAL ; -outl (port, val); +outl (val, port);return 4 ; }return -EINVAL ;
arch/alpha/kernel/sys_marvel.c +12 -13
@@ -263,6 +263,18 @@ init_io7_irqs(struct io7 *io7,*/ printk (" Interrupts reported to CPU at PE %u\n" , boot_cpuid); +/* Set up the lsi irqs. */ +for (i =0 ; i <128 ; ++i) { +irq_set_chip_and_handler (base + i, lsi_ops, handle_level_irq); +irq_set_status_flags (base + i,IRQ_LEVEL ); + } + +/* Set up the msi irqs. */ +for (i =128 ; i < (128 +512 ); ++i) { +irq_set_chip_and_handler (base + i, msi_ops, handle_level_irq); +irq_set_status_flags (base + i,IRQ_LEVEL ); + } +raw_spin_lock (&io7->irq_lock);/* set up the error irqs */
@@ -272,12 +284,6 @@ init_io7_irqs(struct io7 *io7,io7_redirect_irq (io7, &io7->csrs->STV_CTL.csr, boot_cpuid);io7_redirect_irq (io7, &io7->csrs->HEI_CTL.csr, boot_cpuid); -/* Set up the lsi irqs. */ -for (i =0 ; i <128 ; ++i) { -irq_set_chip_and_handler (base + i, lsi_ops, handle_level_irq); -irq_set_status_flags (i,IRQ_LEVEL ); - } -/* Disable the implemented irqs in hardware. */ for (i =0 ; i <0x60 ; ++i)init_one_io7_lsi (io7, i, boot_cpuid);
@@ -285,13 +291,6 @@ init_io7_irqs(struct io7 *io7,init_one_io7_lsi (io7,0x74 , boot_cpuid);init_one_io7_lsi (io7,0x75 , boot_cpuid); - -/* Set up the msi irqs. */ -for (i =128 ; i < (128 +512 ); ++i) { -irq_set_chip_and_handler (base + i, msi_ops, handle_level_irq); -irq_set_status_flags (i,IRQ_LEVEL ); - } -for (i =0 ; i <16 ; ++i)init_one_io7_msi (io7, i, boot_cpuid);
arch/alpha/kernel/traps.c +3 -3
@@ -166,12 +166,12 @@ static long dummy_emul(void) { return 0; }long (*alpha_fp_emul_imprecise)(struct pt_regs *regs,unsigned long writemask) = (void *)dummy_emul;EXPORT_SYMBOL_GPL (alpha_fp_emul_imprecise); -long (*alpha_fp_emul) (unsigned long pc) +long (*alpha_fp_emul) (unsigned long pc,unsigned long summary) = (void *)dummy_emul;EXPORT_SYMBOL_GPL (alpha_fp_emul);#else long alpha_fp_emul_imprecise (struct pt_regs *regs,unsigned long writemask); -long alpha_fp_emul (unsigned long pc); +long alpha_fp_emul (unsigned long pc,unsigned long summary);#endif asmlinkage void
@@ -185,7 +185,7 @@ do_entArith(unsigned long summary, unsigned long write_mask,emulate the instruction. If the processor supports precise exceptions, we don't have to search. */ if (!amask (AMASK_PRECISE_TRAP )) - si_code =alpha_fp_emul (regs->pc -4 ); + si_code =alpha_fp_emul (regs->pc -4 , summary);else si_code =alpha_fp_emul_imprecise (regs, write_mask);if (si_code ==0 )
arch/alpha/math-emu/math.c +77 -11
125 lines not on this page · raw message
arch/arm/Kconfig +1 -1
@@ -93,7 +93,7 @@ config ARM select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_TRANSPARENT_HUGEPAGE if ARM_LPAE select HAVE_ARM_SMCCC if CPU_V7 - select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 + select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 && !CPU_32v3 select HAVE_CONTEXT_TRACKING_USER select HAVE_C_RECORDMCOUNT select HAVE_BUILDTIME_MCOUNT_SORT
arch/arm64/boot/dts/qcom/sm6115-fxtec-pro1x.dts +1 -1
@@ -151,7 +151,7 @@ touchscreen@14 { interrupts-extended = <&tlmm 80 IRQ_TYPE_LEVEL_LOW>; - irq-gpios = <&tlmm 80 IRQ_TYPE_LEVEL_LOW>; + irq-gpios = <&tlmm 80 GPIO_ACTIVE_LOW>; reset-gpios = <&tlmm 71 GPIO_ACTIVE_HIGH>; AVDD28-supply = <&ts_vdd_supply>; VDDIO-supply = <&ts_vddio_supply>;
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +1 -1
@@ -19,7 +19,7 @@ emmc_pwrseq: emmc-pwrseq { compatible = "mmc-pwrseq-emmc"; pinctrl-0 = <&emmc_reset>; pinctrl-names = "default"; - reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_HIGH>; + reset-gpios = <&gpio1 RK_PB3 GPIO_ACTIVE_LOW>; }; leds {
arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts +12 -0
@@ -132,6 +132,18 @@ &i2s0_8ch_bus { <3 RK_PD7 1 &pcfg_pull_none>; }; +&i2s0_8ch_bus_bclk_off { + rockchip,pins = + <3 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>, + <3 RK_PD1 1 &pcfg_pull_none>, + <3 RK_PD2 1 &pcfg_pull_none>, + <3 RK_PD3 1 &pcfg_pull_none>, + <3 RK_PD4 1 &pcfg_pull_none>, + <3 RK_PD5 1 &pcfg_pull_none>, + <3 RK_PD6 1 &pcfg_pull_none>, + <3 RK_PD7 1 &pcfg_pull_none>; +}; + &i2s1 { pinctrl-names = "default"; pinctrl-0 = <&i2s_8ch_mclk_pin>, <&i2s1_2ch_bus>;
arch/arm64/kernel/compat_alignment.c +2 -2
@@ -114,8 +114,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)static int do_alignment_ldmstm (unsigned long addr,u32 instr,struct pt_regs *regs) { -unsigned int rd, rn, nr_regs, regbits; -unsigned long eaddr, newaddr; +unsigned int rd, rn, regbits; +unsigned long eaddr, newaddr, nr_regs;unsigned int val;/* count the number of registers in the mask to be transferred */
arch/openrisc/kernel/entry.S +39 -4
54 lines not on this page · raw message
arch/powerpc/platforms/powermac/low_i2c.c +1 -1
@@ -1504,7 +1504,7 @@ static int __init pmac_i2c_create_platform_devices(void)if (bus->platform_dev ==NULL )return -ENOMEM ; bus->platform_dev->dev.platform_data = bus; - bus->platform_dev->dev.of_node = bus->busnode; + bus->platform_dev->dev.of_node =of_node_get (bus->busnode);platform_device_add (bus->platform_dev); }
arch/powerpc/platforms/pseries/iommu.c +12 -11
@@ -812,18 +812,11 @@ static struct device_node *pci_dma_find(struct device_node *dn,/* parse DMA window property. During normal system boot, only default * DMA window is passed in OF. But, for kdump, a dedicated adapter might -* have both default and DDW in FDT. In this scenario, DDW takes precedence -* over default window. +* have both default and DDW in FDT. In this scenario, default window +* takes precedence over DDW. For a dedicated adapter, default window will +* potentially have more unused TCEs. */ -if (ddw_win) { -struct dynamic_dma_window_prop *p; - - p = (struct dynamic_dma_window_prop *)ddw_prop; - prop->liobn = p->liobn; - prop->dma_base = p->dma_base; - prop->tce_shift = p->tce_shift; - prop->window_shift = p->window_shift; - }else if (default_win) { +if (default_win) {unsigned long offset, size, liobn;of_parse_dma_window (rdn, default_prop, &liobn, &offset, &size);
@@ -832,6 +825,14 @@ static struct device_node *pci_dma_find(struct device_node *dn, prop->dma_base =cpu_to_be64 (offset); prop->tce_shift =cpu_to_be32 (IOMMU_PAGE_SHIFT_4K ); prop->window_shift =cpu_to_be32 (order_base_2 (size)); + }else { +struct dynamic_dma_window_prop *p; + + p = (struct dynamic_dma_window_prop *)ddw_prop; + prop->liobn = p->liobn; + prop->dma_base = p->dma_base; + prop->tce_shift = p->tce_shift; + prop->window_shift = p->window_shift; }return rdn;
arch/riscv/include/asm/acpi.h +19 -0
@@ -12,6 +12,8 @@#ifndef _ASM_ACPI_H#define _ASM_ACPI_H +#include <linux/cpuidle.h> +/* Basic configuration for ACPI */ #ifdef CONFIG_ACPI
@@ -71,6 +73,23 @@ int acpi_get_riscv_isa(struct acpi_table_header *table,void acpi_get_cbo_block_size (struct acpi_table_header *table,u32 *cbom_size,u32 *cboz_size,u32 *cbop_size); + +/* +* RISC-V Functional Fixed Hardware Specification Version v1.0.1, +* Chapter 3.1.2, Table 4: Arch. Context Lost Flags +*/ +#define RISCV_LPI_HART_TIMER_CTXT_LOST BIT(0) + +static inline unsigned int arch_get_idle_state_flags (u32 arch_flags) +{ +if (arch_flags &RISCV_LPI_HART_TIMER_CTXT_LOST ) +return CPUIDLE_FLAG_TIMER_STOP ; + +return 0 ; +} + +#define arch_get_idle_state_flags arch_get_idle_state_flags +#else static inline void acpi_init_rintc_map (void ) { }static inline struct acpi_madt_rintc *acpi_cpu_get_madt_rintc (int cpu)
arch/s390/kernel/perf_cpum_cf.c +142 -73
400 lines not on this page · raw message
arch/x86/coco/tdx/tdx.c +4 -6
@@ -606,8 +606,8 @@ static bool handle_in(struct pt_regs *regs, int size, int port) .r13 = PORT_READ, .r14 = port, }; -u64 mask =GENMASK (BITS_PER_BYTE * size,0 );bool success; +u64 val;/* * Emulate the I/O read via hypercall. More info about ABI can be found
@@ -615,18 +615,16 @@ static bool handle_in(struct pt_regs *regs, int size, int port)* "TDG.VP.VMCALL<Instruction.IO>". */ success = !__tdx_hypercall (&args); + val = success ? args.r11 :0 ; -/* Update part of the register affected by the emulated instruction */ - regs->ax &= ~mask; -if (success) - regs->ax |= args.r11 & mask; +insn_assign_reg (®s->ax, val, size);return success; }static bool handle_out (struct pt_regs *regs,int size,int port) { -u64 mask =GENMASK (BITS_PER_BYTE * size,0 ); +u64 mask =GENMASK (BITS_PER_BYTE * size -1 ,0 );/* * Emulate the I/O write via hypercall. More info about ABI can be found
arch/x86/events/intel/uncore.c +1 -0
@@ -66,6 +66,7 @@ int uncore_die_to_segment(int die)return bus ?pci_domain_nr (bus) : -EINVAL ; } +/* Note: This API can only be used when NUMA information is available. */ int uncore_device_to_die (struct pci_dev *dev) {int node =pcibus_to_node (dev->bus);
arch/x86/events/intel/uncore_snbep.c +6 -7
@@ -1474,13 +1474,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool } map->pbus_to_dieid[bus] = die_id =uncore_device_to_die (ubox_dev); -raw_spin_unlock (&pci2phy_map_lock); - -if (WARN_ON_ONCE (die_id ==-1 )) { - err = -EINVAL ; -break ; - } } }
@@ -6530,7 +6524,7 @@ static void spr_update_device_location(int type_id)while ((dev =pci_get_device (PCI_VENDOR_ID_INTEL , device, dev)) !=NULL ) { - die =uncore_device_to_die (dev); + die =uncore_pcibus_to_dieid (dev->bus);if (die <0 )continue ;
@@ -6554,6 +6548,11 @@ static void spr_update_device_location(int type_id)int spr_uncore_pci_init (void ) { +int ret =snbep_pci2phy_map_init (0x3250 ,SKX_CPUNODEID ,SKX_GIDNIDMAP , true); + +if (ret) +return ret; +/* * The discovery table of UPI on some SPR variant is broken, * which impacts the detection of both UPI and M3UPI uncore PMON.
arch/x86/include/asm/insn-eval.h +36 -0
@@ -9,6 +9,7 @@#include <linux/compiler.h> #include <linux/bug.h> #include <linux/err.h> +#include <asm/insn.h> #include <asm/ptrace.h> #define INSN_CODE_SEG_ADDR_SZ (params) ((params >> 4) & 0xf)
@@ -44,4 +45,39 @@ enum insn_mmio_type {enum insn_mmio_type insn_decode_mmio (struct insn *insn,int *bytes); +/* +* Write @val into *@reg following the x86 rules for writes to +* general-purpose registers (Intel SDM Vol. 1, "General-Purpose +* Registers in 64-Bit Mode"): an 8- or 16-bit write leaves the rest of +* the register untouched, a 32-bit write zero-extends the result into +* the upper 32 bits, and a 64-bit write replaces the whole register. +* +* @bytes is the width of the write, not a property of the instruction: +* an instruction that, say, sign-extends a 32-bit immediate into a +* 64-bit register does a 64-bit write here. +* +* @reg need not be 8-byte aligned: KVM's instruction emulator offsets +* the pointer by one byte to address the high-byte registers (AH, CH, +* DH, BH). Use narrow stores for the sub-word cases so the access +* width matches @bytes and the adjacent bytes are left alone. +*/ +static inline void insn_assign_reg (unsigned long *reg,u64 val,int bytes) +{ +switch (bytes) { +case 1 : + *(u8 *)reg = (u8 )val; +break ; +case 2 : + *(u16 *)reg = (u16 )val; +break ; +case 4 : +/* A 32-bit write zero-extends into the upper 32 bits. */ + *reg = (u32 )val; +break ; +case 8 : + *reg = val; +break ; + } +} +#endif /* _ASM_X86_INSN_EVAL_H */
arch/x86/include/asm/sev.h +2 -0
@@ -440,6 +440,7 @@ static inline void snp_update_svsm_ca(void) { }#ifdef CONFIG_KVM_AMD_SEV bool snp_probe_rmptable_info (void ); +int snp_rmptable_init (void );int snp_lookup_rmpentry (u64 pfn,bool *assigned,int *level);void snp_dump_hva_rmpentry (unsigned long address);int psmash (u64 pfn);
@@ -450,6 +451,7 @@ void kdump_sev_callback(void);void snp_fixup_e820_tables (void );#else static inline bool snp_probe_rmptable_info (void ) {return false; } +static inline int snp_rmptable_init (void ) {return -ENOSYS ; }static inline int snp_lookup_rmpentry (u64 pfn,bool *assigned,int *level) {return -ENODEV ; }static inline void snp_dump_hva_rmpentry (unsigned long address) {}static inline int psmash (u64 pfn) {return -ENODEV ; }
arch/x86/kvm/emulate.c +4 -22
@@ -24,6 +24,7 @@#include "kvm_emulate.h" #include <linux/stringify.h> #include <asm/debugreg.h> +#include <asm/insn-eval.h> #include <asm/nospec-branch.h> #include <asm/ibt.h>
@@ -489,25 +490,6 @@ static void assign_masked(ulong *dest, ulong src, ulong mask) *dest = (*dest & ~mask) | (src & mask); } -static void assign_register (unsigned long *reg,u64 val,int bytes) -{ -/* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */ -switch (bytes) { -case 1 : - *(u8 *)reg = (u8 )val; -break ; -case 2 : - *(u16 *)reg = (u16 )val; -break ; -case 4 : - *reg = (u32 )val; -break ;/* 64b: zero-extend */ -case 8 : - *reg = val; -break ; - } -} -static inline unsigned long ad_mask (struct x86_emulate_ctxt *ctxt) {return (1UL << (ctxt->ad_bytes <<3 )) -1 ;
@@ -555,7 +537,7 @@ register_address_increment(struct x86_emulate_ctxt *ctxt, int reg, int inc) {ulong *preg =reg_rmw (ctxt, reg); -assign_register (preg, *preg + inc, ctxt->ad_bytes); +insn_assign_reg (preg, *preg + inc, ctxt->ad_bytes); }static void rsp_increment (struct x86_emulate_ctxt *ctxt,int inc)
@@ -1781,7 +1763,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,static void write_register_operand (struct operand *op) { -return assign_register (op->addr.reg, op->val, op->bytes); +return insn_assign_reg (op->addr.reg, op->val, op->bytes); }static int writeback (struct x86_emulate_ctxt *ctxt,struct operand *op)
@@ -2014,7 +1996,7 @@ static int em_popa(struct x86_emulate_ctxt *ctxt) rc =emulate_pop (ctxt, &val, ctxt->op_bytes);if (rc !=X86EMUL_CONTINUE )break ; -assign_register (reg_rmw (ctxt, reg), val, ctxt->op_bytes); +insn_assign_reg (reg_rmw (ctxt, reg), val, ctxt->op_bytes); --reg; }return rc;
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -1578,7 +1578,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, u8 *rw_imageEMIT_mov (dst_reg, src_reg);#ifdef CONFIG_SMP /* add <dst>, gs:[<off>] */ -EMIT2 (0x65 ,add_1mod (0x48 , dst_reg)); +EMIT2 (0x65 ,add_2mod (0x48 ,0 , dst_reg));EMIT3 (0x03 ,add_2reg (0x04 ,0 , dst_reg),0x25 );EMIT ((u32 )(unsigned long )&this_cpu_off,4 );#endif
arch/x86/virt/svm/sev.c +6 -15
@@ -189,7 +189,7 @@ void __init snp_fixup_e820_tables(void)* described in the SNP_INIT_EX firmware command description in the SNP * firmware ABI spec. */ -static int __init snp_rmptable_init (void ) +int __init snp_rmptable_init (void ) {u64 max_rmp_pfn, calc_rmp_sz, rmptable_size, rmp_end, val;void *rmptable_start;
@@ -197,11 +197,11 @@ static int __init snp_rmptable_init(void)if (!cc_platform_has (CC_ATTR_HOST_SEV_SNP ))return 0 ; -if (!amd_iommu_snp_en) - goto nosnp; +if (WARN_ON_ONCE (!amd_iommu_snp_en)) +return -ENOSYS ;if (!probed_rmp_size) - goto nosnp; +return -ENOSYS ; rmp_end = probed_rmp_base + probed_rmp_size -1 ;
@@ -218,13 +218,13 @@ static int __init snp_rmptable_init(void)if (calc_rmp_sz > probed_rmp_size) {pr_err ("Memory reserved for the RMP table does not cover full system RAM (expected 0x%llx got 0x%llx)\n" , calc_rmp_sz, probed_rmp_size); - goto nosnp; +return -ENOSYS ; } rmptable_start =memremap (probed_rmp_base, probed_rmp_size,MEMREMAP_WB );if (!rmptable_start) {pr_err ("Failed to map RMP table\n" ); - goto nosnp; +return -ENOSYS ; }/*
@@ -261,17 +261,8 @@ static int __init snp_rmptable_init(void) crash_kexec_post_notifiers = true;return 0 ; - -nosnp: -cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); -return -ENOSYS ; } -/* -* This must be called after the IOMMU has been initialized. -*/ -device_initcall (snp_rmptable_init); -static struct rmpentry *get_rmpentry (u64 pfn) {if (WARN_ON_ONCE (pfn > rmptable_max_pfn))
block/blk-sysfs.c +3 -0
@@ -668,6 +668,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,struct queue_sysfs_entry *entry =to_queue (attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj);struct request_queue *q = disk->queue; +unsigned int noio_flag;ssize_t res;if (!entry->store_limit && !entry->store)
@@ -701,7 +702,9 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr,mutex_lock (&q->sysfs_lock);blk_mq_freeze_queue (q); + noio_flag =memalloc_noio_save (); res = entry->store (disk, page, length); +memalloc_noio_restore (noio_flag);blk_mq_unfreeze_queue (q);mutex_unlock (&q->sysfs_lock);return res;
block/genhd.c +1 -0
@@ -616,6 +616,7 @@ static bool __blk_mark_disk_dead(struct gendisk *disk)*/ void blk_mark_disk_dead (struct gendisk *disk) { +blk_queue_flag_set (QUEUE_FLAG_DYING , disk->queue);__blk_mark_disk_dead (disk);blk_report_disk_dead (disk, true); }
drivers/acpi/apei/erst.c +1 -1
@@ -108,7 +108,7 @@ static inline u64 erst_get_timeout(void)if (erst_erange.attr &ERST_RANGE_SLOW ) { timeout = ((erst_erange.timings &ERST_EXEC_TIMING_MAX_MASK ) >> -ERST_EXEC_TIMING_MAX_SHIFT ) *NSEC_PER_MSEC ; +ERST_EXEC_TIMING_MAX_SHIFT ) *NSEC_PER_USEC ;if (timeout <FIRMWARE_TIMEOUT ) timeout =FIRMWARE_TIMEOUT ; }
drivers/acpi/apei/ghes.c +1 -1
@@ -556,7 +556,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,return false; p = (char *)(err +1 ); - length -=sizeof (err); + length -=sizeof (*err);for (i =0 ; i < err->err_info_num; i++) {struct cper_arm_err_info *err_info;
drivers/acpi/pfr_update.c +24 -21
67 lines not on this page · raw message
drivers/ata/libata-scsi.c +14 -14
@@ -3546,17 +3546,13 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)static size_t ata_format_dsm_trim_descr (struct scsi_cmnd *cmd,u32 trmax,u64 sector,u32 count) { -struct scsi_device *sdp = cmd->device; -size_t len = sdp->sector_size; +size_t len =ATA_SECT_SIZE ;size_t r;__le64 *buf;u32 i =0 ;unsigned long flags; -WARN_ON (len >ATA_SCSI_RBUF_SIZE ); - -if (len >ATA_SCSI_RBUF_SIZE ) - len =ATA_SCSI_RBUF_SIZE ; +BUILD_BUG_ON (ATA_SECT_SIZE >ATA_SCSI_RBUF_SIZE );spin_lock_irqsave (&ata_scsi_rbuf_lock, flags); buf = ((void *)ata_scsi_rbuf);
@@ -3591,13 +3587,11 @@ static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc) {struct ata_taskfile *tf = &qc->tf;struct scsi_cmnd *scmd = qc->scsicmd; -struct scsi_device *sdp = scmd->device; -size_t len = sdp->sector_size;struct ata_device *dev = qc->dev;const u8 *cdb = scmd->cmnd;u64 block;u32 n_block; -const u32 trmax = len >>3 ; +const u32 trmax =ATA_MAX_TRIM_RNUM ;u32 size;u16 fp;u8 bp =0xff ;
@@ -3641,13 +3635,13 @@ static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc) goto invalid_param_len;/* -* size must match sector size in bytes -* For DATA SET MANAGEMENT TRIM in ACS-2 nsect (aka count) -* is defined as number of 512 byte blocks to be transferred. +* The TRIM descriptor is a single 512-byte page, which is the maximum +* WRITE SAME length advertised in the Block Limits VPD page. For DATA +* SET MANAGEMENT TRIM the COUNT field (aka nsect) is the number of +* 512-byte blocks to be transferred. */ - size =ata_format_dsm_trim_descr (scmd, trmax, block, n_block); -if (size != len) +if (size !=ATA_SECT_SIZE ) goto invalid_param_len;if (ata_ncq_enabled (dev) &&ata_fpdma_dsm_supported (dev)) {
@@ -3673,6 +3667,12 @@ static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc)ATA_TFLAG_WRITE ;ata_qc_set_pc_nbytes (qc); +/* +* The DSM TRIM payload is a single 512-byte page, which may be smaller +* than the WRITE SAME data-out buffer (one logical block); only +* transfer that page so the length matches the COUNT field. +*/ + qc->nbytes = size;return 0 ;
drivers/auxdisplay/charlcd.c +14 -7
@@ -595,6 +595,16 @@ static int charlcd_init(struct charlcd *lcd)return 0 ; } +static void charlcd_deinit (struct charlcd *lcd) +{ +struct charlcd_priv *priv =charlcd_to_priv (lcd); + +if (lcd->ops->backlight) { +cancel_delayed_work_sync (&priv->bl_work); + lcd->ops->backlight (lcd,CHARLCD_OFF ); + } +} +struct charlcd *charlcd_alloc (unsigned int drvdata_size) {struct charlcd_priv *priv;
@@ -654,8 +664,10 @@ int charlcd_register(struct charlcd *lcd)return ret; ret =misc_register (&charlcd_dev); -if (ret) +if (ret) { +charlcd_deinit (lcd);return ret; + } the_charlcd = lcd;register_reboot_notifier (&panel_notifier);
@@ -665,16 +677,11 @@ EXPORT_SYMBOL_GPL(charlcd_register);int charlcd_unregister (struct charlcd *lcd) { -struct charlcd_priv *priv =charlcd_to_priv (lcd); -unregister_reboot_notifier (&panel_notifier);charlcd_puts (lcd,"\x0cLCD driver unloaded.\x1b[Lc\x1b[Lb\x1b[L-" );misc_deregister (&charlcd_dev); the_charlcd =NULL ; -if (lcd->ops->backlight) { -cancel_delayed_work_sync (&priv->bl_work); - priv->lcd.ops->backlight (&priv->lcd,CHARLCD_OFF ); - } +charlcd_deinit (lcd);return 0 ; }
drivers/base/arch_numa.c +12 -0
@@ -105,6 +105,18 @@ static void __init setup_node_to_cpumask_map(void)if (nr_node_ids ==MAX_NUMNODES )setup_nr_node_ids (); +/* +* This check should never be true but it makes it clear to compilers +* that node_to_cpumask_map is bound by nr_node_ids, avoiding false +* positive fortify warnings when accessing node_to_cpumask_map in the +* for loop below. +*/ +if (unlikely (nr_node_ids >MAX_NUMNODES )) { +pr_err ("nr_node_ids (%u) is larger than MAX_NUMNODES (%u)\n" , + nr_node_ids,MAX_NUMNODES ); +return ; + } +/* allocate and clear the mapping */ for (node =0 ; node < nr_node_ids; node++) {alloc_bootmem_cpumask_var (&node_to_cpumask_map[node]);
drivers/base/property.c +16 -3
@@ -759,18 +759,31 @@ struct fwnode_handle * fwnode_get_next_child_node(const struct fwnode_handle *fwnode, struct fwnode_handle *child) { + const struct fwnode_handle *parent; + struct fwnode_handle *child_parent __free(fwnode_handle) = NULL;struct fwnode_handle *next; -if (IS_ERR_OR_NULL (fwnode)) +/* +* If this function is in a loop and the previous iteration returned +* an child from fwnode->secondary, then we need to use the secondary +* as parent rather than @fwnode. +*/ +if (child) { + child_parent =fwnode_get_parent (child); + parent = child_parent; + }else { + parent = fwnode; + } +if (IS_ERR_OR_NULL (parent))return NULL ;/* Try to find a child in primary fwnode */ - next =fwnode_call_ptr_op (fwnode, get_next_child_node, child); + next =fwnode_call_ptr_op (parent, get_next_child_node, child);if (next)return next;/* When no more children in primary, continue with secondary */ -return fwnode_call_ptr_op (fwnode->secondary, get_next_child_node, child); +return fwnode_get_next_child_node (parent->secondary,NULL ); }EXPORT_SYMBOL_GPL (fwnode_get_next_child_node);
drivers/bluetooth/btusb.c +6 -0
@@ -783,6 +783,12 @@ static const struct usb_device_id quirks_table[] = { { USB_DEVICE(0x2b89, 0x6275), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + /* Additional Realtek 8761CU Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0b05, 0x1d70), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + /* Additional Realtek 8821AE Bluetooth devices */ { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
drivers/bluetooth/hci_bcm.c +1 -0
@@ -548,6 +548,7 @@ static int bcm_close(struct hci_uart *hu)if (IS_ENABLED (CONFIG_PM ) && bdev->irq_acquired) {devm_free_irq (bdev->dev, bdev->irq, bdev);device_init_wakeup (bdev->dev, false); +pm_runtime_dont_use_autosuspend (bdev->dev);pm_runtime_disable (bdev->dev); }
drivers/bluetooth/hci_bcm4377.c +1 -0
@@ -2486,6 +2486,7 @@ static const struct bcm4377_hw bcm4377_hw_variants[] = { .has_bar0_core2_window2 = true, .broken_mws_transport_config = true, .broken_le_coded = true, + .broken_le_ext_adv_report_phy = true, .send_calibration = bcm4378_send_calibration, .send_ptb = bcm4378_send_ptb, },
drivers/bluetooth/hci_h5.c +3 -1
@@ -987,8 +987,10 @@ static void h5_btrtl_open(struct h5 *h5)static void h5_btrtl_close (struct h5 *h5) { -if (!test_bit (H5_WAKEUP_DISABLE , &h5->flags)) +if (!test_bit (H5_WAKEUP_DISABLE , &h5->flags)) { +pm_runtime_dont_use_autosuspend (&h5->hu->serdev->dev);pm_runtime_disable (&h5->hu->serdev->dev); + }gpiod_set_value_cansleep (h5->device_wake_gpio,0 );gpiod_set_value_cansleep (h5->enable_gpio,0 );
drivers/bluetooth/hci_intel.c +1 -0
@@ -348,6 +348,7 @@ static int intel_set_power(struct hci_uart *hu, bool powered)devm_free_irq (&idev->pdev->dev, idev->irq, idev);device_wakeup_disable (&idev->pdev->dev); +pm_runtime_dont_use_autosuspend (&idev->pdev->dev);pm_runtime_disable (&idev->pdev->dev); } }
drivers/bluetooth/hci_ldisc.c +1 -1
@@ -451,7 +451,7 @@ static int hci_uart_setup(struct hci_dev *hdev)if (IS_ERR (skb)) {BT_ERR ("%s: Reading local version information failed (%ld)" , hdev->name,PTR_ERR (skb)); -return 0 ; +return PTR_ERR (skb); }if (skb->len !=sizeof (*ver)) {
drivers/bluetooth/hci_serdev.c +1 -1
@@ -221,7 +221,7 @@ static int hci_uart_setup(struct hci_dev *hdev)if (IS_ERR (skb)) {bt_dev_err (hdev,"Reading local version info failed (%ld)" ,PTR_ERR (skb)); -return 0 ; +return PTR_ERR (skb); }if (skb->len !=sizeof (*ver))
drivers/cdx/cdx.c +5 -2
@@ -741,7 +741,6 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)sysfs_bin_attr_init (res_attr); - cdx_dev->res_attr[num] = res_attr;sprintf (res_attr_name,"resource%d" , num); res_attr->mmap = cdx_mmap_resource;
@@ -750,8 +749,12 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num) res_attr->size =cdx_resource_len (cdx_dev, num); res_attr->private = (void *)(unsigned long )num; ret =sysfs_create_bin_file (&cdx_dev->dev.kobj, res_attr); -if (ret) +if (ret) {kfree (res_attr); +return ret; + } + + cdx_dev->res_attr[num] = res_attr;return ret; }
drivers/char/ipmi/ipmb_dev_int.c +3 -2
@@ -141,13 +141,14 @@ static ssize_t ipmb_write(struct file *file, const char __user *buf,u8 msg[MAX_MSG_LEN ];ssize_t ret; -if (count >sizeof (msg)) +if (!count || count >sizeof (msg))return -EINVAL ;if (copy_from_user (&msg, buf, count))return -EFAULT ; -if (count < msg[0 ]) +if (msg[IPMB_MSG_LEN_IDX ] <IPMB_REQUEST_LEN_MIN || + count < (size_t )msg[IPMB_MSG_LEN_IDX ] +1 )return -EINVAL ; rq_sa =GET_7BIT_ADDR (msg[RQ_SA_8BIT_IDX ]);
drivers/char/ipmi/ipmi_msghandler.c +1 -0
@@ -3692,6 +3692,7 @@ int ipmi_add_smi(struct module *owner, out_err_bmc_reg:ipmi_bmc_unregister (intf); out_err_started: + intf->in_shutdown = true;if (intf->handlers->shutdown) intf->handlers->shutdown (intf->send_info); out_err:
drivers/char/tpm/tpm_i2c_nuvoton.c +4 -2
@@ -182,8 +182,10 @@ static int i2c_nuvoton_wait_for_stat(struct tpm_chip *chip, u8 mask, u8 value, timeout);if (rc >0 )return 0 ; -/* At this point we know that the SINT pin is asserted, so we -* do not need to do i2c_nuvoton_check_status */ + +disable_irq (priv->irq); +if (rc <0 ) +return rc; }else {unsigned long ten_msec, stop;bool status_valid;
drivers/clocksource/timer-sun4i.c +1 -1
@@ -208,7 +208,7 @@ static int __init sun4i_timer_init(struct device_node *node)sun4i_timer_clear_interrupt (timer_of_base (&to));clockevents_config_and_register (&to.clkevt,timer_of_rate (&to), -TIMER_SYNC_TICKS ,0xffffffff ); +TIMER_SYNC_TICKS +1 ,0xffffffff );/* Enable timer0 interrupt */ val =readl (timer_of_base (&to) +TIMER_IRQ_EN_REG );
drivers/crypto/allwinner/Kconfig +0 -16
@@ -70,14 +70,6 @@ config CRYPTO_DEV_SUN8I_CE_HASH help Say y to enable support for hash algorithms. -config CRYPTO_DEV_SUN8I_CE_PRNG - bool "Support for Allwinner Crypto Engine PRNG" - depends on CRYPTO_DEV_SUN8I_CE - select CRYPTO_RNG - help - Select this option if you want to provide kernel-side support for - the Pseudo-Random Number Generator found in the Crypto Engine. - config CRYPTO_DEV_SUN8I_CE_TRNG bool "Support for Allwinner Crypto Engine TRNG" depends on CRYPTO_DEV_SUN8I_CE
@@ -113,14 +105,6 @@ config CRYPTO_DEV_SUN8I_SS_DEBUG This will create /sys/kernel/debug/sun8i-ss/stats for displaying the number of requests per flow and per algorithm. -config CRYPTO_DEV_SUN8I_SS_PRNG - bool "Support for Allwinner Security System PRNG" - depends on CRYPTO_DEV_SUN8I_SS - select CRYPTO_RNG - help - Select this option if you want to provide kernel-side support for - the Pseudo-Random Number Generator found in the Security System. - config CRYPTO_DEV_SUN8I_SS_HASH bool "Enable support for hash on sun8i-ss" depends on CRYPTO_DEV_SUN8I_SS
drivers/crypto/allwinner/sun8i-ce/Makefile +0 -1
@@ -1,5 +1,4 @@ obj-$(CONFIG_CRYPTO_DEV_SUN8I_CE) += sun8i-ce.o sun8i-ce-y += sun8i-ce-core.o sun8i-ce-cipher.o sun8i-ce-$(CONFIG_CRYPTO_DEV_SUN8I_CE_HASH) += sun8i-ce-hash.o -sun8i-ce-$(CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG) += sun8i-ce-prng.o sun8i-ce-$(CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG) += sun8i-ce-trng.o
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +0 -57
141 lines not on this page · raw message
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c deleted +0 -159
159 lines not on this page · raw message
drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h +0 -29
@@ -15,7 +15,6 @@#include <linux/hw_random.h> #include <crypto/internal/hash.h> #include <crypto/md5.h> -#include <crypto/rng.h> #include <crypto/sha1.h> #include <crypto/sha2.h>
@@ -58,9 +57,7 @@#define CE_ALG_SHA384 20#define CE_ALG_SHA512 21#define CE_ALG_TRNG 48 -#define CE_ALG_PRNG 49#define CE_ALG_TRNG_V2 0x1c -#define CE_ALG_PRNG_V2 0x1d/* Used in ce_variant */ #define CE_ID_NOTSUPP 0xFF
@@ -96,10 +93,6 @@#define ESR_H6 4#define ESR_D1 5 -#define PRNG_DATA_SIZE (160 / 8) -#define PRNG_SEED_SIZE DIV_ROUND_UP(175, 8) -#define PRNG_LD BIT(17) -#define CE_DIE_ID_SHIFT 16#define CE_DIE_ID_MASK 0x07
@@ -133,13 +126,10 @@ struct ce_clock {* bytes or words * @hash_t_dlen_in_bytes: Does the request size for hash is in * bits or words -* @prng_t_dlen_in_bytes: Does the request size for PRNG is in -* bytes or words * @trng_t_dlen_in_bytes: Does the request size for TRNG is in * bytes or words * @ce_clks: list of clocks needed by this variant * @esr: The type of error register -* @prng: The CE_ALG_XXX value for the PRNG * @trng: The CE_ALG_XXX value for the TRNG */ struct ce_variant {
@@ -148,12 +138,10 @@ struct ce_variant {u32 op_mode[CE_ID_OP_MAX ];bool cipher_t_dlen_in_bytes;bool hash_t_dlen_in_bits; -bool prng_t_dlen_in_bytes;bool trng_t_dlen_in_bytes;bool needs_word_addresses;struct ce_clock ce_clks[CE_MAX_CLOCKS ];int esr; -unsigned char prng;unsigned char trng; };
@@ -312,16 +300,6 @@ struct sun8i_ce_hash_reqctx {struct ahash_request fallback_req;// keep at the end }; -/* -* struct sun8i_ce_prng_ctx - context for PRNG TFM -* @seed: The seed to use -* @slen: The size of the seed -*/ -struct sun8i_ce_rng_tfm_ctx { -void *seed; -unsigned int slen; -}; -/* * struct sun8i_ce_alg_template - crypto_alg template * @type: the CRYPTO_ALG_TYPE for this template
@@ -342,7 +320,6 @@ struct sun8i_ce_alg_template {union {struct skcipher_engine_alg skcipher;struct ahash_engine_alg hash; -struct rng_alg rng; } alg;unsigned long stat_req;unsigned long stat_fb;
@@ -383,11 +360,5 @@ int sun8i_ce_hash_finup(struct ahash_request *areq);int sun8i_ce_hash_digest (struct ahash_request *areq);int sun8i_ce_hash_run (struct crypto_engine *engine,void *breq); -int sun8i_ce_prng_generate (struct crypto_rng *tfm,const u8 *src, -unsigned int slen,u8 *dst,unsigned int dlen); -int sun8i_ce_prng_seed (struct crypto_rng *tfm,const u8 *seed,unsigned int slen); -void sun8i_ce_prng_exit (struct crypto_tfm *tfm); -int sun8i_ce_prng_init (struct crypto_tfm *tfm); -int sun8i_ce_hwrng_register (struct sun8i_ce_dev *ce);void sun8i_ce_hwrng_unregister (struct sun8i_ce_dev *ce);
drivers/crypto/allwinner/sun8i-ss/Makefile +0 -1
@@ -1,4 +1,3 @@ obj-$(CONFIG_CRYPTO_DEV_SUN8I_SS) += sun8i-ss.o sun8i-ss-y += sun8i-ss-core.o sun8i-ss-cipher.o -sun8i-ss-$(CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG) += sun8i-ss-prng.o sun8i-ss-$(CONFIG_CRYPTO_DEV_SUN8I_SS_HASH) += sun8i-ss-hash.o
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +0 -39
@@ -11,7 +11,6 @@*/ #include <crypto/engine.h> -#include <crypto/internal/rng.h> #include <crypto/internal/skcipher.h> #include <linux/clk.h> #include <linux/delay.h>
@@ -283,25 +282,6 @@ static struct sun8i_ss_alg_template ss_algs[] = { .do_one_request = sun8i_ss_handle_cipher_request, }, }, -#ifdef CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG -{ - .type = CRYPTO_ALG_TYPE_RNG, - .alg.rng = { - .base = { - .cra_name = "stdrng", - .cra_driver_name = "sun8i-ss-prng", - .cra_priority = 300, - .cra_ctxsize = sizeof(struct sun8i_ss_rng_tfm_ctx), - .cra_module = THIS_MODULE, - .cra_init = sun8i_ss_prng_init, - .cra_exit = sun8i_ss_prng_exit, - }, - .generate = sun8i_ss_prng_generate, - .seed = sun8i_ss_prng_seed, - .seedsize =PRNG_SEED_SIZE , - } -}, -#endif#ifdef CONFIG_CRYPTO_DEV_SUN8I_SS_HASH { .type = CRYPTO_ALG_TYPE_AHASH, .ss_algo_id = SS_ID_HASH_MD5,
@@ -501,12 +481,6 @@ static int sun8i_ss_debugfs_show(struct seq_file *seq, void *v)seq_printf (seq,"\tFallback due to SG numbers: %lu\n" , ss_algs[i].stat_fb_sgnum);break ; -case CRYPTO_ALG_TYPE_RNG : -seq_printf (seq,"%s %s reqs=%lu tsize=%lu\n" , - ss_algs[i].alg.rng.base.cra_driver_name, - ss_algs[i].alg.rng.base.cra_name, - ss_algs[i].stat_req, ss_algs[i].stat_bytes); -break ;case CRYPTO_ALG_TYPE_AHASH : seq_printf(seq, "%s %s reqs=%lu fallback=%lu\n", ss_algs[i].alg.hash.base.halg.base.cra_driver_name,
@@ -707,14 +681,6 @@ static int sun8i_ss_register_algs(struct sun8i_ss_dev *ss)return err; }break ; -case CRYPTO_ALG_TYPE_RNG : - err =crypto_register_rng (&ss_algs[i].alg.rng); -if (err) { -dev_err (ss->dev,"Fail to register %s\n" , - ss_algs[i].alg.rng.base.cra_name); - ss_algs[i].ss =NULL ; - } -break ;case CRYPTO_ALG_TYPE_AHASH : id = ss_algs[i].ss_algo_id; ss_method = ss->variant->alg_hash[id];
@@ -756,11 +722,6 @@ static void sun8i_ss_unregister_algs(struct sun8i_ss_dev *ss) ss_algs[i].alg.skcipher.base.base.cra_name);crypto_engine_unregister_skcipher (&ss_algs[i].alg.skcipher);break ; -case CRYPTO_ALG_TYPE_RNG : -dev_info (ss->dev,"Unregister %d %s\n" , i, - ss_algs[i].alg.rng.base.cra_name); -crypto_unregister_rng (&ss_algs[i].alg.rng); -break ;case CRYPTO_ALG_TYPE_AHASH :dev_info (ss->dev,"Unregister %d %s\n" , i, ss_algs[i].alg.hash.base.halg.base.cra_name);
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c deleted +0 -177
177 lines not on this page · raw message
drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +0 -23
@@ -8,7 +8,6 @@#include <crypto/aes.h> #include <crypto/des.h> #include <crypto/engine.h> -#include <crypto/rng.h> #include <crypto/skcipher.h> #include <linux/atomic.h> #include <linux/debugfs.h>
@@ -27,7 +26,6 @@#define SS_ALG_DES (1 << 2)#define SS_ALG_3DES (2 << 2)#define SS_ALG_MD5 (3 << 2) -#define SS_ALG_PRNG (4 << 2)#define SS_ALG_SHA1 (6 << 2)#define SS_ALG_SHA224 (7 << 2)#define SS_ALG_SHA256 (8 << 2)
@@ -68,8 +66,6 @@#define SS_FLOW0 BIT(30)#define SS_FLOW1 BIT(31) -#define SS_PRNG_CONTINUE BIT(18) -#define MAX_SG 8#define MAXFLOW 2
@@ -79,9 +75,6 @@#define SS_DIE_ID_SHIFT 20#define SS_DIE_ID_MASK 0x07 -#define PRNG_DATA_SIZE (160 / 8) -#define PRNG_SEED_SIZE DIV_ROUND_UP(175, 8) -#define MAX_PAD_SIZE 4096/*
@@ -213,16 +206,6 @@ struct sun8i_cipher_tfm_ctx {struct crypto_skcipher *fallback_tfm; }; -/* -* struct sun8i_ss_prng_ctx - context for PRNG TFM -* @seed: The seed to use -* @slen: The size of the seed -*/ -struct sun8i_ss_rng_tfm_ctx { -void *seed; -unsigned int slen; -}; -/* * struct sun8i_ss_hash_tfm_ctx - context for an ahash TFM * @fallback_tfm: pointer to the fallback TFM
@@ -272,7 +255,6 @@ struct sun8i_ss_alg_template {struct sun8i_ss_dev *ss;union {struct skcipher_engine_alg skcipher; -struct rng_alg rng;struct ahash_engine_alg hash; } alg;unsigned long stat_req;
@@ -298,11 +280,6 @@ int sun8i_ss_skencrypt(struct skcipher_request *areq);int sun8i_ss_get_engine_number (struct sun8i_ss_dev *ss);int sun8i_ss_run_task (struct sun8i_ss_dev *ss,struct sun8i_cipher_req_ctx *rctx,const char *name); -int sun8i_ss_prng_generate (struct crypto_rng *tfm,const u8 *src, -unsigned int slen,u8 *dst,unsigned int dlen); -int sun8i_ss_prng_seed (struct crypto_rng *tfm,const u8 *seed,unsigned int slen); -int sun8i_ss_prng_init (struct crypto_tfm *tfm); -void sun8i_ss_prng_exit (struct crypto_tfm *tfm);int sun8i_ss_hash_init_tfm (struct crypto_ahash *tfm);void sun8i_ss_hash_exit_tfm (struct crypto_ahash *tfm);
drivers/cxl/core/pmem.c +6 -4
@@ -221,12 +221,14 @@ static struct cxl_nvdimm *cxl_nvdimm_alloc(struct cxl_nvdimm_bridge *cxl_nvb, dev->bus = &cxl_bus_type; dev->type = &cxl_nvdimm_type;/* -* A "%llx" string is 17-bytes vs dimm_id that is max -* NVDIMM_KEY_DESC_LEN +* dev_id is the nvdimm dimm_id used for security key lookup. +* It must match id_show(), which emits the CXL serial as an +* unsigned decimal. A u64 decimal string is at most 20 digits +* plus NUL. */ -BUILD_BUG_ON (sizeof (cxl_nvd->dev_id) <17 || +BUILD_BUG_ON (sizeof (cxl_nvd->dev_id) <21 ||sizeof (cxl_nvd->dev_id) >NVDIMM_KEY_DESC_LEN ); -sprintf (cxl_nvd->dev_id,"%llx" , cxlmd->cxlds->serial); +sprintf (cxl_nvd->dev_id,"%llu" , cxlmd->cxlds->serial);return cxl_nvd; }
drivers/cxl/cxl.h +2 -1
@@ -547,7 +547,8 @@ struct cxl_nvdimm_bridge {struct nvdimm_bus_descriptor nd_desc; }; -#define CXL_DEV_ID_LEN 19 +/* Holds a u64 serial as a decimal string: up to 20 digits + NUL */ +#define CXL_DEV_ID_LEN 21struct cxl_nvdimm {struct device dev;
drivers/cxl/pmem.c +1 -1
@@ -38,7 +38,7 @@ static ssize_t id_show(struct device *dev, struct device_attribute *attr, char *struct cxl_nvdimm *cxl_nvd =nvdimm_provider_data (nvdimm);struct cxl_dev_state *cxlds = cxl_nvd->cxlmd->cxlds; -return sysfs_emit (buf,"%lld\n" , cxlds->serial); +return sysfs_emit (buf,"%llu\n" , cxlds->serial); }static DEVICE_ATTR_RO (id);
drivers/fpga/altera-cvp.c +6 -4
@@ -16,6 +16,7 @@#include <linux/module.h> #include <linux/pci.h> #include <linux/sizes.h> +#include <linux/string.h> #define CVP_BAR 0/* BAR used for data transfer in memory mode */ #define CVP_DUMMY_WR 244/* dummy writes to clear CvP state machine */
@@ -264,7 +265,7 @@ static int altera_cvp_v2_wait_for_credit(struct fpga_manager *mgr,static int altera_cvp_send_block (struct altera_cvp_conf *conf,const u32 *data,size_t len) { -u32 mask, words = len /sizeof (u32); +u32 words = len /sizeof (u32);int i, remainder;for (i =0 ; i < words; i++)
@@ -273,9 +274,10 @@ static int altera_cvp_send_block(struct altera_cvp_conf *conf,/* write up to 3 trailing bytes, if any */ remainder = len %sizeof (u32);if (remainder) { - mask =BIT (remainder *8 ) -1 ; -if (mask) - conf->write_data (conf, *data & mask); +u32 word =0 ; + +memcpy (&word, data, remainder); + conf->write_data (conf, word); }return 0 ;
drivers/fpga/stratix10-soc.c +12 -9
@@ -195,20 +195,18 @@ static int s10_ops_write_init(struct fpga_manager *mgr, ret =s10_svc_send_msg (priv,COMMAND_RECONFIG , &ctype,sizeof (ctype));if (ret <0 ) - goto init_done; + goto init_error; - ret =wait_for_completion_timeout ( - &priv->status_return_completion,S10_RECONFIG_TIMEOUT ); -if (!ret) { +if (!wait_for_completion_timeout (&priv->status_return_completion, +S10_RECONFIG_TIMEOUT )) {dev_err (dev,"timeout waiting for RECONFIG_REQUEST\n" ); ret = -ETIMEDOUT ; - goto init_done; + goto init_error; } - ret =0 ;if (!test_and_clear_bit (SVC_STATUS_OK , &priv->status)) { ret = -ETIMEDOUT ; - goto init_done; + goto init_error; }/* Allocate buffers from the service layer's pool. */
@@ -217,14 +215,16 @@ static int s10_ops_write_init(struct fpga_manager *mgr,if (IS_ERR (kbuf)) {s10_free_buffers (mgr); ret =PTR_ERR (kbuf); - goto init_done; + goto init_error; } priv->svc_bufs[i].buf = kbuf; priv->svc_bufs[i].lock =0 ; } -init_done: +return 0 ; + +init_error:stratix10_svc_done (priv->chan);return ret; }
@@ -342,6 +342,9 @@ static int s10_ops_write(struct fpga_manager *mgr, const char *buf,if (!s10_free_buffers (mgr))dev_err (dev,"%s not all buffers were freed\n" , __func__); +if (ret <0 ) +stratix10_svc_done (priv->chan); +return ret; }
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +8 -2
@@ -935,7 +935,10 @@ void dc_dmub_srv_log_diagnostic_data(struct dc_dmub_srv *dc_dmub_srv)struct dmub_diagnostic_data diag_data = {0 };uint32_t i; -if (!dc_dmub_srv || !dc_dmub_srv->dmub) { +if (!dc_dmub_srv) +return ; + +if (!dc_dmub_srv->dmub) {DC_LOG_ERROR ("%s: invalid parameters." , __func__);return ; }
@@ -1179,7 +1182,10 @@ void dc_dmub_srv_enable_dpia_trace(const struct dc *dc) {struct dc_dmub_srv *dc_dmub_srv = dc->ctx->dmub_srv; -if (!dc_dmub_srv || !dc_dmub_srv->dmub) { +if (!dc_dmub_srv) +return ; + +if (!dc_dmub_srv->dmub) {DC_LOG_ERROR ("%s: invalid parameters." , __func__);return ; }
drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +1 -1
@@ -852,7 +852,7 @@ static void populate_dummy_dml_surface_cfg(struct dml_surface_cfg_st *out, unsig out->SurfaceWidthC[location] = in->timing.h_addressable; out->SurfaceHeightC[location] = in->timing.v_addressable; out->PitchY[location] = ((out->SurfaceWidthY[location] +127 ) /128 ) *128 ; - out->PitchC[location] =0 ; + out->PitchC[location] =1 ; out->DCCEnable[location] = false; out->DCCMetaPitchY[location] =0 ; out->DCCMetaPitchC[location] =0 ;
drivers/gpu/drm/nouveau/nouveau_gem.c +10 -1
@@ -313,11 +313,20 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem, rep->offset = nvbo->offset;if (vmm->vmm.object.oclass >=NVIF_CLASS_VMM_NV50 && !nouveau_cli_uvmm (cli)) { +int ret; + + ret =ttm_bo_reserve (&nvbo->bo, false, false,NULL ); +if (ret) +return ret; + vma =nouveau_vma_find (nvbo, vmm); -if (!vma) +if (!vma) { +ttm_bo_unreserve (&nvbo->bo);return -EINVAL ; + } rep->offset = vma->addr; +ttm_bo_unreserve (&nvbo->bo); }else rep->offset =0 ;
drivers/hid/hid-mcp2221.c +9 -0
@@ -759,6 +759,9 @@ static int mcp2221_raw_event(struct hid_device *hdev,u8 *buf;struct mcp2221 *mcp =hid_get_drvdata (hdev); +if (size <4 ) +return 0 ; +switch (data[0 ]) {case MCP2221_I2C_WR_DATA :
@@ -820,6 +823,10 @@ static int mcp2221_raw_event(struct hid_device *hdev, mcp->status = -EINVAL ;break ; } +if (4 + data[3 ] > size) { + mcp->status = -EINVAL ; +break ; + } buf = mcp->rxbuf;memcpy (&buf[mcp->rxbuf_idx], &data[4 ], data[3 ]); mcp->rxbuf_idx = mcp->rxbuf_idx + data[3 ];
@@ -943,6 +950,8 @@ static void mcp2221_hid_unregister(void *ptr) {struct hid_device *hdev = ptr; +if (hdev->io_started) +hid_device_io_stop (hdev);hid_hw_close (hdev);hid_hw_stop (hdev); }
drivers/hid/hid-picolcd_debugfs.c +9 -0
@@ -98,6 +98,15 @@ static ssize_t picolcd_debug_eeprom_read(struct file *f, char __user *u, ret = resp->raw_data[2 ];if (ret > s) ret = s; +/* +* raw_data[2] is a device-supplied length; also clamp it to +* what picolcd_raw_event() actually stored (raw_size), or a +* hostile device overruns the raw_data[] buffer. +*/ +if (ret > resp->raw_size -3 ) + ret = resp->raw_size -3 ; +if (ret <0 ) + ret =0 ;if (copy_to_user (u, resp->raw_data+3 , ret)) ret = -EFAULT ;else
drivers/hid/hid-roccat.c +11 -2
@@ -70,6 +70,15 @@ static struct roccat_device *devices[ROCCAT_MAX_DEVICES];/* protects modifications of devices array */ static DEFINE_MUTEX (devices_lock); +static void roccat_free_device (struct roccat_device *device) +{ +int i; + +for (i =0 ; i <ROCCAT_CBUF_SIZE ; i++) +kfree (device->cbuf[i].value); +kfree (device); +} +static ssize_t roccat_read (struct file *file,char __user *buffer,size_t count,loff_t *ppos) {
@@ -226,7 +235,7 @@ static int roccat_release(struct inode *inode, struct file *file)hid_hw_power (device->hid,PM_HINT_NORMAL );hid_hw_close (device->hid); }else { -kfree (device); +roccat_free_device (device); } }
@@ -374,7 +383,7 @@ void roccat_disconnect(int minor)hid_hw_close (device->hid);wake_up_interruptible (&device->wait); }else { -kfree (device); +roccat_free_device (device); } }EXPORT_SYMBOL_GPL (roccat_disconnect);
drivers/hid/hid-sensor-custom.c +8 -1
@@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom &sensor_inst->fields[i]. hid_custom_attribute_group);if (ret) -break ; + goto err_remove_groups;/* For power or report field store indexes */ if (sensor_inst->fields[i].attribute.attrib_id ==
@@ -621,6 +621,13 @@ static int hid_sensor_custom_add_attributes(struct hid_sensor_custom }return ret; + +err_remove_groups: +while (--i >=0 ) +sysfs_remove_group (&sensor_inst->pdev->dev.kobj, + &sensor_inst->fields[i].hid_custom_attribute_group); +kfree (sensor_inst->fields); +return ret; } static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *
drivers/hid/hid-sensor-hub.c +25 -17
63 lines not on this page · raw message
drivers/hsi/controllers/omap_ssi_core.c +6 -0
@@ -502,6 +502,12 @@ static int ssi_probe(struct platform_device *pd)pm_runtime_enable (&pd->dev); + ssi->device.dma_mask = &ssi->device.coherent_dma_mask; + + err =dma_set_mask_and_coherent (&ssi->device,DMA_BIT_MASK (32 )); +if (err) + goto out2; + err =ssi_hw_init (ssi);if (err <0 ) goto out2;
drivers/hwmon/max6621.c +4 -4
@@ -17,8 +17,8 @@#define MAX6621_DRV_NAME "max6621"#define MAX6621_TEMP_INPUT_REG_NUM 9 -#define MAX6621_TEMP_INPUT_MIN -127000 -#define MAX6621_TEMP_INPUT_MAX 128000 +#define MAX6621_TEMP_INPUT_MIN -128000 +#define MAX6621_TEMP_INPUT_MAX 127000#define MAX6621_TEMP_ALERT_CHAN_SHIFT 1#define MAX6621_TEMP_S0D0_REG 0x00
@@ -239,7 +239,7 @@ max6621_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,if (ret)return ret; - *val = (regval >>MAX6621_REG_TEMP_SHIFT ) * + *val = ((s16 )regval >>MAX6621_REG_TEMP_SHIFT ) *1000L ;break ;
@@ -254,7 +254,7 @@ max6621_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,if (ret)return ret; - *val = regval *1000L ; + *val = (s16 )regval *1000L ;break ;case hwmon_temp_crit_alarm:
drivers/hwtracing/coresight/coresight-etm3x-sysfs.c +4 -11
@@ -717,26 +717,19 @@ static DEVICE_ATTR_RW(cntr_rld_event);static ssize_t cntr_val_show (struct device *dev,struct device_attribute *attr,char *buf) { -int i, ret =0 ;u32 val;struct etm_drvdata *drvdata =dev_get_drvdata (dev->parent);struct etm_config *config = &drvdata->config;if (!coresight_get_mode (drvdata->csdev)) {spin_lock (&drvdata->spinlock); -for (i =0 ; i < drvdata->nr_cntr; i++) - ret +=sprintf (buf,"counter %d: %x\n" , - i, config->cntr_val[i]); + val = config->cntr_val[config->cntr_idx];spin_unlock (&drvdata->spinlock); -return ret; - } - -for (i =0 ; i < drvdata->nr_cntr; i++) { - val =etm_readl (drvdata,ETMCNTVRn (i)); - ret +=sprintf (buf,"counter %d: %x\n" , i, val); + }else { + val =etm_readl (drvdata,ETMCNTVRn (config->cntr_idx)); } -return ret; +return sysfs_emit (buf,"%#x\n" , val); } static ssize_t cntr_val_store(struct device *dev,
drivers/hwtracing/ptt/hisi_ptt.c +13 -7
@@ -171,13 +171,13 @@ static bool hisi_ptt_wait_trace_hw_idle(struct hisi_ptt *hisi_ptt) HISI_PTT_WAIT_TRACE_TIMEOUT_US); } -static void hisi_ptt_wait_dma_reset_done (struct hisi_ptt *hisi_ptt) +static bool hisi_ptt_wait_dma_reset_done (struct hisi_ptt *hisi_ptt) {u32 val; -readl_poll_timeout_atomic (hisi_ptt->iobase +HISI_PTT_TRACE_WR_STS , - val, !val,HISI_PTT_RESET_POLL_INTERVAL_US , -HISI_PTT_RESET_TIMEOUT_US ); +return !readl_poll_timeout_atomic (hisi_ptt->iobase +HISI_PTT_TRACE_WR_STS , + val, !val,HISI_PTT_RESET_POLL_INTERVAL_US , +HISI_PTT_RESET_TIMEOUT_US ); }static void hisi_ptt_trace_end (struct hisi_ptt *hisi_ptt)
@@ -202,14 +202,18 @@ static int hisi_ptt_trace_start(struct hisi_ptt *hisi_ptt)return -EBUSY ; } - ctrl->started = true; -/* Reset the DMA before start tracing */ val =readl (hisi_ptt->iobase +HISI_PTT_TRACE_CTRL ); val |=HISI_PTT_TRACE_CTRL_RST ;writel (val, hisi_ptt->iobase +HISI_PTT_TRACE_CTRL ); -hisi_ptt_wait_dma_reset_done (hisi_ptt); +if (!hisi_ptt_wait_dma_reset_done (hisi_ptt)) { +pci_err (hisi_ptt->pdev,"timed out waiting for DMA reset\n" ); + val =readl (hisi_ptt->iobase +HISI_PTT_TRACE_CTRL ); + val &= ~HISI_PTT_TRACE_CTRL_RST ; +writel (val, hisi_ptt->iobase +HISI_PTT_TRACE_CTRL ); +return -ETIMEDOUT ; + } val =readl (hisi_ptt->iobase +HISI_PTT_TRACE_CTRL ); val &= ~HISI_PTT_TRACE_CTRL_RST ;
@@ -234,6 +238,8 @@ static int hisi_ptt_trace_start(struct hisi_ptt *hisi_ptt)if (!hisi_ptt->trace_ctrl.is_port) val |=HISI_PTT_TRACE_CTRL_FILTER_MODE ; + ctrl->started = true; +/* Start the Trace */ val |=HISI_PTT_TRACE_CTRL_EN ;writel (val, hisi_ptt->iobase +HISI_PTT_TRACE_CTRL );
drivers/i3c/master.c +5 -4
@@ -2546,11 +2546,12 @@ static void i3c_master_unregister_i3c_devs(struct i3c_master_controller *master)if (!i3cdev->dev)continue ; - i3cdev->dev->desc =NULL ; -if (device_is_registered (&i3cdev->dev->dev)) +if (device_is_registered (&i3cdev->dev->dev)) { +get_device (&i3cdev->dev->dev);device_unregister (&i3cdev->dev->dev); -else -put_device (&i3cdev->dev->dev); + } + i3cdev->dev->desc =NULL ; +put_device (&i3cdev->dev->dev); i3cdev->dev =NULL ; } }
drivers/i3c/master/svc-i3c-master.c +9 -1
@@ -388,14 +388,22 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master, buf = slot->data;while (SVC_I3C_MSTATUS_RXPEND (readl (master->regs +SVC_I3C_MSTATUS )) && - slot->len <SVC_I3C_FIFO_SIZE ) { + slot->len < dev->ibi->max_payload_len) { mdatactrl =readl (master->regs +SVC_I3C_MDATACTRL ); count =SVC_I3C_MDATACTRL_RXCOUNT (mdatactrl); + count =min (count, dev->ibi->max_payload_len - slot->len);readsb (master->regs +SVC_I3C_MRDATAB , buf, count); slot->len += count; buf += count; } +/* +* The device may have sent more than the requested payload. Drop the +* extra bytes so they do not leak into the next transfer. +*/ +if (SVC_I3C_MSTATUS_RXPEND (readl (master->regs +SVC_I3C_MSTATUS ))) +writel (SVC_I3C_MDATACTRL_FLUSHRB , master->regs +SVC_I3C_MDATACTRL ); + master->ibi.tbq_slot = slot;return 0 ;
drivers/infiniband/core/ucma.c +4 -1
@@ -1335,7 +1335,10 @@ static int ucma_set_ib_path(struct ucma_context *ctx,memset (&event,0 ,sizeof event); event.event =RDMA_CM_EVENT_ROUTE_RESOLVED ; -return ucma_event_handler (ctx->cm_id, &event); +rdma_lock_handler (ctx->cm_id); + ret =ucma_event_handler (ctx->cm_id, &event); +rdma_unlock_handler (ctx->cm_id); +return ret; } static int ucma_set_option_ib(struct ucma_context *ctx, int optname,
drivers/infiniband/hw/cxgb4/device.c +6 -0
@@ -953,6 +953,12 @@ void c4iw_dealloc(struct uld_ctx *ctx)static void c4iw_remove (struct uld_ctx *ctx) {pr_debug ("c4iw_dev %p\n" , ctx->dev); + +/* c4iw_register_device() may still be using ctx->dev. */ +cancel_work_sync (&ctx->reg_work); +if (!ctx->dev) +return ; +debugfs_remove_recursive (ctx->dev->debugfs_root);c4iw_unregister_device (ctx->dev);c4iw_dealloc (ctx);
drivers/interconnect/core.c +4 -3
@@ -526,7 +526,7 @@ struct icc_path *of_icc_get_by_index(struct device *dev, int idx) path->name =kasprintf (GFP_KERNEL ,"%s-%s" , src_data->node->name, dst_data->node->name);if (!path->name) { -kfree (path); +icc_put (path); path =ERR_PTR (-ENOMEM ); }
@@ -624,8 +624,9 @@ struct icc_path *icc_get(struct device *dev, const char *src, const char *dst) path->name =kasprintf (GFP_KERNEL ,"%s-%s" , src_node->name, dst_node->name);if (!path->name) { -kfree (path); - path =ERR_PTR (-ENOMEM ); +mutex_unlock (&icc_lock); +icc_put (path); +return ERR_PTR (-ENOMEM ); } out:mutex_unlock (&icc_lock);
drivers/iommu/amd/init.c +30 -6
@@ -3219,7 +3219,7 @@ static bool __init detect_ivrs(void)return true; } -static void iommu_snp_enable (void ) +static __init void iommu_snp_enable (void ) {#ifdef CONFIG_KVM_AMD_SEV if (!cc_platform_has (CC_ATTR_HOST_SEV_SNP ))
@@ -3244,6 +3244,14 @@ static void iommu_snp_enable(void) goto disable_snp; } +/* +* Enable host SNP support once SNP support is checked on IOMMU. +*/ +if (snp_rmptable_init ()) { +pr_warn ("SNP: RMP initialization failed, SNP cannot be supported.\n" ); + goto disable_snp; + } +pr_info ("IOMMU SNP support enabled.\n" );return ;
@@ -3381,6 +3389,19 @@ static int __init iommu_go_to_state(enum iommu_init_state state) ret =state_next (); } +/* +* SNP platform initilazation requires IOMMUs to be fully configured. +* If the SNP support on IOMMUs has NOT been checked, simply mark SNP +* as unsupported. If the SNP support on IOMMUs has been checked and +* host SNP support enabled but RMP enforcement has not been enabled +* in IOMMUs, then the system is in a half-baked state, but can limp +* along as all memory should be Hypervisor-Owned in the RMP. WARN, +* but leave SNP as "supported" to avoid confusing the kernel. +*/ +if (ret &&cc_platform_has (CC_ATTR_HOST_SEV_SNP ) && + !WARN_ON_ONCE (amd_iommu_snp_en)) +cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); +return ret; }
@@ -3484,25 +3505,28 @@ static bool amd_iommu_sme_check(void)* IOMMUs * ****************************************************************************/ -int __init amd_iommu_detect (void ) +void __init amd_iommu_detect (void ) {int ret;if (no_iommu || (iommu_detected && !gart_iommu_aperture)) -return -ENODEV ; + goto disable_snp;if (!amd_iommu_sme_check ()) -return -ENODEV ; + goto disable_snp; ret =iommu_go_to_state (IOMMU_IVRS_DETECTED );if (ret) -return ret; + goto disable_snp; amd_iommu_detected = true; iommu_detected =1 ; x86_init.iommu.iommu_init = amd_iommu_init; +return ; -return 1 ; +disable_snp: +if (cc_platform_has (CC_ATTR_HOST_SEV_SNP )) +cc_platform_clear (CC_ATTR_HOST_SEV_SNP ); }/****************************************************************************
drivers/iommu/amd/ppr.c +2 -1
@@ -151,7 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)/* Submit event */ iommu_report_device_fault (&pdev->dev, &event); - +pci_dev_put (pdev);return ; out:
@@ -159,6 +159,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)amd_iommu_complete_ppr (&pdev->dev,PPR_PASID (raw[0 ]),IOMMU_PAGE_RESP_FAILURE ,PPR_TAG (raw[0 ]) &0x1FF ); +pci_dev_put (pdev); }void amd_iommu_poll_ppr_log (struct amd_iommu *iommu)
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +40 -16
111 lines not on this page · raw message
drivers/iommu/intel/dmar.c +13 -2
@@ -915,6 +915,18 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg)return 0 ; } +static bool dmar_required (void ) +{ +/* tboot supersedes any user/platform opt */ +if (!intel_iommu_tboot_noforce &&tboot_enabled ()) +return true; + +if (!no_iommu && (!dmar_disabled ||dmar_platform_optin ())) +return true; + +return false; +} +void __init detect_intel_iommu (void ) {int ret;
@@ -928,8 +940,7 @@ void __init detect_intel_iommu(void)if (!ret) ret =dmar_walk_dmar_table ((struct acpi_table_dmar *)dmar_tbl, &validate_drhd_cb); -if (!ret && !no_iommu && !iommu_detected && - (!dmar_disabled ||dmar_platform_optin ())) { +if (!ret && !iommu_detected &&dmar_required ()) { iommu_detected =1 ;/* Make sure ACS will be enabled */ pci_request_acs ();
drivers/iommu/intel/iommu.c +4 -4
@@ -63,7 +63,7 @@ static int rwbf_quirk;* (used when kernel is launched w/ TXT) */ static int force_on =0 ; -static int intel_iommu_tboot_noforce; +int intel_iommu_tboot_noforce;static int no_platform_optin;#define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
@@ -3156,10 +3156,11 @@ static bool has_external_pci(void)static int __init platform_optin_force_iommu (void ) { -if (!dmar_platform_optin () || no_platform_optin || !has_external_pci ()) +if (no_iommu || !dmar_platform_optin () || no_platform_optin || + !has_external_pci ())return 0 ; -if (no_iommu || dmar_disabled) +if (dmar_disabled)pr_info ("Intel-IOMMU force enabled due to platform opt in\n" );/*
@@ -3170,7 +3171,6 @@ static int __init platform_optin_force_iommu(void)iommu_set_default_passthrough (false); dmar_disabled =0 ; - no_iommu =0 ;return 1 ; }
drivers/iommu/intel/iommu.h +2 -0
@@ -1352,6 +1352,7 @@ static inline bool ecmd_has_pmu_essential(struct intel_iommu *iommu)extern int dmar_disabled;extern int intel_iommu_enabled; +extern int intel_iommu_tboot_noforce;#else static inline int iommu_calculate_agaw (struct intel_iommu *iommu) {
@@ -1364,6 +1365,7 @@ static inline int iommu_calculate_max_sagaw(struct intel_iommu *iommu)#define dmar_disabled (1)#define intel_iommu_enabled (0)#define intel_iommu_sm (0) +#define intel_iommu_tboot_noforce (0)#endif static inline const char *decode_prq_descriptor(char *str, size_t size,
drivers/iommu/iommu-sva.c +1 -1
@@ -142,8 +142,8 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm out:refcount_set (&handle->users,1 ); -mutex_unlock (&iommu_sva_lock); handle->dev = dev; +mutex_unlock (&iommu_sva_lock);return handle; out_free_domain:
drivers/mailbox/qcom-ipcc.c +11 -6
@@ -165,7 +165,7 @@ static struct mbox_chan *qcom_ipcc_mbox_xlate(struct mbox_controller *mbox, {struct qcom_ipcc *ipcc =to_qcom_ipcc (mbox);struct qcom_ipcc_chan_info *mchan; -struct mbox_chan *chan; +struct mbox_chan *chan, *free_chan =NULL ;struct device *dev;int chan_id;
Lines of this file are not shown. View the raw message.
drivers/md/persistent-data/dm-array.c +45 -8
53 lines not on this page · raw message
drivers/media/cec/platform/stm32/stm32-cec.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/media/test-drivers/vicodec/vicodec-core.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +3 -0
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/broadcom/bnxt/bnxt.h +2 -0
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +1 -2
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/nvidia/forcedeth.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/qlogic/qede/qede.h +4 -4
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/qlogic/qede/qede_fp.c +1 -0
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/renesas/ravb_main.c +6 -3
Lines of this file are not shown. View the raw message.
drivers/net/ethernet/renesas/ravb_ptp.c +38 -6
44 lines not on this page · raw message
drivers/net/wireless/ath/ath11k/mac.c +17 -11
Lines of this file are not shown. View the raw message.
drivers/net/wireless/ath/ath6kl/cfg80211.c +5 -0
Lines of this file are not shown. View the raw message.
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +12 -0
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt7615/main.c +3 -2
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +12 -4
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +1 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtl8xxxu/core.c +14 -5
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c +9 -3
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtlwifi/rtl8192du/trx.c +2 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw88/pci.c +3 -1
Lines of this file are not shown. View the raw message.
drivers/net/wireless/realtek/rtw88/tx.c +1 -0
Lines of this file are not shown. View the raw message.
drivers/nvme/host/tcp.c +44 -1
45 lines not on this page · raw message
drivers/pci/controller/plda/pcie-plda-host.c +42 -10
52 lines not on this page · raw message
drivers/platform/chrome/cros_ec_sensorhub_ring.c +15 -4
Lines of this file are not shown. View the raw message.
drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c +0 -1
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +14 -4
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/bioscfg.h +8 -0
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c +11 -4
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/int-attributes.c +5 -1
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c +10 -4
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c +10 -4
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/platform/x86/hp/hp-bioscfg/string-attributes.c +5 -1
Lines of this file are not shown. View the raw message.
drivers/platform/x86/intel/ishtp_eclite.c +4 -1
Lines of this file are not shown. View the raw message.
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c +71 -6
77 lines not on this page · raw message
drivers/power/supply/bq256xx_charger.c +15 -14
Lines of this file are not shown. View the raw message.
drivers/power/supply/bq25890_charger.c +12 -0
Lines of this file are not shown. View the raw message.
drivers/power/supply/charger-manager.c +39 -15
54 lines not on this page · raw message
drivers/power/supply/cros_usbpd-charger.c +15 -2
Lines of this file are not shown. View the raw message.
drivers/power/supply/max17040_battery.c +22 -10
Lines of this file are not shown. View the raw message.
drivers/power/supply/twl4030_charger.c +10 -2
Lines of this file are not shown. View the raw message.
drivers/rapidio/devices/rio_mport_cdev.c +7 -3
Lines of this file are not shown. View the raw message.
drivers/regulator/qcom-refgen-regulator.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/staging/media/tegra-video/vip.c +3 -7
Lines of this file are not shown. View the raw message.
drivers/usb/phy/phy-fsl-usb.c +26 -26
52 lines not on this page · raw message
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +2 -2
Lines of this file are not shown. View the raw message.
drivers/video/fbdev/ssd1307fb.c +67 -5
72 lines not on this page · raw message
fs/ecryptfs/keystore.c +39 -6
45 lines not on this page · raw message
fs/lockd/svcsubs.c +31 -24
55 lines not on this page · raw message
fs/nfsd/nfs2acl.c +28 -24
52 lines not on this page · raw message
fs/nfsd/nfs4proc.c +33 -18
51 lines not on this page · raw message
fs/nfsd/nfs4state.c +160 -51
211 lines not on this page · raw message
fs/ocfs2/cluster/heartbeat.c +116 -32
148 lines not on this page · raw message
fs/ocfs2/refcounttree.c +35 -12
47 lines not on this page · raw message
kernel/trace/ring_buffer.c +107 -59
166 lines not on this page · raw message
mm/kmemleak.c +38 -13
51 lines not on this page · raw message
mm/memory.c +27 -22
49 lines not on this page · raw message
mm/rmap.c +46 -14
60 lines not on this page · raw message
net/openvswitch/datapath.c +24 -24
48 lines not on this page · raw message
net/sctp/stream.c +33 -15
48 lines not on this page · raw message
net/sunrpc/svc.c +67 -7
74 lines not on this page · raw message
net/sunrpc/xprtrdma/svc_rdma_rw.c +37 -10
47 lines not on this page · raw message
net/sunrpc/xprtrdma/svc_rdma_sendto.c +32 -15
47 lines not on this page · raw message
net/sunrpc/xprtrdma/svc_rdma_transport.c +31 -13
44 lines not on this page · raw message
scripts/rust_is_available_bindgen_libclang_22.h new file +5 -0
Lines of this file are not shown. View the raw message.
tools/testing/selftests/kvm/x86_64/sev_migrate_tests.c +0 -2
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Part of the diff is not shown here. View the raw message.